Lucity vs sota.io: Swiss Jurisdiction, EU Servers, and an Open-Source Exit Ramp

Most of the jurisdiction stories we've covered are binary: a US LLC running EU-region servers (Out Plane), or a genuinely EU-native operator we're at parity with on jurisdiction (Coolify, Apply.Build, Zerops). Lucity is neither. Its core workloads and databases run on Hetzner Cloud in Nuremberg, Germany — the same city and cloud provider a lot of EU-native infrastructure, including sota.io's, actually sits on. But the company operating Lucity is Swiss: a sole proprietorship in Bern, governed by Swiss law, with disputes going to Swiss courts. That's a genuinely different case from anything we've written up so far — not a CLOUD Act red flag, but not the same legal answer as an EU-established operator either.

What Lucity is

Lucity is a Kubernetes-native git-push PaaS: connect a GitHub repo, its build tool (Railpack) auto-detects the language and framework, deploys land on a managed Kubernetes cluster running standard tooling (ArgoCD, Helm, CloudNativePG for Postgres). It's built and operated by zeitlos, a small Bern-based software consultancy (DevOps/platform engineering, security, web development) — Lucity is a product it built and now runs commercially, the same pattern as Apply.Build/Codebite. The core is open source (AGPL-3.0, 32 GitHub stars as of this writing — modest, but a real, active project, not vaporware) and self-hosting it is free with "no limits, no fees." The managed cloud version is self-serve today: sign up, 14-day trial with CHF 5 in credits, deploy.

Pricing

Lucity charges a small base subscription that doubles as prepaid usage credit, plus metered resources:

For the 2 vCPU / 2 GB benchmark spec we use across these comparisons, guaranteed resources work out to 2 × CHF 16 + 2 × CHF 8 = CHF 48/mo, with the Pro plan's CHF 25 base fee absorbed into that as prepaid credit rather than stacking on top — an illustrative calculation from the published rate card, not an official Lucity quote. At the CHF/EUR rate on the day of writing (roughly 1.07), that's approximately €51/mo. Below that spec, the Hobby plan at CHF 5/mo covers smaller always-on workloads that don't need guaranteed compute at all.

The jurisdiction question

Lucity's own Terms of Use name the operator directly: "zeitlos.software Inh. Christian Blättler", CHE-439.475.468, Mattenhofstrasse 5, 3007 Bern, Switzerland. The governing-law clause: "These terms are governed by the laws of Switzerland, excluding its conflict-of-law rules and the [CISG]... The exclusive place of jurisdiction for any dispute is Bern, Switzerland." That's not the CLOUD Act problem we've written about with US-incorporated platforms — Switzerland isn't the United States, so 18 U.S.C. §2713 has no reach here at all.

It's a different, more subtle gap: Switzerland has held an EU adequacy decision since 2000 (most recently reconfirmed by the European Commission on 15 January 2024), meaning personal data can move between the EU and Switzerland without Standard Contractual Clauses. But adequacy is a data-transfer mechanism, not EU membership — a Swiss sole proprietorship is regulated under Switzerland's Federal Act on Data Protection (FADP/nDSG) and answers to the Swiss FDPIC, not to an EU data protection authority, and Swiss courts, not EU courts, resolve disputes. Lucity's own Privacy Policy confirms the infrastructure itself is genuinely EU-located: "the platform core, your workloads, and their databases run on Hetzner Cloud in Nuremberg, Germany," with object storage on OVHcloud in Gravelines, France. It also discloses, honestly, that its CDN provider (Bunny) "may cache" publicly served content and request metadata "at edge locations outside the EU" — a narrow exposure limited to public content, not account or application data, but worth noting for completeness. For a customer whose actual requirement is "the data processor is itself an EU-established entity" — not just EU-hosted, not just EU-adequate — a Bern sole proprietorship is a different legal answer than a Berlin GmbH, even with servers sitting in the same country.

sota.io's setup is the latter: operated by mamarx GmbH, registered in Berlin (HRB 213877 B, Amtsgericht Charlottenburg). The DPA is governed by German law with Berlin as exclusive jurisdiction, states that all personal data is "processed and stored exclusively within the European Union," and publishes every sub-processor by name — Hetzner Online GmbH, Supabase Inc., Stripe Payments Europe Ltd., and Anthropic PBC (opt-in only, under EU Standard Contractual Clauses).

The open-source angle — a genuine Lucity strength

This is where Lucity's pitch is stronger than sota.io's, and worth stating plainly rather than burying: Lucity leads its own marketing with "No lock-in. Ever." The platform is AGPL-3.0, and it ships a lucity eject command that exports the full underlying infrastructure — Helm charts, ArgoCD Application manifests, environment configs, and a README — so a customer can, in principle, walk away and run the same setup without Lucity at all. sota.io has no equivalent: no open-source core, no self-host mode, no eject path. If vendor lock-in itself is the primary risk a team is trying to manage — separate from jurisdiction — Lucity has an answer sota.io doesn't.

To be fair to Lucity, further

Managed Redis is available as a standard infrastructure option (sota.io doesn't offer one); Postgres is provisioned via CloudNativePG, a genuine Kubernetes operator rather than a black box; and Lucity publishes dedicated comparison pages against Railway, Render, Fly.io, Heroku, Vercel, and Coolify, suggesting a team that's thought carefully about where it sits in this market. Neither company holds a SOC 2 or ISO 27001 certification — parity, not an edge for either side.

Availability

Lucity is self-serve today. sota.io is not: per its own pricing page, Developer and Team plans are "available at GA" and sit behind a waitlist; only Enterprise is open now, at info@sota.io.

Side-by-side

The actual trade-off

If avoiding vendor lock-in is the actual priority — an open-source core with a real export path — Lucity has a concrete answer sota.io can't currently match, and its infrastructure genuinely sits in the EU. If the requirement is specifically an EU-established, EU-regulated operator rather than an EU-adequate one, sota.io's Berlin GmbH is the more literal fit, even though both platforms' servers can end up in the same country.

See also: Out Plane vs sota.io: EU data centers, Delaware LLC · Coolify vs sota.io: self-hosted vs managed · Apply.Build vs sota.io: security vs database bundling