Stop Calling It ‘European’ — That’s Not a Trust Strategy

You see a product announcement that should make you cheer. A git hosting service that promises your code “never leaves Europe.” GDPR-friendly. Sovereignty-friendly. Everything a privacy-conscious developer has been begging for.

Then you click the link. The page loads. You look for a team. Nothing. You look for pricing. Nothing. You look for a legal address, a privacy policy, an actual human being. Nothing. So you close the tab, and you don’t come back.

That’s the story of pushin.eu. And it’s the perfect case study in why geographic sovereignty is not a trust substitute.

Let me be blunt: If your entire value proposition is “your code never leaves Europe,” but your website doesn’t even tell me who’s responsible for keeping it safe, you’ve already failed. I don’t care how many ISO certifications you claim. I don’t care how strong your encryption is. If you’re trying to gain custody of someone’s intellectual property, you have to show your face.

What do developers actually see when they land on pushin.eu? Here’s a field report from the wild:

• No company details. Not a name, not a street address, not an imprint.
• No legal pages. No terms of service, no privacy policy, no data processing agreement.
• No transparent pricing. Just a vibe.

The community response was immediate and brutal. “Nice idea, zero trust signals,” one commenter wrote. “Smells vibe coded,” said another. And that’s the part that should terrify the founders: “Vibe coded” isn’t an insult about the codebase. It’s an indictment of the entire operation. It means nobody can tell if this is a real company or a weekend experiment that got too much attention.

Now, there’s a tiny sign of life. There’s a mention on the Elixir forum. Peter announced PushIn, something with Oban and Ash and CVEs. So behind the curtain, there’s a person. But that’s exactly the problem: the curtain is still there.

If you’re building a security product, you don’t get to hide. You don’t get to say “trust me, it’s European.” Europe has plenty of opaque, incompetent, and outright dangerous products. Without operational transparency, “European” is just a marketing label — the same way “Made in Italy” doesn’t automatically make a handbag worth buying.

Developers get this. We’ve been burned before. We’ve seen projects sit silent for months. We’ve seen maintainers disappear. We’ve seen “open source” become abandonware. So when a new hosting service launches with zero accountability, our default isn’t curiosity. It’s fear. The fear of entrusting critical infrastructure to a skeleton crew with a beautifully written README and no phone number.

Here’s the brutal truth: If you can’t show me who’s behind the code, why should I hand you mine?

I wanted a European GitHub alternative. I still do. I’d love to move my repositories to a platform that respects EU law and doesn’t touch NSA servers. But I’ll take a transparent US-based company over a mysterious EU vault any day. Because the real containment policy isn’t where your servers live — it’s whether you’re willing to be held accountable.

So for every developer out there building “the next big thing” in infrastructure: stop polishing the home page and start publishing your legal documents. Put your faces on the site. List your prices. Update your changelog. If you can’t do that, don’t be surprised when developers treat your project like a suspicious email attachment.

The best security feature isn’t a data center location. It’s a visible human being who answers when something goes wrong. And that’s something no jurisdiction can provide for you.