Security

EU-only. No asterisks. Codebahn is a Swedish company running on EU infrastructure with every sub-processor EU-incorporated. No data leaves the EU for storage, processing, or analytics.

Where your code lives

Primary compute and storage on Scaleway in Paris, France. Encrypted backups on Hetzner in Falkenstein, Germany. Different provider, different region.

Database: Managed PostgreSQL on a private network with no public endpoint.
Object storage: Private ACL, AES-256 server-side encryption, versioning enabled.
Backups: Encrypted client-side with Restic before upload. Hetzner stores ciphertext only.

How it is protected

Data is encrypted in transit and at rest. TLS 1.2+ for all connections, TLS 1.3 where both endpoints support it. AES-256 via Scaleway managed encryption for block storage, object storage, and managed PostgreSQL.

Authentication: Email verification codes for web login, TOTP-based two-factor authentication, SSH keys for Git, scoped personal access tokens for API and CI. Passwords hashed with PBKDF2 (320,000 iterations).
Server access: SSH key authentication only. Admin SSH is IP-restricted.
Firewall: Default-drop policy on all inbound traffic.
Patching: OS-level security updates applied automatically. Forgejo security patches targeted within 24 hours of upstream release.

Who can access it

Every repository on Codebahn is private. There is no public repository hosting. One tenant cannot discover that another tenant exists: cross-tenant API requests return 404, not 403. Explore pages, user search, and organisation search are blocked.

CI jobs run in ephemeral virtual machines, not shared containers. Each tenant gets its own VM. A container escape compromises only that tenant's own jobs. Runner VMs accept no inbound traffic, and the cloud metadata endpoint is blocked. VMs are terminated after idle timeout; no state carries between runs. See CI runners for specs and compatibility.

On the server side, production access is separated into tiers. The application runs as an unprivileged user with no sudo. We do not access repository content unless required for a specific support request, security incident, or abuse investigation. Server logs containing IP addresses are retained for 30 days, then deleted.

Backups and recovery

Daily encrypted backups to a separate provider and region. Verified automatically every week: the latest snapshot is restored to a temporary directory, PostgreSQL dumps are validated, and a random sample of repositories is checked with git fsck.

Retention: 7 daily + 4 weekly snapshots.
Account closure: Data remains accessible read-only for 30 days after termination. Backups rotate out within 90 days of deletion.

Deploys use blue-green switching with health checks. A pre-deploy snapshot of git data is taken before every release, so rollback does not depend on the backup schedule.

Incident response

When something goes wrong, we follow a structured process: detect, classify, fix, communicate, review.

Severity	Definition	Response time
Critical	Data breach, unauthorised access, complete outage	Within 1 hour
High	Partial degradation affecting multiple customers	Within 4 hours
Medium	Limited impact, single-customer issue	Within 1 business day
Low	Cosmetic or informational, no direct user impact	Within 5 business days

Critical and High incidents are communicated via email to affected customers and updated on the status page. For incidents involving personal data, we notify affected data controllers within 48 hours per our DPA and GDPR Article 33.

Every Critical and High incident gets a post-incident review within five business days, covering timeline, root cause, impact, and prevention. We publish a summary for incidents with broad user impact.

Vulnerability disclosure

If you find a security vulnerability, email security@codebahn.net with a description, steps to reproduce, the affected component, and your severity assessment.

In scope: codebahn.net (Forgejo instance, API, Git endpoints, documentation), CI runner infrastructure, and the Codebahn CLI/MCP server. Out of scope: upstream Forgejo vulnerabilities (report to the Forgejo security team), third-party services, social engineering, and physical attacks.

Step	Timeline
Acknowledgement	Within 2 business days
Initial assessment	Within 5 business days
Fix deployed (critical/high)	Target within 7 days
Fix deployed (medium/low)	Within 30 days

Safe harbour: If you act in good faith, we will not pursue legal action. Good faith means you do not access other users' data, do not degrade the service, stop and report once you have enough to demonstrate the vulnerability, and give us reasonable time to fix before public disclosure.

What we do not have yet

We do not hold ISO 27001 or SOC 2 Type II. If your procurement requires signed audit reports today, we are not your vendor yet.

Certification is an independent audit of security processes. The processes on this page are real and running in production. A SOC 2 Type II engagement costs upward of EUR 50,000 with annual renewal. At our current size, that investment goes into the infrastructure itself. We will pursue certification as we grow.

Our infrastructure vendors are independently certified:

Scaleway (compute, storage, database): ISO 27001
Hetzner (backups): ISO 27001 (scope includes Falkenstein, where backups are stored)
Mollie (payments): PCI DSS Level 1, SOC 2 Type 2

These certifications cover the infrastructure and payment systems that Codebahn runs on. They do not cover Codebahn's own operational processes.

We do have a Data Processing Agreement that follows GDPR Article 28, with audit rights, breach notification within 48 hours, and sub-processor change notification.

For procurement and compliance

One-click export in standard Forgejo format. The archive includes all repositories, issues, pull requests, labels, milestones, releases, and reviews. No ticket required, no waiting period. See exporting your data.

For security questionnaires or vendor assessments, email security@codebahn.net.

Start a team, from €39/mo See pricing

Use it for 30 days. If it's not right, one email and we refund it.