> Do the couple dozen devs at my company really need an internally-hosted version?
From personal experience and knowledge through friends: Everyone writes code. Universities, Governments, Governmental agencies, political parties, etc.
A lot of them do not want to host in the cloud, especially in Germany, considering that the cloud (depending on the provider you are looking at) means hosting outside of Germany with all that entails privacy and regulation wise.
My response is "what's your threat model?". For a small company, our only security advantage is being a small target; there's no way we're competing with the Gitlab.com team on security.
1. If a 3-letter agency requests access to your on-prem data you'll know about the request and know which data is compromised.
2. You now have to trust your hosting provider. This is almost the same as being a small target, but not quite because you need to worry about all of their employees AND all of your own. There are 1k+ employees to attempt to compromise at Gitlab, and you have no control over or contracts with any of them.
3. Expanding on 2, given the disconnect between Gitlab and your own organization you open yourself up to new kinds of attacks like social engineering an account takeover, or expanding an email breach to a source code breach.
I don't think any of that matters for most people, but your attack surface area is increased with current cloud tech.
Without on-prem, you're cut out of your source code service and will have to do a potentially hasty migration to an entirely new platform (which brings its own issues inherent in any migration project).
Do the couple dozen devs at my company really need an internally-hosted version, or should we just pay for the cloud offering and supply our own runners? Seems easy to frame as a wash.