Sign-in Passkeys, authenticator apps and company accounts
The European git platform where the server enforces the rules, for everyone: no force-pushes to protected branches, no secrets in your history, an audit log nobody can rewrite. You focus on the code.
How it works
No plugins to install, no hooks to set up on anyone's machine. Everything happens on the server, in a moment, the same way for everyone on the team.
Your team keeps the git it knows, over HTTPS or SSH.
Force-pushes and deletions on protected branches are rejected. Admins included.
Keys and tokens are stopped before they reach the history, with file and line.
Who, what, when and from where. Denied attempts included.
Nightly backups, with an automatic restore test every week.
0 exceptions
Branch protections apply to owners and admins too.
<2 s
p95 for history, diff and blame on a 100,000-commit repository.
7 days
At most between two automatic backup restore tests.
5 min
Between watchdog checks on services, disk and certificates.
The platform
Eleven strengths, one platform. They stay out of the way until you need them, and then they speak plainly.
A local hook can be switched off, a convention can be forgotten. Here the check runs on every push, and the rejection is explained right in the terminal of whoever tried it, in their own language.
Private keys, cloud tokens and API keys are blocked before they reach the history.
It can only grow: nothing is edited, nothing is deleted.
If you're not a member, you can't even tell a repository exists.
No password to remember, unless you want one.
A watchdog every 5 minutes, and an email to admins if something is off.
Measured on a 100,000-commit test repository: p95 under 2 seconds.
Import branches and tags with a secret scan, then mirror automatically: GitHub Actions keeps running as it does today.
Nightly backups and an automatic restore test every week. To us, a backup that has never been tested doesn't exist.
GitHub Actions workflows run on CodeQuay runners: on push, on tags, manually or on a schedule, with approvals for deployments.
Built in Italy by arimaslab. Instances run in data centers in the European Union, with no third-party tracking.
Before and after
What happens when the rules depend on local conventions, and what happens with CodeQuay.
Allowed: whoever has the highest permissions bypasses conventions and local hooks.
Rejected by the server, owners and admins included, with the reason explained in the terminal.
It lands in the history: you have to rewrite history and rotate the key, often days later.
The push is rejected before the commit enters the repository, with the file and line.
The same version number can point to different code at different times.
Release tags are immutable: a fix ships as a new version.
You piece it together from scattered logs, if there are any.
An append-only audit log with user, action, time, IP and outcome, denied attempts included.
They can often see at least the names of the organization's other repositories.
To them, other projects don't exist: they don't show up in lists and return 404.
Only then do you find out whether the backup actually works.
Restores are tested automatically every week; if one fails, an alert goes out.
Who it's for
Client projects isolated from each other, contractors with access to the right project only, releases with tags that never change.
Learn more: Software agenciesData in the EU, a tamper-proof audit log, and protections you can document for GDPR, NIS2 and internal audits.
Learn more: Public sector and regulated industriesFAQ
The short answers. You'll find all the others on the FAQ page.
All questionsSign-up is open: anyone can create an account at git.codequay.it/signup and start on the Free plan, then upgrade online to Team or Business whenever they like.
If someone invites your email address to an organization, a project or a repository, you can also create your account from the invitation link: the address counts as already verified.
A passkey is a credential that replaces your password: it lives on your device or in your password manager and is unlocked with your fingerprint, face or PIN. It's bound to the site it was created for, so a look-alike page can't use it, which makes it the strongest protection against phishing.
On CodeQuay you add one after your first sign-in, from Settings → Security. From then on you sign in by picking the passkey, with no password and no codes: a passkey unlocked with your fingerprint, face or PIN already counts as strong authentication.
You can register more than one, for example on your laptop and your phone. Passkeys synced by iCloud Keychain, Google Password Manager or a password manager are available on all your devices, and hardware security keys work too.
The push is rejected. CodeQuay scans the new files in every push and stops any that contain recognizable credentials: private keys, AWS access keys, Google API keys, live Stripe keys, GitHub tokens, Slack tokens and CodeQuay personal tokens. The message points to the file and line and shows only the start of the value; the audit log records the rule that was broken, never the secret.
To move on, remove the secret from the history (a later commit that deletes it isn't enough) and revoke the credential. If the secret was already in the history of an imported repository, the import scan flags it: in that case it needs to be rotated.
Yes. You authorize the instance key as a deploy key on the GitHub repository and start the import: it copies every branch and every tag with the full history (pull requests aren't imported), protects the default branch and scans the entire history for secrets, reporting type, file, line and commit without ever showing the value. If it's interrupted, just run it again and it picks up where it left off.
Developers only need to change the remote URL in their existing clones: commits, hashes, branches and tags stay the same. Coming from another git platform? Use git clone --mirror and git push --mirror.
Repositories, databases and backups stay in data centers in the European Union. CodeQuay is built in Italy by arimaslab srl, and neither the website nor the platform uses third-party tracking, analytics or advertising.
Prices are per user, excluding VAT, billed monthly or yearly (which costs less), and they're published on the Pricing page:
Protections, secret blocking at push, the audit log and tested backups are included in every plan; a dedicated instance, in the EU or on your premises, is quoted on request.
CodeQuay · by arimaslab
A guided migration from GitHub, with your full history and your CI right where it is.