Gitlab Inc. 10-K

ITEM 1. BUSINESS Overview In today’s world, software defines the speed of innovation. Every industry, business, and function within a company is dependent on software. To remain competitive and survive, nearly all companies must digitally transform and become experts at building, delivering, and securing software. To meet these market needs, GitLab pioneered The DevSecOps Platform, a fundamentally new approach to software development and delivery. Our platform is uniquely built as a single application and interface with a unified data model, enabling all stakeholders in the software delivery lifecycle – from development teams to operations teams to security teams – to work together in a single tool with a single workflow. With GitLab, they can build better, more secure software faster. GitLab is the solution to significant business transformation needs. Across every industry – and across companies of every size – technology leaders want to make developers more productive so they can deliver better products faster; they want to measure productivity, so they can increase operational efficiency; they want to secure the software supply chain, so they can reduce security and compliance risk; and, they want to accelerate cloud migration, so they can unlock digital transformation results. These technology leaders need a platform that enables a value stream-driven mindset – a mindset that shortens the time from idea to customer value – and establishes a powerful flywheel for data collection and aggregation. And they are looking for a platform approach that unifies the entire development experience, so that customers can be faster than their competition in moving from idea to customer value. GitLab is designed to consolidate point solutions to cut costs and boost efficiency, and provides end-to-end visibility across the entire software development lifecycle, from planning to production to security. We believe GitLab is the shortest path to unlocking business and technology transformation results. Our DevSecOps Platform accelerates our customers’ ability to create business value and innovate by reducing their software development cycle times from weeks to minutes. It removes the need for point tools and delivers enhanced operational efficiency by eliminating manual work, increasing productivity, and creating a culture of innovation and velocity. The DevSecOps Platform also embeds security earlier into the development process, improving our customers’ software security, quality, and overall compliance. GitLab is available to any team, regardless of the size, scope, and complexity of their deployment. As a result, we have more than 30 million registered users and more than 50% of the Fortune 100 companies are GitLab customers. For purposes of determining the number of our active customers, we look at our customers with more than $5,000 of Annual Recurring Revenue, or ARR, in a given period, who we refer to as our Base Customers. For purposes of determining our Base Customers, a single organization with separate subsidiaries, segments, or divisions that use The DevSecOps Platform is considered a single customer for determining each organization’s ARR. GitLab is the only DevSecOps platform built on an open-core business model. We enable any customer and contributor to add functionality to our platform. In 2022, nearly 800 people contributed more than 3,000 merge requests back to the core product, extending GitLab’s in-house R&D efforts and empowering our most passionate users to make improvements to the DevOps tool they use every day. Our open-core approach has enabled us to build trust with our customers, and to maintain our high velocity of innovation so that we can rapidly create the most comprehensive DevSecOps platform. GitLab exists today in large part thanks to the vast and growing community of open source contributors around the world. We actively work to grow open source community engagement by operating with transparency. We make our strategy, direction, and product roadmap available to the wider community, where we encourage and solicit their feedback. By making non-sensitive information public, 5 Table of Contents we create a deeper level of trust with our customers and we make it easier to solicit contributions and collaboration from our users and customers. See the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations —Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for additional information about how we define ARR. We make our plans available through our self-managed and software-as-a-service, or SaaS offering. For our self-managed offering, the customer installs GitLab in their own on-premise or hybrid cloud environment. For our SaaS offering, the platform is managed by GitLab and hosted either in our public cloud or in our private cloud based on the customer’s preference. For more information regarding our customers, refer to the section titled “Business—Our Customers.” DevOps is the set of practices that combines software development (dev) and IT operations (ops). It allows teams to collaborate and work together to shorten the development lifecycle and evolve from delivering software on a slow, periodic basis to rapid, continuous updates. When DevOps started, each team bought their own tools in isolation, leading to a “Bring Your Own DevOps” environment. The next evolution was standardizing company-wide on the same tool for each stage across the DevOps lifecycle. However, these tools were not connected, leading to a “Best in Class DevOps” environment. Teams tried to remedy this fragmentation and inefficiency by manually integrating these DevOps point solutions together defining the next phase: “Do-It-Yourself (or DIY) DevOps.” At the same time, the faster delivery of software required more DevOps tools per project. Increased adoption of a microservice architecture led to more projects. The combination caused an exponential increase in the number of tool-project integrations. This has often led to poor user experiences, higher costs, and increased time to deliver new software. As a result, business outcomes often failed and the potential for DevOps was never fully realized. In short, an entirely new platform for DevOps was needed. The DevSecOps Platform replaces the DIY DevOps approach. It enables teams to realize the full potential of DevOps and become software-led businesses. It spans all stages of the DevOps lifecycle, from project planning (Plan), to source code management (Create), to continuous integration (Verify), to application security testing (Secure), to packaging artifacts (Package), to continuous delivery and deployment (Release) to configuring infrastructure for optimal deployment (Configure), to monitoring it for incidents (Monitor), to protecting the production deployment (Protect), and managing the whole cycle with value stream analytics (Manage). It also allows customers to manage and secure their applications across any cloud through a single platform. GitLab’s DevSecOps Platform has broad use across teams. It helps product and business teams work with developers to introduce new features and drive successful business outcomes. It helps Chief Technology Officers, or CTOs, modernize their software development and delivery environment and drive developer productivity. It helps Chief Information Officers, or CIOs, adopt microservices and cloud native development to improve the efficiency, scale, and performance of their software architecture. It helps Chief Information Security Officers, or CISOs, reduce security vulnerabilities without compromising speed to market. It helps teams attract and retain top talent by creating a superior developer experience that allows people to focus more time on their job and less time managing tools. The majority of our customers begin their GitLab journey by using our Source Code Management, Continuous Integration and Continuous Delivery (CI/CD) solutions, referred to as Create and Verify. Developers use these solutions to collaborate together on the same code base without conflicting or accidentally overwriting each other's changes. Create also maintains a running history of software contributions from each developer to allow for version control. Teams use Verify to ensure changes to code go through defined quality standards with automatic testing and reporting. We believe serving as this system of record for code and our high engagement with developers is a competitive advantage in realizing our single application vision as it creates interdependence and adoption across more stages of the DevSecOps lifecycle, such as Package, Secure, and Release. As more stages are addressed within a single application, the benefits of The DevSecOps Platform are enhanced. 6 Table of Contents Innovation is a key differentiated competitive advantage. We have a dual flywheel innovation strategy that leverages both development spend from our research and development team members as well as community contributions via our open-core business model. By leveraging the power of each, we create a virtuous cycle where more contributions lead to more features, which leads to more users, leading back to more contributions. We emphasize iteration to drive rapid innovation in our development strategy. This iterative approach has enabled us to release a new version of our software on the 22 nd day of every month for 136 months in a row as of January 31, 2023. This is also due in part to our over 3,500 contributors in our global open source community as of January 31, 2023. GitLab team members also use The DevSecOps Platform to power our own DevSecOps lifecycle. By doing so, we benefit from the inherent advantages of using a single application. We leverage these learnings to establish a rapid feedback loop to continually and rapidly improve The DevSecOps Platform. We have been a 100% remote workforce since inception and, as of January 31, 2023 , had approximately 2,170 team members in over 65 cou ntries. Operating remotely allows us access to a global talent pool that enables us to hire talented team members, regardless of location, providing a strong competitive advantage. We foster a culture of results built on our core values of collaboration, results, efficiency, diversity-inclusion-belonging, iteration, and transparency. We aim to be transparent to build alignment and affinity with our community and customers. This is exemplified through our corporate handbook, or the Handbook, our central repository that details how we run GitLab and is shared with the world. It consists of over 2,700 webpages of text, including our strategy and roadmap. We welcome everyone, both inside and outside of GitLab, to contribute to the Handbook. We have a simple pricing structure to enable broad-based adoption from organizations and teams of all sizes. We offer a free tier with a large number of features to encourage use of The DevSecOps Platform, solicit contributions, and serve as targeted lead generation for paid customers. We also offer two paid subscription tiers - effective April 3, 2023 the monthly list price will be $29 for Premium and $99 for Ultimate - with access to additional features that are more relevant to managers, directors, and executives. Our subscription plans are available as a self-managed offering, where the customer installs GitLab in their own on-premise or hybrid cloud environment or a SaaS offering where the platform is managed by GitLab and hosted either in the public cloud or in a private cloud based on the customer’s preference. GitLab’s DevSecOps platform is used globally by teams of all sizes across a broad range of industries. To reach, engage and help drive success at each, we have strong partnerships with cloud hyperscalers, including Google Cloud and Amazon Web Services, or AWS, who offer GitLab on their marketplaces. We also benefit from strategic alliance partnerships, which resell GitLab to large enterprise customers, and our strong channel partnerships ranging from large global systems integrators to regional digital transformation specialists, and volume resellers. We have a multi-faceted land-and-expand bottom up and top down sales strategy. Our customer journey can begin with developers and then expand to more teams and up to senior executive buyers. Equally so, the customer journey can start with executive level buying decision-makers looking for a solution to their business and technology challenges, such as developer productivity, efficiency, security and compliance, and cloud migration. As of January 31, 2023 and 2022, our Dollar-Based Net Retention Rate was above 130% and above 152%, respectively. Our Base Customers grew to 7,002 as of January 31, 2023 from 4,593 as of January 31, 2022. Our cohort of customers generating $1.0 million or more in ARR grew to 63 as of January 31, 2023 from 39 as of January 31, 2022. Our business has experienced rapid growth. We generated revenue of $424.3 million and $252.7 million in fiscal 2023 and 2022 , respectively, representing growth of 68%. During this period, we continued to invest in growing our business to capitalize on our market opportunity. The net loss attributable to GitLab was $172.3 million and $155.1 million in fiscal 2023 and fiscal 2022 , respectively. Our operating cash flow margin, which we define as operating cash flows as a percentage of revenue, 7 Table of Contents was (18.2)% and (19.7)% for fiscal 2023 and fiscal 2022 , respectively. Our gross profit margin was 88% for each of fiscal 2023 and fiscal 2022. The DevSecOps Platform GitLab has pioneered The DevSecOps Platform, a single application that brings together development, operations, IT, security, and business teams to deliver desired business outcomes through efficient software development. It represents a step change in how teams plan, build, secure and deliver software. The DevSecOps Platform is built on a single codebase, unified data model, and user interface. Organizations can deploy The DevSecOps Platform as a self-managed offering in their own hybrid-cloud, or on-premises environments, and as a SaaS offering is hosted in either the public cloud or in a private cloud based on the customer’s preference. The DevSecOps Platform is designed in a way that enables our customers to move their DevOps workflow across any hybrid or multi-cloud environment while maintaining full feature parity and a single application experience. The DevSecOps Platform is purpose-built to address every stage of the software development and delivery DevSecOps lifecycle: • Manage. GitLab enables all stakeholders – from executives to practitioners – to get visibility and insights into their value stream delivery in order to measure the flow of work, from idea to customer value. With capabilities such as Value Streams Dashboard and Value Stream Analytics, GitLab is uniquely positioned to be the tool of choice for data-driven organization – enabling teams to understand software delivery performance and value to the business without complex configurations or data scientists. GitLab helps teams organize multiple projects into a single collaborative portfolio, track important events across the DevSecOps lifecycle, measure using key performance indicators how the organization is adopting and performing with DevSecOps, audit activity and permissions across stages to ensure compliance while simplifying audit, and optimize and analyze the flow of work through the full DevSecOps value stream. • Plan. To create software, teams require collaborative planning from disparate groups, each with shared and unique objectives. Planning together in the same system in which all of the work will take place enables faster and more efficient work in all other stages of The DevSecOps Platform. We enable portfolio planning and management through epics, groups (programs) and milestones to organize and track progress. GitLab helps teams organize, plan, align, and track project work to ensure teams are working on the right things at the right time and maintain end to end visibility and traceability of issues throughout the delivery lifecycle from idea to production. • Create. Helps teams design, develop, and securely manage code and project data from a single distributed version control system to enable rapid iteration and delivery of business value. GitLab repositories provide a scalable single source of truth for collaborating on projects and code which enables teams to be productive without disrupting their workflows. • Verify. Helps software teams fully embrace Continuous Integration, or CI, to automate the builds, integration, and verification of their code. GitLab’s CI capabilities enable automated accessibility, usability, performance testing, and code quality analysis to provide fast feedback to developers and testers about the quality of their code. With pipelines that enable concurrent testing and parallel execution, teams quickly get insight about every commit, allowing them to deliver higher quality code faster. • Package. Enables teams to package their applications and dependencies, manage containers, and build artifacts with ease. The private, secure, container, and package registries are built-in 8 Table of Contents and preconfigured out-of-the box to work seamlessly with GitLab source code management, or SCM, security scanners, and Continuous Integration/Continuous Delivery, or CI/CD, pipelines. • Secure. Provides Static Application Security Testing, or SAST, Dynamic Application Security Testing, or DAST, Fuzz Testing, Container Scanning, and Dependency Scanning to help users deliver secure applications along with license compliance. • Release. Helps automate the release and delivery of applications, shortening the delivery lifecycle, streamlining manual processes, and accelerating team velocity. With zero-touch CD built right into the pipeline, deployments can be automated to multiple environments like staging and production, and the system executes without additional manual intervention - even for more advanced patterns like canary deployments. With feature flags, built-in auditing/traceability, on-demand environments, and GitLab Pages for static content delivery, users are able to deliver faster and with more confidence than ever before. • Configure. Helps teams to configure and manage their application environments. Strong integration to Kubernetes reduces the effort needed to define and configure the infrastructure required to support an application. Protects access to key infrastructure configuration details such as passwords and login information by using ‘secret variables’ to limit access to only authorized users and processes. • Monitor. Provides feedback in the form of errors, traces, metrics, logs, and alerts to help reduce the severity and frequency of incidents so that users can release software frequently with confidence. • Govern. Extends an existing operation's practices to help teams manage their security vulnerabilities, project dependencies, and compliance policies to reduce overall risk. This enables teams to identify risks by providing them with a high degree of visibility into their projects' dependencies, security findings, and user activities. This visibility is then coupled with management tools to respond to those risks. Lastly, policies can be used to automate compliance and to help secure the software supply chain. Key Benefits Delivered to our Customers • Run their entire DevSecOps lifecycle from a single application. The DevSecOps Platform lets our customers operate their entire DevSecOps lifecycle across a single application. This single codebase, unified data model, user permissioning, and interface can centralize and unify every aspect of our customers’ DevSecOps lifecycle to streamline workflows and processes, and enhance overall productivity and efficiency. • Enhanced innovation and revenue growth due to faster time to market. The DevSecOps Platform enables businesses to shorten their cycle times to meet the growing business demand to deliver new capabilities and increase responsiveness to change. With The DevSecOps Platform, our customers can often increase the number of their software releases from the tens to thousands and reduce the time it takes to release new software from months to days, helping them generate more revenue. • Reduce vulnerabilities and increase security. The DevSecOps Platform lets teams shift left and embed security decisions earlier in the development process, without sacrificing speed or quality. It also eliminates the need for multiple data repositories, multiple security tools, and reduces the number of hand-offs between development, operations, and security teams. The DevSecOps Platform provides a single consolidated view of vulnerabilities across software increasing the efficiency of vulnerability management and remediation. This enables our customers to find and correct security vulnerabilities in their software earlier or eliminate inefficiencies in the software development process altogether. 9 Table of Contents • Enable audit and compliance. The DevSecOps Platform eliminates fragmented tools and point integrations that create blind spots and poor visibility across work streams. This allows compliance and audit teams to more easily log, track, and trace different steps across the DevSecOps lifecycle, better understand governance, and improve their compliance posture. • Boost team member morale and productivity. The DevSecOps Platform enables our customers to spend more time building, deploying, and securing software, and less time managing, integrating, and triaging across different tools. In a single application, each team member can follow the entire lifecycle from beginning to end with contextual history and understanding at each process. This helps to deliver outsized productivity gains, helping our customers increase their revenue, and generate greater profits. • Reduce costs by enhancing productivity, consolidating point tools, and eliminating integrations. The DevSecOps Platform fulfills the functionality of multiple point products, enabling teams to consolidate the number of tools they use. Further, The DevSecOps Platform also delivers cost savings to our customers by eliminating the hidden costs and time it takes to manually integrate these point products and drives greater efficiency gains and productivity. Based on a 2022 study conducted by Forrester Consulting, commissioned by us and covering a limited number of our customers, the cost savings and business benefits achievable by deploying The DevSecOps Platform to revenue-generating applications can enable customers to deliver a 427% r eturn on investment within three years of deployment. • Embrace the benefits of a portable workload and multi-cloud strategy. The DevSecOps Platform enables application portability by allowing customers to seamlessly secure and manage their applications across clouds. This allows our customers to provide full value stream analytics on their DevSecOps workflow and simplify their application security and compliance across clouds. It also allows them to optimize their cloud costs and embrace the best services across each cloud, without becoming overly reliant on a single public cloud provider. Competitive Strengths Our business benefits from the following competitive strengths: • Best-In-Class DevSecOps – GitLab is an all-in-one DevSecOps solution with security built in (not bolted on) to the platform. • Flexibility - GitLab offers flexible deployment options serving every type of organization. This includes SaaS for customers who want to consume DevSecOps as a service, self-management for customers who want deployment control, and GitLab Dedicated – our single tenant SaaS service – for customers in highly regulated industries and with complex compliance and security requirements. • Cloud Agnostic – GitLab can be deployed anywhere, enabling a multi-cloud strategy. And, we have no preferential treatment for any specific cloud, which enables our customers to avoid vendor lock-in. • User Experience – GitLab has a superior user experience with an integrated platform enabling developers to prevent context switching. • Open Core Platform – GitLab is open core built with our customers creating a fast pace of innovation. 10 Table of Contents Our Growth Strategy We intend to invest in our business to advance adoption of The DevSecOps Platform. Our growth strategies include: • Advance our feature maturity across more stages of the DevSecOps lifecycle. We intend to continue making strategic investments in research and development and hiring top technical talent to mature our features in more stages of the DevSecOps lifecycle. For example, in fiscal 2023, we have invested a significant portion of our human capital on development into the Secure, Govern, and Plan stages. Our acquisition of Opstrace, Inc. in fiscal 2022 demonstrates our aim to deliver functionality in our Monitor stage, leveraging the entire DevSecOps Platform to provide advanced observability. We will continue to make many of our features open source or source-code available to encourage contributions, which in turn, accelerates our ability to innovate and provide a better platform to our customers. • Drive growth through enhanced sales and marketing. We believe that nearly all teams will modernize from DIY DevOps into DevSecOps Platforms and that the opportunity to continue growing our customer base is substantial. To drive new customer growth, we intend to continue investing in sales and marketing, with a focus on replacing DIY DevOps within larger teams. We also continue to focus on acquiring users with our free product and converting free users to paying customers, with a special emphasis on improving the self-service purchasing experience. • Drive increased expansion within our existing customer base. As customers realize the benefits of a single application, they typically increase their spend with us by adding more users or purchasing higher tiered plans. As a result, for fiscal 2023 and fiscal 2022, our Dollar-Based Net Retention Rate was above 130% and above 152%, respectively. We plan to continue investing in sales and marketing, with a focus on driving expansion of The DevSecOps Platform within existing customers, particularly for our larger customers. • Further grow adoption of our SaaS offering. As teams move more workloads to the cloud a nd consume technology as a service, we believe our SaaS offering will continue to grow at a faster rate than our self-managed offering. We intend to continue making investments in research and development to enhance new SaaS features, as well as in sales and marketing, to drive further adoption of our SaaS offering. • Grow and invest in our partner network. We have been investing in our global partner ecosystem, composed of hyperscalers and cloud providers, including Google Cloud and AWS, technology and independent software vendor partners, global resellers, and system integrators. We plan to continue investing in building out our partner program to expand our distribution footprint, to broaden the awareness of The DevSecOps Platform, and to more efficiently add new customers. We will also continue to invest in building out our partnerships to deliver transformation services to help our enterprise customers accelerate the deployment of The DevSecOps Platform. • Expand our global footprint. We believe there is significant opportunity to continue to expand internationally. We grew our international revenue to $71.4 million for fiscal 2023 from $41.1 million for fiscal 2022, representing an increase of 73%. We intend to grow our international revenue by increasing our investments strategically in our internatio nal sales and marketing operations, including headcount in the EMEA and APAC regions. Human Capital Our Unique Culture and Values Our success is driven by our culture. We believe that our values and culture are a competitive advantage within our industry, and we will continue to invest time and resources in building our culture to 11 Table of Contents drive superior business results. We are highly dependent on our management, highly-skilled engineers, sales team members and other professionals. It is crucial that we continue to identify, attract and retain valuable team members. To facilitate hiring and retention, we strive to make GitLab a diverse, inclusive workplace where every team member feels they belong and has the opportunity to grow and develop their career. We were recognized by Fortune as one of 2022’s Best Workplaces in Technology and by Fast Company as one of 2022’s Best Workplaces for Innovators. We also have a 96% CEO approval rating and a 4.5 overall workplace approval rating on Glassdoor.com, as of January 31, 2023. As a result, we trust that our values have led and will continue to lead to results that distinguish us from other companies. They include: • Our mission is to ensure that everyone can contribute. This mission guides our path, and we live our values along that path. Our values are a living document, and we encourage our team members to make suggestions to improve our company values constantly. We have established six core C.R.E.D.I.T. values: ◦ C ollaboration - Helping others is a priority; we rely on each other for help and advice; ◦ R esults - We follow through on our promises to each other, customers, users, and investors; ◦ E fficiency - We are about working on the right things to achieve more progress faster; ◦ D iversity, Inclusion & Belonging - We aim to foster an environment where everyone can thrive; ◦ I teration - We do the smallest thing possible and get it out as quickly as possible; and ◦ T ransparency - We strive to be open about as many things as possible to reduce the threshold to contribution and to make collaboration easier. • Measure results, not hours. Our all-remote culture helps us to practice our values. As an all-remote company, we are able to recruit from a wider, more diverse, and more uniquely skilled pool of talent across the world. The freedom and flexibility that comes with an all-remote workforce enables team members to view work in an entirely new light, one which focuses on results and productivity over the number of hours spent working. For example, product engineers have measurable objectives to hit rather than prescribed hours to work and team members have on-call shifts based on when they are most productive and best able to contribute to our success. • We seek to be transparent in everything we do. We publicly share non-sensitive information, including our strategy and objectives, in written form to encourage innovation and trust amongst our team members, customers, and the wider open source community. Our process of being public by default reduces the threshold to contribution and makes collaboration easier. Transparency creates awareness for GitLab, allows us to recruit people who care about our values, gets us more and faster feedback from people outside GitLab, and makes it easier to collaborate. We believe that our transparency creates more value than it captures, and our ability to execute on our strategy far exceeds the abilities of our competitors. • We do the smallest thing possible and get it out as quickly as we can. We aim to take an iterative approach in everything we do, including our day to day work and building The DevSecOps Platform. Our process is centered on dividing work into small increments, not completing everything at once, and pursuing each stage with speed and efficiency. Approaching work this way, we are able to rapidly get input from end-users who are actively using our platform, continuously revisit what we are doing with a fresher perspective, and gradually gain a greater 12 Table of Contents sense of visibility into what the end picture should look like. By adopting this approach, we are able to work with a greater sense of speed and efficiency, getting more done in less time. Team Members Our mission is to make it so everyone can contribute. When everyone can contribute, consumers become contributors, and we greatly increase the rate of human progress through changing creative work from unilateral read-only to collective collaboration and innovation. This mission is integral to our culture, and how we hire, build products, and lead our industry. The DevSecOps Platform brings together developers, operations, and security professionals and elevates their innovation to new levels, making it faster, safer, and more accessible. We are an all-remote company, and we pride ourselves in how we work through enabling our team members the individualized flexibility to reach their business results. We believe this leads to a team that is continually engaged and passionate about the positive impact of GitLab. As of January 31, 2023, we had approximately 2,170 team members in over 65 countries. In February 2023, in connection with our ongoing efforts to drive towards profitable growth, we announced a plan to reduce our global headcount by approximately 130 team members, which represents approximately 7% of our total headcount. We engage our team members in various ways, including through direct employment, Professional Employer Organizations (“PEOs”), and as independent contractors. In the locations where we use PEOs, we contract with the PEO for it to serve as “Employer of Record” for team members engaged through such PEO. Team members are employed by the PEO but provide services to GitLab. We also engage team members through a PEO self-employed model in certain jurisdictions where we contract with the PEO, which in turn contracts with individual team members as independent contractors. None of our team members are represented by a labor union. In certain countries in which we operate, we are subject to, and comply with, local labor law requirements which may automatically make our team members subject to industry-wide collective bargaining agreements or works councils. We have not experienced any work stoppages. We work to identify, attract, and retain team members who are aligned with and will help us progress with our mission, and we seek to provide competitive cash and equity compensation. We believe we have a strong and open relationship with our team members and our unique mission, culture and values differentiate us and continue to be key drivers of our business success. Diversity, Inclusion and Belonging Mission Diversity, Inclusion & Belonging is fundamental to our success. We include it in every way possible and in all that we do. We strive for a transparent environment where all globally dispersed voices are heard and welcomed. We strive for an environment where people can show up as their full selves each day and can contribute to their best ability. And with over an estimated 30 million users utilizing GitLab across the globe (both free and paid tiers), we strive for a team that is representative of our users. Compensation, Benefits and Perks We provide team members with competitive compensation packages that include base salaries and equity awards, including restricted stock units. We are an open organization, and we want to be as transparent as possible about our compensation principles. Our compensation model is open to data driven iterations. Additional benefits programs (which vary by country and region) include a 401(k) Plan with a company match, healthcare, vision, and dental insurance benefits, health savings and flexible spending accounts, flexible paid time off, parental leave, and other benefits tailored to the specific needs of our team members such as family forming, caregiving, and mental health resources. Throughout the course of the year, we also encourage team members to take part in various sponsorship and volunteer initiatives that support and ultimately uplift their local communities. As with our unique ways of working, GitLab and its team members have identified and sought out opportunities for impact that speak back not only to our values but our all-remote nature. 13 Table of Contents Our Open Source Philosophy We recognize that it is imperative to balance our need to generate revenue with the needs of the open source software project. To determine what is available in our free tier and what is available only in our paid tiers, we first assess who cares the most about the feature. Individual contributors rarely purchase The DevSecOps Platform, and thus, if the feature is something primarily individuals care about it will be open source. If the features are something primarily managers, directors, or executives care about, then it will be source-available. When considering buyers as part of product tiering decisions, we use the following guidance: • Premium is for team(s) usage, with the purchasing decision led by one or more managers or directors • Ultimate is for strategic organizational usage, with the purchasing decision led by one or more executives We want to be good stewards of our open source solution, so we aim to provide much of The DevSecOps Platform to the market for free. Having all stages of the platform available to users for free encourages cross-stage adoption and more collaboration and helps users see the benefit of a single application approach. Including all major features in our free tier helps us keep our codebase for the free and paid tiers similar, which helps us carry forward our promise of being good stewards of our open source solution without diverging codebases. We seek to clearly and consistently articulate our monetization strategy on teams and organizations to provide predictability to both our customers as well as the community of contributors. Our open source approach is intended to increase our development velocity as the developer pool who contributes to our codebase is greater than the size of any single engineering team. As of January 31, 2023, more than 3,500 individuals have contributed to The DevSecOps Platform and since April 30, 2019, merge code contributions have averaged more than 250 per month. Because people outside of our organization can read our code, users can contribute to identifying and solving issues, which accelerates the time we can release new software to market. This has also been a big contribution to enabling us to release a new version of our software for 136 months in a row and counting as of January 31, 2023. We believe our open source approach helps us acquire, retain, and grow our paying customer base. Our customers benefit from the advanced innovation that comes from distributed development, the documentation, best practices, and knowledge sharing across our community, as well as the engagement of making their own contributions back to our codebase. The DevSecOps Platform and Plans We offer The DevSecOps Platform in three different subscription tiers: Free, Premium and Ultimate. While our Free tier platform includes significant functionality for individual users, our paid tiers include features that are more relevant for managers, directors, and executives. • Our Free tier caters to capabilities needed by individual contributors to do their daily jobs. • Our Premium tier builds on the capabilities of the Free Plan while also adding functionality intended specifically for managers and directors to help teams enhance collaboration between development and operations teams, manage projects and portfolios, and accelerate the deployment of code. • Our Ultimate tier provides further functionality for executives and has functions to help teams establish better collaboration between development, operations, and security teams, instill organizational wide security, compliance and planning practices, and implement full value stream measurement, analytics, and reporting, across the DevSecOps lifecycle. 14 Table of Contents Our subscription plans are available as a self-managed offering which customers download to run in their own on-premise environment or hybrid cloud environments, and also a SaaS offering which is managed by us and is hosted in either the public cloud or in a private cloud based on the customer’s preference. Research and Development Strategy We ship features and components of features at a high velocity in the smallest possible increments to optimize for code quality, efficiency and speed. As each feature is typically similar in size, we are able to measure and track our development team's efficacy by counting the number of merge requests, or a request to merge one branch of code into another. We believe that our development approach, using The DevSecOps Platform, is a key competitive advantage. We make product investment decisions based on each stage’s contribution to revenue, monthly active usage, and served addressable market size. Currently, the majority of our development costs are in Create (Source Code Management), Verify (Continuous Integration), Secure (Application Security Testing), and Manage (Analytics and Administrative capabilities). Our research and development team consists of our architects, software engineers, security experts, DevSecOps engineers, product management, user experience, quality assurance, and data collection teams. We intend to continue to invest in our research and development capabilities to extend The DevSecOps Platform and products. Our Technology Our single application strategy means that we have one codebase to author, test, secure, package, and distribute. This also means that we are able to give users the most choice. Our customers can use a SaaS subscription or run The DevSecOps Platform themselves in a self-managed way in their own cloud environments. For self-managed users, GitLab is the only truly public-cloud-agnostic solution. Customers can also run The DevSecOps Platform in their own data centers if they wish. They can further choose to run GitLab on traditional servers, or they can use containers and an orchestration system like Kubernetes. From an end user standpoint, our single application strategy provides one consistent user interface across all stages of the DevSecOps lifecycle. We see this result in a manifold reduction in lifecycle time for software development teams. For integrators, GitLab has a single application programming interface (“API”) to write integrations against, as opposed to a fragmented tool chain. For IT system administrators and internal security teams this also means they have one application environment and authentication system to inspect and certify according to their team’s standards. Our Customers We serve organizations of all sizes across industries and regions. As of January 31, 2023, we had customers in over 140 countries. We believe that our customer growth is best represented by the number of our Base Customers, which increased to 7,002 as of January 31, 2023 from 4,593 as of January 31, 2022. In 2019, we began to invest more heavily in our enterprise sales motion and have had strong success in attracting, retaining, and growing ARR from our larger customers. For the year ended January 31, 2023, more than 69% of our ARR came from public sector and enterprise customers. Our success has been exemplified by the growth in our $100,000 ARR customers to 697 as of January 31, 2023 from 492 as of January 31, 2022. Further, during the same period, we grew our $1.0 million ARR customers to 63 from 39, an increase of 62%. We have key reference customers across a breadth of industry verticals that we believe validate The DevSecOps Platform, and our customers range from small and medium-sized teams to Fortune 500 companies. No individual customer represented more than 10% of our revenue in fiscal 2023 or fiscal 2022. 15 Table of Contents Sales and Marketing Our go-to-market strategy spans a self-service buying experience, high velocity inside sales, and a dedicated outbound enterprise sales team. We segment our sales organization by size and region, with an additional vertical focus on the public sector. Our sales organization succeeds because of our transparent, cross-functional collaboration and a commitment to over-performance, efficiency, diversity, and constant improvement. Our customer success team, or CS, manages our technical relationships with customers both pre-sale and long-term partnerships post-sale. CS works to help customers achieve positive business results with GitLab by building awareness, adoption, usage, performance, and modern DevOps capabilities. We believe that this focus on business results and engaged partnership maximizes long-term, sustainable customer value and drives expansion with our existing customers. Through our commitment to open collaboration, we also have select technology and channel partners who increase efficient access to new customers and support growth of existing customers through trusted relationships, existing contracts, service delivery capability and capacity, and collaboration on large digital transformations. These partners include systems integrators, cloud platform partners, independent software vendors, managed service providers, resellers, distributors, and ecosystem partners. Our partnership program provides additional rewards for partners that make commitments to and investments in a deeper GitLab relationship. Our marketing department is focused on generating awareness of The DevSecOps Platform to our developer community, existing customers and users, and potential customers. We utilize diverse tactics such as digital demand generation, account based marketing, nurture programs, sales development, virtual and field events, sponsored webinars, gated content downloads, whitepapers, display advertising and integrated campaigns to connect with prospective customers. We also host and present at regional, national and global industry events. We offer our free tier and/or a free trial to prospective customers allowing them to try before they buy, allowing customers to see the strengths of The DevSecOps Platform and the business benefits. We are then able to engage with these users to encourage them to upgrade to a paid version. Once a customer is onboarded with GitLab, our teams work to identify additional business units and parent/child/subsidiary prospects that would benefit from The DevSecOps Platform. Finally, as engaged members of the open-source community, our contributors often serve as subject matter experts at market-leading developer events, and The DevSecOps Platform is presented on the cutting edge of innovation. Competition The markets we serve are highly competitive and rapidly evolving. With the introduction of new technologies and innovations, we expect the competitive environment to remain intense. We view our primary current competition as customers’ legacy approach of DIY DevOps, using a combination of point tools manually integrated together. Our offering is substantially different in that it is one platform, one codebase, one interface and a unified data model that spans the entire DevSecOps lifecycle. We expect that the competition from DIY DevOps will decrease over time as companies realize the shortcomings in this approach. To ensure easy transitions for customers and support for dependencies on internal and external tools, we support staged adoption while continuing the use of some legacy tools. Beyond this legacy approach of DIY DevOps, our principal competitor is Microsoft Corporation following their acquisition of GitHub. There are also a number of other private and public companies whose products address only a portion of the DevSecOps lifecycle and/or are cobbled together from several point solutions. These are essentially third-party DIY DevOps and are not a single application. 16 Table of Contents We believe we compete favorably based on the following competitive factors: • ability to provide a single application that is purpose-built to span the entire DevSecOps lifecycle; • ability to rapidly innovate and consistently ship and release more features and versions of our software; • maturity of features in the Create (Source Code Management) and Verify (Continuous Integration) stages; • ability to run natively across any public cloud, private cloud, hybrid cloud, or on-premises environment; • ability to enable collaboration between developers, IT operations, and security teams; • ability to reduce handoffs, friction, and switching costs across different stages of the DevSecOps lifecycle; • ability to reduce software development times to release better software faster; • ability to consolidate multiple tools into a single platform; • ability to eliminate manual integrations that are costly and time-effective to maintain; • ability to provide a seamless, consistent, and single user experience through one user interface; • ability to deliver a large, engaging community of open source contributors; • performance, scalability, and reliability; • ability to implement more differentiated security and governance; • quality of service and overall customer satisfaction; and • strong documentation and transparency of information. Corporate Philanthropy As part of our mission to make it so everyone can contribute, we believe that it is important to support teams that can further this goal at local and global levels. To further this mission, in September 2021, our board of directors approved the reservation of up to 1,635,545 shares of Class A common stock for the issuance to charitable organizations, to be further designated by our board of directors. To date, we have made no contributions. Government Regulation We are subject to many varying laws and regulations in the United States and throughout the world, including those related to data privacy, security and protection, intellectual property, worker classification, employment and labor, workplace safety, consumer protection, anti-bribery, import and export controls, immigration, federal securities, and tax. Moreover, new and existing laws and regulations (or changes in interpretation of existing laws and regulations) may also be adopted, implemented, or interpreted to apply to us or our contributors, and uncertainty around the application of these laws may affect demand for our platform. Additionally, as our platform’s geographic scope continues to expand, regulatory agencies or courts may claim that we are subject to additional requirements, or are prohibited from conducting our business in or with certain jurisdictions, either generally or with respect to certain services, or that we are otherwise required to change our business practices. We believe that we are in material compliance with such laws and regulations and do not expect continued compliance to have a material impact on our capital 17 Table of Contents expenditures, earnings, or competitive position. We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not expect compliance to have a material adverse effect on our business. See Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K for a more comprehensive description of risks related to government regulation affecting our business. Intellectual Property The protection of our technology and intellectual property is an important aspect of our business. We rely upon a combination of trademarks, trade secrets, know-how, copyrights, patents, confidentiality procedures, contractual commitments, domain names, and other legal rights to establish and protect our intellectual property. We generally enter into confidentiality agreements and invention or work product assignment agreements with our officers, team members, agents, contractors, and business partners to control access to, and clarify ownership of, our proprietary information. As of January 31, 2023, we had five issued patents and four pending patent applications in the United States and abroad. These patents and patent applications seek to protect proprietary inventions relevant to our business. The issued patents are scheduled to expire on or around the years between 2034 and 2036 and cover a means of undertaking metaphor-based language code fuzzing relating to testing of code. As of January 31, 2023, we had ten trademark registrations and applications in the United States, including for “GITLAB” and our logo. We also had 21 trademark registrations and applications in certain other jurisdictions and regions. Additionally, we are the registered holder of a number of domain names, including gitlab.com. We are dedicated to open source software. Our product incorporates many components subject to open source software licenses, and in turn we license many significant components of our software under open source software licenses. Such licenses grant licensees broad permissions to use, copy, modify, and redistribute the covered software which can limit the value of our software copyright assets. Legal Proceedings We are, and from time to time, we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of our management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results. Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors. Corporate Information We were incorporated in the State of Delaware as GitLab Inc. in September 2014. We are a remote-only company, meaning that all of our team members work remotely. Due to this, we do not currently have a headquarters. Our website address is https://about.gitlab.com. The information contained on, or that can be accessed through, our website is not a part of this Annual Report on Form 10-K. Investors should not rely on any such information in deciding whether to conduct any transactions involving our Class A common stock. Unless otherwise indicated, the terms “GitLab,” the “Company,” “we,” “us,” and “our” refer to GitLab Inc. and our subsidiaries, and our variable interest entity as “JiHu”. References to our “common stock” include our Class A common stock and Class B common stock. Available Information 18 Table of Contents We file electronically with the Securities and Exchange Commission, or the SEC, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended. The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements and other information that we file with the SEC electronically. We make available on our website at https://about.gitlab.com, free of charge, copies of these reports and other information as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. We use our investor relations page on our website (https://ir.gitlab.com/), press releases, public conference calls, public webcasts, our Twitter account (@gitlab), our Facebook page, our LinkedIn page, our company news site (https://about.gitlab.com/press/) and our corporate blog (https://about.gitlab.com/blog/) as means of disclosing material nonpublic information and for complying with our disclosure obligations under Regulation FD. The information disclosed by the foregoing channels could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above and to review the information disclosed through such channels. Any updates to the list of disclosure channels through which we announce information will be posted on the investor relations page on our website. The contents of the websites referred to above are not incorporated into this Annual Report on Form 10-K. Further, our references to the URLs for these websites are intended to be inactive textual references only. 19 Table of Contents