Item 1. Business
ITEM 1. BUSINESS
Overview
In today’s world, software defines the speed of innovation. Every industry, business, and every function within a company is dependent on software. Nearly all companies must digitally transform and become experts at building, delivering, and securing software to remain competitive and survive.
To meet these market needs, GitLab pioneered The DevSecOps Platform, a fundamentally new approach to software development and delivery. Our platform is uniquely built as a single application with native artificial intelligence, or AI, assisted workflows, and a single interface with a unified data model, enabling all stakeholders in the software delivery lifecycle – from development teams to operations teams to security teams – to work together in a single tool with a single workflow. With GitLab, they can build better, more secure software, faster.
GitLab is the solution to significant business transformation needs. Across every industry – and across companies of every size – technology leaders want to make developers more productive so they can deliver better products faster; they want to measure productivity so they can increase operational efficiency; they want to secure the software supply chain so they can reduce security and compliance risk; and, they want to accelerate secure cloud migration, so they can unlock digital transformation results. These technology leaders need a platform that enables a value stream-driven mindset that shortens the time from idea to customer value and establishes a powerful flywheel for data collection and aggregation. And they are looking for a platform approach that unifies the entire development experience, so that customers can be faster than their competition in moving from idea to customer value.
We believe GitLab is the shortest path to unlocking business and technology transformation results. Our DevSecOps platform accelerates our customers’ ability to create business value and innovate by reducing their software development cycle times from weeks to minutes – achieving up to 7x faster cycle time. It removes the need for point tools and delivers enhanced operational efficiency by eliminating manual work, increasing productivity, and creating a culture of innovation and velocity. GitLab also embeds security earlier into the development process, improving our customers’ software security, quality, and overall compliance.
GitLab is available to any team, regardless of the size, scope, and complexity of their deployment. As a result, we have more than 30 million registered users, and more than 50% of the Fortune 100 companies are GitLab customers. For purposes of determining the number of our active customers, we look at our customers with more than $5,000 of Annual Recurring Revenue, or ARR, in a given period, who we refer to as our Base Customers. For purposes of determining our Base Customers, a single organization with separate subsidiaries, segments, or divisions that use The DevSecOps Platform is considered a single customer for determining each organization’s ARR.
GitLab is the only DevSecOps platform built on an open-core business model. We enable any customer and contributor to add functionality to our platform. In calendar year 2023, nearly 700 people contributed more than 2,100 merge requests back to the core product, extending GitLab’s in-house R&D efforts and empowering our most passionate users to make improvements to the DevOps tool they use every day. Our open-core approach has enabled us to build trust with our customers and maintain our high velocity of innovation so that we can rapidly create the most comprehensive DevSecOps platform.
GitLab largely exists today thanks to the vast and growing community of open source contributors worldwide. We actively work to grow open source community engagement by operating with transparency. We make our strategy, direction, and product roadmap available to the wider community, where we encourage and solicit their feedback. By making non-sensitive information public, we create a deeper level of trust with our customers and make it easier to solicit contributions and collaboration from our users and customers.
5
Table of Contents
We make our plans available through our self-managed and software-as-a-service (SaaS) offering. For our self-managed offering, the customer installs GitLab in their own on-premise or hybrid cloud environment. For our SaaS offering, the platform is managed by GitLab and hosted either in our public cloud or in our private cloud based on the customer’s preference.
GitLab and the Evolution of DevSecOps
DevOps is the set of practices that combines software development (dev) and IT operations (ops). It allows teams to collaborate and work together to shorten the development lifecycle and evolve from delivering software on a slow, periodic basis to rapid, continuous updates. When DevOps started, each team bought their own tools in isolation, leading to a “Bring Your Own DevOps” environment. The next evolution was standardizing company-wide on the same tool for each stage across the DevOps lifecycle. However, these tools were not connected, leading to a “Best in Class DevOps” environment. Teams tried to remedy this fragmentation and inefficiency by manually integrating these DevOps point solutions together, defining the next phase: “Do-It-Yourself (or DIY) DevOps.”
At the same time, the faster delivery of software required more DevOps tools per project. Increased adoption of a microservice architecture led to more projects. The combination caused an exponential increase in the number of tool-project integrations. This has often led to poor user experiences, higher costs, and increased time to deliver new software. As a result, business outcomes often failed, and the potential for DevOps was never fully realized. In short, an entirely new platform for DevOps was needed.
The DevSecOps Platform – pioneered by GitLab – replaces the DIY DevOps approach. It enables teams to realize the full potential of DevOps and become software-led businesses. It spans all stages of the DevOps lifecycle, from project planning (Plan), to source code management (Create), to continuous integration (Verify), to application security testing (Secure), to packaging artifacts (Package), to continuous delivery and deployment (Release) to configuring infrastructure for optimal deployment (Configure), to monitoring it for incidents (Monitor), to protecting the production deployment (Protect), and managing the whole cycle with value stream analytics (Manage). It also allows customers to manage and secure their applications across any cloud through a single platform.
GitLab’s DevSecOps platform has broad use across teams. It helps product and business teams work with developers to introduce new features and drive successful business outcomes. It helps Chief Technology Officers, or CTOs, modernize their software development and delivery environment and drive developer productivity. It helps Chief Information Officers, or CIOs, adopt microservices and cloud native development to improve their software architecture’s efficiency, scale, and performance. It helps Chief Information Security Officers, or CISOs, reduce security vulnerabilities without compromising speed to market. It helps teams attract and retain top talent by creating a superior developer experience that allows people to focus more time on their jobs and less time managing tools.
The majority of our customers begin their GitLab journey by using our Source Code Management, Continuous Integration and Continuous Delivery (CI/CD) solutions, referred to as Create and Verify. Developers use these solutions to collaborate on the same code base without conflicting or accidentally overwriting each other's changes. Create also maintains a running history of software contributions from each developer to allow for version control. Teams use Verify to ensure changes to code go through defined quality standards with automatic testing and reporting. We believe serving as this system of record for code and our high engagement with developers is a competitive advantage in realizing our single application vision as it creates interdependence and adoption across more stages of the DevSecOps lifecycle, such as Package, Secure, and Release. As more stages are addressed within a single application, the benefits of The DevSecOps Platform are enhanced.
GitLab’s innovation strategy is a key differentiated competitive advantage. We have a dual flywheel innovation strategy that leverages both development efforts from our research and development team members as well as community contributions via our open-core business model. By leveraging the power
6
Table of Contents
of each, we create a virtuous cycle where more contributions lead to more features, leading more users and more contributions.
We emphasize iteration to drive rapid innovation in our development strategy. This iterative approach has enabled us to release a new version of our software every month for 148 months in a row as of January 31, 2024. This is also due in part to our over 4,000 contributors in our global open source community as of January 31, 2024. GitLab team members also use The DevSecOps Platform to power our own DevSecOps lifecycle. By doing so, we benefit from the inherent advantages of using a single application. We leverage these learnings to establish a rapid feedback loop to continually and rapidly improve our platform.
GitLab’s DevSecOps platform is used globally by teams of all sizes across a broad range of industries. To reach, engage, and help drive success broadly, we have strong partnerships with cloud hyperscalers, including Google Cloud and Amazon Web Services, or AWS, who offer GitLab on their marketplaces. We also benefit from strategic alliance partnerships, which resell GitLab to large enterprise customers, and our strong channel partnerships ranging from large global systems integrators to regional digital transformation specialists and volume resellers.
We have a multi-faceted land-and-expand bottom-up and top-down sales strategy. Our customer journey can begin with developers and then expand to more teams and up to senior executive buyers. Equally so, the customer journey can start with executive-level buying decision-makers looking for a solution to their business and technology challenges, such as developer productivity, efficiency, security and compliance, and cloud migration. As of January 31, 2024 and 2023, our Dollar-Based Net Retention Rate was 130% and above 130%, respectively. Our Base Customers grew to 8,602 as of January 31, 2024 from 7,002 as of January 31, 2023. Our cohort of customers generating $1.0 million or more in ARR grew to 96 as of January 31, 2024 from 63 as of January 31, 2023.
Our business has experienced rapid growth. We generated revenue of $579.9 million and $424.3 million in fiscal 2024 and 2023, respectively, representing growth of 37%. During this period, we continued to invest in growing our business to capitalize on our market opportunity. The net loss attributable to GitLab was $424.2 million and $172.3 million in fiscal 2024 and fiscal 2023, respectively. Our operating cash flow margin, which we define as operating cash flows as a percentage of revenue, was 6.0% and (18.2)% for fiscal 2024 and fiscal 2023, respectively. Our gross profit margin was 90% and 88% for fiscal 2024 and fiscal 2023, respectively.
The DevSecOps Platform
GitLab has pioneered The DevSecOps Platform, a single application that brings together development, operations, IT, security, and business teams to deliver better, more secure software faster. It represents a step change in how teams plan, develop, secure and deploy software.
GitLab is built on a single codebase, unified data model, and user interface. Organizations can deploy GitLab as a self-managed offering in their own hybrid cloud, or on-premises environments and as a SaaS offering hosted in either the public cloud or in a private cloud based on the customer’s preference.
GitLab is designed to enable our customers to move their software development and delivery workflows across any hybrid or multi-cloud environment while maintaining full feature parity and a single application experience.
GitLab’s DevSecOps platform is purpose-built and includes AI to address every stage of the software development lifecycle:
• Manage. GitLab enables all stakeholders – from executives to practitioners – to get visibility and insights into their value stream delivery in order to measure the flow of work, from idea to customer value. With capabilities such as Value Streams Dashboard and Value Stream Analytics, GitLab is uniquely positioned to be the tool of choice for data-driven organizations – enabling
7
Table of Contents
teams to understand software delivery performance and value to the business without complex configurations or data scientists. GitLab helps teams organize multiple projects into a single collaborative portfolio and track important events across the DevSecOps lifecycle. It also allows organizations to measure using key performance indicators - like adoption and performance metrics - as well as audit activity and permissions to ensure compliance while simplifying and optimizing the flow of work through the full DevSecOps value stream.
• Plan. To create software, teams require collaborative planning from disparate groups, each with shared and unique objectives. GitLab enables this collaboration with portfolio planning and management through epics, groups (programs), and milestones that organize and track progress. GitLab helps teams organize, plan, align, and track project work to ensure teams are working on the right things at the right time and maintain end-to-end visibility and traceability of issues throughout the delivery lifecycle from idea to production.
• Create. GitLab helps teams design, develop, and securely manage code and project data from a single distributed version control system to enable rapid iteration and delivery of business value. GitLab repositories provide a scalable single source of truth for collaborating on projects and code, enabling teams to be productive without disrupting their workflows.
• Verify. GitLab helps software engineering teams fully embrace Continuous Integration, or CI, to automate the builds, integration, and verification of their code. GitLab’s secure CI capabilities enable automated accessibility, usability, performance testing, and code quality analysis to provide fast feedback to developers and testers about the quality of their code. With pipelines that enable concurrent testing and parallel execution, teams quickly get insight about every commit, allowing them to deliver higher quality code faster.
• Package. GitLab enables teams to package their applications and dependencies, manage containers, and build artifacts with ease. The private, secure, container, and package registries are built-in and preconfigured out-of-the-box to work seamlessly with GitLab source code management, or SCM, security scanners, and Continuous Integration/Continuous Delivery, or CI/CD, pipelines.
• Secure. GitLab’s offering is differentiated with built in, not bolted on, security capabilities. GitLab provides Static Application Security Testing, or SAST, Dynamic Application Security Testing, or DAST, Fuzz Testing, Container Scanning, and Dependency Scanning to help customers deliver secure applications along with license compliance.
• Release. GitLab helps automate the release and delivery of applications, shortening the delivery lifecycle, streamlining manual processes, and accelerating team velocity. With zero-touch CD built right into the pipeline, deployments can be automated to multiple environments like staging and production, and the system executes without additional manual intervention - even for more advanced patterns like canary deployments. With feature flags, built-in auditing/traceability, on-demand environments, and GitLab Pages for static content delivery, users can deliver faster and more confidently than ever before.
• Configure. GitLab helps software development and delivery teams to configure and manage their application environments. Strong integration to Kubernetes reduces the effort needed to define and configure the infrastructure required to support an application. GitLab protects access to key infrastructure configuration details such as passwords and login information by using ‘secret variables’ to limit access to only authorized users and processes.
• Monitor. GitLab provides feedback in the form of errors, traces, metrics, logs, and alerts to help reduce the severity and frequency of incidents so that users can release software frequently with confidence.
8
Table of Contents
• Govern. GitLab extends an existing operation's practices to help teams manage their security vulnerabilities, project dependencies, and compliance policies to reduce overall risk. This enables teams to identify risks by providing them with a high degree of visibility into their projects' dependencies, security findings, and user activities. This visibility is then coupled with management tools to respond to those risks. Lastly, policies can be used to automate compliance and to help secure the software supply chain.
Key Benefits Delivered to our Customers
• Accelerate software delivery. We believe GitLab is the most comprehensive AI-powered DevSecOps platform. With GitLab, customers benefit from delivering better, more secure software faster. GitLab customers see up to 7x faster cycle time, enabling them to meet the growing business demand to deliver new capabilities and increase responsiveness to change. With GitLab, our customers can often increase the number of their software releases from the tens to thousands and reduce the time it takes to release new software from months to days, helping them generate more revenue.
• Reduce vulnerabilities and increase security. GitLab lets organizations adopt a ‘shift left’ security strategy, embedding security protections and guardrails earlier in the development process, without sacrificing developer speed. It also eliminates the need for multiple data repositories and multiple security tools and reduces the number of hand-offs between development, operations, and security teams. GitLab provides a single consolidated view of vulnerabilities across software, increasing the efficiency of vulnerability management and remediation. This enables our customers to find and correct security vulnerabilities in their software earlier or eliminate inefficiencies in the software development process altogether.
• Enable audit and compliance. GitLab eliminates fragmented tools and point integrations that create blind spots and poor visibility across work streams. This allows compliance and audit teams to more easily log, track, and trace different steps across the software delivery lifecycle, better understand governance, and improve their compliance posture.
• Adopt AI throughout the software development lifecycle. GitLab is differentiated by offering AI-assisted workflows throughout the software development lifecycle. Our suite of AI capabilities, known as GitLab Duo, improves every step of software development and delivery – from planning and code generation to vulnerability detection and value stream measurement. GitLab Duo is privacy and transparency first and is model agnostic, we choose the right model for the right job, and can quickly evolve, replace, and change models as needed. We do not use customer content to train models.
• Improve developer experience and productivity. GitLab enables our customers to spend more time building, deploying, and securing software and less time managing, integrating, and triaging across different tools. In a single application, each team member can follow the entire lifecycle from beginning to end with contextual history and understanding of each process. This helps to deliver outsized productivity gains, helping our customers increase their revenue and generate greater profits.
• Reduce costs through toolchain consolidation. GitLab’s unique DevSecOps platform approach provides the capabilities of multiple point products, enabling teams to consolidate the number of tools they use. Further, The DevSecOps Platform also delivers cost savings to our customers by eliminating the hidden costs and time it takes to integrate these point products manually and drives greater efficiency gains and productivity. Based on a 2022 study conducted by Forrester Consulting, commissioned by us and covering a limited number of our customers, the cost savings and business benefits achievable by deploying GitLab to revenue-generating applications can enable customers to deliver a 427% r eturn on investment within three years of deployment, and a potential payback period of under 6 months.
9
Table of Contents
• Embrace the benefits of a portable workload and multi-cloud strategy. The DevSecOps Platform enables application portability by allowing customers to seamlessly secure and manage their applications across clouds. This allows our customers to provide full value stream analytics on their DevSecOps workflow and simplify their application security and compliance across clouds. It also allows them to optimize their cloud costs and embrace the best services across each cloud without becoming overly reliant on a single public cloud provider.
Competitive Strengths
Our business benefits from the following competitive strengths:
• Best-In-Class DevSecOps – GitLab is an all-in-one DevSecOps solution with security built in (not bolted on) to the platform.
• Security and Compliance – GitLab’s platform is differentiated by offering enforced workflows, enabling security and compliance teams to establish enterprise-wide policies so that they can shift security earlier in the development process without sacrificing developer velocity and experience.
• AI Throughout the Software Development Experience – GitLab offers AI throughout the software development and deployment experience, accelerating and improving every step of the software delivery lifecycle. In addition, GitLab offers a privacy-first and model-agnostic approach, enabling organizations to adopt AI in their software practices safely and responsibly.
• Flexibility - GitLab offers flexible deployment options serving every type of organization. This includes SaaS for customers who want to consume DevSecOps as a service, self-management for customers who want deployment control, and GitLab Dedicated – our single tenant SaaS service – for customers in highly regulated industries and with complex compliance and security requirements.
• Cloud Agnostic – GitLab can be deployed anywhere, enabling a multi-cloud strategy. And, we have no preferential treatment for any specific cloud, which enables our customers to avoid vendor lock-in.
• User Experience – GitLab has a superior user experience with an integrated platform enabling developers to prevent context switching.
• Open Core Platform – GitLab is open core built with our customers creating a fast pace of innovation.
Our Growth Strategy
We intend to invest in our business to advance the adoption of The DevSecOps Platform. Our growth strategies include:
• Advance our feature maturity across more stages of the DevSecOps lifecycle. We intend to continue making strategic investments in research and development and hiring top technical talent to mature our features in more stages of the DevSecOps lifecycle. For example, in fiscal 2023, we have invested a significant portion of our human capital in development into the Secure, Govern, and Plan stages. Our acquisition of Opstrace, Inc. in fiscal 2022 demonstrates our aim to deliver functionality in our Monitor stage, leveraging the entire DevSecOps Platform to provide advanced observability. We will continue to make many of our features open source or source code available to encourage contributions, which, in turn, accelerates our ability to innovate and provide a better platform to our customers.
10
Table of Contents
• Drive growth through enhanced sales and marketing. We believe that nearly all teams will modernize from DIY DevOps into DevSecOps Platforms and that the opportunity to continue growing our customer base is substantial. To drive new customer growth, we intend to continue investing in sales and marketing, with a focus on replacing DIY DevOps within larger teams. We also continue to focus on acquiring users with our free product and converting free users to paying customers, with a special emphasis on improving the self-service purchasing experience.
• Drive increased expansion within our existing customer base. As customers realize the benefits of a single application, they typically increase their spend with us by adding more users or purchasing higher-tiered plans. As a result, for fiscal 2024 and fiscal 2023, our Dollar-Based Net Retention Rate was 130% and above 130% , respectively. We plan to continue investing in sales and marketing, with a focus on driving the expansion of The DevSecOps Platform within existing customers, particularly for our larger customers.
• Further grow adoption of our SaaS offering. As teams move more workloads to the cloud a nd consume technology as a service, we believe our SaaS offering will continue to grow at a faster rate than our self-managed offering. We intend to continue making investments in research and development to enhance new SaaS features, as well as in sales and marketing, to drive further adoption of our SaaS offering.
• Grow and invest in our partner network. We have been investing in our global partner ecosystem, composed of hyperscalers and cloud providers, including Google Cloud and AWS, technology and independent software vendor partners, global resellers, and system integrators. We plan to continue investing in building out our partner program to expand our distribution footprint, broaden the awareness of The DevSecOps Platform, and more efficiently add new customers. We will also continue to invest in building out our partnerships to deliver transformation services to help our enterprise customers accelerate the deployment of The DevSecOps Platform.
• Expand our global footprint. We believe there is a significant opportunity to continue to expand internationally. We grew our international revenue to $106.9 million for fiscal 2024 from $71.4 million for fiscal 2023, representing an increase of 50%. We intend to grow our international revenue by strategically increasing our investments in internatio nal sales and marketing operations, including headcount in the EMEA and APAC regions.
Human Capital
Our Unique Culture and Values
Our success is driven by our culture. We believe that our values and culture are a competitive advantage within our industry, and we will continue to invest time and resources in building our culture to drive superior business results. We are highly dependent on our management, highly skilled engineers, sales team members and other professionals. It is crucial that we continue to identify, attract and retain valuable team members. To facilitate hiring and retention, we strive to make GitLab a diverse and inclusive workplace where every team member feels they belong and has the opportunity to grow and develop their career.
In calendar year 2023, we remained Great Place to Work certified with 89% of US team members agreeing that GitLab is a great place to work and 94% of US team members saying they are proud to work here. We have a 85% CEO approval rating and a 4.5 overall workplace approval rating on Glassdoor.com, as of January 31, 2024. As a result, we trust that our values have led and will continue to lead to results that distinguish us from other companies. Our values include:
• Our mission is to ensure that everyone can contribute. This mission guides our path, and we live our values along that path. Our values are a living document, and we encourage our team
11
Table of Contents
members to make suggestions to improve our company values constantly. We have established six core C.R.E.D.I.T. values:
◦ C ollaboration - Helping others is a priority; we rely on each other for help and advice;
◦ R esults for Customers - We follow through on our promises to each other, customers, users, and investors;
◦ E fficiency - We are about working on the right things to achieve more progress faster;
◦ D iversity, Inclusion & Belonging - We aim to foster an environment where everyone can thrive;
◦ I teration - We do the smallest thing possible and get it out as quickly as possible; and
◦ T ransparency - We strive to be open about as many things as possible to reduce the threshold to contribution and to make collaboration easier.
• Measure results, not hours. Our all-remote culture helps us to practice our values. As an all-remote company, we can recruit from a wider, more diverse, and uniquely skilled pool of talent across the world.
• We seek to be transparent in everything we do. We publicly share non-sensitive information, including our long-term strategy and product roadmap, in written form to encourage innovation and trust amongst our team members, customers, and the wider open source community. Transparency creates awareness for GitLab, allows us to recruit people who care about our values, gets us more and faster feedback from people outside GitLab, and makes it easier to collaborate. We believe that our transparency creates more value than it captures, and our ability to execute our strategy far exceeds the abilities of our competitors.
• We do the smallest thing possible and get it out as quickly as we can. We aim to take an iterative approach in everything we do, including our day-to-day work and building The DevSecOps Platform. Our process is centered on dividing work into small increments, not completing everything at once, and pursuing each stage with speed and efficiency. Approaching work this way, we are able to rapidly get input from end-users who are actively using our platform, continuously revisit what we are doing with a fresher perspective, and gradually gain a greater sense of visibility into what the end picture should look like. By adopting this approach, we are able to work with a greater sense of speed and efficiency, getting more done in less time.
Team Members
Our mission is to make it so everyone can contribute. When everyone can contribute, consumers become contributors, and we greatly increase the rate of human progress through changing creative work from unilateral read-only to collective collaboration and innovation. This mission is integral to our culture, and how we hire, build products, and lead our industry. The DevSecOps Platform brings together developers, operations, and security professionals and elevates their innovation to new levels, making it faster, safer, and more accessible. We are an all-remote company, and we pride ourselves in how we work through enabling our team members with the individualized flexibility to reach their business results. We believe this leads to a team that is continually engaged and passionate about the positive impact of GitLab.
As of January 31, 2024, we had approxi mately 2,130 team members in 65 countries. We engage our team members in various ways, including through direct employment, Professional Employer Organizations (“PEOs”), and as independent contractors. In the locations where we use PEOs, we contract with the PEO for it to serve as “Employer of Record” for team members engaged through such PEO. Team members are employed by the PEO but provide services to GitLab. We also engage team members through a PEO self-employed model in certain jurisdictions where we contract with the PEO,
12
Table of Contents
which in turn contracts with individual team members as independent contractors. None of our team members are represented by a labor union. In certain countries in which we operate, we are subject to, and comply with, local labor law requirements which may automatically make our team members subject to industry-wide collective bargaining agreements or works councils. We have not experienced any work stoppages. We work to identify, attract, and retain team members who are aligned with and will help us progress with our mission, and we seek to provide competitive cash and equity compensation. We believe we have a strong and open relationship with our team members and our unique mission, culture and values differentiate us and continue to be key drivers of our business success.
Diversity, Inclusion and Belonging
Diversity, Inclusion & Belonging is fundamental to our success. We include it in every way possible and in all that we do. We strive for a transparent environment where all globally dispersed voices are heard and welcomed. We strive for an environment where people can show up as their full selves each day and contribute to their best ability. With an estimated 30 million registered users utilizing GitLab across the globe, we strive for a team that is representative of our users.
Compensation, Benefits, and Perks
We provide team members with competitive compensation packages that include base salaries and equity awards, including restricted stock units. We are an open organization and want to be as transparent as possible about our compensation principles. Our compensation model is open to data-driven iterations. Additional benefits programs (which vary by country and region) include a 401(k) Plan with a company match, healthcare, vision, and dental insurance benefits, health savings, and flexible spending accounts, flexible paid time off, parental leave, and other benefits tailored to the specific needs of our team members such as family forming, caregiving, and mental health resources. Throughout the year, we also encourage team members to participate in various volunteer initiatives that support and ultimately uplift their local communities. As with our unique ways of working, GitLab and its team members have identified and sought out opportunities for impact that speak back not only to our values but our all-remote nature.
Our Open Source Philosophy
We recognize that it is imperative to balance our need to generate revenue with the needs of the open source software project. To determine what is available in our free tier and what is available only in our paid tiers, we first assess who cares the most about the feature. Individual contributors rarely purchase The DevSecOps Platform, and thus, if the feature is something primarily individuals care about, it will be open source. If the features are something primarily managers, directors, or executives care about, then it will be source-available. When considering buyers as part of product tiering decisions, we use the following guidance:
• Premium is for team(s) usage, with the purchasing decision led by one or more managers or directors
• Ultimate is for strategic organizational usage, with the purchasing decision led by one or more executives
We want to be good stewards of our open source solution, so we aim to ensure all stages of the DevOps lifecycle (plan, create, verify, package, release, configure, monitor) will have some open source features. Having all stages of the platform available to users for free encourages cross-stage adoption and more collaboration and helps users see the benefit of a single application approach. Including all major features in our free tier helps us keep our codebase for the free and paid tiers similar, which helps us carry forward our promise of being good stewards of our open source solution without diverging codebases. We seek to clearly and consistently articulate our monetization strategy on teams and organizations to provide predictability to both our customers as well as the community of contributors.
13
Table of Contents
Our open source approach is intended to increase our development velocity as the developer pool who contributes to our codebase is greater than the size of any single engineering team. As of January 31, 2024, more than 4,000 individuals have contributed to The DevSecOps Platform and since January 1, 2021, code contributions have averaged more than 259 per month. Because people outside of our organization can read our code, users can contribute to identifying and solving issues, which accelerates the time we can release new software to market. This has also been a big contribution to enabling us to release a new version of our software for 148 months in a row and counting as of January 31, 2024 .
We believe our open source approach helps us acquire, retain, and grow our paying customer base. Our customers benefit from the advanced innovation that comes from distributed development, the documentation, best practices, knowledge sharing across our community, and the possibility to extend or enhance our platform with unique capabilities through their own contributions back to our codebase.
The DevSecOps Platform and Plans
We offer GitLab in three different subscription tiers: Free, Premium and Ultimate.
• Our Free tier caters to capabilities needed by individual contributors.
• Our Premium tier is intended specifically for managers and directors to help teams enhance collaboration between development and operations teams, manage projects and portfolios, and accelerate the deployment of code.
• Our Ultimate tier enables organization-wide change, helping teams establish better collaboration between development, operations, and security teams, instilling organizational-wide security, compliance, and planning practices, and implementing full value stream measurement, analytics, and reporting, across the DevSecOps lifecycle.
Our subscription plans are available as a self-managed offering that customers download to run in their own on-premise environment or hybrid cloud environments, and also a SaaS offering that is managed by us and is hosted in either the public cloud or in a private cloud based on the customer’s preference.
Research and Development Strategy
We ship features and components of features at a high velocity in the smallest possible increments to optimize for code quality, efficiency, and speed. As each feature is typically similar in size, we are able to measure and track our development team's efficacy by counting the number of merge requests or a request to merge one branch of code into another. We believe that our development approach, using The DevSecOps Platform, is a key competitive advantage.
We make product investment decisions based on each stage’s contribution to revenue, monthly active usage, and served addressable market size. Currently, the majority of our development costs are in Create (Source Code Management), Verify (Continuous Integration), Secure (Application Security Testing), and Manage (Analytics and Administrative capabilities).
Our research and development team consists of our architects, software engineers, security experts, DevSecOps engineers, product management, user experience, quality assurance, and data collection teams. We intend to continue to invest in our research and development capabilities to extend The DevSecOps Platform and products.
Our Technology
Our single application strategy means that we have one codebase to author, test, secure, package, and distribute. This also means that we are able to give users the most choice. Our customers can use a SaaS subscription or run The DevSecOps Platform themselves in a self-managed way in their own cloud
14
Table of Contents
environments. For self-managed users, GitLab is the only truly public-cloud-agnostic solution. Customers can also run The DevSecOps Platform in their own data centers if they wish. They can further choose to run GitLab on traditional servers or use containers and an orchestration system like Kubernetes.
From an end-user standpoint, our single application strategy provides one consistent user interface across all stages of the DevSecOps lifecycle. We see this result in a manifold reduction in lifecycle time for software development teams. For integrators, GitLab has a single application programming interface (“API”) to write integrations against instead of a fragmented toolchain. For IT system administrators and internal security teams this also means they have one application environment and authentication system to inspect and certify according to their team’s standards.
Our Customers
We serve organizations of all sizes across industries and regions. As of January 31, 2024 , we had customers in over 140 countries. We believe that our customer growth is best represented by the number of our Base Customers, which increased to 8,602 as of January 31, 2024 from 7,002 as of January 31, 2023. We are continuously investing in our enterprise sales motion and have achieved strong success in attracting, retaining, and growing ARR from our larger customers. For the year ended January 31, 2024, more than 70% of our ARR came from public sector and enterprise customers. Our success has been exemplified by the growth in our $100,000 ARR customers to 955 as of January 31, 2024, from 697 as of January 31, 2023. Further, during the same period, we grew our $1.0 million ARR customers to 96 from 63, an increase of 52%. We have key reference customers across a breadth of industry verticals that we believe validate The DevSecOps Platform, and our customers range from small and medium-sized teams to Fortune 500 companies. There were no individual customers whose revenue represented more than 10% of total revenue in fiscal 2024 or fiscal 2023.
Sales and Marketing
Our go-to-market strategy spans a dedicated enterprise sales motion, a self-service buying experience, and a customer success organization. We organize our sales organization by region and size, with an additional vertical focus on regulated industries, such as the public sector, financial services, and telecommunications. Our sales organization’s success is centered around our customers’ success, ensuring they achieve platform value through GitLab.
Our customer success organization, or CS, manages our relationships with customers, both pre-sale and post-sale. CS helps customers achieve platform value and productivity with GitLab by building awareness, adoption, usage, and performance around modern DevSecOps capabilities. We believe that this focus around platform value and partnership engagement maximizes long-term expansion with our existing customer base.
Through our commitment to open collaboration, we also have select technology and channel partners who increase efficient access to new and existing customers, and support the existing customer growth through trusted relationships, existing contracts, service delivery capability and capacity, and collaboration on large digital transformations. These partners include systems integrators, cloud platform partners, independent software vendors, managed service providers, resellers, distributors, and ecosystem partners. Our partnership program rewards partners who commit to and invest in a deeper GitLab relationship, and lean into services for implementation and expansion success.
Our marketing department is focused on generating awareness of our DevSecOps Platform to the developer community, existing customers and users, and potential customers. We utilize diverse strategies such as digital demand generation, account-based marketing, nurture programs, sales development, virtual and field events, sponsored webinars, gated content downloads, whitepapers, display advertising and integrated campaigns to connect with prospective customers. We also host and present at regional, national and global industry events.
15
Table of Contents
We offer our free tier and/or a free trial to prospective customers, allowing them to try before they buy, and allowing customers to see the strengths of The DevSecOps Platform and the business benefits. We are then able to engage with these users to encourage them to upgrade to a paid version. Once a customer is onboarded with GitLab, our teams work to identify additional business units and parent/child/subsidiary prospects that would benefit from The DevSecOps Platform. Finally, as engaged members of the open-source community, our contributors often serve as subject matter experts at market-leading developer events, and The DevSecOps Platform is presented on the cutting edge of innovation.
Competition
The markets we serve are highly competitive and rapidly evolving. With the introduction of new technologies and innovations, we expect the competitive environment to remain intense.
We operate in two primary competitive landscapes: DevOps point solutions and DevOps platforms. In terms of point solutions that are stitched together GitLab’s offering is substantially different in that it is one platform, one codebase, one interface, and a unified data model that spans the entire DevSecOps lifecycle. The market, however, is shifting from point solutions to platforms as companies realize the shortcomings of a point solution approach. To ensure easy transitions for customers and support for dependencies on internal and external tools, we support staged adoption while continuing the use of some legacy tools.
In terms of DevOps platforms, our principal competitor is Microsoft Corporation following their acquisition of GitHub. We view GitLab as differentiated from GitHub in several areas, including value delivery to all personas in the software delivery lifecycle (not limited to developers), integrated security and compliance, AI throughout the software delivery process, cloud agnosticism, open core business model, and ability to scale to meet enterprise-level workloads.
Furthermore, we believe we compete favorably based on the following factors:
• ability to provide a single application that is purpose-built to span the entire DevSecOps lifecycle;
• ability to rapidly innovate and consistently ship and release more features and versions of our software;
• maturity of features in the Create (Source Code Management) and Verify (Continuous Integration) stages;
• ability to run natively across any public cloud, private cloud, hybrid cloud, or on-premises environment;
• ability to include AI features across the DevSecOps lifecycle:
• ability to enable collaboration between developers, IT operations, and security teams;
• ability to reduce handoffs, friction, and switching costs across different stages of the DevSecOps lifecycle;
• ability to reduce software development times to release better software faster;
• ability to consolidate multiple tools into a single platform;
• ability to eliminate manual integrations that are costly and time-effective to maintain;
• ability to provide a seamless, consistent, and single user experience through one user interface;
• ability to deliver a large, engaging community of open source contributors;
• performance, scalability, and reliability;
16
Table of Contents
• ability to implement more differentiated security and governance;
• quality of service and overall customer satisfaction; and
• strong documentation and transparency of information.
Corporate Philanthropy
As part of our mission to make it so everyone can contribute, we believe that it is important to support teams that can further this goal at local and global levels. To further this mission, in September 2021, our board of directors approved the reservation o f up to 1,635,545 shares of Class A common stock for the issuance to charitable organizations, to be further designated by our board of directors.
In March 2023, we approved the donation of $10.7 million aggregate principal amount of shares of Class A common stock to GitLab Foundation (the “Foundation”), a California nonprofit public benefit corporation. The Foundation is also a related party as certain of our officers serve as directors of the Foundation. This donation was provided in equal quarterly distributions throughout fiscal 2024. Additional donations are anticipated in fiscal 2025.
During the year ended January 31, 2024, we donated 231,408 shares of Class A common stock at fair value to the Foundation. The fair value of the common stock was determined based on the quoted market price on the grant date.
Additionally, as part of GitLab’s Environmental, Social and Governance (ESG) objectives, GitLab purchased $0.2 million in carbon removal reforestation credits in January 2024 to cover 8,580 Tonnes of CO2E of the company's emissions.
Government Regulation
We are subject to many varying laws and regulations in the United States and throughout the world, including those related to data privacy, security and protection, intellectual property, worker classification, employment and labor, workplace safety, consumer protection, anti-bribery, import and export controls, immigration, federal securities, and tax.
Moreover, new and existing laws and regulations (or changes in interpretation of existing laws and regulations) may also be adopted, implemented, or interpreted to apply to us or our contributors, and uncertainty around the application of these laws may affect demand for our platform. Additionally, as our platform’s geographic scope continues to expand, regulatory agencies or courts may claim that we are subject to additional requirements, or are prohibited from conducting our business in or with certain jurisdictions, either generally or with respect to certain services, or that we are otherwise required to change our business practices. We believe that we are in material compliance with such laws and regulations and do not expect continued compliance to have a material impact on our capital expenditures, earnings, or competitive position. We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not expect compliance to have a material adverse effect on our business. See Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K for a more comprehensive description of risks related to government regulation affecting our business.
Intellectual Property
The protection of our technology and intellectual property is an important aspect of our business. We rely upon a combination of trademarks, trade secrets, know-how, copyrights, patents, confidentiality procedures, contractual commitments, domain names, and other legal rights to establish and protect our intellectual property. We generally enter into confidentiality agreements and invention or work product assignment agreements with our officers, team members, agents, contractors, and business partners to control access to, and clarify ownership of, our proprietary information.
17
Table of Contents
As of January 31, 2024 , we had ten issued patents and six pending patent applications in the United States and abroad. These patents and patent applications seek to protect proprietary inventions relevant to our business. The issued patents are scheduled to expire between 2034 and 2042.
As of January 31, 2024, we had eleven trademark registrations and applications in the United States, including for “GITLAB” and our logo. We also had thirty-eight trademark registrations and applications in certain other jurisdictions and regions. Additionally, we are the registered hold er of a number of domain names, including gitlab.com.
We are dedicated to open source software. Our product incorporates many components subject to open source software licenses, and in turn we license many significant components of our software under open source software licenses. Such licenses grant licensees broad permissions to use, copy, modify, and redistribute the covered software which can limit the value of our software copyright assets.
Legal Proceedings
We are, and from time to time we may become, involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of our management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results.
Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.
Corporate Information
We were incorporated in the State of Delaware as GitLab Inc. in September 2014. We are a remote-only company, meaning that all of our team members work remotely. Due to this, we do not currently have a headquarters. Our website address is https://about.gitlab.com. The information contained on, or that can be accessed through, our website is not a part of this Annual Report on Form 10-K. Investors should not rely on any such information in deciding whether to conduct any transactions involving our Class A common stock. Unless otherwise indicated, the terms “GitLab,” the “Company,” “we,” “us,” and “our” refer to GitLab Inc., our subsidiaries, and our consolidated variable interest entity, “JiHu”. References to our “common stock” include our Class A common stock and Class B common stock.
Available Information
We file electronically with the Securities and Exchange Commission, or the SEC, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended. The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements and other information that we file with the SEC electronically. We make available on our website at https://about.gitlab.com, free of charge, copies of these reports and other information as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.
We use our investor relations page on our website (https://ir.gitlab.com/), press releases, public conference calls, public webcasts, our X account (@gitlab), our Facebook page, our LinkedIn page, our company news site (https://about.gitlab.com/press/) and our corporate blog (https://about.gitlab.com/blog/) as means of disclosing material nonpublic information and for complying with our disclosure obligations under Regulation FD. The information disclosed by the foregoing channels could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above and to review the information disclosed through such channels. Any updates to the list of disclosure channels through which we announce information will be posted on the investor relations page on our website.
18
Table of Contents
The contents of the websites referred to above are not incorporated into this Annual Report on Form 10-K. Further, our references to the URLs for these websites are intended to be inactive textual references only.
19
Table of Contents