Infrastructure

1. Datacenter Location

All customer data — repositories, issues, account records, and metadata — is hosted exclusively within the European Union. No data is stored or replicated outside the EU / EEA.

• Primary datacenter: Germany (netcup)
• Backups: Germany (Hetzner Storage Box) — same EU region

2. Hosting Provider

Compute infrastructure is provided by netcup GmbH (Karlsruhe, Germany), acting as a sub-processor under Art. 28 GDPR. Backups are stored on a Hetzner Storage Box (Germany).

3. Software Stack

• Git hosting: Forgejo (self-hosted)
• Account & access layer: gitbuild.dev (Laravel application)
• Database: PostgreSQL
• Email: self-hosted Postfix relay (EU)

4. Sub-processors

The following sub-processors process personal data on our behalf. All are located within the EU / EEA, with the exception noted below:

• netcup (Germany) — compute, database, and self-hosted services
• Hetzner (Germany) — backup storage (Storage Box)
• Mollie (Netherlands) — payment processing for paid plans
• Have I Been Pwned — password compromise check at registration (only a non-reversible hash prefix is transmitted; see the Privacy Policy)

Apart from the HIBP hash-prefix check, no personal data is transferred to a third country outside the EU / EEA.

5. Uptime & Availability

The service is operated on a commercially reasonable best-efforts basis. Scheduled maintenance is performed with notice where possible. We are not liable for unavailability caused by scheduled maintenance, force majeure, or circumstances beyond our control. Business and Enterprise customers may agree a separate written SLA.

6. Data Security

• Transport encryption (TLS) for all connections
• Passwords stored as one-way hashes (bcrypt/Argon)
• Rate limiting and honeypot bot protection on signup
• Password compromise screening via Have I Been Pwned (hash-prefix only)
• EU-only hosting and backups, no third-country replication

7. No AI Training

We do not train AI models on your data. Repository content, issues, and metadata are never used to train machine learning or AI systems.

Private repositories are never accessed or processed for AI training by anyone. They remain strictly confidential on EU infrastructure.

Public repositories are accessible to anyone on the internet. While we never train on or share public repository content for AI purposes, we cannot prevent third parties from accessing what you have made public. Access to your content for AI training purposes is never granted to third parties by us.