Infrastructure

1. Datacenter Location

All customer data — repositories, issues, account records, and metadata — is hosted exclusively within the European Union. No data is stored or replicated outside the EU / EEA.

• Primary datacenter: Germany (netcup)
• Backups: Germany (Hetzner Storage Box) — same EU region

2. Hosting Provider

Compute infrastructure is provided by netcup GmbH (Karlsruhe, Germany), acting as a sub-processor under Art. 28 GDPR. Backups are stored on a Hetzner Storage Box (Germany).

3. Software Stack

• Git hosting: Forgejo (self-hosted)
• Account & access layer: gitbuild.dev (Laravel application)
• Database: PostgreSQL
• Email: self-hosted Postfix relay (EU)

4. Sub-processors

The following sub-processors process personal data on our behalf. All are located within the EU / EEA, with the exception noted below:

• netcup (Germany) — compute, database, and self-hosted services
• Hetzner (Germany) — backup storage (Storage Box)
• Mollie (Netherlands) — payment processing for paid plans
• Have I Been Pwned — password compromise check at registration (only a non-reversible hash prefix is transmitted; see the Privacy Policy)

Apart from the HIBP hash-prefix check, no personal data is transferred to a third country outside the EU / EEA.

5. Uptime & Availability

The service is operated on a commercially reasonable best-efforts basis. Scheduled maintenance is performed with notice where possible. We are not liable for unavailability caused by scheduled maintenance, force majeure, or circumstances beyond our control. Business and Enterprise customers may agree a separate written SLA.

6. Data Security

• Transport encryption (TLS) for all connections
• Passwords stored as one-way hashes (bcrypt/Argon)
• Rate limiting and honeypot bot protection on signup
• Password compromise screening via Have I Been Pwned (hash-prefix only)
• EU-only hosting and backups, no third-country replication

7. No AI Training

Repository content, issues, and metadata are not used to train machine learning or AI systems, and access is not granted to third parties for that purpose.