Avoid using a third-party hosted version control system when:
- The code is under NDA or otherwise has contractual or legal obligations that the hosting provider cannot or will not enforce. For example, code hosted externally may have issues with Common Criteria certification (this may or may not be an issue but source control was discussed in projects I have been involved in).
- The code contains unfiled patents, trade secrets or other intellectual property that the hosting provider cannot or will not protect.
Other things to consider when using a third-party hosting provider:
- Does the hosting provider support the version control system you are using? Conversion is possible but often complex and difficult. (This was mentioned in the question but it is included here for completeness)
- How are you billed for the service? Are there limits or thresholds such as repository size limits, bandwidth caps or throttling, user caps? Most providers are relatively cheap but be sure to work out how much it will actually cost before using the service.
- Does the hosting provider update to newer versions frequently? If not, are there features in newer versions you require? If they do, are there incompatibilities between the newer version and the version you are using now?
- Does the hosting provider meet your uptime or bandwidth requirements? If the source code is inaccessible when you need it, what legal options are there to recoup costs? Most systems provide few guarantees.
- Does the hosting provider store the source code in a country or jurisdiction where laws may allow others access? Many hosting providers will outsource their storage and servers to a IaaS cloud provider like Amazon but it is still worth asking the question.
- Does the hosting provider provide audit logs of accesses, not just modifications?
- How do you create and manage users who have access to the source code? Can you delegate this to other people in the organization? Can you access audit logs of user management?
- Does the hosting provider provide or enforce strong or multi-factor authentication?
- Does the provider enforce encrypted communication, e.g. SSL or SSH? Can you get access to any customer-specific side certificates or keys if required?
- How do you "onboard" any existing source code? Can you upload or import history?
- When you cease to be a customer of the hosting provider, can you get access to your source code history? If so how and for how long? What happens if the hosting provider goes out of business or merges with your competitor?
- How will your needs change over time? Are you likely to need more or less space, users or repositories than you have now? Can the provider handle these changes?
- Will your organization need more bandwidth to cope with the increased influx and outflux of data?
- Does the existing, on-premise source control system integrate with an authentication service, such as Active Directory? Using a third party hosting provider usually means developers need to remember another set of credentials.
Remember, too, that third party hosting providers are not the "silver bullet" for redundancy. They can be great as an additional, readily accessible backup but few hosting providers will guarantee the backups, at least not without paying more.
That said, third party hosting providers can be great, particularly for a distributed workforce, since they can work on source code without needing VPN access, and it is one less server that needs to be administered.
