Your code belongs in Europe.
A sovereign European Git hosting platform, currently in development.
Vault42 is Europe's sovereign code hosting platform, built on open-source Forgejo, with all data hosted exclusively in the EU. No surveillance. No data farming. Just code.
We take care of
Four situations Vault42 is built for.
European hosting is the reason to choose Vault42 over an equally convenient alternative. It's not the reason people start looking.
Client code under contract
Client contracts increasingly ask where the code lives, and who could be compelled to hand it over. Vault42 will be incorporated and hosted entirely in the EU, outside the CLOUD Act's reach.
Moving off GitHub
Forgejo imports repositories, issues, pull requests and history, and runs the same GitHub Actions syntax. Add a managed runner on any paid plan, or keep hosting your own for free.
No server to run
Someone has to patch the host, watch disk space, test restores and apply upgrades at an inconvenient hour. On Vault42, that will be handled for a fixed monthly price.
A bill you can predict
Usage-based CI billing is hard to forecast, and a busy month can mean an invoice nobody budgeted for. Vault42's plans are flat and published, with no per-minute billing on managed runners either.
Professional Git hosting with European values at every layer.
Vault42 is built on open-source technology, hosted in Europe, and designed to keep your code under European rules.
EU Digital Sovereignty
Your code stays within EU borders and outside the reach of the US CLOUD Act, foreign subpoenas, and any jurisdiction you never agreed to. Data residency isn't the same as jurisdiction: a US company's 'EU region' doesn't change who it answers to legally.
100% EU Infrastructure
Every Vault42 server and backup lives in EU data centers. Infrastructure built in Europe, owned in Europe, governed by European law.
Zero AI Data Harvesting
Your code trains your product, not someone else's model. We don't sell an AI product, so there's no training pipeline pointed at your repositories and no reason for that to change.
Built on Forgejo
Fully open-source, GPLv3 licensed, community governed. Every line of code powering your repositories is publicly auditable.
Independently Owned
Vault42 takes no venture capital and has no acquisition roadmap. Nobody outside the team can buy the direction it goes in.
Developer First
The Git tools you actually use every day: pull requests, issues, repositories and Forgejo Actions.
We're open about everything, including our code.
From launch, we'll publish a monthly transparency report with the raw figures for infrastructure changes, uptime, and Forgejo donations.
ForgejoBuilt on open-source you can trust.
Vault42 is being built on Forgejo, a community-governed free-software Git platform with no closed-source components. Every line of code powering your repositories can be read, audited, and verified.
Don't want to take our word for it? Forgejo is free and open-source, so you can self-host it today without a Vault42 account and move to us later only if you decide you want to.
Codeberg, one of the largest Forgejo instances, is operated by Codeberg e.V., a non-profit European code host, with 300,000+ repositories and 200,000+ accounts. The platform is proven at scale.
Visit forgejo.org100% Free Software
No proprietary code, no black boxes. Full source available and auditable by anyone.
Community Governed
Decisions are made by contributors rather than a corporation, and no single entity controls the project.
Fork of Gitea
Born from the Gitea community, Forgejo is battle-tested with years of development behind it.
No Lock-in
Every export is plain Forgejo, importable into any other Forgejo or Gitea instance, including one you run yourself.
Who's behind this
A small team, two countries
Vault42 is a small team of freelancers working from Czechia and the Netherlands. We build products as an answer to the big tech oligarchy and to enshittification: made for the people who use them, not for investors. Self-funded, with no venture capital and no growth targets set from outside the team.
A lot of developers, myself included, have had enough of Microsoft, of GitHub, and of trusting American companies with their work. We host git on EU soil, under GDPR, where your code is never scanned to train a model, and where what we say we sell is all that we sell.
A complete git forge.
Standard Forgejo. No proprietary extras.
Full git hosting
SSH & HTTPS, unlimited private repos
Pull requests & review
Inline comments, approvals, squash & rebase
Branch protection
Required reviews, force-push blocked
Issues & planning
Labels, milestones, project boards
Forgejo Actions
GitHub Actions-compatible workflows
Package registry
npm, Docker, Maven, PyPI, Cargo, NuGet
Releases
Tagged, with build artifacts
Wikis
Per repository, versioned in git
Webhooks & REST API
Every event, fully scriptable
Signed commits
SSH & GPG verification, signed tags
Orgs & teams
Per-team permissions, 2FA
Mirroring
Push or pull, any git host
Pipelines run on a runner: a managed one from us on any paid plan, or one you host yourself, free on every plan. Ours run in the EU; for a self-hosted runner, build location depends on where you host it.
Vault42 runs unmodified upstream Forgejo. Your repositories run on any Forgejo instance.
The actual software you'll be using.
Not mockups. Real screens from a demo repository, on Forgejo running the same version we deploy for you.
Captured from our own instance. The repository is a demo; the software is exactly what you get.
Where we match GitHub, and where we don't.
Including the parts where GitHub wins.
| Feature | Vault42 | GitHub |
|---|---|---|
| Git hosting & review | Yes | Yes |
| CI/CD | Forgejo Actions, same workflow syntax | GitHub Actions |
| Package registry | npm, Docker, Maven, PyPI+ | GitHub Packages |
| Private repos | Unlimited on paid | Unlimited |
| Jurisdiction | EU only, outside CLOUD Act and FISA 702 | US, CLOUD Act and FISA 702 |
| Platform source | Open source (Forgejo) | Proprietary |
| Leaving | Runs on any Forgejo | No equivalent forge |
| Build machines | Yours free, or a managed runner on a paid plan | Shared runners |
| AI assistant | None | Copilot |
| Cloud dev environments | None | Codespaces |
| Marketplace | None | Thousands of apps |
| Ecosystem | Small, new | Largest |
| Support | Email and chat; phone on Enterprise | Tiered, paid plans only |
Workflow files use GitHub Actions syntax. Actions hosted on GitHub need a full URL, and workflows that call the GitHub API or rely on GitHub-specific context need small changes.
- Repositories, branches, and tags
- Issues, pull requests, and comments
- GitHub Actions-compatible workflow syntax
Move your repositories over, history intact.
Forgejo includes a native GitHub importer for repositories, issues, pull requests and history. Forgejo Actions uses GitHub Actions-compatible workflow syntax. For CI, connect your own runner, or add a managed one on a paid plan.
Get Early AccessInfrastructure
Your Code Will Never Leave Europe
Built on Scaleway's European infrastructure, with servers owned, operated, and governed entirely within the EU and nothing routed through a US cloud.
Paris
France
Amsterdam
Netherlands
Warsaw
Poland
Milan
Italy
Backup and recovery
Daily encrypted backups
Snapshots every 24 hours, kept for 30 days.
Second-region copy
Every backup is replicated to a separate EU region.
Tested restore
The restore procedure is documented and tested regularly, not only written down.
Know when a dependency you use has a published vulnerability
Vault42 will check the dependencies your repositories declare against public vulnerability advisories, and open an issue in the affected repository when it finds one.
Vulnerable dependency: example-package
- Affected
- 2.3.1
- Fixed in
- 2.3.4
- Severity
- High
- Source
- OSV
No new company sees your dependencies
The scan runs on Vault42's own EU infrastructure, the same servers that already host your repositories. Your dependency list isn't sent anywhere else to make this work.
Open data, open tooling
Advisories come from open sources, including OSV and ENISA's European Vulnerability Database (EUVD). The scanning tooling is open source too, so leaving Vault42 doesn't mean losing the check.
A record for the Cyber Resilience Act
Teams increasingly need to show they track known vulnerabilities in what they ship. This isn't a compliance guarantee, just one piece of that record.
Included on every plan, including Open Source. Paid plans add pull requests that update the dependency to a fixed version, for you to review.
Pricing Built on Principle
Open source stays free, and every plan keeps your data in the EU.
We give 5% of our plan revenue to the Forgejo project and publish every payment.
Open Source
For public repositories, with no credit card required.
- Forgejo Actions CI/CD, with a runner you host
- Unlimited public repositories
- 1GB storage
- Full Git hosting: push, pull, branches, tags
- Issue tracking
- Pull requests and code review
- Protected branches
- Release management
- Wikis
- Basic web editor
- User profiles and activity feeds
- Two-factor authentication (2FA)
- Dependency vulnerability alerts
- Join existing organisations and teams
- No private repositories
- Cannot create organisations or teams
Developer
For the solo developer who needs private repos.
Reserve Developer- Forgejo Actions CI/CD: add a managed runner, or self-host yours free
- Everything in Open Source
- Unlimited private repositories
- 10GB storage
- Project boards
- Webhooks and third-party integrations
- Automated dependency fix pull requests
- Standard support by email
- Create organisations, to group your own repositories
Teams
2 × €12 per user
Join the Teams Waitlist- Forgejo Actions CI/CD: add a managed runner, or self-host yours free
- Everything in Developer
- Invite team members into your organisations, with paid seats
- 20GB storage per user
- Advanced team permissions
- Support by email and chat
Enterprise
For teams that want CI they don't have to run themselves, an isolated setup, a signed SLA, and a named support contact.
Everything in Teams, plus:
- An isolated instance on dedicated infrastructure
- CI concurrency beyond 8 jobs, on dedicated runner infrastructure, backed by your SLA
- A signed SLA with agreed uptime targets, scoped per contract
- Priority support by email, chat and phone, with a named contact
Storage covers your Git data, Git LFS objects, packages and release artifacts. CI logs and build caches don't count against it. On Teams, storage is pooled across the organisation, so a five-seat team shares 100GB however it likes.
Managed CI runners
A build machine of your own, without running one yourself.
Small
- Runs 2 jobs at once
- Beyond that, jobs wait in line.
- 120 min job timeout
- 40 GB disk
- 150 fair-use hours / month
Standard
- Runs 4 jobs at once
- Beyond that, jobs wait in line.
- 120 min job timeout
- 60 GB disk
- 200 fair-use hours / month
Large
- Runs 8 jobs at once
- Beyond that, jobs wait in line.
- 120 min job timeout
- 100 GB disk
- 300 fair-use hours / month
Or bring your own runner
Free
Free on every plan, including Open Source. Connect a machine you control and pay us nothing for CI.
A managed runner still costs more than a bare VPS. The difference buys EU residency you don't have to prove yourself, and a single-tenant instance you don't have to patch, monitor or keep alive: it runs only your builds, never anyone else's, on that instance at the same time.
No per-minute billing. No overage. Your runner sleeps when idle, so only time it's awake counts — and the monthly runtime on each plan is well beyond what normal use needs. We'll email you at 80%, and if you reach the limit, jobs pause until the next month or until you ask us to lift it.
Planned pricing, not final. Prices are confirmed at launch.
Managed runner prices follow what our infrastructure provider charges for the underlying hardware, and may change if theirs does.
All prices exclude VAT.
All plans include EU-only data hosting, GDPR compliance, and support for the Forgejo ecosystem.
Your next commit doesn't have to leave Europe.
Join the waitlist of European developers who want their code to stay where they live.
EU-only infrastructure · Forgejo-based GitHub migration
Is my data actually protected from US law?
Vault42 will be incorporated and hosted entirely within the EU, with no US infrastructure, no US parent company, and no legal obligations under US law, including the CLOUD Act and Section 702 of FISA.
Can I migrate from GitHub?
Forgejo's importer handles this natively. Repositories, issues, pull requests and workflows are designed to move over intact, using GitHub Actions-compatible syntax. Run them on a runner you host, or on a managed one from us.
What if I'm not ready to trust Vault42 with my code?
Fair enough, we're new. Forgejo, the platform we're built on, is free and open-source; you can self-host it yourself today, no Vault42 account at all. Move to us later only if you want the hosted convenience.
What if Vault42 shuts down?
Your repositories are standard Forgejo, so there is no proprietary format to escape from. If we ever wind down, we commit to at least 90 days' notice, read-only access for the whole of that period, and a full export of every repository, issue, pull request and wiki in Forgejo's native format. That export imports into any other Forgejo or Gitea instance, including one you run yourself. We'd rather say this now than have you wonder about it later.
Do I need my own build server for CI?
No. Forgejo Actions runs your pipelines on every plan, including Open Source. What you need is a runner for the builds to execute on, and there are two ways to get one. Add a managed runner on any paid plan and we run it for you. Or host it yourself, free on any plan: any spare VPS running the Forgejo runner in Docker will do. The managed option still costs more than a bare VPS: what the difference buys is EU residency you don't have to prove yourself, a single-tenant instance that runs only your builds, and no server for you to patch, monitor or keep alive.
What counts as storage?
Storage covers your Git data, Git LFS objects, packages and release artifacts. CI logs and build caches don't count against it. On Teams, storage is pooled across the organisation, so a five-seat team shares 100GB however it likes.
100% Renewable-MatchedEuropean Power
Vault42 runs on Scaleway's European datacentres, where every kilowatt-hour is matched to wind and hydro generation in some of the most energy-efficient facilities in the industry. It runs on EU infrastructure, and the environmental figures come directly from Scaleway's published impact data.
100% renewable-matched electricity
Scaleway matches all datacentre electricity to wind and hydro generation through Guarantees of Origin, across Paris, Amsterdam, Warsaw and Milan.
Industry-leading efficiency
Scaleway's datacentres averaged a 1.37 PUE in 2024, below the ~1.55 industry norm, and as low as 1.25 in their most efficient site.
A low-carbon grid
France's grid, where Scaleway's largest datacentres sit, is one of the lowest-carbon in the world, running mostly on nuclear and hydro.
A footprint you can check
Scaleway publishes the carbon, hardware and water footprint of every service it runs, across emission scopes 1, 2 and 3.
Powered by Scaleway, and the footprint is public
Vault42's hosted infrastructure runs on Scaleway's European datacentres, powered by renewable-matched electricity. The datacentres averaged a 1.37 PUE, and Scaleway reports the carbon, hardware and water footprint of its services.
The bigger picture
European software independence is the same move as European energy independence. Stop sending money and data to systems that don't share our values.
Paris
our primary region, on one of the lowest-carbon grids in the world
1.37 PUE
Scaleway's 2024 datacentre average, against a ~1.55 industry norm
€0
spent with US hyperscalers
France's grid, where our primary region sits, runs mostly on nuclear and hydro and is roughly ten times lower-carbon than the US average. Our other EU regions vary; Scaleway publishes the figures for each.
Running on
Forgejo
self-hosted git
Scaleway + Coolify
EU infrastructure
Matomo
cookieless analytics
This site runs on the stack we're building. No US clouds, no third-party trackers.