In our case cloud is fine, as long as it’s within our security boundary- so that means external SaS is out, but hosted within our cloud is fine. I’m still not super excited about the prospect of managing and maintaining it though :/ We’re going down this path because AWS is killing code commit and other pipeline stuff, which sucks because even though other tools are better, code commit was fedRamped and from the same vendor.