Your source code is part of your supply chain
Under Article 21 of NIS2, essential and important entities must manage the cybersecurity risks of their suppliers and of how they develop and maintain their systems. The service that hosts your code, runs your pipelines and decides what reaches production is one of those suppliers.
Gitoro is built so that answering for it is straightforward: who can reach your code, what was reviewed before it shipped, and where it is stored are all things you can show.
How Gitoro supports Article 21
The measures from Article 21(2) that concern where your code lives and how it changes.
| NIS2 measure | In Gitoro |
|---|---|
| Supply chain security (d) | A Danish supplier with EU-only hosting, outside the reach of the US CLOUD Act. Our security documentation is published in our trust center. |
| Secure development and vulnerability handling (e) | Branch protection, code owners and required checks before merge. Secret detection on every push, and dependency vulnerability scanning on plans that include it. |
| Assessing effectiveness (f) | An audit log of what members and service accounts do, exported every hour to your own endpoint and signed. |
| Cryptography (h) | Git over SSH or HTTPS. Pipelines sign in to your cloud with short-lived OIDC tokens instead of stored keys. |
| Access control (i) | Restricted repositories, custom roles, and a view of every repository a person can reach, and why. |
| Multi-factor authentication (j) | Require two-factor authentication or a passkey across the workspace, enforced in the web app, the API, MCP and Git. |
Controls you can point to
Set by owners and admins for the whole workspace.
Security policies
Require two-factor authentication or a passkey, expiring tokens with capped scopes, and a maximum session length.
Security policies →Audit log
Records what members and service accounts do, with an hourly signed export to your own endpoint.
Audit log →Protected branches
Approvals, code owners and passing checks before anything is merged.
Branch protection →Ready for your supplier assessment
Our trust center collects our security documentation in one place, so your supplier review doesn't have to start with a blank questionnaire.
Open the trust center →NIS2 obligations rest with your organisation, and no supplier can make you compliant on its own. Gitoro helps with the requirements that concern your source code and the service that hosts it.
Your code under EU law, out of reach of the CLOUD Act
The US CLOUD Act can compel US-based companies to hand over data under their control, even when it's stored in Europe. Gitoro is Danish, with EU-only hosting for your code, pipelines, and AI.
GDPR by design
Export or delete your data anytime.
EU-only infrastructure
Your code and data stay in Europe.
European AI
AI features run on models hosted in Europe.