GitLab
31 named things its latest annual report says its results depend on, each in the company's own words. 22 of them are also named by other companies we've read.
Customers
Public sector and enterprise customers
concentrated in · more than 70% of our ARRFor the year ended January 31, 2026, more than 70% of our ARR came from public sector and enterprise customers.Business (Item 1)
U.S. federal government
earns fromnamed as a riskGovernment certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained the revised certification.Risk factors (Item 1A)
Also named by ACN, ADSK, AKAM, AMRC, APG, CACI, CBRE, CI and 25 more
Suppliers
Open source contributors
depends on · more than 5,200 individualsnamed as a riskIf contributors, including influential contributors, do not continue to contribute code, our customer base and contributor engagement may decline.Risk factors (Item 1A)
Third-party AI model providers
depends onnamed as a riskWe rely on third-party vendors for the provision of the AI models which power many of our AI features.Risk factors (Item 1A)
Also named by TEAM
Payment processors
depends onnamed as a riskThe termination of our ability to process payments on any material payment solution would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing.Risk factors (Item 1A)
Also named by FIVE
Professional Employer Organizations (PEOs)
depends onnamed as a riskIn all locations where we utilize PEOs, we rely on those PEOs to comply with local employment laws and regulations.Risk factors (Item 1A)
Partners and platforms
Channel partners
depends onnamed as a riskChannel partners may become an increasingly important aspect of our business, particularly with regard to enterprise, governmental, and international sales.Risk factors (Item 1A)
GitLab Information Technology (Hubei) Co., Ltd. (JiHu)
earns fromnamed as a riskAlthough the joint venture entity is an autonomous company, it is the exclusive seller of GitLab in mainland China, Hong Kong and Macau and is therefore the public face of GitLab in those areas.Risk factors (Item 1A)
Microsoft IDEs and code editors
depends onnamed as a riskA change to the policies and specifications pertaining to any of these third-party tools (including those developed by Microsoft), could cause us to lose market share to competitors whose products and services continue to support integrations with such tools.Risk factors (Item 1A)
Amazon Web Services (AWS)
depends onWe have been investing in our global partner ecosystem, composed of hyperscalers and cloud providers, including Google Cloud and AWS, technology and independent software vendor partners, global resellers, and system integrators.Business (Item 1)
Also named by AAON, ABNB, ADSK, AIOT, BLK, CARR, CG, COF and 56 more
Google Cloud
depends onWe have been investing in our global partner ecosystem, composed of hyperscalers and cloud providers, including Google Cloud and AWS, technology and independent software vendor partners, global resellers, and system integrators.Business (Item 1)
Also named by AAON, CME, DGX, ETSY, FTNT, LBTYA, MSTR, NTAP and 4 more
Competitors
Microsoft Corporation (GitHub)
competes withnamed as a riskOur principal competitor is Microsoft Corporation, which owns GitHub.Business (Item 1)
Atlassian
competes withnamed as a riskWe also compete with DevOps product collections and point solutions from vendors such as Atlassian, JFrog, and Harness.Business (Item 1)
JFrog
competes withWe also compete with DevOps product collections and point solutions from vendors such as Atlassian, JFrog, and Harness.Business (Item 1)
Harness
competes withWe also compete with DevOps product collections and point solutions from vendors such as Atlassian, JFrog, and Harness.Business (Item 1)
Places
China
operates innamed as a riskAccordingly, any adverse change in the Chinese economy, the Chinese legal system or Chinese governmental, economic or other policies could have a material adverse effect on our business and operations in China and our prospects generally.Risk factors (Item 1A)
Also named by A, AA, AAOI, AAP, AAPL, AB, ADI, AEHR and 261 more
Regulators
Office of Foreign Assets Control (OFAC)
subject tonamed as a riskWhile BIS and OFAC did not assess any penalties, we understand that BIS and OFAC may consider our regulatory history, including these prior disclosures and warning/cautionary letters, if the company is involved in a future enforcement case for failure to comply with export control laws and regulations.Risk factors (Item 1A)
Also named by ABNB, ADP, AIG, APP, BMI, BMNR, BPOP, CAT and 46 more
U.S. Bureau of Industry and Security (BIS)
subject tonamed as a riskIn September 2019, we disclosed these apparent violations to BIS and OFAC, which resulted in a BIS Warning Letter and an OFAC Cautionary Letter, in January and February 2020, respectively.Risk factors (Item 1A)
Also named by AAOI, AMD, APH, CRWV, EXTR, GLW, LITE, MTSI and 5 more
Cyberspace Administration of China
subject tonamed as a riskAlso, the Cyberspace Administration of China has developed measures to govern cross-border transfers of personal data, such as security assessments, certifications, and Standard Contractual Clauses, all of which may impact our ability to transact with customers with operations in China.Risk factors (Item 1A)
Laws and programs
EU General Data Protection Regulation (GDPR)
subject to · up to the greater of €20 million or 4% of worldwide annual revenuesnamed as a riskThe GDPR and U.K. GDPR provide for penalties for noncompliance of up to the greater of €20 million or 4% of worldwide annual revenues (in the case of the GDPR) or £17 million and 4% of worldwide annual revenue (in the case of the U.K. GDPR).Risk factors (Item 1A)
Also named by ACN, ADSK, AIG, ALK, AMG, ANET, APG, AXON and 61 more
EU Digital Services Act (DSA)
subject to · up to 6% of global annual turnovernamed as a riskCompliance with the DSA and similar laws could subject us to increased compliance costs and operational requirements, and includes significant penalties for non-compliance of up to 6% of global annual turnover and provides for the ability of civil society organizations and non-governmental organizations to commence class action lawsuits.Risk factors (Item 1A)
Also named by ABNB, ADBE, BKNG, CSGP, DASH, EBAY, ETSY, GDDY and 8 more
OECD Pillar 2 global minimum tax
subject to · 15%named as a riskWhile the United States has withdrawn support for Pillar 2, certain countries in which we operate have adopted legislation.Risk factors (Item 1A)
U.K. GDPR
subject to · £17 million and 4% of worldwide annual revenuenamed as a riskAs we are required to comply with both the GDPR and the U.K. GDPR, we could be subject to parallel enforcement actions with respect to breaches of the GDPR or U.K. GDPR which affects both E.U. and U.K. data subjects.Risk factors (Item 1A)
Also named by VTR
California Consumer Privacy Act (CCPA)
subject tonamed as a riskAdditionally, we are subject to the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data.Risk factors (Item 1A)
Also named by AAP, AIOT, AKAM, ALL, APP, AYI, BAC, BBSI and 69 more
One Big Beautiful Bill Act (OBBBA)
subject tonamed as a riskOBBBA increased the tax rate associated with international operations and reduced the tax benefit associated with certain foreign-derived deduction eligible income of United States-domiciled corporations.Risk factors (Item 1A)
Also named by AA, ABR, ADI, ADM, ALB, AMAT, AMGN, AMKR and 121 more
Payment Card Industry Data Security Standard (PCI-DSS)
subject tonamed as a riskOur actual or perceived failure to comply with the PCI-DSS can subject us to fines, termination of banking relationships, and increased transaction fees.Risk factors (Item 1A)
Also named by ABNB, AZO, BJ, BKNG, CASH, CASY, COST, DOV and 20 more
EU-U.S. Data Privacy Framework
subject tonamed as a riskWe will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business.Risk factors (Item 1A)
Also named by ADBE, APP, CRM, CRWD, DDOG, DOCN, IDXX, INTU and 12 more
China Personal Information Protection Law (PIPL)
subject tonamed as a riskOur failure to comply with the PIPL may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.Risk factors (Item 1A)
Also named by ADSK, BSX, DCI, EWBC, FBIN, IDCC, KVUE, SBUX and 2 more
Digital services taxes
subject tonamed as a riskFor example, several jurisdictions have proposed or enacted taxes applicable to digital services, which include business activities on digital advertising and online marketplaces, and which apply to our business.Risk factors (Item 1A)
Russia and Belarus sanctions
subject tonamed as a riskFor example, Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries, and have sanctioned various entities and individuals located there, while recent sanctions restrict the provision of certain cloud services to Russia.Risk factors (Item 1A)