Buildkite might be an option in a regulated environment.
They don't get access to your code (BYO runners, they manage pipeline config / logs / notifications). You run their (open source, easy to build yourself) agent on infrastructure you control.
It's really nicely put together.