Code hosting privacy ratings
Places to host Git repositories.
9 code hosting are rated against 9 public criteria, and 9 have enough evidence for a letter grade. Of the 6 with a known jurisdiction, 4 are based in a Five Eyes country, and 6 in the wider Fourteen Eyes.
Open-source code hosting only · Criteria for this category · Suggest an addition · Markdown
| Name | Grade | Score | Data | Jurisdiction | Open source | No trackers or telemetry | No ads or data sales | Independent audit | Transparency report | Tells users about requests | TLS configuration | Security headers | Modern web standards |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Self-hosted Git forge with issues, pull requests, package registries and CI through Forgejo Actions. A community fork of Gitea, with its domains held by the non-profit Codeberg e.V. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
Lightweight self-hosted Git service written in Go, with a web interface for repositories, issues, pull requests and wikis. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
Open source peer-to-peer code collaboration stack built on Git, where repositories, issues and patches are replicated between nodes and signed with cryptographic identities, with no central server. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
Git and Mercurial hosting with ticket tracking, mailing lists, wikis and a CI build service. Can be self-hosted, or used through the hosted instance at sr.ht. |
Grade B | 75 | 100% | Netherlands Nine Eyes | Yes | Yes | Yes | No | Partial | Yes | Yes | No | Not tested yet |
Non-profit Git hosting run by Codeberg e.V. in Berlin on the open source Forgejo software, with issues, pull requests, CI and static page hosting. |
Grade C | 66 | 100% | Germany Fourteen Eyes | Yes | Yes | Yes | No | No | No | Yes | Partial | Not tested yet |
Git hosting with CI/CD, issue tracking and project management, offered as the hosted GitLab.com service or as software to self-host. |
Grade C | 63 | 100% | United States Five Eyes | Yes | No | Partial | Partial | Yes | Yes | Yes | No | Not tested yet |
Git hosting service owned by Microsoft, with pull requests, issues, Actions CI/CD, package hosting, Pages static sites and Copilot AI features. |
Grade D | 50 | 100% | United States Five Eyes | No | No | Partial | Partial | Yes | Yes | Yes | Yes | Not tested yet |
Git hosting service from Atlassian with pull requests, Bitbucket Pipelines CI/CD and integration with Jira and other Atlassian products. |
Grade D | 47 | 100% | Australia Five Eyes | No | No | Partial | Partial | Yes | Yes | Yes | Partial | Not tested yet |
Lightweight self-hosted Git service written in Go, with issues, pull requests, packages and CI through Gitea Actions. Maintained with commercial backing from CommitGo. |
Grade F | 30 | 100% | United States Five Eyes | Yes | No | No | No | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
Questions
What is the most private option among code hosting?
No pick has been made yet. The table above is sorted by score, based on public evidence.
How are code hosting rated?
Each entry answers 9 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers and modern web standards. Answers need links to evidence. See the full criteria.
Does jurisdiction matter?
Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.