FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Phabricator

PreferencesOfficial website

Phabricator is an open source suite of web tools for code review, repository hosting, task management and project planning, originally developed at Facebook and now maintained as the Phorge fork after the original project was archived.

Block Phabricator until consentScan my site
Overview

What does Phabricator do?

What is Phabricator

Phabricator is an open source collection of web applications for software engineering teams. It groups Differential for code review, Diffusion for repository hosting, Maniphest for issues, Phriction for wiki pages and several other tools. The original project was archived in 2021 and is now maintained as the Phorge community fork.

Cookies and data collected

Phabricator sets first party cookies such as phsid for the authenticated session, phusr to store the user identifier and various CSRF tokens. Personal data processed includes account name, email address, code review comments, repository history, attached files and audit logs of every action performed in the interface.

GDPR and ePrivacy legal basis

Use of Phabricator inside a company is grounded on Article 6(1)(b) GDPR (the employment or service contract) and Article 6(1)(f) GDPR (legitimate interest in operating a secure development environment). Phabricator cookies are strictly necessary, so the consent obligation under Article 5(3) ePrivacy Directive does not apply.

Data transfers and hosting

Phabricator is fully self hosted. When the instance lives in the EU there is no transfer to a third country. If the operator chooses to run Phabricator on infrastructure outside the EU or to mirror repositories to a non EU SaaS, the usual transfer rules apply, including the Standard Contractual Clauses.

DPIA considerations

A formal DPIA is not generally required for a development tool, but the record of processing should describe accounts, code review history, retention of audit logs and access controls. Where Phabricator is used to monitor developer productivity, an Article 35 DPIA and works council consultation are recommended in EU jurisdictions.

Compliance steps

Restrict access with strong authentication, log only what is needed, define retention of audit logs and revisions, mention Phabricator in the internal privacy notice, secure SSH and Git transport with up to date keys and apply security patches from the Phorge fork promptly.

Compliance

Phabricator and the GDPR

Legal basis
Article 6(1)(b) GDPR (performance of the employment or service contract) and Article 6(1)(f) GDPR (legitimate interest in operating a code review and project management platform for the workforce). Cookies are strictly necessary, so no consent is required under Article 5(3) ePrivacy Directive.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, TTDSG, BDSG, LOPDGDD, EDPB guidelines on employee monitoring, ISO 27001 best practices

Impact assessment (DPIA)

A DPIA is not strictly mandatory for a self hosted developer tool, but the record of processing should describe accounts, repositories, code review comments, audit logs, retention and access controls. Where Phabricator is used to monitor performance or productivity of employees, a DPIA under Article 35 GDPR and consultation with the works council are recommended.

Sample text for your banner

This site uses Phabricator for internal code review and project management. Strictly necessary cookies (phsid, phusr) keep you logged in and protect the application. No consent is required, but you can read our privacy notice for more information.
Cookies and trackers

What Phabricator sets and contacts

Tracking method
Self hosted PHP web application that uses first party session cookies, account cookies and CSRF tokens. Phabricator does not load remote tracking scripts and stores all data inside the database controlled by the operating organisation.
Server location
Operator dependent. Phabricator (now maintained as the Phorge fork) is installed on the organisation own infrastructure, typically inside the EU when used by an EU controller.

Cookies set (4)

NameTypeDurationPurpose
phsidsessionSessionAuthenticated session identifier used by Phabricator to keep the user logged in across requests.
phusrfirst_party30 daysStores the username so the login screen can pre fill the field on returning visits.
phcidfirst_party1 yearClient identifier used to bind a long lived session token to a specific browser.
phcsrfsessionSessionCross site request forgery token that protects every form submission inside the Phabricator interface.

Third-party domains contacted (3)

  • phabricator.organization.example
  • we.phorge.it
  • secure.phabricator.com
Questions

Frequently asked questions about Phabricator

Can't find your question? Write to us, we answer fast.

Which cookies does Phabricator set?

Phabricator sets first party session and account cookies, primarily phsid for the authenticated session, phusr for the user identifier and several CSRF tokens. No third party analytics or advertising cookies are loaded by the standard installation.

Is consent required to use Phabricator?

No. The cookies set by Phabricator are strictly necessary for authentication and CSRF protection, so the consent requirement of Article 5(3) ePrivacy Directive does not apply. An information notice is still required.

What is the GDPR legal basis for Phabricator?

Inside a company the legal basis is Article 6(1)(b) GDPR for the employment or service contract, combined with Article 6(1)(f) GDPR (legitimate interest) in running a secure development platform. Specific monitoring use cases may require an additional basis.

Are repository data transferred to the United States?

Not by default. Phabricator is self hosted and was archived by Meta in 2021, so no telemetry is sent to the United States from the standard install. Transfers only occur if the operator hosts the instance outside the EU or mirrors data to a non EU service.

Is a DPIA required for Phabricator?

A DPIA is not required for ordinary developer use. It is recommended when Phabricator is used to systematically evaluate developer performance, monitor working time or process sensitive incident data, in which case Article 35 GDPR applies.

How should Phabricator be implemented securely?

Use a hardened web server with TLS, enable strong authentication and SSO, restrict access by role, log only necessary events, define retention for audit logs and revisions and apply security patches from the Phorge community fork.

What are the alternatives to Phabricator?

Modern alternatives include GitLab self managed, Gitea, Forgejo, Gerrit and SourceHut. Each offers code review and project management features with different hosting models, cookie footprints and integration ecosystems.

How do I describe Phabricator in my privacy notice?

List Phabricator as an internal development platform under the controller, describe the categories of data (account, code review history, audit logs), the legal basis, retention, the absence of third country transfers in your setup and a contact for data subject rights.

Same category

More services: Other

See the whole category

JS.org

JS.org is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. JS.org offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, JS.org empowers organizations to optimize strategy and maximize return on investment.

Other

Agorize

Agorize is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Agorize supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Agorize ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Loopi

Loopi is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Loopi provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Loopi helps deliver the right message to the right audience at the right time.

Preferences

Zulip

Zulip is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Zulip integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Zulip helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Storeify Store Locator

Storeify Store Locator offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Storeify Store Locator integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for.

Other

Recooty Job Widget

Recooty Job Widget is a human resources and recruitment platform that streamlines hiring, onboarding, and talent management processes. It provides applicant tracking, job board integration, employee management, and performance review tools. Recooty Job Widget automates repetitive HR tasks, enabling teams to focus on strategic initiatives. With self-service portals, analytics dashboards, and compliance management, Recooty Job Widget helps organizations attract, retain, and develop top talent efficiently.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site