# Sovereignty and data residency

This page covers the legal entity, governing law, and data path behind the "EU-only, no asterisks" claim. For the specific services that process your data, see [sub-processors](/docs/subprocessors/).

## Legal entity

Codebahn is operated by Hackerman AB, incorporated in Sweden. Org. nr 559079-1918. Registered address: Drakenbergsgatan 33, 412 69 Gothenburg, Sweden.

Swedish-owned. Independent. Self-funded. The entity that signs your contract is the same entity that operates the service.

## Governing law

Contracts are governed by Swedish law. The Data Processing Agreement follows GDPR. There is no arbitration clause routing disputes to a US jurisdiction.

## Data path

Every sub-processor is EU-incorporated. No data leaves the EU for storage, processing, or analytics. CI jobs resolve the most common GitHub Actions from [local mirrors](/docs/action-mirrors/) on the instance, so action code is fetched within the EU. See [sub-processors](/docs/subprocessors/) for the service-by-service list with locations, providers, and retention details.

Data is encrypted in transit (TLS 1.2+, with 1.3 where supported by both endpoints) and at rest (AES-256). Server logs with IP addresses are kept for 30 days. Billing records are kept for seven years, as Swedish bookkeeping law requires.

## CLOUD Act

The US CLOUD Act compels US-incorporated companies to produce data stored abroad on US government request. Codebahn is not a US company and has no US parent. The Act does not apply.

Ticking "EU region" on a US-owned service changes the datacenter, not the legal entity that controls your data. That distinction is the point.

## EU tech sovereignty

The EU's [tech sovereignty agenda](https://digital-strategy.ec.europa.eu/en/policies/eu-tech-sovereignty) defines the goal: Europe should be able to develop and control its own digital infrastructure without depending on non-EU providers. Source code hosting is part of that infrastructure.

Codebahn meets that bar by construction, not by bolt-on. The entity is Swedish. The servers are French and German. The contracts are governed by EU law. There is no US parent that could be compelled under the CLOUD Act, and no acquisition path that would change that.

If your organization is evaluating providers against EU digital sovereignty requirements, the relevant facts are on this page and the [sub-processors](/docs/subprocessors/) list.

## NIS2 and DORA

The [NIS2 Directive](https://eur-lex.europa.eu/eli/dir/2022/2555) (Article 21(2)(d)) requires entities in scope to assess the security of their supply chain, including the jurisdiction and data residency of each supplier. Source code hosting is part of that supply chain. [24 of 27 EU member states](https://digital-strategy.ec.europa.eu/en/policies/nis2-transposition) have transposed NIS2 into national law.

For financial entities, [DORA](https://eur-lex.europa.eu/eli/reg/2022/2554) adds prescriptive ICT third-party risk management requirements on top of NIS2.

Codebahn publishes the answers these assessments require: [NIS2 supplier assessment](/nis2/), [DORA register of information](/dora/), [sub-processor list](/docs/subprocessors/), and [security posture](/security/). No NDA required.

## What we do not have yet

We do not hold ISO 27001 or SOC 2 Type II. If your procurement requires those signed audit reports today, we are not your vendor yet. We intend to pursue certification; we are not there now.