Due diligence
European by design
What your security, legal and procurement teams need to approve Branchscope: where your data lives, who can reach it, and what Branchscope depends on.
Hosted in the EU
Branchscope is hosted in the EU. Repositories, code graphs, reviews and accounts are stored there.
No outside calls you didn't set up
Branchscope calls other services only when you set it up. An import you start reads that repository from GitHub or GitLab once. Administrators can add mirrors, which push branches and tags on to another git host; webhooks, which send events to the URLs they give or to apps they install; and integrations, which post to Slack, Discord, Microsoft Teams, Mattermost or Sentry. All are off until added, and the keys, tokens and chat URLs they use are stored encrypted.
No trackers
The web app loads no third-party scripts, analytics or trackers, and serves its own fonts. Your browser talks only to Branchscope.
No AI on your code
Code graphs and reviews are derived by compilers and extractors, never by an AI model, and Branchscope sends your code to none.
Open-source foundations
Postgres stores the data, Keycloak signs people in, NATS carries events and Garage, an S3-compatible store from France, keeps objects. No proprietary cloud services.
Run it yourself
Every service runs in containers; Docker Compose runs the whole stack. Nothing ties Branchscope to one cloud.
Identity you control
People sign in through Keycloak over OIDC. Disable someone there and their sessions, tokens and SSH keys stop working within a minute or two.
Fails closed
Every push and merge passes the push guard. If it can't be reached, nothing lands.
Every action attributed
Each push, merge and refusal records who did it and, for agents, which agent acted for whom. The audit log records who changed security settings, such as rulesets, secrets, mirrors and access, and when.
Documents for your review
Need a data processing agreement, a list of subprocessors or a security questionnaire answered? Contact us.