Compare
fremforge vs GitLab
fremforge is a European alternative to GitLab: Git hosting, merge requests as pull requests, CI/CD runners, package registries and security scanning on one platform, run by a European company on T Cloud Public in Germany. This page compares the two on price, security, supply chain and data location, using GitLab's own published pages, and says plainly what GitLab has that we do not.
Price per seat
Most of GitLab's security scanning is in Ultimate, which has no published list price. On fremforge it is in the one seat price.
GitLab Premium 🇺🇸 US company
$29/user/mobilled annually
"$29 per user/month, billed annually" with 10,000 compute minutes a month (GitLab pricing). Dependency scanning, secret push protection, DAST and licence scanning are Ultimate features (sources in the table below).
GitLab Ultimate 🇺🇸 US company
Custom pricingno published list price
"Get custom pricing", with 50,000 compute minutes a month (GitLab pricing).
fremforge 🇪🇺 hosted in Germany
€30/seat/moflat · €25.50/seat/mo billed annually
Secret scanning with push protection, SAST, dependency, container image, IaC and licence scanning, reachability, security fix pull requests, the dependency proxy and 1,000 CI minutes per seat per month, in the seat price. Pricing.
GitLab prices are in USD, as published; we have not converted them. GitLab Free is $0 for up to 5 users per top-level group, with 400 compute minutes a month (GitLab pricing).
Feature by feature
GitLab column: the tier GitLab's own documentation gives for gitlab.com. fremforge column: what every fremforge seat includes.
| Capability | GitLab | fremforge |
|---|---|---|
| Secret detection in pipelines | Free and up (docs) | Included |
| Secret push protection | Ultimate (docs) | Included. Secrets are refused before the commit enters history, with custom patterns per organisation or repository |
| Secret validity checks | Ultimate (docs) | Included, switched on per provider |
| SAST | Basic scanning in every tier; findings in merge requests and Advanced SAST in Ultimate (docs) | Included. OpenGrep on every pull request, findings on the pull request |
| Dependency scanning | Ultimate (docs) | Included. Trivy and osv-scanner on every pull request |
| Container scanning | Scanning in every tier; merge request and security views in Ultimate (docs) | Included. Every pushed image scanned, with base-image fix pull requests |
| Infrastructure-as-code scanning | Scanning in every tier; result processing in Ultimate (docs) | Included. Terraform, Kubernetes, Helm, Dockerfile and Compose |
| Reachability | Static reachability, Ultimate (docs) | Included. Reachable, not reachable or unknown, with file and line as evidence |
| Known exploited and EPSS | KEV and EPSS on the vulnerability details page, Ultimate (docs) | Included. ENISA EU Vulnerability Database and CISA KEV listings ranked and fixed first; EPSS within a severity |
| Automatic fixes | Container scanning auto-remediation and agentic SAST resolution, Ultimate (docs) | Included. Security fix pull requests for npm, Go, PyPI, Maven, Gradle, NuGet, Cargo and base images; AI fixes for selected SAST findings with your own model key |
| Licence compliance | Ultimate (docs) | Included. SPDX allowlist per repository |
| DAST | Ultimate (docs) | Not offered |
| Dependency proxy | Container images in every tier, as a pull-through cache (docs); a virtual registry for other formats in beta, Premium and up (docs) | Included and on by default: npm, PyPI, Go, Maven, NuGet, Cargo, Helm, RPM and container images, with known malware refused, package policy and a minimum release age |
| SBOM | Dependency list and export, Ultimate (docs) | SBOM with every runner-built image; signed SLSA provenance |
| Signing | Sigstore keyless signing in CI (docs) | cosign keyless signing on fremforge's own Sigstore in Germany; image signature policy on pull |
| Protected environments | Premium and up (docs) | Included. Required reviewers per environment |
| Audit to your SIEM | Audit event streaming, Ultimate (docs) | Included. Signed delivery to Splunk, QRadar, Sentinel or Datadog |
| IP allow list | Premium and up (docs) | Included |
| Where your data is | "hosted in the United States" for gitlab.com (privacy statement); a choice of region, including EU regions, with GitLab Dedicated, a single-tenant Ultimate offering on AWS (docs) | Germany, on Deutsche Telekom's T Cloud Public (eu-de). No US-parented processor on the data path |
What GitLab has that fremforge does not
- A free plan. GitLab Free is $0 for up to 5 users. fremforge has a 30-day free trial, then €30 per seat.
- Self-managed and Dedicated. GitLab runs in your own environment or as a single-tenant instance. fremforge is hosted only.
- SAML single sign-on. fremforge signs in through OIDC (Entra ID, Okta, Google Workspace, Keycloak, Authentik and others), not SAML.
- DAST. fremforge does not run dynamic application security testing.
- Planning. Epics, roadmaps and iterations. fremforge has issues, labels and milestones.
- GitLab CI syntax. fremforge's CI uses the GitHub Actions workflow syntax, so
.gitlab-ci.ymlpipelines are rewritten as workflows. The migration guide shows how.
Moving from GitLab
The importer copies repositories with their full history, issues, merge requests (as pull requests), labels, milestones, wikis and releases. A small repository with a simple .gitlab-ci.yml takes 30 to 60 minutes, including the pipeline.
Every statement about GitLab on this page comes from GitLab's own pages, linked where it is made, read on 23 October 2026. GitLab changes its tiers and prices; if something here is out of date, tell us at support@frem.sh and we will correct it. GitLab is a trademark of GitLab Inc. fremforge is not affiliated with GitLab.