cloudparts

Secure Source Manager

Google Cloud’s managed Git forge: each customer gets its own single-tenant instance in one region, with repositories, pull requests, issues and branch protection, all behind Google Cloud IAM and private networking.

What it is
Version control
Used for
Issue tracking
Type
Managed service on Google Cloud
Made by
Google Cloud
License
Proprietary
Facts checked
20 October 2026
Website

What it is

You start by creating an instance: a regionally deployed, single-tenant server that only your organization uses, which takes up to 60 minutes to come up. Each instance has its own web interface and Git endpoints, with hostnames like INSTANCE-PROJECT_NUMBER-git.REGION.sourcemanager.dev. By default a project can have 5 instances per region, and each instance supports up to 500 users and 100 GB of storage. Repositories inside it accept any Git client over HTTPS or SSH; for HTTPS, a gcloud credential helper hands Git short-lived credentials, so there are no passwords to store.

It has the usual forge features: pull requests with reviewers, labels and milestones, issues, notifications, and branch protection that can require pull requests, approvals, linear history and passing status checks, with required reviewers from CODEOWNERS files since May 2026. A triggers file in the repository starts Cloud Build jobs, and webhooks reach other systems such as Jenkins. The rest is security plumbing: separate IAM roles for instances and repositories, customer-managed encryption keys (CMEK), private instances reached through Private Service Connect, VPC Service Controls against data exfiltration, and FedRAMP High and HIPAA compliance.

Each instance costs $1,000 a month regardless of how many users it has, prorated for partial months. Secure Source Manager was generally available by invitation from October 2023 and for all customers from August 4, 2025. It is Google Cloud’s replacement for Cloud Source Repositories, which stopped taking new customers on June 17, 2024. Additions in 2026 include the us-east1 region, custom domains for private instances, read-only access through Developer Connect and, since August, an MCP server for AI agents in preview.

Why teams pick it

  • Isolation and data residency: a single-tenant instance in a region you choose, encrypted with your own keys and reachable only from your private network if you want
  • One IAM system for developers and service accounts across repositories, builds and the rest of Google Cloud
  • A complete forge (pull requests, issues, branch protection, CODEOWNERS, webhooks) wired to Cloud Build
  • Compliance boxes ticked for regulated teams: FedRAMP High and HIPAA since September 2025

Watch out for

  • A flat $1,000 per instance per month whatever the number of users, which is steep for a small team
  • Instance quotas of 500 users and 100 GB of storage, so large organizations need several instances
  • Setup is heavier than creating a repository: choose a region, wait up to an hour, and create the service agent by hand before using CMEK
  • Young: generally available to everyone only since August 2025, and newer pieces such as the MCP server are still in preview

Alternatives

What all version control have in common →Compare side by side →
Azure ReposAzureMicrosoft’s hosted Git repositories, part of Azure DevOps: pull requests guarded by branch policies that can require reviewers, linked work items and a passing build, plus the older centralized Team Foundation Version Control.AWS CodeCommitAWSAWS’s managed Git hosting: private repositories inside an AWS account, with access controlled by IAM instead of separate user accounts, pull requests with approval rules, and triggers into other AWS services.

How it fits with other technologies

Create an instance and a repository, then clone it · bash

gcloud source-manager instances create acme \
  --region=us-central1 --project=acme-prod       # takes up to 60 minutes

gcloud source-manager repos create shop \
  --instance=acme --region=us-central1 --project=acme-prod --default-branch=main

# let gcloud supply short-lived credentials to Git
git config --global credential.'https://*.*.sourcemanager.dev'.helper gcloud.sh
git clone https://acme-123456789012-git.us-central1.sourcemanager.dev/acme-prod/shop.git

See it in a real stack

No architecture uses Secure Source Manager yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2023–2026

Google Cloud’s earlier Git hosting was Cloud Source Repositories. In May 2024 Google announced its end of sale, and from June 17, 2024 it was no longer available to new customers, with Secure Source Manager named as the place to go instead.

Secure Source Manager had entered preview on June 15, 2023 and became generally available by invitation on October 12, 2023, adding regions in Taiwan, the Netherlands, Tel Aviv and Montréal along the way. Over the next two years Google filled in the forge and the security features: Cloud Build integration and generally available branch protection in September 2024, Workforce Identity Federation and email notifications that November, then general availability for all customers on August 4, 2025, and FedRAMP High and HIPAA compliance that September.

Google pitches it as a way to keep the whole build pipeline inside a private perimeter: when software is compromised, it says, data and business processes are at risk too. In 2026 it added CODEOWNERS-based required reviewers, removed legacy and insecure SSH algorithms in a breaking change, and released an MCP server in preview so AI agents can work with repositories.

Why it’s built this way

A single-tenant instance per customer and region
Running a dedicated instance in one region lets a customer place source code in its own private network perimeter, controlled with VPC Service Controls and IAM, and keep it in a chosen location.
Google Cloud IAM for every user and service account
One identity system for developers and for the service accounts in a CI/CD pipeline simplifies the security posture, instead of keeping a separate set of forge accounts and tokens.
Build with Cloud Build and webhooks, not built-in runners
Google positions the product as part of a CI/CD solution with Cloud Build, and lets third-party build systems such as Jenkins connect through webhooks.

Timeline

  1. 2023

    Preview (June 15); generally available by invitation (October 12)

  2. 2024

    Cloud Source Repositories closed to new customers (June 17); Cloud Build integration and branch protection GA (September 11)

  3. 2025

    Generally available to all customers (August 4); FedRAMP High and HIPAA (September 10)

  4. 2026

    CODEOWNERS required reviewers (May 6); MCP server in preview (August 15)

Sources9 · facts checked 20 October 2026

Improve this page on GitHub