Secure Source Manager - Managed Git Service

Secure Source Manager is Google’s managed Git service on Google Cloud. Google describes it as a regionally deployed, single-tenant source code repository secured through IAM and embedded in the platform’s security mechanisms.

What is Secure Source Manager?

Secure Source Manager provides Git repositories as a managed service. The foundation is an instance that runs in a region and has its own instance URI; inside it you create the individual repositories through the web interface or the API. Because every instance is single-tenant, resources are not shared with other customers.

Access uses the familiar Git SCM client commands over both HTTPS and SSH. For collaboration, pull requests with reviewers, labels, milestones, assignees, and due dates are available, alongside issues; notifications cover repository events and pull request participation.

On the security side, the documentation lists separate roles and permissions for instances and repositories, customer-managed encryption keys (CMEK) for data at rest, and integration into a VPC Service Controls perimeter to prevent exfiltration. FedRAMP High and HIPAA are listed as compliance attributes.

For teams that previously used Cloud Source Repositories, Secure Source Manager is the current managed Git service within Google Cloud; our page on Cloud Source Repositories is marked as discontinued.

Billing is per instance per month regardless of the number of users per instance, with partial months prorated. For supported locations and SLA values, refer to the official Google Cloud pages.

Core Features

• Managed Git repositories: Regionally deployed, single-tenant instances with repositories and full Git compatibility over HTTPS and SSH.
• IAM access control: Separate roles and permissions at instance and repository level.
• Pull requests and issues: Code review with reviewers, labels, milestones, assignees, and due dates, plus issue tracking.
• Branch protection: Rules for required pull requests, minimum reviewer counts, linear history, and build status checks before merge.
• CMEK and VPC Service Controls: Customer-managed keys for data at rest and perimeter protection against exfiltration.
• Integrations: Cloud Build via a triggers file, Jenkins and other services via webhooks, and Developer Connect as a read-only Git proxy.

Typical Use Cases

Keeping source code inside your own cloud environment

An organization with strict requirements on where source code is stored runs its repositories in an instance in the required region and connects them to existing permission management through IAM.

Code review with enforced rules

A development team uses branch protection rules to ensure changes only reach the main branch through pull requests with a minimum number of reviewers and successful build checks.

Connecting existing CI/CD pipelines

Builds are triggered in Cloud Build via a triggers file; existing Jenkins jobs are connected through webhooks.

Migrating from Cloud Source Repositories

A team whose repositories currently live in Cloud Source Repositories moves them to Secure Source Manager and keeps management inside Google Cloud.

Protecting sensitive repositories

Repositories containing especially sensitive code are placed inside a VPC Service Controls perimeter and encrypted with customer-managed keys.

Benefits

• Fully managed: No self-operated Git servers, patching, or backups.
• Regional control: Instances run in a chosen region and are single-tenant.
• Consistent IAM integration: Permissions follow the existing Google Cloud access model.
• Auditable reviews: Pull requests, issues, and branch protection support verifiable approval processes.
• Predictable cost: Price per instance per month independent of user count.

Integration with innFactory

As a certified Google Cloud Partner, innFactory supports you with Secure Source Manager: instance design and region selection, IAM and branch protection concepts, integration with Cloud Build and existing CI/CD tooling, and migration from Cloud Source Repositories.

Contact us for a consultation on Secure Source Manager and Google Cloud.