Security features at a glance
Everything fremforge ships, in one scannable table. Each row links into the dedicated page for configuration, override flow, and the underlying tool’s documentation.
fremforge is deliberately transparent about the OSS tooling underneath every control: customers under BSI C5, ISO 27001, BaFin, or ENISA-regulated review need the tool-level audit trail, and we’d rather you can grep our source than reverse-engineer a black box. The differentiation is the integration (hooks, RBAC, audit chain, EU residency, no Microsoft, no AWS) — not the scanner.
Code-push controls
| Control | What it does | Tool | Configurable per tenant |
|---|---|---|---|
| Push protection | Pre-receive secret-scan; rejects commits containing credentials before they enter git history | Gitleaks v8 (120+ patterns) | Override rules + per-pattern bypass |
| Branch protection | Per-branch rules: required reviewers, status checks, signed-commit requirement, force-push blocks | Forgejo native | Yes (per branch) |
| Two-factor auth | TOTP for every user account; WebAuthn enforcement available at the org level (user-side WebAuthn enrolment is via the Forgejo user-settings security page). Enforceable per-org | Forgejo native + custom enforcement hooks | Yes (org-wide enforce, per-user opt-in) |
| OIDC MFA verification | Cryptographically verify your IdP asserted MFA on every sign-in via the OIDC amr claim (RFC 8176). Replaces the legacy operator-attested “trust IdP MFA” checkbox — the token says ["pwd","mfa"] or it’s not MFA | Custom claim-check middleware | Per-tenant required-amr policy |
| SSO break-glass | When your IdP is unavailable, misconfigured, or the SSO connection is broken, named org owners can recover access via a separately-managed break-glass credential path. Audit-logged | Custom (fremforge-written) | Per-tenant named owners |
| Keyless commit signing (sigstore / gitsign) | OIDC-bound signing — your IdP identity (Entra, Okta, Google Workspace, Authentik) signs the commit via a 10-minute Fulcio cert. Forgejo renders Verified by sigstore: <email> via <IdP>. Root CA in T Cloud Public DEW KMS (FIPS 140-2 Level 3 HSM, Germany). Fulcio at sign.frem.sh, TSA at tsa.frem.sh. Deliberately no Rekor / transparency log — TSA-anchored timestamping only, keeps signatures off any third-party log | Self-hosted Fulcio v1.8.5 + TSA on T Cloud Public eu-de, customer-side gitsign | Org admin → Allowed OIDC issuers + strictness level |
| Commit signing — SSH key | Sign commits with the same SSH key Forgejo uses for push. “Verified” badge appears natively in the web UI. Coexists with keyless; org admin sets strictness | OpenSSH + Forgejo’s allowedSignersFile | Per-user enable |
| Commit signing — GPG | Standard git commit.gpgsign flow. Upload public key at user settings, Forgejo verifies + renders the “Verified” badge | GnuPG + Forgejo native | Per-user enable |
Code-quality + vulnerability scanning
These scanners run centrally on fremforge’s own scanners on every pull request and on the default branch. There is no workflow file to install in your repositories. Results are listed under Security › Findings.
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| SAST | Static analysis on every PR and on the default branch, run centrally on fremforge’s own scanners — there is no workflow file in your repo to install or maintain. Detects injection, XSS, hardcoded secrets and dangerous APIs in C, C++, C#, Go, Java, JavaScript and TypeScript, Kotlin, PHP, Python, Ruby, Rust, Scala, Swift and Bash | OpenGrep with GitLab sast-rules, 0xdea C/C++ rules and fremforge’s own rules | Block severity; your own OpenGrep rules, each checked on its own sample before it runs |
| Secret scanning | gitleaks on every pull request (the fremforge/secret-scan check) and a weekly sweep of every repository’s full history; push protection blocks secrets at push time | Gitleaks | Pull request check on or off |
| IaC scanning | trivy config misconfiguration checks (Dockerfile, Compose, Kubernetes, Helm, Terraform and more) on every PR, as the fremforge/iac-scan check with its own findings tab, plus your organisation’s own Rego checks; blocks only on what a PR adds; findings grouped by CIS benchmark and NIS2 area in the compliance report | Trivy | Mode and threshold under Security › Policies › Scanners |
| Dependency scanning (OSV) | Dependency CVE/GHSA scan on every PR, run centrally on fremforge’s own scanners. Surfaces fixable CVEs with the suggested upgrade | osv-scanner | Severity threshold |
| Reachability | Marks each dependency and image finding reachable, not reachable or unknown, with the evidence (file and line, or the affected function), and ranks lists, Recommendations and the digest by it. Go: govulncheck on the binaries in your images. JavaScript and TypeScript: Jelly, at import level unless the advisory names functions. Python, Java and Kotlin: import level, through other packages too, never unreachable. Nothing is hidden or dismissed; what blocks a merge is unchanged unless you opt in | govulncheck, Jelly, fremforge import readers | Opt-in SLA multiplier (1-4) for not-reachable findings; opt-in “do not block pull requests on not-reachable findings” |
| Known exploited | Flags findings whose CVE is listed as exploited by ENISA’s EU Vulnerability Database or CISA’s KEV catalogue: a badge and filter, ranked before EPSS, never given a stretched SLA, AutoFix first. Both lists refreshed daily | ENISA EUVD + CISA KEV mirrors | - |
| Security fixes | One click opens one pull request that bumps a vulnerable dependency to the lowest version that fixes every open advisory (the ecosystems on Supported ecosystems) or bumps an image’s FROM base; Fix all per repository. Never merged automatically. Optional AI fixes for a short list of SAST rules use only your own model provider and are off by default | Hosted Renovate; your own AI provider for SAST fixes | Per-repo and per-org limits; AI fixes off by default |
| Rule-based fixes | Open fix PR on a secret finding moves the credential into an environment variable (Go, Python, JavaScript, TypeScript); on six IaC checks it sets the property to its secure value. A set rule, no AI: nothing leaves fremforge. Syntax-checked and re-scanned first, never merged automatically | gitleaks and Trivy, the scanners that raised the finding | Per-repo and per-org limits |
| Container image scanning | fremforge’s central scanner runs Trivy (no install step): trivy fs and trivy config on every PR, trivy image on every image in your registry and every image pulled through the dependency proxy. Findings are listed under Security › Findings › Container images, attached to the image and commit. An image block action (none, warn, block_pull) applies to findings at or above the image threshold, high by default | Trivy | Block action, threshold and ignore files |
| License scanning | Trivy licence detection on every PR, run centrally on fremforge’s own scanners. Classifies each dependency’s licence into a 7-bucket SPDX-policy severity (permissive → reciprocal → restricted → forbidden); blocks merge on findings at/above the configured threshold. Surfaces at Security › Findings › Licences | Trivy | Block severity + SPDX allowlist + per-finding dismiss |
| OpenSSF Scorecard | Weekly best-practice score per repo. Not a per-repo workflow — runs weekly on isolated platform infrastructure using a read-only per-tenant bot with read-only repo access; unchanged repos are skipped, and only the score JSON is retained. Surfaces gaps (branch protection, MFA enforcement, pinned dependencies, code review coverage) as a column on the Repos page | scorecard | Weekly cadence + unchanged-HEAD skip |
| Malicious packages | OSV MAL-* advisories matched against each repository’s default-branch SBOM and the language packages in every published container image, after each push and daily. Always critical; image pulls with an open finding are refused | osv-scanner + Trivy | Dismiss with reason and end date |
| Package policies | One policy per organisation decides which registry packages may be downloaded: vulnerability thresholds (severity, CVSS, EPSS, fix available), SPDX licence lists, allow and deny lists with version ranges, and a minimum age. Exceptions need a second person to approve them. Enforce refuses with 403, Shadow (the default) records; a file bundling known malware is refused in every mode. Container images: shadow only | Syft + osv-scanner | Mode, rules, per-type overrides, exceptions |
| Upload malware scan | ClamAV over Git-LFS objects, web attachments and package uploads. The dependency proxy scans fetched packages and image layers with ClamAV when your organisation turns it on (off by default) | ClamAV + SaneSecurity feeds | Override on known-FP signatures |
| Workflow security gate | A pre-receive check parses every changed workflow YAML and rejects pushes that introduce: docker:// references to non-allowlisted registries, dangerous pull_request_target + script injection patterns, unpinned uses: references to non-mirrored orgs | Custom rules (fremforge-written) | Per-tenant docker-URI allowlist override |
| IP allowlist | One per-org list of allowed CIDR ranges for every HTTPS surface: web admin, fremforge API, repository web interface, Forgejo REST API, Git over HTTPS, LFS and package registries. Git over SSH is not covered. Audit-only preview and a 24-hour owner break-glass | Custom rules (fremforge-written) | Per-tenant CIDR list + runner toggle |
Supply-chain provenance
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| SBOMs | CycloneDX 1.6 and SPDX 2.3 SBOMs generated centrally on every PR (both formats accepted at ingest). Publishing a release binds the SBOM already held for that commit to the release rather than re-scanning it, so a release SBOM needs no build and appears immediately. Queryable at Security › Components › SBOMs | Syft | Retention window + release refs |
| Signed publication attestation | An in-toto / SLSA-provenance DSSE envelope generated server-side by fremforge on Forgejo release.published / package webhooks — no workflow file in your repos. fremforge hashes each asset and signs with a platform-held Ed25519 key (keyid fremforge-slsa-builder-v1, builder https://frem.sh/runner-controller/v1), uploaded alongside the asset as <asset>.intoto.jsonl, plus a second keyless signature against fremforge’s self-hosted Fulcio + RFC3161 TSA as <asset>.sigstore.json. No public Sigstore, no Rekor, no transparency log. Verify locally with the published trust root — see SLSA provenance. Deliberately not described as a SLSA level: it attests what was PUBLISHED, not how it was built; the re-derivation and what is missing are in SLSA provenance | Custom server-side signer (Node stdlib crypto, Ed25519 DSSE) + self-hosted Sigstore | — |
| Cosign image signing + verification | The central fremforge/cosign-verify pull-request check verifies the signatures of digest-pinned images, either from your organisation’s own workflows through fremforge’s Sigstore or from the public Sigstore, and says when it could not check. It is informational. The image signature policy can also require signed images at pull time, with your trusted identities. Customer CI signs with its own OIDC identity — no long-lived signing keys | cosign + self-hosted Fulcio | Signature policy (shadow or enforce) |
| Workflow pinning | A daily scan lists every uses: in .forgejo/workflows/ that points at a tag or branch instead of a 40-character commit SHA; one click opens a pull request that pins them. .github/workflows and docker:// references are not checked | Custom (fremforge-written) | — |
| Action mirror | uses: actions/checkout@v4 resolves to frem.sh/actions/checkout — Forgejo native pull-mirror of upstream with 8-hour sync. No build-time github.com fetch on the customer’s critical path. Mirrored orgs include actions, docker, pnpm, aws-actions, azure, google-github-actions, peter-evans, softprops, sonarsource, step-security, dorny | Forgejo native pull-mirror (EU-only action resolution) | (Operator-managed; transparent to customers) |
| Marketplace compatibility surface | The top-20 most-used GitHub Marketplace actions verified to work unmodified on fremforge — GITHUB_TOKEN, GITHUB_SHA, GITHUB_REF, GITHUB_API_URL etc all populated identically | Forgejo Actions runtime | — |
| Dependency updates | Version updates by Renovate for every enrolled organisation, every night, plus Run now. Identifies stale dependencies, action versions and container base images. Repositories can opt out | Renovate + custom orchestration | Per-repo opt-out |
Runtime isolation (hosted CI runners)
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| Hosted runner sandbox | One commit = one dedicated VM = one kernel. The platform spawns a fresh ephemeral ECS VM per commit, registers forgejo-runner --ephemeral so each registration is consumed by one task, then destroys the VM once that commit’s jobs complete. No two customers, and no two commits, ever share a kernel — jobs of the same commit may share the VM, so treat a pipeline as one trust domain. Each VM carries its own ENI + Security Group (network isolation) and has no IAM agency attached (no platform-API access from inside). An out-of-band reaper backstop kills orphan VMs whose runner never registered or never finished. Same model as GitHub-hosted and GitLab-hosted runners | T Cloud Public ECS + per-VM ENI + forgejo-runner (act_runner) | VM flavor (CPU/RAM ceiling), per-tenant concurrency cap |
| Per-tenant concurrent cap | 2 concurrent jobs per seat guaranteed (at least 10, at most 60), and up to 60 when capacity is idle (GitHub-hosted: Free 20, Pro 40, Team 60). Higher on request | Platform-level enforcement | Per-tenant override |
| Runner-minute pool | seat_cap × 1000 min/month. Trial tenants have a flat 500-min pool — see Billing. Overage-enabled tenants keep running; others are refused dispatch | Pre-dispatch check vs metered usage | Per-tenant cap override |
| Egress proxy | Customer workflows reach the public internet through the runner egress proxy (SSRF-only deny, CGNAT-permissive — matches GitHub-hosted behaviour) | Custom proxy (fremforge-written, Hono-based) | — |
| Job wall-clock | 60-min hard ceiling per job. A stale-VM sweeper kills anything older than 90 min | Out-of-band sweeper | Step-level timeout-minutes |
Secrets + access control
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| Deploy secrets | Per-environment encrypted secrets. AES-256-GCM at rest with a MASTER_ENCRYPTION_KEY held in DEW KMS. Decrypted only inside the runner VM that needs them. Key rotation supports a two-key window (current + previous) for in-place rotation | Custom (Node crypto) + per-env scoping + DEW KMS | Per env / per repo / per org |
| RBAC + per-tenant scoping | Forgejo’s native RBAC + fremforge’s tenant-scoping layer; all platform API endpoints enforce tenant_id from the JWT, no cross-tenant data leaks. Org admin → Members → Roles | Forgejo + fremforge api middleware | Per-team granularity |
| OIDC single sign-on | Preferred IdP path. Connect Okta, Entra, ADFS, Google Workspace, Authentik, Keycloak, Auth0 — any OpenID Connect provider — for inbound federation. Domain verification, just-in-time user provisioning, group → team mapping. Configured at Org admin → SSO → Auth sources | Forgejo native OIDC auth-source | Per-tenant IdP config |
| SAML 2.0 single sign-on | Not available yet. Connect Entra ID or ADFS over OIDC instead | — | — |
| SCIM 2.0 user provisioning | Push users from your IdP into your fremforge org via SCIM 2.0. Per-tenant bearer-token auth, dual-token rotation window, idempotent CRUD on Forgejo users. Works with any SCIM-compliant IdP | Custom api endpoints under /<slug>/scim/v2/* | Per-tenant SCIM token |
| SSH CA | SSH access to git uses a CA-signed certificate, not raw key fingerprints. Per-user cert with TTL; revocable via the org admin UI | OpenSSH CA + fremforge-managed cert issuance | TTL + per-user revoke |
| Authentication policy | Per-org bundle of enforcement toggles: hardware-backed keys (WebAuthn-only, no TOTP), max PAT lifetime (cap below the 90-day platform default), signed-commits required (block unsigned pushes), SSH disabled (HTTPS-only), 2FA required, SSO-only sign-in (block local Forgejo username/password). Mirrors the GHEC enterprise-policy surface. Each toggle audit-emits on change | Forgejo carried patches + fremforge enforcement hooks | Per-tenant policy bundle |
| Email-domain allowlist | Per-org allowlist of email hostname patterns. When enabled, members can only add @acme.com-style addresses matching the configured patterns. Closes the “claim commits as attacker@arbitrary-domain.com” path during forensic review. Pre-existing emails not auto-evicted; OIDC sign-in is exempt (the IdP attests). Patterns support exact + *.subdomain shapes | Custom rules + Bunny edge intercept on /user/settings/account/email | Per-tenant patterns + enforce flag |
| Workflow secrets | Org-level + repo-level Actions secrets injected into every CI job as env vars. Forgejo stores encrypted at rest; fremforge admin proxies CRUD with audit events (value never persisted in fremforge DB or audit log). Override secret = same form is the rotation flow | Forgejo native secrets + fremforge admin proxy | Per-org / per-repo / per-environment |
| Workflow OIDC for cloud auth | Runner VMs get a fresh OIDC JWT with aud=fremforge per job. Customer cloud trust policies key off this for short-lived credential exchange (no long-lived AWS keys, GCP service-account JSONs, or Azure client secrets in workflow secrets) | Custom OIDC issuer signed by fremforge runner-OIDC key (rotated 180d; manual rotation, auto-rotator not yet shipped) | — |
| Agent-native authentication | Three IdP-side patterns for non-human callers: (1) Direct customer-IdP JWT bearer — present an Entra workload-identity / Okta service-account / Google service-account JWT directly as Authorization: Bearer on any /api/v1/* endpoint; (2) RFC 8693 token exchange + OBO — POST /_app/api/v1/auth/token-exchange accepts subject_token and optional actor_token; audit chain records both actor and on_behalf_of; (3) RFC 6749 client_credentials — POST /_app/api/v1/oauth/token for apps without an IdP. Per-tenant audience binding (https://frem.sh/<slug>), per-source claim assertions (tid/hd), DB-level UNIQUE preventing two tenants from claiming the same issuer for direct bearer | Custom (auth_sources + oauth_clients + token-exchange pipeline using jose) | Per-source opt-in; per-client scope cap |
DevOps observability
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| DORA dashboard | The four canonical DORA metrics — Deployment frequency, Lead time for changes, Change-failure rate, MTTR — computed over a 30-day rolling window from deployment events recorded for your tenant. Ingest path is the Forgejo release webhook plus a manual POST /_app/api/v1/dora/deployments for workflows that don’t tag releases. Visible at Org admin → DORA | Custom (fremforge-written, against tenant DB) | Rolling window + manual ingest |
| Security overview | Security › Overview: open findings per scanner, with links into each tab, and the setup checklist | Custom aggregator | — |
| Workflow run inspector | Every Actions run streams structured logs (annotated with step + line) into the tenant audit log and into a per-run viewer at Org admin → Actions → Runs. Failed-job filter + workflow YAML diff vs last green run | Forgejo Actions UI + fremforge audit overlay | — |
| Runner usage panel | Per-month runner-minute count + per-job duration table at Org admin → CI runners → Usage. Drives invoice line items via the metering_events table | Custom (runner_jobs aggregation) | — |
AI posture
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| BYO AI — agent-native access | fremforge is AI-agnostic. Customer Claude Code / Cursor / Windsurf / Codex CLI / Aider operate against the same Git + REST surface as humans (machine-readable OpenAPI spec). Combined with Agent-native authentication (direct IdP JWT bearer, RFC 8693 token exchange + OBO, RFC 6749 client_credentials), agents authenticate as first-class principals — no human PAT borrowing. No forge-locked-in AI product, no agentic features that demand a specific vendor | Standards-compliant Git + REST | Customer-controlled |
| AI integrations (BYOK) | Org admin → AI integrations: register your own AI vendor key (Anthropic, OpenAI, Mistral, others). Enables: AI PR review (drafts review comments on diff), Renovate AI explanations (plain-English changelog summaries on dep-bump PRs), and the /_app/api/v1/orgs/<slug>/ai/complete gateway for workflow-side LLM calls | Custom gateway (fremforge-written) | Per-org vendor + key |
Compliance + audit
| Control | What it does | Tool | Configurable |
|---|---|---|---|
| Audit log | Every state-changing operation (push, role change, secret create, runner override, billing change) logged with actor + timestamp + before/after. Two-tier retention: queryable hot tier (90 / 180 / 365 / 730 days, configurable per tenant) + 3-year cryptographic-chain archive in T Cloud Public OBS WORM | Custom append-only (audit_events table) | Per-tenant retention window |
| Audit chain | Hash-chained audit log + linear hash chain anchored every 2 min into T Cloud Public OBS WORM. Verifier cron checks chain integrity hourly + full-sweep every 30 min. Customers can verify “no event was deleted or modified after the fact” | Custom (fremforge-written, BSI C5 alignment) | — |
| SIEM streaming | Real-time stream of audit events to a customer-provided endpoint (Splunk HEC, Sentinel, ELK, OpenSearch, generic HTTPS webhook). EU-resident relay, no data leaves the eu-de region. Per-tenant endpoint health visible to operator + tenant admin | Custom forwarder + siem_endpoints table | Per-customer endpoint config |
| Data export (GDPR portability) | Self-service tenant data export: repos (as git bundles), issues, pull requests and releases (NDJSON), package inventory, scan findings, package-policy state, signed attestations, repository and container-image SBOMs, audit events (NDJSON), with a DSSE-signed manifest. Downloaded from a signed OBS URL valid 7 days. Required for GDPR Art. 20 portability + offboarding | Custom exporter | Triggerable any time |
| Lifecycle policies | Per-tenant retention + deletion automation: stale-repo archive, runner-minute-cap behaviour, audit-log retention window, tenant-suspension grace period, end-of-contract data-erasure SLA | Custom (tenant_lifecycle table) | Per-tenant policy |
| Repo mirroring (inbound migrations) | Pull-mirror customer repos from GitHub, GitLab, Bitbucket, or any other Git host into fremforge with credential-based auth + periodic sync. Used during phased migrations; mirror is removable once cutover is complete | Forgejo native pull-mirror + fremforge admin proxy | Per-repo source + interval |
| Notification preferences | Org-wide event routing: which audit events emit mail/webhook/SIEM, which roles get paged on Critical findings, billing-event escalation contacts | Custom (notification_preferences table) | Per-tenant routing |
| Vulnerability disclosure | security.txt published, security@frem.sh 24h ack SLA, public hall-of-thanks page, no-litigation-for-good-faith-research policy | — | — |
| Fix-by SLA | Per-org SLA pill next to every open finding. Default deadlines (Critical 7d / High 30d / Medium 90d / Low none) — tightenable per tenant. NIST SP 800-40r4-anchored | Custom (fremforge-written) | Per-tenant tightening |
What we explicitly don’t do
| Anti-feature | Why |
|---|---|
| No Microsoft footprint (no GitHub, no Azure AD, no Office 365, no Defender, no GHAS CodeQL) | EU sovereignty + Schrems II — see trust |
| No US-hosted Sigstore / Fulcio / Rekor in the verification path | Same. fremforge runs its own Fulcio + TSA on T Cloud Public eu-de with the root CA in DEW KMS (FIPS 140-2 Level 3 HSM, Germany). No public Sigstore, no Rekor / transparency log — TSA-only timestamping by design |
| No AWS, GCP, or any US-cloud-controlled dependency on the platform critical path | Same |
| No third-party CDN-loaded fonts (Google Fonts etc.) | Self-hosted at www.frem.sh/fonts/ via Bunny EU edge |
| No black-box scanners (proprietary detection rules you can’t audit) | Customer audit trail requires tool-named transparency |
| No long-lived service-account credentials in customer workflows | OIDC-only for cloud auth; long-lived keys are an opt-in deprecated path |
Tool transparency — full bill of materials
If you need this for an RFP, BSI C5 audit, or internal security review, the canonical list — with versions, pull sources, and the platform-foundation vendor row — lives at docs.frem.sh/security/bill-of-materials/. The table below is a quick-reference subset.
| Layer | Tool | Where used | License |
|---|---|---|---|
| Source-control core | Forgejo v15 | Repo hosting, code review, Actions runner protocol | GPLv3 |
| CI runner binary | forgejo-runner (act_runner) v13.2.0 | Per-job ephemeral ECS VM | MIT |
| Secret scanning | Gitleaks v8 | Pre-receive hook | MIT |
| SAST | OpenGrep v1.21 | PR-time analysis | LGPLv2.1 |
| Container CVE scanning | Trivy | Customer CI + runner-image baked-in | Apache 2.0 |
| Dependency scanning | osv-scanner | PR-time analysis | Apache 2.0 |
| SBOM generation | Syft | Release-tag workflow | Apache 2.0 |
| Image signing + verify | cosign | Pull check, and the informational fremforge/cosign-verify pull-request check | Apache 2.0 |
| Keyless code signing — CA | Fulcio v1.8.5 (Helm chart 2.9.0) | Self-hosted on T Cloud Public eu-de at sign.frem.sh | Apache 2.0 |
| Keyless code signing — TSA | Sigstore TSA (timestamp authority) | Self-hosted on T Cloud Public eu-de at tsa.frem.sh | Apache 2.0 |
| Customer-side gitsign | gitsign | Customer git client; OIDC-bound commit signing | Apache 2.0 |
| Dependency bumper | Renovate | Hosted bot, 15-min cron, per-repo opt-out | AGPLv3 |
| Image build (rootless) | kaniko | Container build in customer workflows | Apache 2.0 |
| Malware scanning | ClamAV | Pre-receive scan + LFS upload | GPLv2 |
| OpenSSF best-practice scoring | scorecard | Weekly per-repo | Apache 2.0 |
| Platform CDN + WAF | Bunny CDN | EU-resident edge, no Cloudflare/Fastly | (Vendor — EU-based, no US sub-processor) |
| Cloud platform | T Cloud Public (Deutsche Telekom) | Compute, storage, networking, DB | (Vendor — eu-de region exclusively) |
| Email (transactional) | Lettermint (NL) | Auth emails, invoices, alerts | (Vendor — EU) |
| Mailbox | mailbox.org | Operational mailbox | (Vendor — EU) |
| Payments | Mollie (NL) | Billing | (Vendor — EU) |
| Bookkeeping | Dinero (DK) | Invoice issuance | (Vendor — EU) |
Every vendor on this list is contractually EU-resident with no US sub-processor in the data path. See the trust page for the full DPA + sub-processor chain.
Roadmap (demand-gated)
| Feature | Status | Trigger |
|---|---|---|
Bring-your-own-KMS for MASTER_ENCRYPTION_KEY (customer-supplied DEW CMK in their own T Cloud Public account) | Designed | First customer commits |
| SLSA build provenance (build-time output-digest capture, so the signed statement refers to an actual build run — the prerequisite for claiming any SLSA level; both Build L3 clauses are already satisfied) | Scoped | Customer demand |
| MCP signing + verifier for AI-agent supply chain | Designed | Industry standard finalises |