Technology Sovereignty

Beyond the Default: From GitHub to Gitoro

The default has a very good marketing department

Most technology decisions do not begin with a requirements document. They begin with a default.

The largest platform. The name everyone knows. The service already used by the people we know. It is easy to justify, easy to procure, and rarely challenged once it has become part of the workflow.

That is also how dependency grows.

Our move from GitHub to Gitoro was the first concrete step in a broader effort to build a more sovereign technology stack. It was not driven by a sudden technical failure, nor by the belief that everything made in the United States is somehow wrong. GitHub served us well, and it provided the capabilities we needed.

The question was whether the familiar default was still the best-suited choice for a small European company building critical infrastructure.

“Everyone uses it” is not a research method

Choosing the biggest name is sometimes simply laziness disguised as due diligence. “Everyone uses it” may be a useful signal, but it is not research. It tells us what is popular. It does not tell us what is best aligned with our requirements, our jurisdiction, our operating model, or the kind of provider relationship we want to build.

There was no dramatic technology breakup here. We looked at our requirements more deliberately and asked whether another provider could meet them while giving us more agency.

The checklist was the easy part

The technical requirements were straightforward. We needed reliable repository hosting and collaboration, protected branches, merge requests, CI/CD, controlled release workflows, runner and deployment controls, and auditable delivery evidence.

The harder requirement was not something we could tick off in a feature matrix: an approachable provider that welcomes suggestions and engages directly with specific needs, without placing a corporate wall between the customer and the people able to help.

Gitoro met the technical requirements. More importantly, it met the human and operational ones.

More than a logo swap

The migration was not about replacing one logo with another. A logo swap is branding. This was plumbing.

We had to understand which parts of our development and delivery process depended on the existing platform, identify what needed to move, and make the new setup increasingly deliberate: protected development, controlled automation, release jobs, runner separation, and evidence that tells us what actually happened during delivery.

This is what sovereignty looks like in practice. It is not a declaration of independence from every foreign provider. It is the steady reduction of unnecessary dependency, combined with a clearer understanding of the systems we rely on.

The corporate brick wall

The biggest difference was the relationship with the provider.

As a small company, we could ask concrete questions. We could raise edge cases. We could make suggestions and have them taken seriously. When something needed clarification or adaptation, the turnaround was quick. The interaction felt like a technical relationship rather than a support ticket disappearing into an enormous organisation.

A feature list can tell you whether a platform supports CI/CD. It cannot tell you what happens when your use of that capability does not fit neatly into the mainstream path. It cannot tell you whether the people behind the platform are reachable, curious, and willing to improve it with you.

This is where the comparison with GitHub becomes unavoidable. A Microsoft-owned platform operating at GitHub’s scale may offer extraordinary breadth, but it cannot realistically offer every small customer the same degree of direct engagement and product-level responsiveness.

That is not necessarily a criticism of the engineers working there. It is a consequence of scale, distance, incentives, and the structure of a large corporate platform.

Gitoro gave us the capabilities we needed without making us feel invisible.

Europe is not an empty map

There is a broader lesson here for companies considering similar changes. Switzerland and Europe offer more than many people expect.

The landscape is not a perfect one-for-one replacement for every large US technology service. There are genuine gaps, and some migrations require compromises or additional engineering. Europe is not a magical supermarket aisle where every familiar service has a local twin waiting on the next shelf.

But the alternatives are stronger and more numerous than many companies assume. The remaining gaps are closing. I may be going out on a limb, but I expect some European providers to mature in a healthier direction: close enough to their customers to remain approachable, ambitious without megalomania, and less exposed to abrupt policy shifts or the decisions of a single dominant political centre.

That is not an argument for choosing a provider merely because it is European. Geography alone does not create quality. It is an argument for doing the research instead of assuming that the largest and most familiar platform is automatically the best answer.

Three things we would do again

For companies beginning their own sovereignty initiatives, three principles have been useful to us:

• Map your dependencies before choosing replacements. The visible product is rarely the whole dependency.
• Separate essential capabilities from familiar defaults. Keep what you genuinely need; question what you have simply inherited.
• Evaluate the provider relationship, not only the feature list. Responsiveness, openness, and the ability to influence the platform are operational capabilities too.

Technology sovereignty is not achieved in one large gesture. It is built one provider, one dependency, and one deliberate decision at a time.

A slightly biased conclusion

Our experience moving to Gitoro has emboldened me to press ahead: to look more carefully for the gold nuggets we have in Switzerland and across Europe, and to give them the serious evaluation they deserve. Defaulting to the dominant players is no longer an option for us.

This may sound biased towards Gitoro. It is. Consider this a full endorsement of Gitoro and the excellent team behind it. @steffen, I’m looking at you.

The platform is capable. The people are responsive. And for a small company trying to build something serious, that combination is difficult to value too highly.