Hi all,
I am trying to find out if there is interest in a hosted Forgejo service with a strong emphasis on EU sovereignty and independence from big tech. Forgejo is an open-source Git hosting platform that I think is great and deserves wider use. For that reason, we will donate 5% of our plan revenue to the Forgejo project.
The plan is to cover what developers and small teams need:
- Forgejo for Git hosting
- Servers at Scaleway (a European cloud provider)
- CI/CD runners
- Dependency vulnerability alerts on every plan
- Daily backups
- Other essentials, as listed on our features page
Vault42 (that’s us) has no US parent company and uses only EU-based subprocessors, so your code stays outside US jurisdiction. ISO 27001 certification is a goal for later on.
The focus will be on private repositories, since Codeberg already serves open-source projects very well. There will also be a free plan for open source with unlimited public repositories, not to compete with Codeberg but to give people another option.
If this interests you, you can join the waitlist at vault42.eu.
Questions and suggestions are welcome in the comments or by DM.
Cheers,
Marijn from Vault42
Disclosure: I am the founder of Vault42.
Any level of extra sovereignty makes a big difference for big customers, so the answer is yes. But for individual developers and start-ups, it’ll come down to if your owners have stock in USA/Israeli companies.
If they do then there is no sovereignty. Rewarding a capitalist who happens to have an EU member passport is still rewarding an USA capitalist. There’s no difference and other than with the odd nationalistic one, all of them will primarily have loyalty towards the USA regardless of on-paper nationality. It’s simply the pragmatic choice when you are a capitalist.
And so any reason to be scared of hosting in the USA will still apply. You’ll still over-comply, rat us out, censor us, invite USA-competitors to study our private repos. And it’ll be based on the exact same cheap orders from the USA, and you’ll still ignore our national laws with as little care as a Microsoft, Google, or indeed as a SAP.
Without sovereignty, what you’re doing is just using nationalism to market a product. We all know putting the USA flag on a product in the USA works great. Used to not work as good in Europe, but now make that an EU flag and it doesn’t feel nationalistic, so it works. But the reason it doesn’t feel nationalistic is because the implication is that it’s sovereign. People will catch on that it isn’t very soon.
Depending on how strict you want to be, you might also need to disallow USA puppets like the Gulf countries and the UK from your owner’s portfolios. And a lot of others are going to be upset to see Russia or China on there too.
I really get that sentiment, because I share it too, to a certain extent. Putting an EU sovereignty sticker on a product that is still tied, one way or another, to the things it claims to reject is basically false advertising, if you ask me.
I care about EU sovereignty and independence from big tech because I want technology to do good, rather than harm the environment and people. That is the reason I started this project and why I’m testing whether others care about it as much as I do, and I’m glad to see that you are one of them.
Concretely: Vault42 has no investors and no parent company. It is run by me as a sole trader in the Czech Republic, and all subprocessors are EU-based. US legal orders such as the CLOUD Act have no direct reach. Anyone wanting data would have to go through Czech and EU law, as with any other European company. And nobody at Vault42 looks into private repositories, for competitors or anyone else.
Sovereignty really is a spectrum, and it has to cover the whole chain of operation, continuously. Keeping that up will probably be the biggest task in running this project. I intend to do it in a way that lets people like you and me feel safe, so that technology serves us rather than using us.
I’m curious: what would you need to see from a product like this before you’d trust it with your code?
I’d probably take you (or any given service) at your word, but you need to actually advertise the advantages. Of course it’s risky, it’s easy to be heavy-handed or to signal your position in a way that dissuades someone. But if you don’t properly name the fears, I have no reason to think you’re addressing the fears either.
Because you’re one person I trust your intention now, but that isn’t a good angle either, because now I wouldn’t trust your longevity and procedures for dealing with disasters (paying for availability after the business venture has failed so customers can download their data for a few months after sunset, money to deal with cyber attacks, stuff like that).
The biggest seal of quality thing that’s possible for you to get with your current angle is to get a government (even just a city or province) customer and saying you’re trusted by them, or getting some sort of official commission to develop for the public sector. Then the customer would feel safe the funding is intended to achieve the stated goals. But you can’t will those contracts into existence either.