EU-hosted Git with no US entity in the chain

"EU region" on a US cloud changes the datacenter, not the entity that controls your data. The CLOUD Act follows the company, not the server. Codebahn is a Swedish company on EU infrastructure with every sub-processor EU-incorporated.

Why EU hosting matters

The CLOUD Act gives US authorities the power to compel US companies to produce data stored anywhere. Picking "EU region" in a dropdown changes where the bytes sit. It does not change who can be compelled to hand them over, or under whose law.

The EU-US Data Privacy Framework replaced Privacy Shield after Schrems II struck it down. It could meet the same fate. Every adequacy decision is one court challenge from reversal. The third collapse happened in June 2026.

NIS2 and DORA are raising the bar for supply chain sovereignty. "Our vendor is US-incorporated but has an EU subsidiary" is getting harder to defend in procurement.

Few managed Git services are both SaaS and fully EU-incorporated. Most teams land on GitHub or GitLab because there is not much else to evaluate. Codebahn exists to be that option.

What EU-hosted means for Codebahn

All code, builds, and metadata are processed and stored exclusively on infrastructure owned and operated by EU companies.

• Company: Hackerman AB, incorporated in Sweden.
• Compute and storage: Scaleway, Paris (France).
• Encrypted backups: Hetzner, Falkenstein (Germany). Different region than primary.
• Payments: Mollie, Amsterdam (Netherlands).
• Contracts: governed by Swedish and EU law.

Hackerman AB is not subject to the US CLOUD Act. The company has no US parent, no US subsidiary, and no US-incorporated entity in its ownership chain. No sub-processor handling customer data is US-incorporated. We publish the full list.

Infrastructure and energy

Scaleway powers its Paris data centres with 100% renewable electricity (wind and hydro, with EU Guarantees of Origin) and uses adiabatic cooling with near-zero water consumption. Hetzner runs its German facilities on 100% renewable hydropower since 2008 and holds EMAS and ISO 14001 environmental certifications. Both providers publish their energy figures independently.

For procurement and legal

Your security questionnaires about CLOUD Act exposure get a clean, one-line answer.

• Data Processing Agreement
• Sub-processor list
• Privacy policy
• Security
• Security and exit addendum (Assurance and Custom)
• DORA register sheet

We do not have SOC 2 yet. If your procurement requires signed compliance reports today, GitLab Dedicated has those. We will get there; we are not there now. If what procurement needs is written commitments rather than an audit report, Assurance publishes them.

For how Codebahn handles your data beyond jurisdiction, see Your code stays private.

How this compares

• GitHub: US entity (Microsoft). EU data residency only on Enterprise tier (ghe.com). US jurisdiction on every plan.
• GitLab: US entity. Dedicated tier for EU data residency at custom pricing. US jurisdiction by default.
• Codebahn: EU entity. EU hosting on every plan. EU jurisdiction. No enterprise gate.