Compare
fremforge vs GitHub
fremforge is a European alternative to GitHub: Git hosting, pull requests, CI/CD runners, package registries and security scanning on one platform, run by a European company on T Cloud Public in Germany. This page compares the two on price, security, supply chain and data location, using GitHub's own published pages, and says plainly what GitHub has that we do not.
Price for a team that commits code
On GitHub, secret scanning and code scanning on private repositories are paid add-ons per active committer. On fremforge they are in the seat.
GitHub Enterprise Cloud 🇺🇸 US company
$21/user/mo+ $19 Secret Protection + $30 Code Security per active committer
Enterprise Cloud "starting at $21 USD per user/month" (GitHub pricing). Secret Protection is "$19 USD per active committer/month" and Code Security "$30 USD per active committer/month" (GitHub security plans). A committer is active if "one of their commits has been pushed to the repository within the last 90 days" (GitHub billing docs). For a member who commits, that is $70 a month.
fremforge 🇪🇺 hosted in Germany
€30/seat/moflat · €25.50/seat/mo billed annually
Secret scanning with push protection, SAST, dependency, container image, IaC and licence scanning, reachability, security fix pull requests, the dependency proxy and 1,000 CI minutes per seat per month, in the seat price. Pricing.
GitHub prices are in USD, as published; we have not converted them. GitHub Team is $4 per user per month and can buy the same two add-ons; it has no SAML single sign-on or IP allow list (GitHub's plans).
Feature by feature
GitHub column: what GitHub's own documentation says, for organisation-owned private repositories. fremforge column: what every fremforge seat includes.
| Capability | GitHub | fremforge |
|---|---|---|
| Secret scanning and push protection | Requires the Secret Protection add-on on Team or Enterprise Cloud (docs) | Included. Secrets are refused before the commit enters history, with custom patterns per organisation or repository |
| Secret validity checks | Secret Protection add-on (docs) | Included, switched on per provider; the console names where each check is sent |
| Code scanning (SAST) | CodeQL; requires the Code Security add-on (docs) | Included. OpenGrep on every pull request, on by default |
| Dependency vulnerability alerts | Dependabot alerts and security updates on every plan (docs) | Included. Trivy and osv-scanner on every pull request, merge blocked at the severity you choose |
| Container image scanning | Through third-party scanners that upload SARIF results (docs) | Included. Every image pushed to the registry is scanned, with base-image fix pull requests |
| Infrastructure-as-code scanning | Through third-party scanners (same SARIF route) | Included. Terraform, Kubernetes, Helm, Dockerfile and Compose, on every pull request |
| Reachability | A ranking signal for Dependabot alerts ("whether vulnerable function calls are detected") (docs) | Each finding marked reachable, not reachable or unknown, with the file and line as evidence. Go, JavaScript and TypeScript call graphs; Python, Java and Kotlin at import level |
| Known exploited first | EPSS filter on Dependabot alerts (docs) | ENISA EU Vulnerability Database and CISA KEV listings badged, ranked first and fixed first; EPSS within a severity |
| Automatic fixes | Dependabot security updates; Copilot Autofix for code scanning needs Code Security (docs) | Security fix pull requests for npm, Go, PyPI, Maven, Gradle, NuGet, Cargo and base images, one per package, known exploited first; AI fixes for selected SAST findings with your own model key |
| Licence compliance | Enterprise account with Code Security (docs) | Included. SPDX allowlist per repository, inherited from the organisation |
| Dependency proxy and package cache | A package firewall in public preview for enterprises, npm documented (docs) | Included and on by default: npm, PyPI, Go, Maven, NuGet, Cargo, Helm, RPM and container images cached per organisation. Known malware refused, package policy, minimum release age; keeps serving when an upstream registry is down |
| Malware | Malware alerts with Dependabot alerts (docs) | Known malware refused in the dependency proxy; ClamAV on every package and image upload |
| SBOM and provenance | SBOM export for everyone; artifact attestations on private repositories need Enterprise Cloud, SLSA Build Level 2 (docs) | SBOM with every runner-built image; signed SLSA provenance from the hosted runners |
| Signing | Attestations on Sigstore Public Good for public repositories, GitHub's own instance for private (docs) | cosign keyless signing on fremforge's own Sigstore (Fulcio and timestamp authority) in Germany; image signature policy on pull |
| Deployment approvals | Required reviewers on private repositories need Enterprise (docs) | Included. Named environments with per-environment secrets, branch rules and required reviewers |
| Audit to your SIEM | Audit log streaming on Enterprise Cloud (docs) | Included. Signed delivery to Splunk, QRadar, Sentinel or Datadog; hash-chained audit trail |
| IP allow list | Enterprise Cloud only (docs) | Included |
| CI minutes | 3,000 a month on Team, 50,000 on Enterprise Cloud, per account; Linux at $0.006 a minute after (docs) | 1,000 a month per seat, pooled; €0.01 a minute after; a single-use VM per job |
| Where your data is | "your local region, the United States, and other countries" (privacy statement); an EU data residency option on Enterprise Cloud, with some data stored outside the region (docs) | Germany, on Deutsche Telekom's T Cloud Public (eu-de). No US-parented processor on the data path |
What GitHub has that fremforge does not
- A free plan. GitHub Free is $0. fremforge has a 30-day free trial, then €30 per seat.
- SAML single sign-on. fremforge signs in through OIDC (Entra ID, Okta, Google Workspace, Keycloak, Authentik and others), not SAML.
- Self-hosting. GitHub Enterprise Server runs in your own data centre. fremforge is hosted only.
- Copilot. fremforge has no AI of its own; optional AI features run only with your own provider key.
- The ecosystem. GitHub Marketplace, Codespaces, GitHub Pages and the largest open-source community. Common Actions such as
actions/checkoutwork on fremforge through EU mirrors; some Marketplace actions need small changes. - Projects and planning. fremforge has issues, labels and milestones, not GitHub Projects boards.
Moving from GitHub
The importer copies repositories with their history, issues, pull requests and releases. A small repository with simple Actions takes 15 to 30 minutes of hands-on time. You can also mirror repositories and keep working on GitHub while you move.
Every statement about GitHub on this page comes from GitHub's own pages, linked where it is made, read on 23 October 2026. GitHub changes its plans and prices; if something here is out of date, tell us at support@frem.sh and we will correct it. GitHub is a trademark of GitHub, Inc. fremforge is not affiliated with GitHub.