European runners for GitHub Actions

What a European runner changes, and what it does not

A GitHub Actions pipeline has layers, and each one can live in a different place. A CI runner is only one of them: the machine where the job executes. Here is who runs each layer, and where, in three common setups.

Layer	GitHub-hosted runners on github.com	GitHub Enterprise Cloud with EU data residency	CRACI runners
Repository and source code storage	GitHub; github.com stores data in the US by default	GitHub, in the EU region	GitHub, as in your current setup. CRACI processes the code in the job's virtual machine and does not store it
Orchestration, workflow runs, logs, checks UI	GitHub	GitHub; Actions data and logs stored in the EU region	GitHub, as in your current setup
Secrets storage	GitHub	GitHub	GitHub; delivered to the CRACI runner when the job starts
Build execution	GitHub-hosted runners on Microsoft Azure, and for some standard Linux jobs AWS; regions not named	Hosted runners in EU Azure regions, through Azure private networking	CRACI runners on European bare-metal infrastructure
Record of what the build fetched	Not recorded	Not recorded	SBOMs and network traces, held by CRACI, hosted in Europe
Artifacts from actions/upload-artifact	GitHub	GitHub; Actions data stored in the EU region	GitHub, as in your current setup
Who operates it	GitHub, a Microsoft company	GitHub, a Microsoft company	GitHub for the control plane; CRACI Corporation Oy, a Finnish company, for the runner

In plain words: with CRACI, the compute that sees your code and secrets during the build runs in Europe and is operated by a European company, and so is the record of every package the build pulled in. GitHub still holds the code and orchestrates the job. CRACI replaces the runner, not GitHub Actions.

Data residency is not sovereignty

Data residency is about where data is stored and processed. Sovereignty adds two more questions: who controls the data, and which law applies to that party, including which jurisdiction can compel the operator to hand data over. A European data center run by a company from outside Europe gives you residency, not sovereignty. Which jurisdictions matter for your case is a question for your legal counsel, not for a runner vendor.

A decision rule that holds up in an audit: list each layer from the table above, write down who operates it and where it runs, and compare that with your requirement. If the requirement covers only where builds execute and where build data lives, a European runner can meet it. If it covers the control plane or code storage, a runner alone cannot.

Your options in Europe

Option	What runs in Europe	Who operates it	Limits
GitHub Enterprise Cloud with data residency (GHE.com)	Code and Actions data in the EU region; hosted runners in EU Azure regions through Azure private networking (x64 in France Central and Sweden Central, arm64 in France Central)	GitHub	Enterprise Cloud only; a separate GHE.com enterprise
CRACI	Managed Linux runners on European bare-metal infrastructure, with build evidence included	CRACI Corporation Oy, a European company	GitHub Actions and Linux only today
Ubicloud	GitHub Actions runners in its European regions, in Germany and Finland	Ubicloud, with offices in San Francisco, Amstelveen and Istanbul	Ubuntu runners
Avrea	Avrea names hosting providers including Aiven, Google Cloud and OVHcloud, and asks customers to discuss data location requirements with it	Avrea, founded in Helsinki	Data location is agreed with Avrea, not published per region
Blacksmith	Machines in Amsterdam and Frankfurt as well as in the US; an organization can ask to be moved to another region	Blacksmith, with its control plane on AWS	A European location, not a European operator
Self-hosted runners on a European cloud	Your runners on a European provider's servers, with Actions Runner Controller or plain virtual machines	You	You patch, isolate and scale them
A different CI platform on European hosting	Everything, including the control plane: GitLab self-managed or a Forgejo or Gitea instance	You or your hosting partner	A CI migration, not a runner change

For the one-to-one detail, see CRACI vs Ubicloud, CRACI vs Avrea and CRACI vs Blacksmith, and for the wider field, GitHub Actions runner providers compared. If you are weighing running your own, see managed vs self-hosted runners.

What CRACI runs in Europe

• Managed runners, hosted in Europe. Builds run on European bare-metal infrastructure, operated by CRACI Corporation Oy. CRACI offers managed runners today; customer-hosted runners are on the roadmap.
• EU data residency on Enterprise. The Enterprise plan lists EU data residency, alongside custom retention and SAML SSO.
• Isolation. Every job runs in its own isolated virtual machine.
• What CRACI holds, and what it does not. CRACI processes your source code in the job's virtual machine and does not store it. It holds build metadata, package data, network traces, SBOMs, provenance, caches and audit records. Caches hold whatever your workflow saves in them.
• A stable egress IP range, for the allowlists your build reaches.
• Certification. CRACI Corporation Oy's information security management system, for the development and operation of the CRACI platform, is certified to ISO/IEC 27001 by Into Certification. CRACI is GDPR compliant.

For the detail your security review needs, see security, the Trust Center and what CRACI can reach.

Why the build layer is worth moving

Even when GitHub stays, the runner is the layer worth moving first. It is where your code is compiled with your secrets present, and where third-party packages enter your product. Running it on European infrastructure keeps that execution, and the record of every package it fetched, on infrastructure operated by a European company rather than on a US hyperscaler's compute.

That record is also evidence. CRACI records each job's dependencies as an SBOM with a completeness state, under an egress policy that fails closed, and keeps monitoring them for new vulnerabilities. European regulation such as the Cyber Resilience Act increasingly asks manufacturers for exactly this kind of record.

The move is a label change: runs-on: craci. CRACI runs builds about twice as fast as GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching, and charges only for build minutes: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee. See CRACI's runners, pricing and how to switch runner providers.

When CRACI is not the answer

• Your requirement covers the control plane or code storage. A European runner is not enough. You need GitLab self-managed or a self-hosted forge in Europe; see GitLab alternatives. CRACI supports GitHub Actions only today, with GitLab CI and Jenkins on the roadmap.
• Runners must run on your own hardware or in your own cloud tenancy. Customer-hosted CRACI runners are on the roadmap, not available today.
• You need macOS or Windows builds in Europe. CRACI runs Linux on x86-64 and ARM64 today, with Windows and macOS on the roadmap.
• You need the lowest price per minute. Other European options list lower.

European GitHub Actions runners: frequently asked questions

Can GitHub Actions builds run in the EU?

Yes. The build runs wherever the runner is, so a runner on European infrastructure runs your build in Europe. You can get one from a managed provider such as CRACI, from GitHub Enterprise Cloud with data residency, which can place hosted runners in EU Azure regions, or by running self-hosted runners on a European cloud.

Is there a European GitHub Actions runner provider?

Yes. CRACI is a European company, and its managed runners for GitHub Actions run on European bare-metal infrastructure. Other providers also run machines in Europe; check both where the machines are and which company operates them.

If my runner is in the EU, is my CI sovereign?

Not on its own. A European runner moves the build execution and the record of what the build fetched. GitHub still stores the code, the secrets, the logs and the artifacts, and orchestrates every job. To take GitHub out of the picture, you need a different CI platform on European hosting.

What data stays with GitHub when I use a European runner?

The repository, the workflow files, the secrets store, the workflow runs and logs, the checks UI and the artifacts uploaded with actions/upload-artifact. The runner receives the code and the job's secrets while the job runs. CRACI processes your code in the job's virtual machine and does not store it.

Does GitHub offer EU data residency for Actions?

On GitHub Enterprise Cloud with data residency, hosted on GHE.com, you can choose an EU region, and GitHub stores repositories and Actions data and logs there. Its hosted runners can run in EU Azure regions through Azure private networking. The operator is still GitHub, and the offer is for Enterprise Cloud customers only.

What is the difference between EU data residency and sovereignty?

Data residency is about where data is stored and processed. Sovereignty adds who controls the data and which law applies to that party. A European data center run by a company from outside Europe gives you residency, not sovereignty. List each layer of your pipeline, who operates it and where, and compare that with your requirement.