I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.

Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.

If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.

As is stated in the pricing card of the enterprise, the plan starts at a certain amount, and is tailored to the needs of the customer. So it really depends on what the needs of the enterprise customer will be.

And yes, will put the info on the website, thanks for suggestions! These kind of questions really help clarify the offerings before we begin :)

Much appreciated!

Thanks, these are fair questions and valid concerns, and you’re right that the site doesn’t cover them properly yet.

The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That’s where most of your points come in:

• Custom domains: will be possible on a dedicated instance.
• Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
• Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
• Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you’ll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
• Data separation: Enterprise customers will get their own instance, so their data won’t be shared with other customers.

I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).

This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I’ll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.

Thanks a lot, I really appreciate it!

Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.

I really get that sentiment, because I share it too, to a certain extent. Putting an EU sovereignty sticker on a product that is still tied, one way or another, to the things it claims to reject is basically false advertising, if you ask me.

I care about EU sovereignty and independence from big tech because I want technology to do good, rather than harm the environment and people. That is the reason I started this project and why I’m testing whether others care about it as much as I do, and I’m glad to see that you are one of them.

Concretely: Vault42 has no investors and no parent company. It is run by me as a sole trader in the Czech Republic, and all subprocessors are EU-based. US legal orders such as the CLOUD Act have no direct reach. Anyone wanting data would have to go through Czech and EU law, as with any other European company. And nobody at Vault42 looks into private repositories, for competitors or anyone else.

Sovereignty really is a spectrum, and it has to cover the whole chain of operation, continuously. Keeping that up will probably be the biggest task in running this project. I intend to do it in a way that lets people like you and me feel safe, so that technology serves us rather than using us.

I’m curious: what would you need to see from a product like this before you’d trust it with your code?

Hi, thanks for this reply, I love your ideas.

Being a home for indie game developers is definitely something I aspire to, because 1) I’m a hobby gamedev myself, and 2) I love indie games and the community.

The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you’d like.

On your two questions:

1. We use a French cloud provider called Scaleway, which is 100% European.
2. “Community governed” on the site refers to Forgejo itself. I’ll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn’t a non-profit, and a PBC is a US legal form, so that doesn’t apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.

Pretty much and by large, yes, compared with self-hosting: we run the servers, upgrades, backups and CI. Compared with GitHub or GitLab.com, the difference is jurisdiction: no US parent company, and most importantly, no Cloud Act, and only EU subprocessors.

Vault42 is meant for people who want both, for mainly freelancers, small agencies and small teams without anyone to spare for running such infrastructure.

Hi FiniteBanjo,

Thanks for your reply and kindness :)

You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?

[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.

Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.