Gitlab Inc 10-K for FY2025
Gitlab Inc. (GTLB)
10-K
2025-03-21
For: 2025-01-31
View Original
Added on
April 12, 2026
About this 10-K
Gitlab Inc filed this 10-K on March 21, 2025, covering the fiscal year ended January 31, 2025 (FY2025).
Headline figures
Fiscal year ended January 31, 2025, as reported in this filing, compared with the same period a year earlier where the filing states it.
- Revenue
- $759.25M
- up 30.9% from $579.91M a year earlier
- Net loss
- $6.33M
- compared with a net loss of $425.68M a year earlier
- Diluted EPS
- -$0.04
- compared with -$2.76 a year earlier
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM 10-K
(Mark One)
For the fiscal year ended January 31 , 2025
or
For the transition period from to
Commission File Number: 001-40895
(Exact name of registrant as specified in its charter)
(State or other jurisdiction of incorporation or organization) | (I.R.S. Employer Identification Number) | |||||||||||||
Address Not Applicable1 | Zip Code Not Applicable1 | |||||||||||||
(Address of Principal Executive Offices) | Zip Code | |||||||||||||
(Registrant’s telephone number, including area code)
Not Applicable
(Former name, former address and former fiscal year, if changed since last report)
Securities registered pursuant to Section 12(b) of the Act:
| Title of Each Class | Trading Symbol(s) | Name of each exchange on which registered | ||||||
per share | ||||||||
Securities registered pursuant to Section 12(g) of the Act: None
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes x No ☐
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No x
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. x Yes ☐ No
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). x Yes o No
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.
| x | Accelerated filer | o | ||||||||||||
Non-accelerated filer | o | Smaller reporting company | ||||||||||||
Emerging growth company | ||||||||||||||
Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. x
If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. x
Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). x
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). ☐ Yes x No
The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant, based on the closing price of $51.23 per share on July 31, 2024 (the last business day of the registrant’s most recently completed second fiscal quarter) as reported by the Nasdaq Stock Market on such date was approximately $6.9 billion.
As of March 7, 2025, the number of shares of the registrant’s Class A common stock outstanding was 144.6 million and the number of shares of the registrant’s Class B common stock outstanding was 19.4 million.
DOCUMENTS INCORPORATED BY REFERENCE
Portions of the registrant’s Definitive Proxy Statement (“Proxy Statement”) relating to the 2025 Annual Meeting of Stockholders will be filed with the Securities and Exchange Commission within 120 days after the end of the registrant’s fiscal year ended January 31, 2025 and is incorporated by reference into Part III of this Report.
_____________________________
1 We are a remote-only company. Accordingly, we do not maintain a headquarters. For purposes of compliance with applicable requirements of the Securities Act of 1933, as amended, or the Securities Act and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act, any stockholder communication required to be sent to our principal executive offices may be directed to the agent for service of process at Corporation Service Company, 251 Little Falls Drive , Wilmington , Delaware 19808 , or to the email address: reach.gitlab@gitlab.com.
TABLE OF CONTENTS
| Page | ||||||||
| Item 1. | ||||||||
| Item 1A. | ||||||||
| Item 1B. | ||||||||
| Item 1C. | ||||||||
| Item 2. | ||||||||
| Item 3. | ||||||||
| Item 4. | ||||||||
| Item 5. | ||||||||
| Item 6. | ||||||||
| Item 7. | ||||||||
| Item 7A. | ||||||||
| Item 8. | ||||||||
| Item 9. | ||||||||
| Item 9A. | ||||||||
| Item 9B. | ||||||||
| Item 9C. | ||||||||
Part III | ||||||||
| Item 10. | ||||||||
| Item 11. | ||||||||
| Item 12. | ||||||||
| Item 13. | ||||||||
| Item 14. | ||||||||
Part IV | ||||||||
| Item 15. | ||||||||
| Item 16. | ||||||||
1
SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS
This Annual Report on Form 10-K, or this Annual Report, contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. All statements contained in this Form 10-K other than statements of historical fact, including statements regarding our future operating results and financial condition, our business strategy and plans, market growth, and our objectives for future operations, are forward-looking statements. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “target,” “plan,” “expect,” and similar expressions are intended to identify forward-looking statements.
Forward-looking statements contained in this Annual Report include, but are not limited to, statements about:
•our future financial performance, including our expectations regarding our total revenue, cost of revenue, gross profit or gross margin, operating expenses, including changes in operating expenses and our ability to achieve and maintain future profitability;
•our business plan and our ability to effectively manage our growth;
•our total market opportunity;
•anticipated trends, growth rates, and challenges in our business and in the markets in which we operate;
•market acceptance of The DevSecOps platform and our ability to increase adoption of The DevSecOps platform;
•beliefs and objectives for future operations;
•our ability to further penetrate our existing customer base and attract, retain, and expand our customer base;
•our ability to timely and effectively scale and adapt The DevSecOps platform;
•our ability to develop new features and bring them to market in a timely manner;
•our incorporation of artificial intelligence features into our products;
•our expectations to grow our partner network;
•our ability to maintain, protect, and enhance our intellectual property;
•our ability to continue to expand internationally;
•the effects of increased competition in our markets and our ability to compete effectively;
•future acquisitions or investments in complementary companies, products, services, or technologies;
•our ability to stay in compliance with laws and regulations that currently apply or become applicable to our business both in the United States and internationally;
•the impact of any data breaches, cyberattacks or other malicious activity on our technology systems;
•economic and industry trends, projected growth, or trend analysis;
2
•the impact of macroeconomic conditions, including inflation, volatile interest rates, regulatory uncertainty, including with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and increased volatility in the capital markets, and regional and other global events, including ongoing armed conflicts in different regions of the world, on our operations, financial results, and liquidity and capital resources, including on customers, sales, expenses, and team members; and
•other statements regarding our future operations, financial condition, and prospects and business strategies.
These forward-looking statements are subject to a number of risks, uncertainties, and assumptions, including those described in the section titled “Risk Factors” and elsewhere in this Annual Report. Moreover, we operate in a very competitive and rapidly changing environment, and new risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties, and assumptions, the forward-looking events and circumstances discussed in this Annual Report may not occur, and actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements.
You should not rely upon forward-looking statements as predictions of future events. The events and circumstances reflected in the forward-looking statements may not be achieved or occur. We undertake no obligation to update any of these forward-looking statements for any reason after the date of this Annual Report or to conform these statements to actual results or to changes in our expectations, except as required by law.
You should read this report and the documents that we reference in this report and have filed with the Securities and Exchange Commission, or the SEC, as exhibits to this report with the understanding that our actual future results, performance, and events and circumstances may be materially different from what we expect.
Summary Risk Factors
Our business is subject to numerous risks and uncertainties, including those risks more fully described below in the section titled “Risk Factors.” These risks include, among others, the following, which we consider our most material risks:
•Our business and operations have experienced rapid growth, and if we do not appropriately and effectively manage future growth, if any, or are unable to improve our systems, processes and controls, our business, financial condition, results of operations, and prospects will be adversely affected.
•Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.
•We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected.
•Security and privacy breaches may hurt our business.
•We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products.
•We face intense competition and could lose market share to our competitors, which would adversely affect our business, operating results, and financial condition.
3
•We may not be able to respond to rapid technological changes with new solutions, which could have a material adverse effect on our operating results.
•If our services fail to perform properly, whether due to material defects with the software or external issues, our reputation could be adversely affected, our market share could decline, and we could be subject to liability claims.
•The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.
•We are dependent on sales and marketing strategies to drive our growth in our revenue. These sales and marketing strategies may not be successful in continuing to generate sufficient sales opportunities. Any decline in our customer renewals and expansions could harm our future operating results.
•Our operating results may fluctuate significantly, which could make our future results difficult to predict and could adversely affect the trading price of our Class A common stock.
•As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.
• The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations.
•Transparency is one of our core values. While we will continue to prioritize transparency, we must also promote "responsible" transparency as transparency can have unintended negative consequences.
•The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.
•Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer.
•Failure to effectively expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our services.
•We rely on our management team and other key team members and will need additional personnel to grow our business, and the loss of one or more key team members or our inability to hire, integrate, train and retain qualified personnel, could harm our business.
•Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity, and teamwork fostered by our culture, and our business may be harmed.
•We engage our team members in various ways, including direct hires, through PEOs and as independent contractors. As a result of these methods of engagement, we face certain challenges and risks that can affect our business, operating results, and financial condition.
4
PART I
ITEM 1. BUSINESS
Overview
In today’s world, software defines the speed of innovation. Every industry, business, and function within a company is dependent on software. To remain competitive and survive, nearly all companies must digitally transform and become experts at developing, delivering, and securing software.
To meet these market needs, GitLab created the DevSecOps platform, a fundamentally new approach to software development and delivery. Built with a unified data model, our platform brings together all stakeholders in the software delivery lifecycle – from development teams to operations teams to security teams. With GitLab, all stakeholders can build better, more secure software, faster.
GitLab is the solution for significant business transformation needs. Across every industry – and across companies of every size – technology leaders want to make developers more productive so they can deliver better products faster; they want to measure productivity so they can increase operational efficiency; they want to secure the software supply chain so they can reduce security and compliance risk; and, they want to accelerate secure cloud migration, so they can unlock digital transformation results. These technology leaders need a platform that enables a value stream-driven mindset that shortens the time from idea to customer value and establishes a powerful flywheel for data collection and aggregation. They are looking for a platform approach that unifies the entire development experience, so that customers can outpace and out-innovate their competition.
We believe GitLab offers the shortest path to unlock technology transformation and business value. GitLab accelerates our customers’ ability to innovate by accelerating their software development from weeks to minutes. It removes the need for point tools and delivers enhanced operational efficiency by eliminating manual work, increasing productivity, and creating a culture of innovation and velocity. Embedding security earlier in the development process, GitLab enables customers to improve software security, quality, and overall compliance.
GitLab is available to any team, regardless of the size, scope, and complexity of their deployment. As a result, we have more than 50 million registered users, and more than 50% of the Fortune 100 companies are GitLab customers. For purposes of determining the number of our active customers, we look at our customers with more than $5,000 of Annual Recurring Revenue, or ARR, in a given period, who we refer to as our Base Customers. For purposes of determining our Base Customers, a single organization with separate subsidiaries, segments, or divisions that use The DevSecOps platform is considered a single customer for determining each organization’s ARR.
GitLab is the only DevSecOps platform built on an open-core business model. We enable any customer and contributor to add functionality to our platform. In calendar year 2024, nearly 900 people contributed more than 3,000 merge requests back to the core product, extending GitLab’s in-house R&D efforts and empowering our most passionate users to make improvements to the DevSecOps solution they use every day. Our open-core approach engenders trust with our customers and enables us to maintain our high velocity of innovation.
Our transparent business value also helps us grow the open source community. We make our strategy, direction, and product roadmap available to the wider community in order to encourage and solicit their feedback. Through responsible transparency, we create a deeper level of trust with our customers and make it easier to solicit contributions and collaboration from our users and customers.
GitLab offers a flexible deployment model for our customers. For our self-managed offering, the customer installs GitLab in their own on-premise or hybrid cloud environment. For our SaaS offering, the platform is managed by GitLab and hosted either in our public cloud or in our private cloud based on the
5
customer’s preference. We also offer GitLab Dedicated, our single tenant SaaS solution, ideally suited for organizations with complex security and compliance requirements.
GitLab and the Evolution of DevSecOps
DevOps is the set of practices that combines software development (dev) and IT operations (ops). It allows teams to collaborate and work together to shorten the development lifecycle and evolve software delivery from a slow, periodic basis to rapid, continuous updates.
The DevSecOps platform – pioneered by GitLab – replaces a “Do it yourself (or DIY)” DevOps approach where organizations stitch together complex toolchains. GitLab enables teams to realize the full potential of DevSecOps so that they can fully become a software-led business. It spans all stages of the DevSecOps lifecycle, from project planning (Plan), to source code management (Create), to continuous integration (Verify), to application security testing (Secure), to packaging artifacts (Package), to continuous delivery and deployment (Release) to configuring infrastructure for optimal deployment (Configure), to monitoring it for incidents (Monitor), to protecting the production deployment (Protect), and managing the whole cycle with value stream analytics (Manage). It also allows customers to manage and secure their applications across any cloud through a single platform.
GitLab’s DevSecOps platform has broad use across teams. It helps product and business teams work with developers to introduce new features and drive successful business outcomes. It helps Chief Technology Officers, or CTOs, modernize their software development and delivery environment and drive developer productivity. It helps Chief Information Officers, or CIOs, adopt microservices and cloud native development to improve their software architecture’s efficiency, scale, and performance. It helps Chief Information Security Officers, or CISOs, reduce security vulnerabilities without compromising speed to market. It helps teams attract and retain top talent by creating a superior developer experience that allows people to focus more time on their jobs and less time managing tools.
The majority of our customers begin their GitLab journey by using our Source Code Management (SCM), Continuous Integration (CI) and Continuous Delivery (CD) solutions, referred to as Create and Verify. Developers use these solutions to collaborate on the same code base without conflicting or accidentally overwriting each other's changes. Create also maintains a running history of software contributions from each developer to allow for version control. Teams use Verify to ensure changes to code go through defined quality standards with automatic testing and reporting. Our position in SCM, CI, and CD – coupled with our strong engagement with developers, managers, and executives – gives us a competitive edge in achieving our unified platform vision. Specifically, this creates connections between different software development stages and, as users adopt more of these interconnected stages within our single application, the overall value of our DevSecOps platform increases.
GitLab’s innovation strategy is another area of differentiation. We have a dual flywheel innovation strategy that leverages both development efforts from our research and development team members as well as community contributions via our open-core business model. By leveraging the power of each, we create a virtuous cycle where more contributions lead to more features, leading to more users and more contributions.
We emphasize iteration to drive rapid innovation in our development strategy. This iterative approach has enabled us to release a new version of our software every month for 160 months in a row as of January 31, 2025. This is also due in part to over 4,800 contributors in our global open source community as of January 31, 2025. GitLab team members also use The DevSecOps platform to power our own DevSecOps lifecycle. By doing so, we benefit from the inherent advantages of using a single application. We leverage these learnings to establish a feedback loop to continually and rapidly improve our platform.
GitLab’s DevSecOps platform is used globally by teams of all sizes across a broad range of industries. To reach, engage, and help drive success broadly, we have strong partnerships with cloud hyperscalers, including Google Cloud and Amazon Web Services, or AWS, who offer GitLab on their marketplaces. In the fourth quarter of fiscal year 2025, we announced a promising partnership with AWS
6
to bring together a new, jointly developed artificial intelligence, or AI, solution named GitLab Duo with Amazon Q. This solution combines the power of AWS’ agentic AI capabilities with GitLab’s comprehensive DevSecOps platform. We also benefit from strategic alliance partnerships which resell GitLab to large enterprise customers, and our strong channel partnerships ranging from large global systems integrators to regional digital transformation specialists and volume resellers.
We have a multi-faceted land-and-expand bottom-up and top-down sales strategy. Our customer journey can begin with developers and then expand to more teams and up to senior executive buyers. Equally so, the customer journey can start with executive-level buying decision-makers looking for a solution to their business and technology challenges, such as developer productivity, efficiency, security and compliance, and cloud migration. As of January 31, 2025 and 2024, our Dollar-Based Net Retention Rate was 123% and 130%, respectively. Our Base Customers grew to 9,893 as of January 31, 2025 from 8,602 as of January 31, 2024. Our cohort of customers generating $100,000 or more in ARR grew to 1,229 as of January 31, 2025 from 955 as of January 31, 2024. Our cohort of customers generating $1.0 million or more in ARR grew to 123 as of January 31, 2025 from 96 as of January 31, 2024.
Our business has experienced rapid growth. We generated revenue of $759.2 million and $579.9 million in fiscal year 2025 and fiscal year 2024, respectively, representing growth of 31%. During this period, we continued to invest in growing our business to capitalize on our market opportunity. The net loss attributable to GitLab was $6.3 million and $425.7 million in fiscal year 2025 and fiscal year 2024, respectively. Our operating cash flow margin, which we define as operating cash flows as a percentage of revenue, was (8)% and 6% for fiscal year 2025 and fiscal year 2024, respectively. Our gross profit margin was 89% and 90% for fiscal year 2025 and fiscal year 2024, respectively.
The DevSecOps Platform
GitLab’s DevSecOps platform brings together development, operations, IT, security, and business teams to deliver better, more secure software faster. It represents a step change in how teams plan, develop, secure and deploy software.
GitLab is built on a single codebase, unified data model, and user interface. GitLab offers customers flexible deployment options, including a self-managed offering, as well as multi-tenant and single tenant (GitLab Dedicated) SaaS solutions.
GitLab is designed to enable our customers to move their software development and delivery workflows across any hybrid or multi-cloud environment while maintaining full feature parity and a single application experience.
GitLab’s platform is purpose-built to address the entire software development lifecycle, with AI offered at every stage:
•Manage. GitLab enables all stakeholders – from executives to practitioners – to get visibility and insights into their value stream delivery in order to measure the flow of work, from idea to customer value. With capabilities such as Value Streams Dashboard and Value Stream Analytics, GitLab is uniquely positioned to be the tool of choice for data-driven organizations – enabling teams to understand software delivery performance and value to the business without complex configurations or data scientists. GitLab helps teams organize multiple projects into a single collaborative portfolio and track important events across the DevSecOps lifecycle. It also allows organizations to measure using key performance indicators - like adoption and performance metrics - as well as audit activity and permissions to ensure compliance while simplifying and optimizing the flow of work through the full DevSecOps value stream.
•Plan. To create software, teams require collaborative planning from disparate groups, each with shared and unique objectives. GitLab enables this collaboration with portfolio planning and management through epics, groups (programs), and milestones that organize and track progress. GitLab helps teams organize, plan, align, and track project work to ensure teams are working on
7
the right things at the right time and maintain end-to-end visibility and traceability of issues throughout the delivery lifecycle from idea to production.
•Create. GitLab helps teams design, develop, and securely manage code and project data from a single distributed version control system to enable rapid iteration and delivery of business value. GitLab repositories provide a scalable single source of truth for collaborating on projects and code, enabling teams to be productive without disrupting their workflows.
•Verify. GitLab helps software engineering teams fully embrace Continuous Integration, or CI, to automate the builds, integration, and verification of their code. GitLab’s secure CI capabilities enable automated accessibility, usability, performance testing, and code quality analysis to provide fast feedback to developers and testers about the quality of their code. With pipelines that enable concurrent testing and parallel execution, teams quickly get insight about every commit, allowing them to deliver higher quality code faster.
•Package. GitLab enables teams to package their applications and dependencies, manage containers, and build artifacts with ease. The private, secure, container, and package registries are built-in and preconfigured out-of-the-box to work seamlessly with GitLab Source Code Management, or SCM, security scanners, and Continuous Integration/Continuous Delivery, or CI/CD, pipelines.
•Secure. GitLab’s offering is differentiated with built in, end-to-end security capabilities. GitLab provides Advanced Static Application Security Testing, or SAST, Dynamic Application Security Testing, or DAST, Fuzz Testing, Container Scanning, and Dependency Scanning to help customers deliver secure applications along with license compliance.
•Release. GitLab helps automate the release and delivery of applications, shortening the delivery lifecycle, streamlining manual processes, and accelerating team velocity. With zero-touch CD built right into the pipeline, deployments can be automated to multiple environments like staging and production, and the system executes without additional manual intervention - even for more advanced patterns like canary deployments. With feature flags, built-in auditing/traceability, on-demand environments, and GitLab Pages for static content delivery, users can deliver faster and more confidently than ever before.
•Configure. GitLab helps software development and delivery teams to configure and manage their application environments. Strong integration to Kubernetes reduces the effort needed to define and configure the infrastructure required to support an application. GitLab helps protect access to key infrastructure configuration details such as passwords and login information by using ‘secret variables’ to limit access to only authorized users and processes.
•Monitor. GitLab provides feedback in the form of errors, traces, metrics, logs, and alerts to help reduce the severity and frequency of incidents so that users can release software frequently with confidence.
•Govern. GitLab extends an organization’s existing operations practices to help teams manage their security vulnerabilities, project dependencies, and compliance policies to reduce overall risk. This enables teams to identify risks by providing them with a high degree of visibility into their projects' dependencies, security findings, and user activities. This visibility is then coupled with management tools to respond to those risks. Lastly, policies can be used to automate compliance and to help secure the software supply chain.
Key Benefits Delivered to our Customers
•Reduce costs through toolchain consolidation. GitLab’s unique DevSecOps platform approach provides the capabilities of multiple point products, enabling teams to consolidate the number of tools they use. Further, The DevSecOps platform also delivers cost savings to our
8
customers by eliminating the hidden costs and time it takes to integrate these point products manually and drives greater efficiency gains and productivity. Based on a 2024 study conducted by Forrester Consulting, commissioned by GitLab, the cost savings and business benefits achievable by deploying GitLab to revenue-generating applications can enable customers to deliver a 483% return on investment within three years of deployment, and a potential payback period of under six months.
•Accelerate software delivery. We believe is the most comprehensive AI-powered DevSecOps platform. With GitLab, customers benefit from delivering better, more secure software faster. GitLab customers see up to 15x faster time to first release, enabling them to meet the growing business demand to deliver new capabilities and increase responsiveness to change. With GitLab, our customers can often increase the number of their software releases from the tens to thousands and reduce the time it takes to release new software from months to days, helping them generate more revenue.
•Reduce software vulnerabilities. GitLab allows organizations to adopt a ‘shift left’ security strategy, embedding security protections and guardrails earlier in the development process, without sacrificing developer speed. It also eliminates the need for multiple data repositories and multiple security tools and reduces the number of hand-offs between development, operations, and security teams. GitLab provides a single consolidated view of vulnerabilities across software, increasing the efficiency of vulnerability management and remediation. This enables our customers to find and correct security vulnerabilities in their software earlier or eliminate inefficiencies in the software development process altogether.
•Enable automated audit and compliance. GitLab eliminates fragmented tools and point integrations that create blind spots and poor visibility across work streams. This allows compliance and audit teams to more easily log, track, and trace different steps across the software delivery lifecycle, better understand governance, and improve their compliance posture.
•Adopt AI throughout the software development lifecycle. GitLab is differentiated by offering AI-powered workflows throughout the software development lifecycle. Our suite of AI capabilities, known as GitLab Duo, helps improve every step of software development and delivery – from planning and code generation to vulnerability detection and value stream measurement. GitLab Duo is privacy and transparency first and is model agnostic, we choose the right model for the right job, and can quickly evolve, replace, and change models as needed. We do not use customer content to train models.
•Improve developer experience and productivity. GitLab enables our customers to spend more time building, deploying, and securing software and less time managing, integrating, and triaging across different tools. In a single application, each team member can follow the entire lifecycle from beginning to end with contextual history and understanding of each process. This helps to deliver outsized productivity gains, helping our customers increase their revenue and generate greater profits.
•Embrace the benefits of a multi-cloud strategy. The DevSecOps platform enables application portability by helping customers to seamlessly secure and manage their applications across clouds. This allows our customers to provide full value stream analytics on their DevSecOps workflow and helps simplify their application security and compliance across clouds. It also helps them to optimize their cloud costs and embrace the best services across each cloud without becoming overly reliant on a single public cloud provider.
9
Competitive Strengths
Our business benefits from the following competitive strengths:
•Secure, unified DevSecOps workflows – GitLab is a single, unified workflow across the software development lifecycle, eliminating tool sprawl and context switching.
•Built-in security and compliance – GitLab’s platform is differentiated by offering enterprise-grade, integrated security and compliance, all without adding friction to developer workflows. This enables security and compliance teams to establish enterprise-wide policies so that they can shift security earlier in the development process without sacrificing developer velocity and experience.
•Context-aware AI throughout the software development lifecycle – GitLab offers AI throughout the software development and deployment experience, helping accelerate and improve every step of the software delivery lifecycle. In addition, GitLab offers a privacy-first and model-agnostic approach, enabling organizations to adopt AI in their software practices safely and responsibly.
•Collaboration and Visibility – As a platform that unifies the entire development lifecycle, we enable technology teams and organizations with the collaboration, visibility, and measurement they need to develop, secure, and deploy software at scale.
Finally, we meet customers where they are with:
•Flexible deployment options, so they pick the option that works for their business strategy.
•Extensibility, so they can integrate with their existing tools and processes, starting with core features, and expand from there.
•An Open Core platform, so they can build the capabilities they need into our platform.
Our Growth Strategy
We intend to invest in our business to advance the adoption of The DevSecOps platform. Our growth strategies include:
•Advance our feature maturity across more stages of the DevSecOps lifecycle. We intend to continue making strategic investments in research and development and hiring top technical talent to mature our features in more stages of the DevSecOps lifecycle. For example, we recently acquired two security companies – Oxeye and Rezilion – which rapidly led to our introduction of a differentiated Advanced SAST solution in the market. We will continue to make many of our features open source or source code available to encourage contributions, which, in turn, accelerates our ability to innovate and provide a better platform to our customers.
•Drive growth through enhanced sales and marketing. We believe that nearly all teams will modernize from DIY DevOps into DevSecOps platforms and that the opportunity to continue growing our customer base is substantial. To drive new customer growth, we intend to continue investing in sales and marketing, with a focus on replacing DIY DevOps within larger teams. We also continue to focus on acquiring users with our free product and converting free users to paying customers, with a special emphasis on improving the self-service purchasing experience.
•Drive increased expansion within our existing customer base. As customers realize the benefits of a single application, they typically increase their spend with us by adding more users or purchasing higher-tiered plans. As a result, for fiscal year 2025 and fiscal year 2024, our Dollar-Based Net Retention Rate was 123% and 130%, respectively. We plan to continue investing in sales and marketing, with a focus on driving the expansion of The DevSecOps platform within existing customers, particularly for our larger customers.
10
•Further grow adoption of our SaaS offering. As teams move more workloads to the cloud and consume technology as a service, we believe our SaaS offering will continue to grow at a faster rate than our self-managed offering. We intend to continue making investments in research and development to enhance new SaaS features, as well as in sales and marketing, to drive further adoption of our SaaS offering. For example, we offer a differentiated single tenant SaaS solution, called GitLab Dedicated, suited for organizations that want the benefits of SaaS and are in highly regulated verticals with complex security and compliance requirements.
•Grow and invest in our partner network. We have been investing in our global partner ecosystem, composed of hyperscalers and cloud providers, including Google Cloud and AWS, technology and independent software vendor partners, global resellers, and system integrators. For example, in the fourth quarter of fiscal year 2025, we announced a promising partnership with AWS to jointly develop a new AI solution called GitLab Duo with Amazon Q, which brings together AWS’ agentic AI capabilities with GitLab’s comprehensive AI-powered DevSecOps platform. We plan to continue investing in building out our partner program to expand our distribution footprint, broaden the awareness of The DevSecOps platform, and more efficiently add new customers. We will also continue to invest in building out our partnerships to deliver transformation services to help our enterprise customers accelerate the deployment of The DevSecOps platform.
•Expand our global footprint. We believe there is a significant opportunity to continue to expand internationally. We grew our international revenue to $140.6 million for fiscal year 2025 from $106.9 million for fiscal year 2024, representing an increase of 32%. We intend to grow our international revenue by strategically increasing our investments in international sales and marketing operations, including headcount in the EMEA and APAC regions.
Human Capital
Our Unique Culture and Values
Our success is driven by our culture. We believe that our values and culture are a competitive advantage within our industry, and we will continue to invest time and resources in building our culture to drive superior business results. We are highly dependent on our management, highly skilled engineers, sales team members and other professionals. It is crucial that we continue to identify, attract and retain valuable team members. To facilitate hiring and retention, we strive to make GitLab an inclusive workplace where every team member feels they belong and have the opportunity to grow and develop their career.
We remained Great Place to Work certified with 93% of US team members agreeing that GitLab is a great place to work and 96% of US team members saying they are proud to work here. We have a 92% CEO approval rating and a 4.1 overall workplace approval rating on Glassdoor.com, as of January 31, 2025. As a result, we trust that our values have led and will continue to lead to results that distinguish us from other companies. Our values include:
•Our mission is to empower customers to deliver secure software, faster. This mission guides our path, and we live our values along that path. Our values are a living document, and we encourage our team members to make suggestions to improve our company values constantly. We have established six core C.R.E.D.I.T. values:
◦Collaboration - Helping others is a priority; we rely on each other for help and advice;
◦Results for Customers - We follow through on our promises to each other, customers, users, and investors;
◦Efficiency - We are about working on the right things to achieve more progress faster;
11
◦Diversity, Inclusion & Belonging - We aim to foster an environment where everyone can thrive;
◦Iteration - We do the smallest thing possible and get it out as quickly as possible; and
◦Transparency - We strive to be open about as many things as possible to reduce the threshold to contribution and to make collaboration easier.
•Results-driven remote work. Our all-remote culture helps us to practice our values. As an all-remote company, we can recruit from a wider, more diverse, and uniquely skilled pool of talent across the world.
•We seek to be transparent in everything we do. We publicly share non-sensitive information, including our long-term strategy and product roadmap, in written form to encourage innovation and trust amongst our team members, customers, and the wider open source community. Transparency creates awareness for GitLab, allows us to recruit people who care about our values, gets us more and faster feedback from people outside GitLab, and makes it easier to collaborate. We believe that our transparency creates more value than it captures, and our ability to execute our strategy far exceeds the abilities of our competitors.
•We do the smallest thing possible and get it out as quickly as we can. We aim to take an iterative approach in everything we do, including our day-to-day work and building The DevSecOps platform. Our process is centered on dividing work into small increments, and pursuing each stage with speed and efficiency, whilst building with the end rsults in mind. Approaching work this way, we are able to rapidly get input from end-users who are actively using our platform, continuously revisit what we are doing with a fresher perspective, and gradually gain a greater sense of visibility into what the end picture should look like. By adopting this approach, we are able to work with a greater sense of speed and efficiency, getting more done in less time.
Team Members
Our mission is to empower customers to deliver secure software, faster. When everyone can contribute, consumers become contributors, and we greatly increase the rate of human progress through changing creative work from unilateral read-only to collective collaboration and innovation. This mission is integral to our culture, and how we hire, build products, and lead our industry. The DevSecOps platform brings together developers, operations, and security professionals and elevates their innovation to new levels, making it faster, safer, and more accessible. We are an all-remote company, and we pride ourselves in how we work through enabling our team members with the individualized flexibility to reach their business results. We believe this leads to a team that is continually engaged and passionate about the positive impact of GitLab.
As of January 31, 2025, we had approximately 2,375 team members in 60 countries. We engage our team members in various ways, including through direct employment, Professional Employer Organizations (“PEOs”), and as independent contractors. In the locations where we use PEOs, we contract with the PEO for it to serve as “Employer of Record” for team members engaged through such PEO. Team members are employed by the PEO but provide services to GitLab. We also engage team members through a PEO self-employed model in certain jurisdictions where we contract with the PEO, which in turn contracts with individual team members as independent contractors. None of our team members are represented by a labor union. In certain countries in which we operate, we are subject to, and comply with, local labor law requirements which may automatically make our team members subject to industry-wide collective bargaining agreements or works councils. We have not experienced any work stoppages. We work to identify, attract, and retain team members who are aligned with and will help us progress with our mission, and we seek to provide competitive cash and equity compensation. We believe we have a strong and open relationship with our team members and our unique mission, culture and values differentiate us and continue to be key drivers of our business success.
12
Diversity, Inclusion and Belonging
Diversity, Inclusion & Belonging is a part of our CREDIT values. We strive for a transparent environment where all globally dispersed voices are heard and welcomed. We strive for an environment where people can show up as their full selves each day and contribute to their best ability. With more than 50 million registered users utilizing GitLab across the globe, we strive to create a team that understands our global user base.
Compensation, Benefits, and Perks
We provide team members with competitive compensation packages that include base salaries and equity awards, including restricted stock units. We are an open organization and want to be as transparent as possible about our compensation principles. Our compensation model is open to data-driven iterations. Additional benefits programs (which vary by country and region) include a 401(k) Plan with a company match, healthcare, vision, and dental insurance benefits, health savings, and flexible spending accounts, flexible paid time off, parental leave, and other benefits tailored to the specific needs of our team members such as family forming, caregiving, and mental health resources. Throughout the year, we also encourage team members to participate in various volunteer initiatives that support and ultimately uplift their local communities. As with our unique ways of working, GitLab and its team members have identified and sought out opportunities for impact that speak back not only to our values but our all-remote nature.
Our Open Source Philosophy
We recognize that it is imperative to balance our need to generate revenue with the needs of the open source software project. To determine what is available in our free tier and what is available only in our paid tiers, we first assess who cares the most about the feature. Individual contributors rarely purchase The DevSecOps platform, and thus, if the feature is something primarily individuals care about, it will be open source. If the features are something primarily managers, directors, or executives care about, then it will be source-available. When considering buyers as part of product tiering decisions, we use the following guidance:
•Premium is for team(s) usage, with the purchasing decision led by one or more managers or directors
•Ultimate is for strategic organizational usage, with the purchasing decision led by one or more executives
We want to be good stewards of our open source solution, so we aim to ensure all stages of the DevSecOps lifecycle (plan, create, verify, package, release, configure, monitor) will have some open source features. Having all stages of the platform available to users for free encourages cross-stage adoption and more collaboration and helps users see the benefit of a single application approach. Including all major features in our free tier helps us keep our codebase for the free and paid tiers similar, which helps us carry forward our promise of being good stewards of our open source solution without diverging codebases. We seek to clearly and consistently articulate our monetization strategy on teams and organizations to provide predictability to both our customers as well as the community of contributors.
Our open source approach is intended to increase our development velocity as the developer pool who contributes to our codebase is greater than the size of any single engineering team. As of January 31, 2025, more than 4,800 individuals have contributed to The DevSecOps platform and since January 1, 2021, code contributions have averaged more than 285 per month. Because people outside of our organization can read our code, users can contribute to identifying and solving issues, which accelerates the time we can release new software to market. This has also been a big contribution to enabling us to release a new version of our software for 160 months in a row and counting as of January 31, 2025.
13
We believe our open source approach helps us acquire, retain, and grow our paying customer base. Our customers benefit from the advanced innovation that comes from distributed development, the documentation, best practices, knowledge sharing across our community, and the possibility to extend or enhance our platform with unique capabilities through their own contributions back to our codebase.
The DevSecOps Platform and Plans
We offer GitLab in three different subscription tiers: Free, Premium and Ultimate.
•Our Free tier caters to capabilities needed by individual contributors.
•Our Premium tier is intended specifically for managers and directors to help teams enhance collaboration between development and operations teams, manage projects and portfolios, and accelerate the deployment of code.
•Our Ultimate tier enables organization-wide change by facilitating better collaboration between development, operations, and security teams, instilling organizational-wide security, compliance, and planning practices, and implementing full value stream measurement, analytics, and reporting, across the DevSecOps lifecycle.
Our subscription plans are available as a self-managed offering that customers download to run in their own on-premise environment or hybrid cloud environments, and also a SaaS offering, which is offered as either multi-tenant or single-tenant (called GitLab Dedicated).
Research and Development Strategy
We ship features and components of features at a high velocity in the smallest possible increments to optimize for code quality, efficiency, and speed. As each feature is typically similar in size, we are able to measure and track our development team's efficacy by counting the number of merge requests or a request to merge one branch of code into another. We believe that our development approach, using The DevSecOps platform, is a key competitive advantage.
We make product investment decisions based upon our DevSecOps platform capabilities contribution to revenue, monthly active usage, and served addressable market size. Currently, the majority of our development costs are in core DevSecOps platform capabilities serving SCM, CI, and Enterprise Agile Planning use cases; Security and Compliance platform capabilities serving Security Risk Management, Application Security Testing, and Software Supply Chain Security use cases; and AI enabled DevSecOps platform capabilities serving the entire Software Development Lifecycle.
Our research and development team consists of our architects, software engineers, security experts, DevSecOps engineers, product management, user experience, quality assurance, and data collection teams. We intend to continue to invest in our research and development capabilities to extend The DevSecOps platform and products.
Our Technology
Our single application strategy means that we have one codebase to author, test, secure, package, and distribute. This also means that we are able to give users the most choice. Our customers can use a SaaS subscription or run The DevSecOps platform themselves in a self-managed way in their own cloud environments. For self-managed users, GitLab is the only truly public-cloud-agnostic solution. Customers can also run The DevSecOps platform in their own data centers if they wish. They can further choose to run GitLab on traditional servers or use containers and an orchestration system like Kubernetes.
From an end-user standpoint, our single application strategy provides one consistent user interface across all stages of the DevSecOps lifecycle. We see this result in a manifold reduction in lifecycle time for software development teams. For integrators, GitLab has a single application programming interface (“API”) to write integrations against instead of a fragmented toolchain. For IT system administrators and
14
internal security teams this also means they have one application environment and authentication system to inspect and certify according to their team’s standards.
Our Customers
We serve organizations of all sizes across industries and regions. As of January 31, 2025, we had customers in over 152 countries. We believe that our customer growth is best represented by the number of our Base Customers, which increased to 9,893 as of January 31, 2025 from 8,602 as of January 31, 2024. We are continuously investing in our enterprise sales motion and have achieved strong success in attracting, retaining, and growing ARR from our larger customers. For the year ended January 31, 2025, more than 70% of our ARR came from public sector and enterprise customers. Our success has been exemplified by the growth in our $100,000 ARR customers to 1,229 as of January 31, 2025, from 955 as of January 31, 2024. Further, during the same period, we grew our $1.0 million ARR customers to 123 from 96, an increase of 28%. We have key reference customers across a breadth of industry verticals that we believe validate The DevSecOps platform, and our customers range from small and medium-sized teams to Fortune 500 companies. There were no individual customers whose revenue represented more than 10% of total revenue in fiscal 2025 or fiscal 2024.
Sales and Marketing
Our go-to-market strategy spans a dedicated enterprise sales motion, a self-service buying experience, ecosystem partners, professional services, and a customer success organization. We organize our sales organization by region and size, with an additional vertical focus on regulated industries such as the public sector, financial services, and telecommunications. Our sales organization’s success is centered around our customers’ success, ensuring they achieve platform value through GitLab.
Our customer success organization manages our relationships with customers, both pre-sale and post-sale. Customer success helps customers achieve platform value and productivity with GitLab by building awareness, adoption, usage, and performance around modern DevSecOps capabilities. We believe that this focus on platform value and partnership engagement maximizes long-term expansion with our existing customer base. Our professional services organization is also focused on helping customers accelerate adoption with GitLab through implementation, migration, advisory, acceleration, and education services.
Through our commitment to open collaboration, we also have select hyperscaler and channel partners who increase efficient access to new and existing customers, and support the existing customer growth through trusted relationships, existing contracts, service delivery capability and capacity, and collaboration on large digital transformations. These partners include systems integrators, cloud platform partners, independent software vendors, managed service providers, resellers, distributors, and ecosystem partners. Our partnership program rewards partners who commit to and invest in a deeper GitLab relationship, and lean into services for implementation and expansion success.
Our marketing department is focused on accelerating the buyer journey, from awareness, consideration, and conversion to expansion and advocacy. We focus on reaching both the executive buyer audience and the individual developer audience among potential and existing customers. We utilize diverse strategies such as digital demand generation, account-based marketing, nurture programs, sales development, virtual and field events, sponsored webinars, gated content downloads, whitepapers, display advertising and integrated campaigns to connect with prospective customers. We also host and present at regional, national and global industry events.
We offer our free tier and/or a free trial to prospective customers. We then engage with these users to encourage them to upgrade to a paid version. Once a customer is onboarded with GitLab, our teams work to identify additional business units and parent/child/subsidiary prospects that would benefit from The DevSecOps platform. Finally, as engaged members of the open-source community, our contributors
15
often serve as subject matter experts at market-leading developer events, and The DevSecOps platform is presented on the cutting edge of innovation.
Competition
The markets we serve are highly competitive and rapidly evolving. With the introduction of new technologies and innovations, we expect the competitive environment to remain intense.
We operate in two primary competitive landscapes: DevSecOps point solutions and DevSecOps platforms. In terms of point solutions that are stitched together, GitLab’s offering is substantially different in that it is one platform, one codebase, one interface, and a unified data model that spans the entire DevSecOps lifecycle.
In terms of DevSecOps platforms, our principal competitor is Microsoft Corporation, which owns GitHub. We view GitLab as differentiated from GitHub in several areas, including value delivery to all personas in the software delivery lifecycle (not limited to developers), integrated security and compliance, AI throughout the software delivery process, cloud agnosticism, open core business model, and ability to scale to meet enterprise-level workloads.
Furthermore, we believe we can compete favorably based on the following factors:
•ability to provide a single application that is purpose-built to span the entire DevSecOps lifecycle;
•ability to rapidly innovate and consistently ship and release more features and versions of our software;
•maturity of features in the Create (Source Code Management) and Verify (Continuous Integration) stages;
•ability to run natively across any public cloud, private cloud, hybrid cloud, or on-premises environment;
•ability to include AI features across the DevSecOps lifecycle:
•ability to enable collaboration between developers, IT operations, and security teams;
•ability to reduce handoffs, friction, and switching costs across different stages of the DevSecOps lifecycle;
•ability to reduce software development times to release better software faster;
•ability to consolidate multiple tools into a single platform;
•ability to eliminate manual integrations that are costly and time-effective to maintain;
•ability to provide a seamless, consistent, and single user experience through one user interface;
•ability to deliver a large, engaging community of open source contributors;
•performance, scalability, and reliability;
•ability to implement more differentiated security and governance;
•quality of service and overall customer satisfaction; and
•strong documentation and transparency of information.
16
Corporate Philanthropy
As part of our mission – we empower organizations to ship secure software faster – we believe that it is important to support teams that can further this goal at local and global levels. To further this mission, in September 2021, our board of directors approved the reservation of up to 1,635,545 shares of Class A common stock for the issuance to charitable organizations, to be further designated by our board of directors.
During the year ended January 31, 2025, we donated 221,195 shares of Class A common stock at fair value to the GitLab Foundation (the “Foundation”), a California nonprofit public benefit corporation. The Foundation is also a related party as certain of our officers serve as directors of the Foundation. The fair value of the common stock was determined based on the quoted market price on the grant date. This equity donation was provided in equal quarterly distributions throughout fiscal year 2025. Donations are anticipated in fiscal year 2026.
Additionally, as part of GitLab’s Sustainability objectives, GitLab purchased $0.14 million in high-quality carbon removal reforestation credits in fiscal year 2025 to cover 4,820 tonnes of CO2e of the company's emissions.
Government Regulation
We are subject to many varying laws and regulations in the United States and throughout the world, including those related to data privacy, security and protection, intellectual property, worker classification, employment and labor, workplace safety, consumer protection, anti-bribery, import and export controls, immigration, federal securities, and tax.
Moreover, new and existing laws and regulations (or changes in interpretation of existing laws and regulations) may also be adopted, implemented, or interpreted to apply to us or our contributors, and uncertainty around the application of these laws may affect demand for our platform. Executive orders and other actions taken by the U.S. presidential administration may also create regulatory uncertainty and impact our operations in ways that are difficult to predict. Additionally, as our platform’s geographic scope continues to expand, regulatory agencies or courts may claim that we are subject to additional requirements, or are prohibited from conducting our business in or with certain jurisdictions, either generally or with respect to certain services, or that we are otherwise required to change our business practices. We believe that we are in material compliance with such laws and regulations and do not expect continued compliance to have a material impact on our capital expenditures, earnings, or competitive position. We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not expect compliance to have a material adverse effect on our business. See Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K for a more comprehensive description of risks related to government regulation affecting our business.
Intellectual Property
The protection of our technology and intellectual property is an important aspect of our business. We rely upon a combination of trademarks, trade secrets, know-how, copyrights, patents, confidentiality procedures, contractual commitments, domain names, and other legal rights to establish and protect our intellectual property. We generally enter into confidentiality agreements and invention or work product assignment agreements with our officers, team members, agents, contractors, and business partners to control access to, and clarify ownership of, our proprietary information.
As of January 31, 2025, we had twelve issued patents and nineteen pending patent applications in the United States and abroad. These patents and patent applications seek to protect proprietary inventions relevant to our business. The issued patents are scheduled to expire between 2034 and 2042.
17
As of January 31, 2025, we had 24 trademark registrations and applications in the United States, including for “GITLAB” and our logo. We also had 52 trademark registrations and applications in certain other jurisdictions and regions. Additionally, we are the registered holder of a number of domain names, including gitlab.com.
We are dedicated to open source software. Our product incorporates many components subject to open source software licenses, and in turn we license many significant components of our software under open source software licenses. Such licenses grant licensees broad permissions to use, copy, modify, and redistribute the covered software which can limit the value of our software copyright assets.
Legal Proceedings
GitLab Securities Class Action and Shareholder Derivative Cases
On September 4, 2024, a putative class action was filed in the United States District Court for the Northern District of California, captioned Dolly v. GitLab et al., Case No. 5:24-cv-06244-EKL, naming GitLab and certain of our officers. The complaint purports to assert claims under Section 10(b) of the Securities Exchange Act of 1934 (“1934 Act”), SEC Rule 10b-5, and Section 20(a) of the 1934 Act, on behalf of persons and entities who acquired our common stock between June 5, 2023 and June 3, 2024 (the “Class Period”). Plaintiff alleges that, during the Class Period, defendants made material misrepresentations or omissions regarding our use of AI features and ability to monetize our AI capabilities that artificially inflated our stock price. Plaintiff seeks, among other things, damages in an unspecified amount, as well as fees and costs. Plaintiff amended his complaint on February 5, 2025 and March 7, 2025, and we will move to dismiss the second amended complaint in April 2025.
Two putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action. The cases were filed on February 14, 2025, in the United States District Court for the Northern District of California, captioned Preciado v. Sijbrandij et al., Case No. 3:25-cv-01597 “Preciado”); and on February 19, 2025 in United States District Court for the Northern District of California, captioned Jones v. Sijbrandij et al., Case No. 3:25-cv-01735 (“Jones”). Both cases are allegedly brought on our behalf. Each of the lawsuits name us as a nominal defendant, and also certain of our officers and current and former members of our board of directors. The Jones complaint purports to assert claims under Section 14(a) of the Exchange Act as well as breach of fiduciary duty, while the Preciado complaint purports to assert those claims as well as unjust enrichment and related corporate torts. The complaints seek to recover unspecified damages and other relief on our behalf.
Based on the preliminary nature of the proceedings in these actions, the outcomes remain uncertain and the Company cannot estimate the potential impact, if any, on its business or financial statements at this time.
In addition to the shareholder matters described above, we are, and from time to time may become, involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results.
Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.
Corporate Information
We were incorporated in the State of Delaware as GitLab Inc. in September 2014. We are a remote-only company, meaning that all of our team members work remotely. Due to this, we do not currently have a headquarters. Our website address is https://about.gitlab.com. The information contained on, or
18
that can be accessed through, our website is not a part of this Annual Report on Form 10-K. Investors should not rely on any such information in deciding whether to conduct any transactions involving our Class A common stock. Unless otherwise indicated, the terms “GitLab,” the “Company,” “we,” “us,” and “our” refer to GitLab Inc., our subsidiaries, and our consolidated variable interest entity, “JiHu”. References to our “common stock” include our Class A common stock and Class B common stock.
Available Information
We file electronically with the Securities and Exchange Commission, or the SEC, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended. The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements and other information that we file with the SEC electronically. We make available on our website at https://about.gitlab.com, free of charge, copies of these reports and other information as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.
We use our investor relations page on our website (https://ir.gitlab.com/), press releases, public conference calls, public webcasts, our X account (@gitlab), our Facebook page, our LinkedIn page, our company news site (https://about.gitlab.com/press/) and our corporate blog (https://about.gitlab.com/blog/) as means of disclosing material nonpublic information and for complying with our disclosure obligations under Regulation FD. The information disclosed by the foregoing channels could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above and to review the information disclosed through such channels. Any updates to the list of disclosure channels through which we announce information will be posted on the investor relations page on our website.
The contents of the websites referred to above are not incorporated into this Annual Report on Form 10-K. Further, our references to the URLs for these websites are intended to be inactive textual references only.
19
ITEM 1A. RISK FACTORS
Investing in our Class A common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our consolidated financial statements and the accompanying notes included elsewhere in this Annual Report on Form 10-K before making a decision to invest in our Class A common stock. Our business, financial condition, operating results, or prospects could also be adversely affected by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks occur, our business, financial condition, operating results, and prospects could be adversely affected. In that event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.
Risks Related to Our Business and Financial Position
Our business and operations have experienced rapid growth, and if we do not appropriately and effectively manage future growth, if any, or are unable to improve our systems, processes and controls, our business, financial condition, results of operations, and prospects will be adversely affected.
We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 9,893 as of January 31, 2025 from 8,602 as of January 31, 2024. The growth and expansion of our business places a continuous significant strain on our management and operational and financial resources. In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and investment decisions by our customers.
We may not be able to sustain the pace of improvements to our products successfully or implement systems, processes, and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations. Failure to effectively manage growth or improve our systems, processes, and controls, or the failure to operate in the intended manner could result in the following adverse impacts to our business: difficulty or delays in deploying customers, declines in quality or customer satisfaction, increases in costs, difficulties in introducing new features or other operational difficulties, inability to manage the growth of our business and to forecast our revenue, expenses, and earnings accurately, or to prevent losses.
Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.
Our total revenue for the years ended January 31, 2025 and 2024 was $759.2 million and $579.9 million, respectively, representing a growth rate of 31%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited
20
and subject to a number of uncertainties, including our ability to plan for and model future growth. Our historical revenue growth should not be considered indicative of our future performance.
Further, in future periods, our revenue could decline or our revenue growth rate could slow. Many factors may contribute to this decline, including changes to technology, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our Class A common stock could be adversely affected.
In addition, we expect to continue to responsibly expend financial and other resources to align with our:
•expansion and enablement of our sales, services, and marketing organization to increase brand awareness and drive adoption of The DevSecOps platform;
•product development, including investments in our product development team and the development of new features and functionality for The DevSecOps platform, including those related to artificial intelligence, or AI;
•technology and sales channel partnerships;
•international expansion;
•acquisitions or strategic investments; and
•general administration, including increased legal and accounting expenses associated with being a public company.
These investments may not result in increased revenue in our business. If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.
Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth. We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business would be harmed. Moreover, if the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, or we are unable to maintain consistent revenue or revenue growth, our share price could be volatile, and it may be difficult to achieve and maintain profitability.
We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected.
We have incurred losses in each year since our inception, including net losses of approximately $173.4 million, $425.7 million and $6.3 million in fiscal year 2023, 2024 and 2025, respectively. As of January 31, 2025, we had an accumulated deficit of approximately $1.2 billion. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers
21
in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to continue to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.
As we continue to invest in infrastructure, develop our services and features, responsibly manage our headcount and expand our sales and marketing activity, we may continue to have losses in future periods and these may increase significantly. As a result, our losses in future periods may be significantly greater than the losses we would incur if we developed our business more slowly. In addition, we may find that these efforts require greater investment of time and human and capital resources than we currently anticipate and/or that they may not result in increases in our revenues or billings. Any failure by us to achieve and sustain profitability on a consistent basis could cause the value of our Class A common stock to decline.
Security and privacy breaches may hurt our business.
The DevSecOps platform hosts, processes, stores, and transmits our customers’ proprietary and sensitive data, including personal data, and financial data. We also use third-party service providers and sub-processors to help us deliver services to our customers and their end-users. These vendors may host, process, store, or transmit personal data, or other confidential information of our team members, our partners, our customers, or our customers’ end-users. We collect such information from individuals located both in the United States and abroad and may host, process, store, or transmit such information outside the country in which it was collected. While we, our third-party cloud providers, our third-party processors, and our customers have implemented security measures designed to protect against security breaches, these measures could fail or may be insufficient, resulting in the unauthorized access or disclosure, modification, misuse, destruction, or loss of our or our customers’ data or other sensitive information. Any security breach of our DevSecOps platform, our operational systems, physical facilities, or the systems of our third-party processors, or the perception that a breach has occurred, could result in litigation, indemnity obligations, regulatory enforcement actions, investigations, compulsory audits, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of our customers and other third parties, we may be considered responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach, if it is found that GitLab failed to conduct comprehensive third party risk due diligence. In addition, any failure by our vendors to comply with applicable law or regulations could result in proceedings against us by governmental entities or others.
Security incidents of ours or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result from AI related sensitive data exposure such as insufficient data anonymization during the training process, system misconfiguration, or from cyber attacks, including, but not limited to, denial-of-service attacks, reverse-engineering of AI algorithms, web scraping, ransomware attacks, business email compromises, computer
22
malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. Any security breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential information of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.
Techniques used to obtain unauthorized access or to sabotage systems change frequently. As a result, we may be unable to fully anticipate these techniques or to implement adequate preventative measures. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers. If we are, or are perceived to be, not in compliance with data protection, consumer privacy, or other legal or regulatory requirements or operational norms bearing on the collection, processing, storage, or other treatment of data records, including personal data, our reputation and operating performance may suffer. Further, we need to continually monitor and remain compliant with all applicable changes in local, state, national, or international legal or regulatory requirements. Any significant violations of data privacy could result in the loss of business, litigation, and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition.
We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify affected individuals, regulatory authorities, and relevant others of security breaches involving certain types of data, including personal data. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and may require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach.
A security breach may cause us to breach customer contracts. Our agreements with certain customers may require us to use industry-standard or reasonable measures to safeguard sensitive personal data or confidential information. A security breach could lead to claims by our customers, their end-users, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages.
Litigation resulting from security breaches may adversely affect our business. Unauthorized access to The DevSecOps platform, systems, networks, or physical facilities could result in litigation with our customers, our customers’ end-users, or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify The DevSecOps platform capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity, or availability of our data or the data of our partners, our customers or our customers’ end-users was disrupted, we could incur significant liability, or The DevSecOps platform, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.
If we fail to detect, contain, or remediate a security breach in a timely manner, or a breach otherwise affects a large amount of data of one or more customers, or if we suffer a cyber attack that impacts our ability to operate The DevSecOps platform, we may suffer material damage to our reputation, business,
23
financial condition, and results of operations. Further, while we maintain cyber insurance that may provide coverage for these types of incidents, such coverage may not be adequate to cover the costs and other liabilities related to these incidents. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim. Our risks are likely to increase as we continue to expand The DevSecOps platform, grow our customer base, and host, process, store, and transmit increasingly large amounts of proprietary and confidential data.
We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products.
The DevSecOps platform is built using open-source technology. Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber attacks as a result of our use of open source code, it may substantially damage our reputation and adversely affect our business, financial condition, and operating results.
We face intense competition and could lose market share to our competitors, which would adversely affect our business, operating results, and financial condition.
The markets for our services are highly competitive, with limited barriers to entry. Competition presents an ongoing threat to the success of our business. We expect competition in the software business generally, and in all of the stages of the software development lifecycle that our product covers, in particular, to continue to increase. We expect to continue to face intense competition from current competitors, as well as from new entrants into the market or from adjacent markets. If we are unable to anticipate or react to these challenges, our competitive position would weaken, and we would experience a decline in revenue or reduced revenue growth, and loss of market share that would adversely affect our business, financial condition, and operating results.
We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which has us competing with many providers with offerings across all stages. We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.
We believe that our ability to compete depends upon many factors both within and beyond our control, including the following:
•the ability of our products or of those of our competitors to deliver the positive business outcomes prioritized and valued by our customers and prospects;
•our ability to price our products competitively, including our ability to transition users of our free product offering to a paid version of The DevSecOps platform;
•the timing and market acceptance of services, including the developments and enhancements to those services offered by us or our competitors, including incorporation of AI into such services;
•the amount and quality of communications, postings, and sharing by our users on public forums, which can promote improvements on The DevSecOps platform but may also lead to disclosure of commercially sensitive details;
•our ability to monetize activity on our services;
•customer service and support efforts;
24
•sales and marketing efforts;
•ease of use, performance and reliability of solutions developed either by us or our competitors;
•our ability to manage our operations in a cost effective manner;
•insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our product offering;
•our reputation and brand strength relative to our competitors;
•introduction of new technologies or standards that compete with or are unable to be adopted in our products;
•ability to attract new team members or retain existing team members which could affect our ability to attract new customers, service existing customers, enhance our product or handle our business needs;
•our ability to maintain and grow our community of users; and
•the length and complexity of our sales cycles.
Many of our current and potential competitors have greater financial, technical, marketing and other resources and larger customer bases than we do. Furthermore, our current or potential competitors may be acquired by third parties with greater available resources and the ability to initiate or withstand substantial price competition. In addition, many of our competitors have established sales and marketing relationships and have access to larger customer bases. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their product offerings or resources. These factors may allow our competitors to respond more quickly than we can to new or emerging technologies and changes in customer preferences. These competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may undercut our pricing policies and allow them to build a larger user base or to monetize that user base more effectively than us. If our competitors’ products, platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected.
In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels, our operating results would be negatively affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.
Many of our users extend the functionality of The DevSecOps platform using third-party code editors and integrated development environments, or IDEs, including editors and IDEs developed by our competitors. Our development and distribution of integrations with such tools is subject to the integration policies and technical specifications imposed by the developer of the tool. A change to the policies and specifications pertaining to any of these third-party tools (including those developed by Microsoft), could cause us to lose market share to competitors whose products and services continue to support integrations with such tools.
We may not be able to respond to rapid technological changes with new solutions, which could have a material adverse effect on our operating results.
The DevSecOps market is characterized by rapid technological change, fluctuating price points, and frequent new product and service introductions. Our ability to increase our user base and increase
25
revenue from existing customers will depend heavily on our ability to enhance and improve our existing solutions, introduce new features and products, both independently and in conjunction with third-party developers and technology partners, reach new platforms and sell into new markets. Customers may require features and capabilities that our current solutions do not have. If we fail to develop solutions that satisfy customer preferences in a timely and cost-effective manner, we may fail to renew our subscriptions with existing customers and create or increase demand for our solutions, and our business may be materially and adversely affected.
The introduction of new services by competitors or the development of entirely new technologies to replace existing offerings could make our solutions obsolete or adversely affect our business. In addition, any new markets or countries into which we attempt to sell our solutions may not be receptive. We may experience difficulties, including delayed releases and upgrades, with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new solutions and enhancements. Delayed releases or upgrades, or releases with defects, could result in adverse publicity, loss of revenue, delay in market acceptance, or claims by customers brought against us, all of which could have a material adverse effect on our reputation, business, operating results, and financial condition. Moreover, upgrades and enhancements to our solutions may require substantial investment and we have no assurance that such investments will be successful. If users do not widely adopt enhancements to our solutions, we may not be able to realize a return on our investment. If we are unable to develop, license, or acquire enhancements to our existing solutions on a timely and cost-effective basis, or if such enhancements do not achieve market acceptance, our business, operating results, and financial condition may be adversely affected.
If our services fail to perform properly, whether due to material defects with the software or external issues, our reputation could be adversely affected, our market share could decline, and we could be subject to liability claims.
Our products are inherently complex and may contain material defects, software “bugs” or errors. Any defects in functionality or operational procedures that cause interruptions in the availability of our products could result in:
•loss or delayed market acceptance and sales;
•loss of data;
•breach of warranty claims;
•sales credits or refunds for prepaid amounts related to unused subscription services;
•loss of customers;
•diversion of development and customer service resources;
•loss of operational time;
•destruction or compromised integrity of data and/or intellectual property; and
•injury to our reputation.
The costs incurred in correcting any material defects, software “bugs” or errors might be substantial and could adversely affect our operating results.
We rely on information technology systems to process, transmit and store electronic information. Our ability to effectively manage our business depends significantly on the reliability and capacity of these systems. The operation, success and growth of our business (whether now or in the future) depends on streamlined processes made available through information systems, global communications, internet activity, and other network processes. The future operation, success and growth of our business depends
26
on streamlined processes made available through information systems, global communications, internet activity, and other network processes.
Our information technology systems may be subject to damage or interruption from telecommunications problems, data corruption, software errors, fire, flood, acts of terror and armed conflicts, global pandemics and natural disasters, power outages, systems disruptions, system conversions, and/or human error. Our existing safety systems, data backup, access protection, user management and information technology emergency planning may not be sufficient to prevent data loss or long-term network outages. In addition, we may have to upgrade our existing information technology systems or choose to incorporate new technology systems from time to time in order for such systems to support the increasing needs of our expanding business. Introduction of new technology, or upgrades and maintenance to our existing systems, could result in increased costs or unforeseen problems which may disrupt or reduce our operating efficacy.
We may also encounter service interruptions, outage, or disruption due to issues interfacing with our customers’ IT systems, including stack misconfigurations or improper environment scaling, defective updates or upgrades, or due to cybersecurity attacks on ours or our customers’ IT systems. Any such service interruption may have an adverse impact on our reputation and future operating results.
Because of the nature and importance of the data that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including: customers’ inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events. If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.
While we currently maintain errors and omissions insurance, it may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.
The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.
Because the market for our services is relatively new and rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services. Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide. Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be able to compete effectively or achieve market acceptance of our products. If we or other software and SaaS providers
27
experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected. If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.
We are dependent on sales and marketing strategies to drive our growth in our revenue. These sales and marketing strategies may not be successful in continuing to generate sufficient sales opportunities. Any decline in our customer renewals and expansions could harm our future operating results.
Our business model depends on generating and maintaining a large user base that is satisfied with The DevSecOps platform. We rely on satisfied customers to expand their footprint by buying new products and services and onboarding additional users. We have implemented user limits on our free SaaS product, and have limited historical data with respect to the number of current and previous free users and the rates in which customers convert to paying customers. As a result, we may not accurately predict future customer purchasing trends.
In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.
It could also become increasingly difficult to predict revenue and timing of collections as our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings. Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.
Our future success also depends in part on our ability to sell more subscriptions and additional services to our current customers. Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease the number of seats in their subscription. If our customers do not purchase additional subscriptions and services from us, our revenue may decline and our operating results may be harmed. Paying customers may decline or fluctuate as a result of a number of factors, including their satisfaction with our services and our end-customer support, the frequency and severity of product outages, our product uptime or latency, their satisfaction with the speed of delivering new features, the pricing of our, or competing, services, and the impact of macroeconomic conditions on our customers and their corporate spending. We have limited historical data with respect to rates of paying customers buying more seats, uptiering, downtiering and churning, so we may not accurately predict future customer trends.
Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and downtiers may increase, or fluctuate, as a result of a number of factors, including: quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices
28
(including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.
Further, we have previously discontinued certain lower priced product offerings, requiring users of these products to switch to another paid offering, switch to our free product or discontinue using our products. Additionally, we have implemented user limits on our free SaaS product. To the extent we discontinue or add additional limits on our free or lower-priced product offerings, we cannot assure you that our customers will purchase our products, and if our end customers do not purchase our products, our revenues may grow more slowly than expected or decline.
Our operating results may fluctuate significantly, which could make our future results difficult to predict and could adversely affect the trading price of our Class A common stock.
Our operating results may vary significantly from period to period, which could adversely affect our business and financial condition. Our operating results have varied significantly from period to period in the past, and we expect that our operating results will continue to vary significantly in the future such that period-to-period comparisons of our operating results may not be meaningful. Accordingly, our financial results in any one quarter or fiscal year should not be relied upon as indicative of future performance. Our quarterly or annual financial results may fluctuate as a result of several factors, many of which are outside of our control and may be difficult to predict, including:
•our ability to attract and retain new customers;
•the addition or loss of material customers, including through acquisitions or consolidations;
•the timing of recognition of revenues;
•the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;
•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;
•customer renewal rates;
•the timing and success of new service introductions by us or our competitors or any other change in the competitive dynamics of our industry, including consolidation among competitors, customers or strategic partners;
•our ability to convert users of our free product offerings into subscribing customers;
•increases or decreases in the number of elements of our services or pricing changes upon any renewals of customer agreements;
29
•allocation of software development in customers’ budget;
•seasonal variations in sales of our products;
•decisions by potential customers to use products of our competitors;
•the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill from acquired companies;
•extraordinary expenses such as litigation or other dispute-related settlement payments or outcomes;
•future accounting pronouncements or changes in our accounting policies or practices;
•negative media coverage or publicity;
•political events;
•the amount and timing of operating costs and capital expenditures related to the expansion of our business, in the U.S. and foreign markets;
•the cost to develop and upgrade The DevSecOps platform to incorporate new technologies; and
•increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.
In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our last two fiscal quarters as compared to the first two fiscal quarters due to the annual budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation and volatile interest rates.
Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. As a result of this variability, our historical operating results should not be relied upon as an indication of future performance. Moreover, this variability and unpredictability could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for the reasons described above or any other reasons, our stock price could fall substantially.
As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.
As our product offerings and the markets for our services mature, or as new competitors introduce new products or services that are similar to or compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, some customers may demand greater price concessions or additional functionality at the same price levels. As a result, in the future we may be required to reduce our prices or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.
In addition, our customers have no obligation to renew their subscriptions for our services after the expiration of the initial subscription period. A majority of our subscriptions are on a one-year period. Our customers may renew for fewer or other elements of our services or negotiate for different pricing terms. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their
30
dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization. Changes in product packaging, pricing strategy, or product offerings, or the implementation or execution of the foregoing, may not be seen favorably by our customers and may have an adverse effect on our ability to retain our current customers and acquire new ones. For example, we have previously discontinued certain lower priced product offerings, and we have in the past implemented price increases, which may cause customers who previously used these tiers to opt for our free version or to cease using our products completely. We may also decide to raise the prices of our product offerings in the future. If our customers do not renew their subscriptions on similar pricing terms, our revenues may decline, and our business could suffer. In addition, over time the average term of our contracts could change based on renewal rates or for other reasons.
The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations.
We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features. The technologies underpinning these features are in the early stages of commercial use and exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.
Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies, such as the E.U. Artificial Intelligence Act, which came into effect on August 1, 2024. These regulations may impose onerous obligations related to our, and our vendors’, development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.
Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area. Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.
Furthermore, many of our generative AI features involve the processing of personal data and may be subject to laws, policies, legal obligations, and codes of conduct related to privacy and data protection. While there is current uncertainty about the extent to which privacy and data protection laws apply to AI technologies, any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.
Our generative AI features may also generate output that is misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.
We rely on third-party vendors for the provision of the AI models which power many of our AI features. In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected.
Further, developing, testing, and offering AI-powered features may lead to greater than expected expenditures for our company because deploying AI systems involves high computing costs, which could adversely affect our gross margin, profitability, financial position, and cash flow.
31
Transparency is one of our core values. While we will continue to prioritize transparency, we must also promote "responsible" transparency as transparency can have unintended negative consequences.
Transparency is one of our core values. As an all-remote open-source software company, we believe transparency is essential to how we operate our business and interact with our team members, the community, and our customers. We also find it to be critical for team member recruitment, retention, efficiency and our culture. In addition, our transparency is highly valued by both our customers and our contributors. While we will continue to emphasize transparency, we also promote and educate our team members about responsible internal and external transparency, as openly sharing certain types of information can potentially lead to unintended, and sometimes negative, consequences.
As a result of our transparency, our competitors and other outside parties may have access to certain information that is often kept confidential or internal at other companies through our Handbook, our team members’ open and public use of The DevSecOps platform to run our business, and other avenues of communication we commonly use. The public availability of this information may allow our competitors to take advantage of certain of our innovations, and may allow parties to take other actions, including litigation, that may have an adverse impact on our operating results or cause reputational harm, which in turn may have a negative economic impact.
We are also subject to Regulation FD, which imposes restrictions on the selective disclosure of material information to stockholders and other market participants, and other regulations. While we have implemented internal controls to maintain compliance with Regulation FD, if as a result of our transparency, we disclose material information in a non-Regulation FD compliant matter, we may be subject to heightened regulatory and litigation risk.
The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.
Consistent with our commitment to our transparency and efficiency values, we maintain a publicly available company Handbook that contains important information about our operations and business practices. This Handbook is open to the public and may be used by our competitors or bad actors in malicious ways that may adversely affect our business, operating results, and financial condition. Although we aim to keep the Handbook updated, the information in the Handbook may not be up to date at all times. Also, because any of our team members can contribute to the Handbook, the information in the Handbook may not be accurate. We have implemented disclosure controls and procedures, including internal controls over financial reporting, that comply with the U.S. securities laws; however, if we fail to successfully maintain the appropriate controls, we may face unintended disclosures of material information about the company through our Handbook, which may lead to disclosure control failures, potential securities law violations, and reputational harm.
Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer.
Our future success depends, in part, on our ability to convert users of our free self-managed or SaaS product offerings into paying customers by selling additional products, and by upselling additional subscription services. The total number of users of our free SaaS product may decline as a result of, or due to, our enforcement of user limits. As a result of our investment in new capabilities and improvements to our free product offering, users of our free product may decline to purchase additional products or subscription services if they perceive the free product to be more attractive as compared to our paid offerings. Converting users of our free product offering may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our end-customers purchase additional products and services depends on a number of factors, including the perceived need for additional products and services, the limitations on the number of users and limitations on storage and
32
transfers applicable to the free product offering as well as general economic conditions. If our efforts to sell additional products and services to our end-customers are not successful, our business may suffer.
Failure to effectively expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our services.
Our ability to increase our customer base and expand with existing customers will depend to a significant extent on our ability to continue to expand our marketing and sales operations. We plan to continue expanding our sales force. We also plan to continue to dedicate resources to sales and marketing programs. We are expanding our marketing and sales capabilities to target additional potential customers, including some larger organizations, but there is no guarantee that we will be successful attracting and maintaining these businesses as customers, and even if we are successful, these efforts may divert our resources away from and negatively impact our ability to attract and maintain our current customer base. All of these efforts will require us to invest financial and other resources. If we are unable to find efficient ways to deploy our marketing spend or to hire, develop, and retain talent required to maintain and support our growth, if our new sales talent are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective, our ability to increase our customer base and achieve broader market acceptance of our services could be harmed.
Any failure to offer high-quality technical support services, including success plan services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.
Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success plan services that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.
Customers may demand more customized configuration and integration services, or custom features and functions that we do not offer, which could adversely affect our business and operating results.
Our current and future customers may demand more customized configuration and integration services, which increase our up-front investment in sales and deployment efforts, with no guarantee that these customers will increase the scope of their subscription. As a result of these factors, we may need to devote a significant amount of sales, operations, engineering, support, and professional services resources to individual customers, increasing the cost and time required to complete sales. If prospective customers require customized features or functions that we do not offer, and which would be difficult for them to deploy themselves, then the market for our applications will be more limited and our business could suffer.
If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, and changing customer needs, requirements, or preferences, our services may become less competitive.
Our industry is subject to rapid technological change, evolving industry standards and practices, and changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including our ability to timely provide enhancements and new features for our existing services or new services that
33
achieve market acceptance or that keep pace with rapid technological developments and the competitive landscape. The success of new services and enhancements depends on several factors, including the timely delivery, introduction, and market acceptance of such services. If we are unable to develop and sell new services that satisfy our customers and provide enhancements and new features for our existing services that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected. Furthermore, we have in the past experienced delays in the planned release dates of new features and upgrades, and have discovered defects in new solutions after their introduction. There can be no assurance that new solutions or upgrades will be released according to schedule, or that when released they will not contain defects. If new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.
Our services must also integrate with a variety of network, hardware, mobile, cloud, and software platforms and technologies, including third-party AI services, and we need to continuously modify and enhance our services to adapt to changes and innovation in these technologies, including changes in internet-related hardware, operating systems, cloud computing infrastructure, and other software, communication, browser and open source technologies. If developers widely adopt new software platforms, we would have to develop new versions of our products to work with those new platforms. This development effort may require significant engineering, marketing, and sales resources, all of which would affect our business and operating results. Any failure of our services to operate effectively with future infrastructure platforms and technologies could reduce the demand for our products and significantly impair our revenue growth. We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, could increase our research and development expenses. If we are unable to respond to these changes in a timely or cost-effective manner, our services may become less marketable and less competitive or obsolete, which may result in customer dissatisfaction, and adversely affect our business.
Our channel partners may provide a poor experience to customers putting our brand or company growth at risk. Channel partners may deliver poor services or a poor selling experience delaying customer purchase or hurting the company brand.
In addition to our direct sales force, we use channel partners to sell and support our products. Channel partners may become an increasingly important aspect of our business, particularly with regard to enterprise, governmental, and international sales. Our future growth in revenue and ability to achieve and sustain profitability may depend in part on our ability to identify, establish, and retain successful channel partner relationships in the United States and internationally, which will take significant time and resources and involve significant risk. If we are unable to maintain our relationships with these channel partners, or otherwise develop and expand our indirect distribution channel, our business, operating results, financial condition, or cash flows could be adversely affected.
We cannot be certain that we will be able to identify suitable indirect sales channel partners. To the extent we do identify such partners, we will need to negotiate the terms of a commercial agreement with them under which the partner would distribute The DevSecOps platform. We cannot be certain that we will be able to negotiate commercially-attractive terms with any channel partner, if at all. In addition, all channel partners must be trained to distribute The DevSecOps platform and must allocate appropriately skilled resources to the customers. In order to develop and expand our distribution channel, we must develop and improve our processes for channel partner introduction and training. If we do not succeed in identifying suitable indirect sales channel partners, our business, operating results, and financial condition may be adversely affected.
We also cannot be certain that we will be able to maintain successful relationships with any channel partners and, to the extent that our channel partners are unsuccessful in selling our products, our ability to sell our products and our business, operating results, and financial condition could be adversely
34
affected. Our channel partners may offer customers the products and services of several different companies, including products and services that compete with our products. Because our channel partners generally do not have an exclusive relationship with us, we cannot be certain that they will prioritize or provide adequate resources to sell our products. Moreover, divergence in strategy by any of these channel partners may materially adversely affect our ability to develop, market, sell, or support our products. We cannot assure you that our channel partners will continue to cooperate with us. In addition, actions taken or omitted to be taken by such parties may adversely affect us. In addition, we rely on our channel partners to operate in accordance with the terms of their contractual agreements with us. For example, our agreements with our channel partners limit the terms and conditions pursuant to which they are authorized to resell or distribute our products and offer technical support and related services. We also typically require our channel partners to represent to us the dates and details of products sold through to our customers. If our channel partners do not comply with their contractual obligations to us, our business, operating results, and financial condition may be adversely affected.
We track certain performance metrics with internal tools and data models and do not independently verify such metrics. Certain of our performance metrics are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and negatively affect our business.
Our internal tools and data models have a number of limitations and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. We calculate and track performance metrics with internal tools, which are not independently verified by any third party. While we believe our metrics are reasonable estimates of our customer base for the applicable period of measurement, the methodologies used to measure these metrics require significant judgment and may be susceptible to algorithmic or other technical errors. For example, the accuracy and consistency of our performance metrics may be impacted by changes to internal assumptions regarding how we account for and track customers, limitations on system implementations, and limitations on the ability of third-party tools to match our database. If the internal tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate. In addition, limitations or errors with respect to how we measure data (or the data that we measure) may affect our understanding of certain details of our business, which could affect our longer-term strategies. If our performance metrics are not accurate representations of our business, user base, or traffic levels; if we discover material inaccuracies in our metrics; or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.
We rely to a significant degree on a number of independent open source contributors, to develop and enhance the open source technologies we use to provide our products and services.
In our development process we rely upon numerous open core software programs which are outside of our direct control. Members of corresponding leadership committees and core teams, many of whom are not employed by us, are primarily responsible for the oversight and evolution of the codebases of these open source technologies. If the project committees and contributors fail to adequately further develop and enhance open source technologies, or if the leadership committees fail to oversee and guide the evolution of the open source technologies in the manner that we believe is appropriate to maximize the market potential of our offerings, then we would have to rely on other parties, or we would need to expend additional resources, to develop and enhance our offerings. We also must devote adequate resources to our own internal contributors to support their continued development and enhancement of open source technologies, and if we do not do so, we may have to turn to third parties or experience delays in developing or enhancing open source technologies. We cannot predict whether further developments and enhancements to these technologies will be available from reliable alternative sources. In either event, our development expenses could be increased, and our technology release and upgrade schedules could be delayed. Delays in developing, completing, or delivering new or enhanced offerings
35
could cause our offerings to be less competitive, impair customer acceptance of our offerings and result in delayed or reduced revenue for our offerings.
Our failure or inability to protect our intellectual property rights, or claims by others that we are infringing upon or unlawfully using their intellectual property, could diminish the value of our brand and weaken our competitive position, and adversely affect our business, financial condition, operating results, and prospects.
We currently rely on a combination of copyright, trademark, patent, trade secret, and unfair competition laws, as well as confidentiality agreements and procedures and licensing arrangements, to establish and protect our intellectual property rights. We have devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on patent and trade secret laws and confidentiality agreements with our team members, licensees, independent contractors, commercial partners, and other advisors. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. We cannot be certain that the steps taken by us to protect our intellectual property rights will be adequate to prevent infringement of such rights by others. Additionally, the process of obtaining patent or trademark protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications or apply for all necessary or desirable trademark applications at a reasonable cost or in a timely manner. Moreover, intellectual property protection may be unavailable or limited in some foreign countries where laws or law enforcement practices may not protect our intellectual property rights as fully as in the United States, and it may be more difficult for us to successfully challenge the use of our intellectual property rights by other parties in these countries. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and our failure or inability to obtain or maintain trade secret protection or otherwise protect our proprietary rights could adversely affect our business.
We may in the future be subject to intellectual property infringement claims and lawsuits in various jurisdictions, and although we are diligent in our efforts to protect our intellectual property we cannot be certain that our products or activities do not violate the patents, trademarks, or other intellectual property rights of third-party claimants. Companies in the technology industry and other patent, copyright, and trademark holders seeking to profit from royalties in connection with grants of licenses own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently commence litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. As we face increasing competition and gain an increasingly high profile, the likelihood of intellectual property rights claims against us may grow.
Further, from time to time, we may receive letters from third parties alleging that we are infringing upon their intellectual property rights or inviting us to license their intellectual property rights. Our technologies and other intellectual property may be found to infringe upon such third-party rights, and such successful claims against us could result in significant monetary liability, prevent us from selling some of our products and services, or require us to change our branding. In addition, resolution of claims may require us to redesign our products, license rights from third parties at a significant expense, or cease using those rights altogether. And we may in the future bring claims against third parties for infringing our intellectual property rights. Costs of supporting such litigation and disputes may be considerable, and there can be no assurances that a favorable outcome will be obtained. Patent infringement, trademark infringement, trade secret misappropriation, and other intellectual property claims and proceedings brought against us or brought by us, whether successful or not, could require significant attention of our management and resources and have in the past and could further result in substantial costs, harm to our brand, and have an adverse effect on our business.
36
Our open source and source code-available business model makes our software vulnerable to authorized and unauthorized distribution and sale.
We license many significant components of our software under permissive open source software licenses which grant licensees broad permissions to use, copy, modify, and distribute the covered software. Under these licenses, third parties are entitled to distribute and sell the covered software without payment to us.
Features available on our paid tiers are source code-available subject to a proprietary software license. This proprietary license prohibits, amongst other things, distribution and sale of the covered software. Notwithstanding these prohibitions, by virtue of the source code’s being publicly available, the covered software is vulnerable to unauthorized distribution and sale by third parties.
We are or may be the defendant in lawsuits or other claims that could cause us to incur substantial liabilities.
We have from time to time been, and are likely to in the future become, defendants in actual or threatened lawsuits brought by or on behalf of our current and former team members, competitors, vendors, shareholders, governmental or regulatory bodies, or third parties who use The DevSecOps platform. In addition, our agreements sometimes include indemnification provisions which can subject us to costs and damages in the event of a claim against an indemnified third party. In either case, the various claims in such lawsuits may include, among other things, negligence or misconduct in the operation of our business and provision of services, intellectual property infringement, unfair competition, or violation of employment or privacy laws or regulations. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate. However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits. In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions. An unfavorable outcome with respect to these lawsuits and any future lawsuits could, individually or in the aggregate, cause us to incur substantial liabilities that may have a material adverse effect upon our business, financial condition or results of operations. In addition, an unfavorable outcome in one or more of these cases could cause us to change our compensation plans for our team members, which could have a material adverse effect upon our business. Further, while we maintain insurance that may provide coverage for these types of lawsuits and other claims, such coverage may not be adequate to cover the related costs and other liabilities.
We may engage in merger and acquisition activities and joint ventures, which could require significant management attention, disrupt our business, dilute stockholder value, and adversely affect our operating results.
As part of our business strategy, we have in the past and expect to continue to make investments in and/or acquire other companies, products, or technologies. We may not be able to find suitable acquisition candidates and we may not be able to complete acquisitions on favorable terms, if at all. Even if we complete acquisitions or joint ventures, we may not ultimately strengthen our competitive position or achieve our goals, and any acquisitions or joint ventures we complete could be viewed negatively by users or investors. In addition, if we fail to successfully integrate such acquisitions, or the assets, technologies or talent associated with such acquisitions, into our company, we may have depleted the company’s capital resources without attractive returns, and the revenue and operating results of the combined company could be adversely affected.
We may face additional risks in connection with acquisitions and joint ventures, including:
•diversion of management time and focus from operating our business to addressing acquisition integration challenges;
37
•coordination of research and development and sales and marketing functions;
•integration of product and service offerings;
•retention of key team members from the acquired company;
•changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;
•integration of customers from the acquired company;
•cultural challenges associated with integrating team members from the acquired company into our organization;
•integration of the acquired company’s accounting, management information, human resources and other administrative systems;
•the need to implement or improve controls, procedures and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;
•additional legal, regulatory or compliance requirements;
•financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we do not adequately address and that cause our reported results to be incorrect;
•liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;
•unanticipated write-offs or charges; and
•litigation or other claims in connection with the acquired company, including claims from terminated team members, customers, former stockholders or other third parties.
Further, we may have to pay cash, incur debt, or issue equity securities to pay for any such acquisition or joint venture, each of which could affect our financial condition or the value of our capital stock and could result in dilution to our stockholders. If we incur more debt it would result in increased fixed obligations and could also subject us to covenants or other restrictions that would impede or may be beyond our ability to manage our operations. Additionally, we may receive indications of interest from other parties interested in acquiring some or all of our business. The time required to evaluate such indications of interest could require significant attention from management, disrupt the ordinary functioning of our business, and adversely affect our operating results.
Our failure to address these risks or other problems encountered in connection with acquisitions activities and joint ventures could cause us to fail to realize the anticipated benefits of these acquisitions, investments or joint ventures, cause us to incur unanticipated liabilities, and harm our business generally.
If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.
The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in
38
preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, business combinations, and impairment of goodwill. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.
Adverse tax laws or regulations could be enacted or existing laws could be applied to us or our customers, which could increase the costs of our services and adversely impact our business.
The application of federal, state, local, and international tax laws to services provided electronically is evolving. New sales, use, value-added tax, digital service or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time (possibly with retroactive effect), and could be applied solely or disproportionately to services provided over the internet. If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows. Moreover, we are subject to the examination of our sales, use, and value-added tax returns by U.S. state and foreign tax authorities. We regularly assess the likelihood of outcomes resulting from these examinations and have reserved for potential adjustments that may result from these examinations. We cannot provide assurance that the final determination of these examinations will not have an adverse effect on our financial position and results of operations.
The termination of our relationship with our payment solutions providers could have a severe, negative impact on our ability to collect revenue from customers.
All web direct customers purchase our solution using online payment solutions such as credit cards, which represent the majority of the payment transactions we receive, and our business depends upon our ability to offer such payment options. The termination of our ability to process payments on any material payment option would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing. If we fail to maintain our compliance with the data protection and documentation standards adopted by our payment processors and applicable to us, these processors could terminate their agreements with us, and we could lose our ability to offer our customers a credit card or other payment option. If these processors increase their payment processing fees because we experience excessive chargebacks or refunds or for other reasons, it could adversely affect our business and operating results. Increases in payment processing fees would increase our operating expense and adversely affect our operating results.
We process, store and use personal data and other data, which subjects us to governmental regulation and other legal obligations, including in the United States, the European Union, or the E.U., the United Kingdom, or the U.K., Canada, and Australia, related to privacy, and our actual or perceived failure to comply with such laws, regulations and contractual obligations could result in significant liability and reputational harm.
We receive, store and process personal data and other customer data. There are numerous federal, state, local and foreign laws regarding privacy and the storing, sharing, access, use, processing, disclosure and protection of personal data and other customer data, the scope of which is changing, subject to differing interpretations, and which may be inconsistent among countries or conflict with other rules.
With respect to E.U. and U.K. team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the E.U. General Data Protection Regulation, or the GDPR, and applicable national implementing legislation of the GDPR, and the U.K. General Data Protection Regulation and U.K. Data Protection Act 2018, or the U.K. GDPR, respectively. We are a controller with respect to this data.
The GDPR and U.K. GDPR impose stringent data protection requirements and, where we are acting as a controller, includes requirements to: provide detailed disclosures about how personal data is
39
collected and processed (in a concise, intelligible and easily accessible form); demonstrate that an appropriate legal basis is in place or otherwise exists to justify data processing activities; grant rights for data subjects in regard to their personal data including the right to be “forgotten,” the right to data portability, the right to correct personal data, and the right to access personal data; notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; define pseudonymized (key-coded) data; limit the retention of personal data; maintain a record of data processing; and comply with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, trainings and audits. Where we act as a processor and process personal data on behalf of our customers, we are required to execute mandatory data processing clauses with those customers and maintain a record of data processing, among other requirements under the GDPR and U.K. GDPR. The GDPR and U.K. GDPR provide for penalties for noncompliance of up to the greater of €20 million or 4% of worldwide annual revenues (in the case of the GDPR) or £17 million and 4% of worldwide annual revenue (in the case of the U.K. GDPR). As we are required to comply with both the GDPR and the U.K. GDPR, we could be subject to parallel enforcement actions with respect to breaches of the GDPR or U.K. GDPR which affects both E.U. and U.K. data subjects. In addition to the foregoing, a breach of the GDPR or U.K. GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our personal data, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.
The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Legal developments in the E.U. have resulted in complexity and uncertainty regarding such transfers. For example, the European Court of Justice, or the CJEU, has previously advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism) are not alone sufficient to protect data transferred to the United States or other countries not deemed adequate and the current E.U.-U.S. Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A. and the U.K, has been subject to proposed legal challenges before the CJEU. Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board has also issued a decision imposing higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers and the CJEU has stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, supervisory authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. personal data to the United States. We will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business. In addition, if participation in the DPF is deemed appropriate, then we would be required to update documentation and processes, which may result in further compliance costs.
40
In addition, following the U.K.’s withdrawal from the E.U., the E.U. issued an adequacy decision in June 2021 in favor of the U.K. permitting data transfers from the E.U. to the U.K. However, this adequacy decision is subject to a four-year term set to expire in 2025, and the E.U. could intervene during the term if it determines that the data protection laws in the U.K. are not sufficient. If the adequacy decision is not renewed after its term, or the E.U. intervenes during the term, data may not be able to flow freely from the E.U. to the U.K. unless additional measures are taken. In which case, we may be required to find alternative solutions for the compliant transfer of personal data into the U.K. from the E.U. As supervisory authorities continue to issue further guidance on personal data (including regarding data export and circumstances in which we cannot use the Standard Contractual Clauses), we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.
We are also subject to evolving E.U. and U.K. privacy laws on cookies and e-marketing. In the E.U. and the U.K., regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may increase fines for non-compliance. In the E.U. and the U.K., informed consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing. The U.K. GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Further, a recent European court decision and regulators’ recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.
We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf or as our sub-processor. To the extent required by applicable law, we attempt to mitigate the associated risks of using third parties by performing security assessments and detailed due diligence, entering into contractual arrangements to ensure that providers only process personal data according to our instructions or equivalent instructions to that of our customer (as applicable), and that they have sufficient technical and organizational security measures in place. Where we transfer personal data outside the E.U. or the U.K. to such third parties, we do so in compliance with the relevant data export requirements, as described above. There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information. Any violation of data or security laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties under the GDPR and the U.K. GDPR outlined above.
Additionally, we are subject to the California Consumer Privacy Act, or the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA, among other things, requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security
41
breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Compliance with privacy legislation adds complexity and has required and may in the future require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.
We are also currently subject to China’s Personal Information Protection Law, or PIPL, which came into effect in November 2021 and which increases the protections of Chinese residents. In particular, the law is intended to protect the rights and interests of individuals, to regulate personal data processing activities, to safeguard the lawful and “orderly flow” of data, and to facilitate reasonable use of personal data. Our failure to comply with the PIPL may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results. Also, the Cyberspace Administration of China has developed measures to govern cross-border transfers of personal data, such as security assessments, certifications, and Standard Contractual Clauses, all of which may impact our ability to transact with customers with operations in China. To reduce the impact of PIPL, we are in the process of transitioning certain users who are resident in China to our JiHu entity.
Further, we are subject to Payment Card Industry Data Security Standard, or PCI-DSS, a security standard applicable to companies that collect, store or transmit certain data regarding credit and debit cards, holders and transactions. We rely on vendors to handle PCI-DSS matters and to ensure PCI-DSS compliance. Despite our compliance efforts, we may become subject to claims that we have violated the PCI-DSS based on past, present, and future business practices. Our actual or perceived failure to comply with the PCI-DSS can subject us to fines, termination of banking relationships, and increased transaction fees. In addition, there is no guarantee that PCI-DSS compliance will prevent illegal or improper use of our payment systems or the theft, loss or misuse of payment card data or transaction information.
We generally seek to comply with industry standards and are subject to the terms of our privacy policies and privacy-related obligations to third parties. We strive to comply with all applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data protection to the extent possible. However, it is possible that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any failure or perceived failure by us to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to users or other third parties, or any compromise of security that results in the unauthorized release or transfer of personal data or other customer data, may result in governmental enforcement actions, litigation, or public statements against us by consumer advocacy groups or others and could cause our users to lose trust in us, which would have an adverse effect on our reputation and business. It is possible that a regulatory inquiry might result in changes to our policies or business practices. Violation of existing or future regulatory orders or consent decrees could subject us to substantial monetary fines and other penalties that could negatively affect our financial condition and operating results. In addition, it is possible that future orders issued by, or enforcement actions initiated by, regulatory authorities could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.
42
Any significant change to applicable laws, regulations or industry practices regarding the use or disclosure of our users’ data, or regarding the manner in which the express or implied consent of users for the use and disclosure of such data is obtained – or in how these applicable laws, regulations or industry practices are interpreted and enforced by state, federal and international privacy regulators – could require us to modify our services and features, possibly in a material manner, may subject us to regulatory enforcement actions and fines, and may limit our ability to develop new services and features that make use of the data that our users voluntarily share with us.
We are subject to various governmental export controls, trade sanctions, and import laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls.
In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC, and collectively, Trade Controls. As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. For example, Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries, and have sanctioned various entities and individuals located there, while recent sanctions restrict the provision of certain cloud services to Russia. Those Trade Controls are unprecedented and expansive, and may continue to evolve. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.
We have procedures in place designed to ensure our compliance with Trade Controls, with which failure to comply could subject us to both civil and criminal penalties, including substantial fines, possible incarceration of responsible individuals for willful violations, possible loss of our export or import privileges, and reputational harm. We are currently working to enhance these procedures. Trade Controls are complex and dynamic regimes, and monitoring and ensuring compliance can be challenging, particularly given that our products are widely distributed throughout the world and are available for download without registration. Prior to implementing certain control procedures, we inadvertently exported our software to entities located in embargoed countries and listed on denied parties lists administered by the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, and OFAC. In September 2019, we disclosed these apparent violations to BIS and OFAC, which resulted in a BIS Warning Letter and an OFAC Cautionary Letter, in January and February 2020, respectively. While BIS and OFAC did not assess any penalties, we understand that BIS and OFAC may consider our regulatory history, including these prior disclosures and warning/cautionary letters, if the company is involved in a future enforcement case for failure to comply with export control laws and regulations. Any future failure by us or our partners to comply with applicable laws and regulations would have negative consequences for us, including reputational harm, government investigations, and penalties.
In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our end-customers’ ability to implement our products in those countries. Changes in our products or changes in export and import regulations in such countries may create delays in the introduction of our products into international markets, prevent our end-customers with international operations from deploying our products globally or, in some cases, prevent or delay the export or import of our products to certain countries, governments, or persons altogether. Any change in export or import laws or regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing export, import or sanctions laws or regulations, or change in the countries, governments, persons, or technologies targeted by such export, import or sanctions laws or regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations. Any decreased use of our products or limitation on our ability to export to or sell our products in international markets could adversely affect our business, financial condition, and results of operations.
43
Failure to comply with anti-bribery, anti-corruption, anti-money laundering laws, and similar laws, could subject us to penalties and other adverse consequences.
We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010 and other anti-bribery and anti-money laundering laws in countries outside of the United States in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their team members, and their third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.
We sometimes leverage third parties to sell our products and services and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our team members, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities. We cannot assure you that all of our team members and agents will not take actions in violation of applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.
Any allegations or actual violation of the FCPA or other applicable anti-bribery, anti-corruption laws, and anti-money laundering laws could result in whistleblower complaints, sanctions, settlements, prosecution, enforcement actions, fines, damages, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from U.S. government contracts, all of which may have an adverse effect on our reputation, business, results of operations, and prospects. Responding to any investigation or action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees. In addition, the U.S. government may seek to hold us liable for successor liability for FCPA violations committed by companies in which we invest or that we acquire. As a general matter, investigations, enforcement actions and sanctions could harm our reputation, business, results of operations, and financial condition.
Further, in June 2024, the U.S. Supreme Court reversed its longstanding approach under the Chevron doctrine, which provided for judicial deference to regulatory agencies. As a result of this decision, we cannot be sure whether there will be increased challenges to existing agency regulations or how lower courts will apply the decision in the context of other regulatory schemes without more specific guidance from the U.S. Supreme Court and/or federal appellate courts. For example, the U.S. Supreme Court’s decision could significantly impact consumer protection, advertising, privacy, artificial intelligence, anti-corruption and anti-money laundering practices and other regulatory regimes with which we are required to comply.
A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.
Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive, and time-consuming, often requiring significant up-front time and expense without any assurance that these efforts will generate a sale. Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained the revised certification. Government demand and payment for our products may be affected by public sector budgetary cycles, funding authorizations, government shutdowns, and general political priorities and initiatives, with funding delays, or reductions or eliminations, adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products. The U.S. federal government and other government entities are in the
44
process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.
Additionally, we rely on certain partners to provide technical support services to certain of our government entity customers to resolve any issues relating to our products. If our partners do not effectively assist our government entity customers in deploying our products, succeed in helping our government entity customers quickly resolve post-deployment issues, or provide effective ongoing support, our ability to sell additional products to new and existing government entity customers would be adversely affected and our reputation could be damaged.
Government entities may have statutory, contractual, or other legal rights to terminate contracts with us for convenience, including in connection with political priorities or initiatives, or due to a default, and any such termination may adversely affect our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.
Our success depends on our ability to provide users of our products and services with access to an abundance of useful, efficient, high-quality code which in turn depends on the quality and volume of code contributed by our open source contributors.
We believe that one of our competitive advantages is the quality, quantity and collaborative nature of the code on GitLab, and that access to open source code is one of the main reasons users visit GitLab. In furtherance of the foregoing competitive advantages and access, we seek to foster a broad and engaged contributor community, and we encourage individuals, companies, governments, and institutions to use our products and services to learn, code and work. If contributors, including influential contributors, do not continue to contribute code, our customer base and contributor engagement may decline. Additionally, if we are not able to address user concerns regarding the safety and security of our products and services or if we are unable to successfully prevent abusive or other hostile behavior on The DevSecOps platform, the size of our customer base and contributor engagement may decline. If there is a decline in the number of contributors, customer or contributor growth rate or engagement, including as a result of the loss of influential contributors and companies who provide innovative code on GitLab, paying customers of our online services may be deterred from using our products or services or reduce their spending with us or cease doing business with us, which would harm our business and operating results.
Seasonality may cause fluctuations in our sales and results of operations.
Historically, we have experienced seasonality in new customer contracts, as we typically enter into a higher percentage of subscription agreements with new customers and renewals with existing customers in the last two fiscal quarters of each year. We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. We expect that this seasonality, which can itself at times be unpredictable, will continue to affect our bookings, deferred revenue, and our results of operations in the future and might become more pronounced as we continue to target larger enterprise customers.
We recognize a significant portion of revenue from subscriptions over the term of the relevant subscription period, and as a result, downturns or upturns in sales are not immediately reflected in our results of operations. Further, we recognize a significant portion of our subscription revenue over the term of the relevant subscription period. As a result, much of the subscription revenue we report each fiscal
45
quarter is the recognition of deferred revenue from subscription contracts entered into during previous fiscal quarters. Consequently, a decline in new or renewed subscriptions in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter and will negatively affect our revenue in future fiscal quarters. Accordingly, the effect of significant downturns in new or renewed sales of our subscriptions is not fully reflected in our results of operations until future periods.
The length of our sales cycle can be unpredictable, particularly with respect to sales to large customers, and our sales efforts may require considerable time and expense.
Our results of operations may fluctuate, in part, because of the length and variability of the sales cycle of our subscriptions and the difficulty in making short-term adjustments to our operating expenses. The length of our sales cycle, from initial contact from a prospective customer to contractually committing to our paid subscriptions can vary substantially from customer to customer based on deal complexity as well as whether a sale is made directly by us. It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers, the timing of our customers’ decisions to make a purchase, greater deal scrutiny by our customers, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. Our results of operations depend in part on sales to new large customers and increasing sales to existing customers. As a result, in particular, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. Because a substantial proportion of our expenses are relatively fixed in the short term, our results of operations will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our Class A common stock to decline.
Risks Related to our People and Culture
We rely on our management team and other key team members and will need additional personnel to grow our business, and the loss of one or more key team members or our inability to hire, integrate, train and retain qualified personnel, could harm our business.
Our future success is dependent, in part, on our ability to hire, integrate, train, retain and motivate the members of our management team and other key team members throughout our organization. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, finance, support, product development, human resources, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.
On December 5, 2024, Sytse Sijbrandij, our co-founder, resigned from his position as our Chief Executive Officer. In connection with his resignation, Mr. Sijbrandij was appointed as the Executive Chair of our board of directors. On December 5, 2024, we also announced that William Staples had been appointed as our Chief Executive Officer. While we conducted this transition in an orderly manner, any change in the leadership of the company is a significant event and may result in additional volatility in our stock price and could disrupt our operations and have an adverse effect on our ability to grow our business.
Competition for highly skilled personnel in our industry is intense, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs. We have, from time to time, experienced, and we may experience in the future, difficulty in hiring and retaining highly skilled team members with appropriate qualifications. In particular, recruiting and hiring senior product engineering personnel with AI and machine learning backgrounds has been, and we expect it to continue to be, challenging.
Further, many of the companies with which we compete for experienced personnel have greater resources than we have. Our competitors also may be successful in recruiting and hiring members of our
46
management team or other key team members, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all. We have in the past, and may in the future, be subject to allegations that team members we hire have been improperly solicited, or that they have divulged proprietary or other confidential information or that their former employers own such team member’s inventions or other work product, or that they have been hired in violation of non-compete provisions or non-solicitation provisions.
In addition, job candidates and existing team members often consider the value of the benefits and equity awards they receive in connection with their employment. If the perceived value of our benefits, equity, or equity awards declines, it may adversely affect our ability to retain highly skilled team members. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects would be severely harmed.
Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity, and teamwork fostered by our culture, and our business may be harmed.
We believe that our corporate culture has been and will continue to be a key contributor to our success. If we do not continue to develop our corporate culture as we grow and evolve, it could harm our ability to foster the innovation, creativity, and teamwork that we believe is important to support our growth. As our organization grows and we are required to implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.
We engage our team members in various ways, including direct hires, through PEOs and as independent contractors. As a result of these methods of engagement, we face certain challenges and risks that can affect our business, operating results, and financial condition.
In the locations where we directly hire our team members into one of our entities, we must ensure that we are compliant with the applicable local laws governing team members in those jurisdictions, including local employment and tax laws. In the locations where we utilize PEOs, we contract with the PEO for it to serve as “Employer of Record” for those team members engaged through the PEO in each applicable location. Under this model, team members are employed by the PEO but provide services to GitLab. We also engage team members through a PEO self-employed model in certain jurisdictions where we contract with the PEO, which in turn contracts with individual team members as independent contractors. In all locations where we utilize PEOs, we rely on those PEOs to comply with local employment laws and regulations. We also issue equity to a substantial portion of our team members, including team members engaged through PEOs and to independent contractors, and must ensure we remain compliant with securities laws of the applicable jurisdiction where such team members are located.
Additionally, in some cases, we contract directly with team members who are independent contractors. When we engage team members through a PEO or independent contractor model, we may not be utilizing the appropriate hiring model needed to be compliant with local laws or the PEO may not be complying with local regulations. Additionally, the agreements executed between PEOs and our team members or between us and team members engaged under the independent contractor model, may not be enforceable depending on the local laws because of the indirect relationship created through these engagement models. Accordingly, as a result of our engagement of team members through PEOs, and of our relationship with independent contractors, our business, financial condition and results of operations could be materially and adversely affected. Furthermore, litigation related to our model of engaging team members, if instituted against us, could result in substantial costs and divert our management’s attention and resources from our business.
47
If we do not effectively hire, integrate, and train additional sales personnel, and expand our sales and marketing capabilities, we may be unable to increase our customer base and increase sales to our existing customers.
Our ability to increase our customer base and achieve broader market adoption of The DevSecOps platform will depend to a significant extent on our ability to continue to expand our sales and marketing operations. We plan to dedicate significant resources to sales and marketing programs and to expand our sales and marketing capabilities to target additional potential customers, but there is no guarantee that we will be successful in attracting and maintaining additional customers. If we are unable to find efficient ways to deploy our sales and marketing investments or if our sales and marketing programs are not effective, our business and operating results would be adversely affected.
Furthermore, we plan to continue expanding our sales force and there is significant competition for sales personnel with the skills and technical knowledge that we require. Our ability to achieve revenue growth will depend, in part, on our success in hiring, integrating, training, and retaining sufficient numbers of sales personnel to support our growth, particularly in international markets. New hires require significant training and may take significant time before they achieve full productivity. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business, operating results, and financial condition will be adversely affected.
We are a remote-only company, meaning that our team members work remotely which poses a number of risks and challenges that can affect our business, operating results, and financial condition. We are highly dependent on technology in our operations and if our technology fails, our business could be adversely affected.
As a remote-only company, we face a number of unique operational risks. For example, technologies in our team members’ homes may not be robust enough and could cause the networks, information systems, applications, and other tools available to team members and service providers to be limited, unreliable, or unsecure. Additionally, we are highly dependent on technology as a remote-only company and if we experience problems with the operation of our current IT systems or the technology systems of third parties on which we rely, that could adversely affect, or even temporarily disrupt, all or a portion of our operations until resolved. In addition, in a remote-only company, it may be difficult for us to develop and preserve our corporate culture and our team members may have decreased opportunities to collaborate in meaningful ways. Any impediments to preserving our corporate culture and fostering collaboration could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively, and execute on our business strategy.
Unfavorable media coverage could negatively impact our business.
We receive a high degree of media coverage, including due to our commitment to transparency. Unfavorable publicity or consumer perception of our service offerings could adversely affect our reputation, resulting in a negative impact on the size of our user base and the loyalty of our users. It could negatively impact our ability to acquire new customers and could lead to customers choosing to leave GitLab. As a result, our business, financial condition and results of operations could be materially and adversely affected.
Our brand, reputation, and business may be harmed if our customers, partners, team members, contributors or the public at large disagrees with, or finds objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team.
Our customers, partners, team members, contributors or the public at large may, from time to time, disagree with, or find objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team. As a result of these disagreements and any
48
negative publicity associated therewith, we could lose customers or partners, or we may have difficulty attracting or retaining team members or contributors and such disagreements may divert resources and the time and attention of management from our business. Our culture of transparency may also result in customers, partners, team members, contributors or the public at large having greater insight into our policies and practices or organizational decisions. Additionally, with the importance and impact of social media, any negative publicity regarding our policies and practices or organizational decisions or actions by members of our management team, may be magnified and reach a large portion of our customer, partner, team member base or contributors in a very short period of time, which could harm our brand and reputation and adversely affect our business.
Risks Related to Our International Operations
We plan to continue expanding our international operations which could subject us to additional costs and risks, and our continued expansion internationally may not be successful.
We plan to expand our operations internationally in the future. Outside of the United States, we currently have direct and indirect subsidiaries in Canada, Germany, France, Ireland, Israel, the Netherlands, Spain, the United Kingdom, Australia, India, Japan, South Korea, and Singapore, and have team members in over 60 countries. We also have a joint venture in China. There are significant costs and risks inherent in conducting business in international markets, including:
•establishing and maintaining effective controls at foreign locations and the associated increased costs;
•adapting our technologies, products, and services to non-U.S. consumers’ preferences and customs;
•increased competition from local providers;
•compliance with foreign laws and regulations;
•adapting to doing business in other languages and/or cultures;
•compliance with the laws of numerous taxing jurisdictions where we conduct business, potential double taxation of our international earnings, foreign tax withholding on intercompany transactions, and potentially adverse tax consequences due to U.S. and foreign tax laws as they relate to our international operations;
•compliance with anti-bribery laws, such as the FCPA and the U.K. Bribery Act, by us, our team members, our service providers, and our business partners;
•difficulties in staffing and managing global operations and the increased travel, infrastructure, and compliance costs associated with multiple international locations;
•complexity and other risks associated with current and future foreign legal requirements, including legal requirements related to data privacy frameworks, such as the GDPR and U.K. GDPR;
•currency exchange rate fluctuations or limitations and related effects on our operating results;
•economic and political instability in some countries, including the potential effects of health pandemics or epidemics and the ongoing armed conflicts in different regions of the world;
•the uncertainty of protection for intellectual property rights in some countries and practical difficulties of enforcing rights abroad; and
•other costs of doing business internationally.
49
These factors and other factors could harm our international operations and, consequently, materially impact our business, operating results, and financial condition. Further, we may incur significant operating expenses as a result of our international expansion, which may not be successful. We have limited experience with regulatory environments and market practices internationally, and we may not be able to penetrate or successfully operate in new markets. If we are unable to continue to expand internationally and manage the complexity of our global operations successfully, our financial condition and operating results could be adversely affected.
We have a limited operating history in China and we face risks with respect to conducting business in connection with our joint venture in China due to certain legal, political, economic and social uncertainties relating to China. Our ability to monetize our joint venture in China may be limited.
In February 2021, we partnered with two Chinese investment partners to form an independent company called GitLab Information Technology (Hubei) Co., Ltd. (极狐, pinyin: JiHu, pronounced Gee Who) which was formed to specifically serve the Chinese market. This company offers a dedicated distribution of The DevSecOps platform available as both a self-managed and SaaS that is only available in mainland China, Hong Kong and Macau. The autonomous company has its own governance structure, management team, and business support functions including Engineering, Sales, Marketing, Finance, Legal, Human Relations and Customer Support.
Our participation in this joint venture in China is subject to general, as well as industry-specific, economic, political, tax, and legal developments and risks in China. The Chinese government exercises significant control over the Chinese economy, including but not limited to controlling capital investments, allocating resources, setting monetary policy, controlling and monitoring foreign exchange rates, implementing and overseeing tax regulations, providing preferential treatment to certain industry segments or companies and issuing necessary licenses to conduct business. In addition, we could face additional risks resulting from changes in China’s data privacy and cybersecurity requirements, including China’s adoption of the Personal Information Protection Law, or PIPL, which went into effect on November 1, 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to citizens of China. Accordingly, any adverse change in the Chinese economy, the Chinese legal system or Chinese governmental, economic or other policies could have a material adverse effect on our business and operations in China and our prospects generally.
We face additional risks in China due to China’s historically limited recognition and enforcement of contractual and intellectual property rights. We may experience difficulty enforcing our intellectual property rights in China. Unauthorized use of our technologies and intellectual property rights by Chinese partners or competitors may dilute or undermine the strength of our brands. If we cannot adequately monitor the use of our technologies and products, or enforce our intellectual property rights in China or contractual restrictions relating to use of our intellectual property by Chinese companies, our revenue from JiHu could be adversely affected.
Our joint venture is subject to laws and regulations applicable to foreign investment in China. There are uncertainties regarding the interpretation and enforcement of laws, rules and policies in China. Because many laws and regulations are relatively new, the interpretations of many laws, regulations and rules are not always uniform. Moreover, the interpretation of statutes and regulations may be subject to government policies reflecting domestic political agendas. Enforcement of existing laws or contracts based on existing law may be uncertain and sporadic. As a result of the foregoing, it may be difficult for us to obtain swift or equitable enforcement of laws ostensibly designed to protect companies like ours, which could have a material adverse effect on our business and results of operations. Our ability to monetize our joint venture in China may also be limited. Although the joint venture entity is an autonomous company, it is the exclusive seller of GitLab in mainland China, Hong Kong and Macau and is therefore the public face of GitLab in those areas. Additionally, under U.S. GAAP, we currently consolidate the joint venture’s financials within our own and rely on the joint venture’s management for accurate and timely delivery of the joint venture’s financials. Therefore, we face reputational and brand
50
risk as a result of any negative publicity faced by the joint venture entity. Any such reputational and brand risk can harm our business and operating results.
We are exposed to fluctuations in currency exchange rates and interest rates, which could negatively affect our results of operations and our ability to invest and hold our cash.
Revenue generated is primarily billed in U.S. dollars while expenses incurred by our international subsidiaries and activities are often denominated in the currencies of the local countries. As a result, our consolidated U.S. dollar financial statements are subject to fluctuations due to changes in exchange rates as the financial results of our international subsidiaries are translated from local currencies into U.S. dollars. Our financial results are also subject to changes in exchange rates that impact the settlement of transactions in non-local currencies. To date, we have not engaged in currency hedging activities to limit the risk of exchange fluctuations and, as a result, our financial condition and operating results could be adversely affected by such fluctuations.
Our fixed-income investment portfolio is subject to fluctuations in fair value due to change in interest rates, which could adversely affect our results of operations due to any rise in interest rates in the future.
Risks Related to Financial and Accounting Matters
Failure to maintain effective systems of internal controls and disclosure controls could have a material adverse effect on our business, operating results, and financial condition.
As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market.
The Sarbanes-Oxley Act requires, among other things, that we maintain effective internal control over financial reporting, or ICFR, and disclosure controls and procedures, or DC&P. In order to maintain and improve the effectiveness of our ICFR and DC&P, we have expended, and anticipate that we will continue to expend, significant resources, including accounting related costs and significant management oversight.
As disclosed in our previously issued Annual Report on Form 10-K for the year ended January 31, 2024, we had identified a material weakness in our ICFR. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. During fiscal year 2024, we determined that a material weakness exists due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the company. In particular:
•We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems used in the financial reporting processes related to revenue. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.
51
We have remediated this material weakness during fiscal year 2025 through implemented actions that enhanced our control environment. Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, has issued an unqualified opinion on the effectiveness of the Company’s ICFR as of January 31, 2025.
Maintaining effective ICFR and DC&P requires ongoing attention and resources. Our current controls may become inadequate because of changes in conditions in our business, personnel, IT systems and applications, or other factors. If we identify additional material weaknesses or fail to maintain effective controls, it could adversely affect our operating results, cause us to fail to meet our reporting obligations, result in a restatement of our financial statements, or adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports.
As a public company that is a large accelerated filer, our independent registered public accounting firm is required to provide an annual attestation report on the effectiveness of our ICFR, which has required, and will continue to require, increased costs, expenses, and management resources.
We incur significant costs and devote management resources as a result of operating as a public company.
As a public company, we incur significant legal, accounting, compliance and other expenses. Our management and other personnel devote a substantial amount of time and incur significant expense in connection with compliance initiatives. As a public company, we bear all of the internal and external costs of preparing and distributing periodic public reports in compliance with our obligations under the securities laws.
In addition, regulations and standards relating to corporate governance and public disclosure, including the Sarbanes-Oxley Act, and the related rules and regulations implemented by the SEC, have increased legal and financial compliance costs and will make some compliance activities more time consuming. We intend to continue to invest resources to comply with evolving laws, regulations and standards, and this investment will result in increased general and administrative expenses and may divert management’s time and attention from our other business activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us, and our business may be harmed. While we believe we currently have sufficient directors’ and officers’ insurance coverage, it may in the future, be more expensive or more difficult for us to obtain director and officer liability insurance. We may also be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors would also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation and leadership development committee, and qualified executive officers.
We may in the future need to raise additional capital to grow our business, and we may not be able to raise capital on terms acceptable to us or at all. In addition, any inability to generate or obtain such capital may adversely affect our operating results and financial condition.
In order to support our growth and respond to business challenges, such as developing new features or enhancements to our services to stay competitive, acquiring new technologies, and improving our infrastructure, we have made significant financial investments in our business and we intend to continue to make such investments. As a result, we may need to engage in additional equity or debt financings to provide the funds required for these investments and other business endeavors. If we need to engage in such additional equity or debt financings, we may not be able to raise needed cash on terms acceptable to us or at all. Financing may be on terms that are dilutive or potentially dilutive to our stockholders, and the prices at which new investors would be willing to purchase our securities may be significantly lower than the current price per share of our Class A common stock. The holders of new debt or equity securities may also have rights, preferences, or privileges that are senior to those of existing holders of our common stock. If new sources of financing are required, but are insufficient or unavailable, we will be
52
required to modify our growth and operating plans based on available funding, if any, which would harm our ability to grow our business.
If we raise additional funds through equity or convertible debt issuances, our existing stockholders may suffer significant dilution and these securities could have rights, preferences, and privileges that are superior to those of holders of our common stock. If we obtain additional funds through debt financing, we may not be able to obtain such financing on terms favorable to us. Such terms may involve restrictive covenants making it difficult to engage in capital raising activities and pursue business opportunities, including potential acquisitions. The trading prices of technology companies have been highly volatile as a result of recent global events, including volatile interest rates and inflation and the ongoing armed conflicts in different regions of the world, which may reduce our ability to access capital on favorable terms or at all. In addition, a sustained adverse market event resulting from such global events could adversely affect our business and the value of our Class A common stock. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired and our business may be adversely affected, requiring us to delay, reduce, or eliminate some or all of our operations.
Changes in tax laws or other tax guidance could adversely affect our effective tax rates, financial condition, and results of operations.
We are a U.S.-based multinational company subject to taxes in multiple U.S. and foreign tax jurisdictions. In the United States and other countries where we conduct business and in jurisdictions in which we are subject to taxes, including those covered by governing bodies that enact tax laws applicable to us, we are subject to potential changes in relevant tax, accounting and other laws, regulations, guidance, and interpretations, including changes to tax laws applicable to corporate multinationals such as GitLab. These countries, governmental bodies, and intergovernmental economic organizations such as the Organization for Economic Cooperation and Development, have or could make unprecedented assertions about how taxation is determined in their jurisdictions that are contrary to the way in which we have interpreted and historically applied the rules and regulations described above in such jurisdictions. In the current global tax policy environment, any changes in laws, regulations, guidance and/or interpretations related to these assertions could adversely affect our effective tax rates, cause us to respond by making changes to our business structure, or result in other costs to us which could adversely affect our operations and financial results.
In December 2017, the U.S. federal government enacted the tax reform legislation known as the Tax Cuts and Jobs Act, or the 2017 Tax Act. The 2017 Tax Act significantly changed the existing U.S. corporate income tax laws by, among other things, lowering the U.S. corporate tax rate, implementing a partially territorial tax system, and imposing a one-time deemed repatriation tax on certain post-1986 foreign earnings. Recently the U.S. Treasury Department issued regulations for the purpose of interpreting the 2017 Tax Act, including regulations disallowing foreign tax credits for taxes which are dissimilar to income taxes, limiting the deductibility of interest, and requiring the capitalization of research and development expenses. Due to the reconciliation process used to pass the 2017 Tax Act, many provisions are in the process of being phased out, and it is uncertain whether many of the provisions in the 2017 Tax Act will be restored. The Inflation Reduction Act of 2022, enacted on August 16, 2022, further amended the U.S. federal tax code, imposing a 15% minimum tax on “adjusted financial statement income” of certain corporations as well as an excise tax on the repurchase or redemption of stock by certain corporations, beginning in the 2023 tax year.
Over the last several years, the Organization for Economic Cooperation and Development, or the OECD, has been working on a Base Erosion and Profit Shifting project that, if implemented, would change various aspects of the existing framework under which our tax obligations are determined in many of the countries in which we do business. The OECD has a framework to implement a global minimum corporate tax of 15% for companies with global revenues and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January
53
1, 2025. While it is uncertain whether the United States will enact legislation to adopt Pillar 2, certain countries in which we operate have adopted legislation. On December 15, 2022, the European Union member states agreed to implement the OECD’s global minimum tax rate of 15%. Similarly, the European Union and several countries have issued proposals that would apply to various aspects of the current tax framework under which we are taxed. These proposals include changes to the existing framework to calculate income tax, as well as proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue. For example, several jurisdictions have proposed or enacted taxes applicable to digital services, which include business activities on digital advertising and online marketplaces, and which apply to our business.
Due to the large and expanding scale of our international business activities, many of these types of changes to the taxation of our activities described above could increase our worldwide effective tax rate, increase the amount of non-income taxes imposed on our business, and harm our financial position, results of operations, and cash flows. Such changes may also apply retroactively to our historical operations and result in taxes greater than the amounts estimated and recorded in our financial statements. There can be no assurance that future tax law changes will not increase the rate of the corporate income tax, impose new limitations on deductions, credits or other tax benefits, or make other changes that may adversely affect our business, cash flows or financial performance. Among other considerations, the applicability and impact of these tax provisions, and of other U.S. or international tax law changes could adversely affect our effective income tax rate and cash flows in future years.
We may have exposure to greater than anticipated tax liabilities.
The tax laws applicable to our business, including the laws of the United States and other jurisdictions, are subject to interpretation and certain jurisdictions are aggressively interpreting their laws to expand the tax bases. Our existing corporate structure has been implemented in a manner we believe is in compliance with current tax laws. However, the taxing authorities of the jurisdictions in which we operate may challenge our methodologies, including for valuing developed technology or intercompany arrangements, which could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations, possibly with retroactive effect. Moreover, changes to our corporate structure could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations.
Furthermore, U.S. and OECD Transfer Pricing Guidelines require us to analyze the functions performed by our entities, the risks incurred, and the assets owned. This functional analysis is a control to sustain the operating margins of our entities and confirm arm’s length pricing for intercompany transactions. Competent authorities could interpret, change, modify or apply adversely, existing tax laws, statutes, rules, regulations or ordinances to us (possibly with retroactive effect); which could require us to make transfer pricing corrections or to pay fines, penalties or interest for past amounts. If we are unable to make corresponding adjustments with our related entities, we would effectively be liable for additional tax, thereby adversely impacting our operating results and cash flows.
Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. Our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus. The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our business, with some changes possibly affecting our tax obligations in future or past years. We regularly assess the likelihood of outcomes resulting from possible examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result from these examinations. We cannot provide assurance that the final determination of any of these examinations will not have an adverse effect on our financial position and results of operations.
54
Our cash and cash equivalents could be adversely affected if the financial institutions in which we hold our cash and cash equivalents fail.
We regularly maintain cash balances at third-party financial institutions in excess of the FDIC insurance limit and similar regulatory insurance limits outside the United States. If a depository institution where we maintain deposits fails or is subject to adverse conditions in the financial or credit markets, we may not be able to recover all, if any, of our deposits, which could adversely impact our operating liquidity and financial performance.
Risks Related to Ownership of Our Class A Common Stock
The market price of our Class A common stock may be volatile, and you could lose all or part of your investment.
Technology stocks historically have experienced high levels of volatility. The market price of our Class A common stock depends on a number of factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance. In addition, the limited public float of our Class A common stock may increase the volatility of the trading price of our Class A common stock. These fluctuations could cause you to lose all or part of your investment in our Class A common stock, since you might not be able to sell your shares at or above the price initially paid for the stock. Factors that could cause fluctuations in the market price of our Class A common stock include the following:
•actual or anticipated changes or fluctuations in our operating results;
•the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;
•announcements by us or our competitors of new products or new or terminated significant contracts, commercial relationships or capital commitments;
•industry or financial analyst or investor reaction to our press releases, other public announcements and filings with the SEC;
•rumors and market speculation involving us or other companies in our industry;
•price and volume fluctuations in the overall stock market from time to time;
•changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;
•failure of industry or financial analysts to maintain coverage of us, changes in financial estimates by any analysts who follow our company, or our failure to meet these estimates or the expectations of investors;
•actual or anticipated developments in our business or our competitors’ businesses or the competitive landscape generally;
•litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;
•developments or disputes concerning our intellectual property rights or our solutions, or third-party proprietary rights;
•announced or completed acquisitions of businesses or technologies by us or our competitors;
•new laws or regulations or new interpretations of existing laws or regulations applicable to our business;
55
•the impact of interest rate volatility on the overall stock market and the market for technology company stocks;
•any major changes in our management or our board of directors;
•effects of public health crises, pandemics, and epidemics;
•general economic conditions, changes in the capital markets generally, inflation, and slow or negative growth of our markets and instability in the global banking sector; and
•other events or factors, including those resulting from political instability, regulatory uncertainty, war, incidents of terrorism or responses to these events, including those related to the ongoing armed conflicts in different regions of the world.
In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect the market price of our Class A common stock, regardless of our actual operating performance. In addition, in the past, following periods of volatility in the overall market and the market prices of a particular company’s securities, companies have been subject to increased stockholder activism or securities class action litigation. Any stockholder activism or securities litigation, if instituted against us, could result in substantial costs and divert our management’s attention and resources from our business. This could have an adverse effect on our business, operating results and financial condition.
Sales of substantial amounts of our Class A common stock in the public markets, or the perception that they might occur, could cause the market price of our Class A common stock to decline.
Sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and greater than 5% stockholders, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline or make it more difficult for you to sell your Class A common stock at a time and price that you deem appropriate.
Moreover, the holders of a significant portion of shares of our capital stock also have rights, subject to some conditions, to require us to file registration statements for the public resale of such capital stock or to include such shares in registration statements that we may file for us or other stockholders.
We may also issue our shares of our capital stock or securities convertible into shares of our capital stock from time to time in connection with a financing, acquisition, investment, or otherwise.
The dual class structure of our common stock will have the effect of concentrating voting control with those stockholders who hold our Class B capital stock, including our directors, executive officers, and beneficial owners of 5% or greater of our outstanding capital stock who hold in the aggregate a majority of the voting power of our capital stock, which will limit or preclude your ability to influence corporate matters, including the election of directors and the approval of any change of control transaction.
Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share. As of January 31, 2025, the holders of our outstanding Class B common stock hold a substantial majority of the voting power of our outstanding capital stock, with our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, holding a majority of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore will be able to control all matters submitted to our stockholders for approval until the earlier of (i) October 14, 2031, (ii) the death or disability, as defined in our restated certificate of incorporation, of Sytse Sijbrandij, (iii) the date specified
56
by a vote of the holders of two-thirds of the then outstanding shares of Class B common stock and (iv) the first date on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) is less than 5% of the aggregate number of shares of outstanding common stock. This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.
Future transfers by holders of our Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of our Class B common stock who retain their shares in the long term.
The dual class structure of our common stock may adversely affect the trading market for our Class A common stock.
Several stockholder advisory firms and large institutional investors oppose the use of multiple class structures. As a result, the dual class structure of our common stock may cause stockholder advisory firms to publish negative commentary about our corporate governance practices or otherwise seek to cause us to change our capital structure, and may result in large institutional investors not purchasing shares of our Class A common stock. Any actions or publications by stockholder advisory firms or institutional investors critical of our corporate governance practices or capital structure could also adversely affect the value of our Class A common stock.
If industry or financial analysts do not continue to publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our Class A common stock, our stock price and trading volume could decline.
The trading market for our Class A common stock will depend in part on the research and reports that industry or financial analysts publish about us or our business. We do not control these analysts or the content and opinions included in their reports. If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price may decline. In addition, if our financial results fail to meet, or exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.
We do not intend to pay dividends in the foreseeable future. As a result, your ability to achieve a return on your investment will depend on appreciation in the price of our Class A common stock.
We have never declared or paid any cash dividends on our capital stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must for the foreseeable future rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.
57
Provisions in our organizational documents and under Delaware law could make an acquisition of us, which could be beneficial to our stockholders, more difficult and may limit attempts by our stockholders to replace or remove our current management.
Provisions in our restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a merger, acquisition or other change of control of our company that our stockholders may consider favorable. In addition, because our board of directors is responsible for appointing the members of our management team, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors. Among other things, our restated certificate of incorporation and amended and restated bylaws include provisions that:
•provide that our board of directors is classified into three classes of directors with staggered three-year terms;
•permit our board of directors to establish the number of directors and fill any vacancies and newly created directorships;
•require supermajority voting to amend some provisions in our restated certificate of incorporation and amended and restated bylaws;
•authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;
•provide that only our chief executive officer or a majority of our board of directors will be authorized to call a special meeting of stockholders;
•eliminate the ability of our stockholders to call special meetings of stockholders;
•do not provide for cumulative voting;
•provide that directors may only be removed “for cause” and only with the approval of two-thirds of our stockholders;
•provide for a dual class common stock structure in which holders of our Class B common stock may have the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our common stock, including the election of directors and other significant corporate transactions, such as a merger or other sale of our company or its assets;
•prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;
•provide that our board of directors is expressly authorized to make, alter, or repeal our amended and restated bylaws; and
•establish advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon by stockholders at annual stockholder meetings.
Moreover, Section 203 of the Delaware General Corporation Law, or DGCL, may discourage, delay, or prevent a change in control of our company. Section 203 imposes certain restrictions on mergers, business combinations, and other transactions between us and holders of 15% or more of our common stock.
58
Our restated certificate of incorporation and amended and restated bylaws contain exclusive forum provisions for certain claims, which may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or team members.
Our restated certificate of incorporation provides that the Court of Chancery of the State of Delaware, to the fullest extent permitted by law, will be the exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a breach of fiduciary duty, any action asserting a claim against us arising pursuant to the DGCL, our restated certificate of incorporation, or our amended and restated bylaws, or any action asserting a claim against us that is governed by the internal affairs doctrine.
Moreover, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all claims brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. Our restated certificate of incorporation and amended and restated bylaws provide that the federal district courts of the United States will, to the fullest extent permitted by law, be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, such provision, the Federal Forum Provision. Our decision to adopt a Federal Forum Provision followed a decision by the Supreme Court of the State of Delaware holding that such provisions are facially valid under Delaware law. While there can be no assurance that federal or state courts will follow the holding of the Delaware Supreme Court or determine that the Federal Forum Provision should be enforced in a particular case, application of the Federal Forum Provision means that suits brought by our stockholders to enforce any duty or liability created by the Securities Act must be brought in federal court and cannot be brought in state court.
Section 27 of the Exchange Act creates exclusive federal jurisdiction over all claims brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. In addition, the Federal Forum Provision applies to suits brought to enforce any duty or liability created by the Exchange Act. Accordingly, actions by our stockholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder must be brought in federal court.
Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the regulations promulgated thereunder.
Any person or entity purchasing or otherwise acquiring or holding any interest in any of our securities shall be deemed to have notice of and consented to our exclusive forum provisions, including the Federal Forum Provision. These provisions may limit a stockholders’ ability to bring a claim in a judicial forum of their choosing for disputes with us or our directors, officers, or team members, which may discourage lawsuits against us and our directors, officers, and team members. Alternatively, if a court were to find the choice of forum provisions contained in our restated certificate of incorporation or amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, financial condition, and operating results.
59
General Risk Factors
We may be adversely affected by natural disasters, pandemics and other catastrophic events, and by man-made problems such as acts of war, terrorism, that could disrupt our business operations and our business continuity and disaster recovery plans may not adequately protect us from a serious disaster.
Natural disasters, pandemics, and epidemics, or other catastrophic events such as fire or power shortages, along with man-made problems such as acts of war and terrorism, and other events beyond our control may cause damage or disruption to our operations, international commerce, and the global economy, and could have an adverse effect on our business, operating results, and financial condition. While we do not have a corporate headquarters, we have team members around the world, and any such catastrophic event could occur in areas where significant portions of our team members are located. Moreover, these conditions can affect the rate of software development operations solutions spending and could adversely affect our customers’ ability or willingness to attend our events or to purchase our services, delay prospective customers’ purchasing decisions or project implementation timing, reduce the value or duration of their subscription contracts, affect attrition rates, or result in requests from customers for payment or pricing concessions, all of which could adversely affect our future sales and operating results. As a result, we may experience extended sales cycles; our ability to close transactions with new and existing customers and partners may be negatively impacted; our ability to recognize revenue from software transactions we do close may be negatively impacted due to implementation delays or other factors; our demand generation activities, and the efficiency and effect of those activities, may be negatively affected. Recent macroeconomic conditions, including inflation and volatile interest rates, have, and may continue to, put pressure on overall spending for our products and services, and may cause our customers to modify spending priorities or delay or abandon purchasing decisions, thereby lengthening sales cycles, and may make it difficult for us to forecast our sales and operating results and to make decisions about future investments. These and other potential effects on our business may be significant and could materially harm our business, operating results and financial condition.
In the event of a natural disaster, including a major earthquake, blizzard, or hurricane, or a catastrophic event such as a fire, power loss, or telecommunications failure, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in development of our solutions, lengthy interruptions in service, breaches of data security, and loss of critical data, all of which could have an adverse effect on our future operating results. Additionally, all of the aforementioned risks may be further increased if we do not implement a disaster recovery plan or the disaster recovery plans we or our partners implement prove to be inadequate.
We are and could continue to be subject to securities class action litigation and shareholder derivative suits.
Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following periods of volatility in the market price of a company’s securities. See Part I, Item 3 of this Form 10-K for additional information regarding our pending legal proceedings. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. These types of litigation could result in substantial costs, adverse publicity, and a diversion of management’s attention and resources, which could adversely affect our business operating results, or financial condition. Additionally, the cost of directors’ and officers’ liability insurance may increase, which may cause us to opt for lower overall policy limits or to forgo insurance that we may otherwise rely on to cover significant defense costs, settlements, and damages awarded to plaintiffs.
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
60
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
GitLab’s cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit. We also make judgments based on current data, assumptions about the risk, the company’s risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable. Our global incident response team performs at-least annual tabletop exercises of our incident processes, including material breach, disaster recovery, and business continuity scenarios.
Governance
ITEM 2. PROPERTIES
We are a remote-only company. Accordingly, we do not maintain a headquarters.
61
ITEM 3. LEGAL PROCEEDINGS
GitLab Securities Class Action and Shareholder Derivative Cases
On September 4, 2024, a putative class action was filed in the United States District Court for the Northern District of California, captioned Dolly v. GitLab et al., Case No. 5:24-cv-06244-EKL, naming GitLab and certain of our officers. The complaint purports to assert claims under Section 10(b) of the Securities Exchange Act of 1934 (“1934 Act”), SEC Rule 10b-5, and Section 20(a) of the 1934 Act, on behalf of persons and entities who acquired our common stock between June 5, 2023 and June 3, 2024 (the “Class Period”). Plaintiff alleges that, during the Class Period, defendants made material misrepresentations or omissions regarding our use of AI features and ability to monetize our AI capabilities that artificially inflated our stock price. Plaintiff seeks, among other things, damages in an unspecified amount, as well as fees and costs. Plaintiff amended his complaint on February 5, 2025 and March 7, 2025, and we will move to dismiss the second amended complaint in April 2025.
Two putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action. The cases were filed on February 14, 2025, in the United States District Court for the Northern District of California, captioned Preciado v. Sijbrandij et al., Case No. 3:25-cv-01597 “Preciado”); and on February 19, 2025 in United States District Court for the Northern District of California, captioned Jones v. Sijbrandij et al., Case No. 3:25-cv-01735 (“Jones”). Both cases are allegedly brought on our behalf. Each of the lawsuits name us as a nominal defendant, and also certain of our officers and current and former members of our board of directors. The Jones complaint purports to assert claims under Section 14(a) of the Exchange Act as well as breach of fiduciary duty, while the Preciado complaint purports to assert those claims as well as unjust enrichment and related corporate torts. The complaints seek to recover unspecified damages and other relief on our behalf.
Based on the preliminary nature of the proceedings in these actions, the outcomes remain uncertain and the Company cannot estimate the potential impact, if any, on its business or financial statements at this time.
In addition to the shareholder matters described above, we are, and from time to time may become, involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results.
Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.
ITEM 4. MINE SAFETY DISCLOSURES
None.
62
PART II
ITEM 5. MARKET FOR REGISTRANT'S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES
Market Information
Our Class A common stock is traded on The Nasdaq Global Select Market, or Nasdaq, under the symbol “GTLB” and began trading on October 14, 2021. Prior to that date, there was no public trading market for our Class A common stock. Our Class B common stock is not listed or traded on any exchange.
Holders of Record
As of March 7, 2025, there were 6 holders of record of our Class A common stock and 15 holders of record of our Class B common stock. The actual number of holders of our Class A common stock and Class B common stock is greater than the number of record holders and includes stockholders who are beneficial owners, but whose shares are held in street name by brokers or other nominees. The number of holders of record presented here also does not include stockholders whose shares may be held in trust by other entities.
Dividend Policy
We have never declared or paid cash dividends on our capital stock. We currently intend to retain all available funds and future earnings, if any, to fund the development and expansion of our business, and we do not anticipate paying any cash dividends in the foreseeable future. Any future determination regarding the declaration and payment of dividends, if any, will be at the discretion of our board of directors and will depend on then-existing conditions, including our financial condition, operating results, contractual restrictions, capital requirements, business prospects, and other factors our board of directors may deem relevant.
Recent Sales of Unregistered Equity Securities
None.
Use of Proceeds
None.
Issuer Purchases of Equity Securities
None.
Stock Performance Graph
The graph below compares the cumulative total stockholder return on our Class A common stock from October 14, 2021 (the date our Class A common stock commenced trading on Nasdaq) through January 31, 2025 with the cumulative total return on the S&P 500 Index and the S&P 500 Information Technology Index. All values assume a $100 initial investment and data for the S&P 500 Composite Index and the S&P Information Technology Index assume reinvestment of dividends. The comparisons are based on historical data and are not indicative of, nor intended to forecast, the future performance of our Class A common stock.
63
This performance graph shall not be deemed “soliciting material” or to be “filed” with the SEC for purposes of Section 18 of the Exchange Act, or otherwise subject to the liabilities under that Section, and shall not be deemed to be incorporated by reference into any of our filings under the Securities Act.
ITEM 6. [RESERVED]
64
ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report. You should review the section titled “Special Note Regarding Forward-Looking Statements” above in this Annual Report for a discussion of forward-looking statements and important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Factors that could cause or contribute to such differences include, but are not limited to, those identified below, and those discussed in the section titled “Risk Factors” in this Annual Report. Our historical results are not necessarily indicative of the results that may be expected for any period in the future.
A discussion regarding our financial condition and results of operations for the year ended January 31, 2025 compared to the year ended January 31, 2024 is presented below. A discussion regarding our financial condition and results of operations for the year ended January 31, 2024 compared to the year ended January 31, 2023 can be found in “Management's Discussion and Analysis of Financial Condition and Results of Operations” in our Annual Report on Form 10-K for the fiscal year ended January 31, 2024, which was filed with the SEC on March 25, 2024.
Overview
In today’s world, software defines the speed of innovation. Every industry, business, and function within a company is dependent on software. To remain competitive and survive, nearly all companies must digitally transform and become experts at developing, delivering, and securing software.
To meet these market needs, GitLab created the DevSecOps platform, a fundamentally new approach to software development and delivery. Built with a unified data model, our platform brings together all stakeholders in the software delivery lifecycle – from development teams to operations teams to security teams. With GitLab, all stakeholders can build better, more secure software, faster.
GitLab is the solution for significant business transformation needs. Across every industry – and across companies of every size – technology leaders want to make developers more productive so they can deliver better products faster; they want to measure productivity so they can increase operational efficiency; they want to secure the software supply chain so they can reduce security and compliance risk; and, they want to accelerate secure cloud migration, so they can unlock digital transformation results. These technology leaders need a platform that enables a value stream-driven mindset that shortens the time from idea to customer value and establishes a powerful flywheel for data collection and aggregation. They are looking for a platform approach that unifies the entire development experience, so that customers can outpace and out-innovate their competition.
We believe GitLab offers the shortest path to unlock technology transformation and business value. GitLab accelerates our customers’ ability to innovate by accelerating their software development from weeks to minutes. It removes the need for point tools and delivers enhanced operational efficiency by eliminating manual work, increasing productivity, and creating a culture of innovation and velocity. Embedding security earlier in the development process, GitLab enables customers to improve software security, quality, and overall compliance.
GitLab is available to any team, regardless of the size, scope, and complexity of their deployment. As a result, we have more than 50 million registered users, and more than 50% of the Fortune 100 companies are GitLab customers. For purposes of determining the number of our active customers, we look at our customers with more than $5,000 of Annual Recurring Revenue, or ARR, in a given period, who we refer to as our Base Customers. For purposes of determining our Base Customers, a single organization with separate subsidiaries, segments, or divisions that use The DevSecOps platform is considered a single customer for determining each organization’s ARR.
65
GitLab is the only DevSecOps platform built on an open-core business model. We enable any customer and contributor to add functionality to our platform. In calendar year 2024, nearly 900 people contributed more than 3,000 merge requests back to the core product, extending GitLab’s in-house R&D efforts and empowering our most passionate users to make improvements to the DevSecOps solution they use every day. Our open-core approach engenders trust with our customers and enables us to maintain our high velocity of innovation.
Our transparent business value also helps us grow the open source community. We make our strategy, direction, and product roadmap available to the wider community in order to encourage and solicit their feedback. Through responsible transparency, we create a deeper level of trust with our customers and make it easier to solicit contributions and collaboration from our users and customers.
GitLab offers a flexible deployment model for our customers. For our self-managed offering, the customer installs GitLab in their own on-premise or hybrid cloud environment. For our SaaS offering, the platform is managed by GitLab and hosted either in our public cloud or in our private cloud based on the customer’s preference. We also offer GitLab Dedicated, our single tenant SaaS solution, ideally suited for organizations with complex security and compliance requirements. See the section entitled “Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for additional information about how we define ARR.
Key Business Metrics
We monitor the following key metrics to help us evaluate our business, identify trends affecting our business, formulate business plans, and make strategic decisions.
Dollar-Based Net Retention Rate and ARR
We believe that our ability to retain and expand our revenue generated from our existing customers is an indicator of the long-term value of our customer relationships and our potential future business opportunities. Dollar-Based Net Retention Rate measures the percentage change in our ARR derived from our customer base at a point in time. Our calculation of ARR and by extension Dollar-Based Net Retention Rate, includes both self-managed and SaaS subscription revenue. We report Dollar-Based Net Retention Rate on a threshold basis of 130% each quarter or the actual number if below 130%.
We calculate ARR by taking the monthly recurring revenue, or MRR, and multiplying it by 12. MRR for each month is calculated by aggregating, for all customers during that month, monthly revenue from committed contractual amounts of subscriptions, including our self-managed and SaaS offerings but excluding professional services. We calculate Dollar-Based Net Retention Rate as of a period end by starting with our customers as of the 12 months prior to such period end, or the Prior Period ARR. We then calculate the ARR from these customers as of the current period end, or the Current Period ARR. The calculation of Current Period ARR includes any upsells, price adjustments, user growth within a customer, contraction, and attrition. We then divide the total Current Period ARR by the total Prior Period ARR to arrive at the Dollar-Based Net Retention Rate.
As of January 31, | |||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||
| Dollar-Based Net Retention Rate | 123% | 130 | % | >130% | |||||||||||||
Customers with ARR of $100,000 or More
We believe that our ability to increase the number of $100,000 ARR customers is an indicator of our market penetration and strategic demand for The DevSecOps platform. A single organization with separate subsidiaries, segments, or divisions that use The DevSecOps platform is considered a single customer for determining each organization’s ARR. We do not count our reseller or distributor channel
66
partners as customers. In cases where customers subscribe to The DevSecOps platform through our channel partners, each end customer is counted separately.
As of January 31, | |||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||
| $100,000 ARR customers | 1,229 | 955 | 697 | ||||||||||||||
Components of Our Results of Operations
Revenue
Subscription - self-managed and SaaS
Subscription - self-managed
Our self-managed subscriptions include support, maintenance, upgrades, and updates on a when-and-if-available basis. Revenue for self-managed subscriptions is recognized ratably over the contract period based on the stand-ready nature of subscription elements.
The typical term of a subscription contract for self-managed offerings is one to three years.
SaaS
Our SaaS subscriptions provide access to our latest managed version of our product hosted in a public or private cloud based on the customer’s preference. Revenue from our SaaS offerings is recognized ratably over the contract period when the performance obligation is satisfied.
The typical term of a subscription contract for SaaS offerings is one to three years.
License - self-managed and other
The license component of our self-managed subscriptions reflects the revenue recognized by providing customers with access to proprietary software features. License revenue is recognized up-front when the software license is made available to our customers.
Other revenue consists of professional services revenue which is derived from fixed fee and time and materials engagements. Revenue from professional services is recognized as the services are performed and control is transferred. For fixed fee engagements that include acceptance clauses, control is deemed to transfer upon customer confirmation, as defined in the respective contract. Accordingly, revenue is recognized upon satisfaction of all contractual requirements.
Cost of Revenue
Subscription - self-managed and SaaS
Cost of revenue for self-managed and SaaS subscriptions consists primarily of allocated cloud-hosting costs paid to third-party service providers, personnel-related costs associated with our customer support personnel, including contractors, third-party payment processing fees, and allocated overhead. Personnel-related expenses consist of salaries, benefits, bonuses, and stock-based compensation. We expect our cost of revenue for self-managed and SaaS subscriptions to increase in absolute dollars as our self-managed and SaaS subscription revenue increases. As our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and managing costs, which may adversely impact our gross margins.
67
License - self-managed and other
Cost of self-managed license and other revenue consists primarily of contractor and personnel-related costs, including stock-based compensation expense, associated with the professional services team and customer support team, third-party payment processing fees, and allocated overhead. We expect our cost of revenue for self-managed license and other to increase in absolute dollars as our self-managed and other revenue increases.
Operating Expenses
Our operating expenses consist of sales and marketing, research and development, and general and administrative expenses. Personnel-related expenses are the most significant component of operating expenses and consist of salaries, benefits, bonuses, stock-based compensation, and sales commissions. Operating expenses also include IT overhead costs.
Sales and Marketing
Sales and marketing expenses consist primarily of personnel-related expenses associated with our sales and marketing personnel, advertising, travel and entertainment related expenses, branding and marketing events, promotions, software subscriptions, and our allocated cloud infrastructure expenses for our free tier. Sales and marketing expenses also include sales commissions paid to our sales force. Such costs incurred on acquisition of an initial contract are capitalized and amortized over an estimated period of benefit of three years, and any such expenses paid for the renewal of a subscription are capitalized and amortized over the contractual term of the renewal. However, prorated costs for commissions that are incremental to obtain a self-managed license contract are expensed immediately.
We expect sales and marketing expenses to increase in absolute dollars as we continue to make strategic investments in our sales and marketing organization to drive additional revenue, further penetrate the market, and expand our global customer base, but to decrease as a percentage of our total revenue over time, although our sales and marketing expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.
Research and Development
Research and development expenses consist primarily of personnel-related expenses, including contractors, as well as cloud infrastructure expenses to support our internal development efforts, and software and subscription services. Costs related to research and development are expensed as incurred.
We expect research and development expenses to increase in absolute dollars as we continue to increase investments in our existing products and services. However, we anticipate research and development expenses to decrease as a percentage of our total revenue over time, although our research and development expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.
General and Administrative
General and administrative expenses consist primarily of personnel-related expenses for our executives, finance, legal, and human resources teams. General and administrative expenses also include external legal, accounting, and director and officer insurance, as well as other consulting and professional services fees, software and subscription services, in-person company-wide event expenses, and any contract termination fees.
We incur expenses as a result of operating as a public company, including costs to comply with the rules and regulations applicable to companies listed on a national securities exchange, costs related to compliance and reporting obligations, costs related to Sarbanes-Oxley compliance, and expenses for insurance, investor relations, and related professional services. We expect that our general and administrative expenses will increase in absolute dollars as our business grows but will decrease as a
68
percentage of our total revenue over time, although our general and administrative expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.
Interest Income, and Other Income (Expense), Net
Interest income consists primarily of interest earned on our cash equivalents and short-term investments.
Other income (expense), net consists primarily of foreign currency transaction gains and losses.
Loss from Equity Method Investment, Net of Tax
Loss from equity method investment, net of tax, consists of our share of losses from the results of operations of Arch, following its deconsolidation.
Provision for (Benefit from) Income Taxes
Provision for (benefit from) income taxes consists primarily of income taxes in the foreign and state jurisdictions in which we conduct business. We maintain a full valuation allowance against our deferred tax assets in certain jurisdictions because we have concluded that it is not more likely than not that the deferred tax assets will be realized.
69
Results of Operations
The following table sets forth our results of operations for the periods presented (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Revenue: | |||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | $ | 675,179 | $ | 506,306 | $ | 369,349 | |||||||||||||||||||||||
| License—self-managed and other | 84,070 | 73,600 | 54,987 | ||||||||||||||||||||||||||
| Total revenue | 759,249 | 579,906 | 424,336 | ||||||||||||||||||||||||||
Cost of revenue:(1) | |||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | 64,916 | 45,486 | 40,841 | ||||||||||||||||||||||||||
| License—self-managed and other | 20,224 | 14,222 | 10,839 | ||||||||||||||||||||||||||
| Total cost of revenue | 85,140 | 59,708 | 51,680 | ||||||||||||||||||||||||||
| Gross profit | 674,109 | 520,198 | 372,656 | ||||||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||||||||
Sales and marketing(1) | 384,295 | 356,393 | 309,992 | ||||||||||||||||||||||||||
Research and development(1) | 239,652 | 200,840 | 156,143 | ||||||||||||||||||||||||||
General and administrative(1) | 192,877 | 150,405 | 117,932 | ||||||||||||||||||||||||||
| Total operating expenses | 816,824 | 707,638 | 584,067 | ||||||||||||||||||||||||||
| Loss from operations | (142,715) | (187,440) | (211,411) | ||||||||||||||||||||||||||
| Interest income | 47,735 | 39,114 | 14,496 | ||||||||||||||||||||||||||
| Other income (expense), net | 9,187 | (12,241) | 21,621 | ||||||||||||||||||||||||||
| Loss before income taxes and loss from equity method investment | (85,793) | (160,567) | (175,294) | ||||||||||||||||||||||||||
| Loss from equity method investment, net of tax | — | (3,824) | (2,468) | ||||||||||||||||||||||||||
| Provision for (benefit from) income taxes | (76,674) | 265,145 | 4,030 | ||||||||||||||||||||||||||
| Net loss | $ | (9,119) | $ | (429,536) | $ | (181,792) | |||||||||||||||||||||||
Net loss attributable to noncontrolling interest(2) | (2,793) | (3,859) | (8,385) | ||||||||||||||||||||||||||
| Net loss attributable to GitLab | $ | (6,326) | $ | (425,677) | $ | (173,407) | |||||||||||||||||||||||
(1)Includes stock-based compensation expense as follows:
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| (in thousands) | |||||||||||||||||||||||||||||
| Cost of revenue | $ | 7,922 | $ | 6,400 | $ | 5,078 | |||||||||||||||||||||||
| Sales and marketing | 72,954 | 68,766 | 48,001 | ||||||||||||||||||||||||||
| Research and development | 58,312 | 50,804 | 36,325 | ||||||||||||||||||||||||||
| General and administrative | 46,711 | 37,079 | 33,163 | ||||||||||||||||||||||||||
| Total stock-based compensation expense | $ | 185,899 | $ | 163,049 | $ | 122,567 | |||||||||||||||||||||||
70
(2)Our results of operations include our variable interest entity, JiHu. The ownership interest of other investors is recorded as a noncontrolling interest. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
The following table sets forth the components of our consolidated statements of operations as a percentage of total revenue for each of the periods presented:
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Revenue | 100 | % | 100 | % | 100 | % | |||||||||||||||||||||||
| Cost of revenue | 11 | 10 | 12 | ||||||||||||||||||||||||||
| Gross profit | 89 | 90 | 88 | ||||||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||||||||
| Sales and marketing | 51 | 61 | 73 | ||||||||||||||||||||||||||
| Research and development | 32 | 35 | 37 | ||||||||||||||||||||||||||
| General and administrative | 25 | 26 | 28 | ||||||||||||||||||||||||||
| Total operating expenses | 108 | 122 | 138 | ||||||||||||||||||||||||||
| Loss from operations | (19) | (32) | (50) | ||||||||||||||||||||||||||
| Interest income | 6 | 7 | 3 | ||||||||||||||||||||||||||
| Other income (expense), net | 1 | (2) | 5 | ||||||||||||||||||||||||||
| Loss before income taxes and loss from equity method investment | (11) | (28) | (41) | ||||||||||||||||||||||||||
| Loss from equity method investment, net of tax | — | (1) | (1) | ||||||||||||||||||||||||||
| Provision for (benefit from) income taxes | (10) | 46 | 1 | ||||||||||||||||||||||||||
| Net loss | (1) | % | (74) | % | (43) | % | |||||||||||||||||||||||
| Net loss attributable to noncontrolling interest | — | % | (1) | % | (2) | % | |||||||||||||||||||||||
| Net loss attributable to GitLab | (1) | % | (73) | % | (41) | % | |||||||||||||||||||||||
Comparison of the Fiscal Year Ended January 31, 2025 and 2024
Revenue
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | $ | 675,179 | $ | 506,306 | $ | 168,873 | 33 | % | |||||||||||||||||||||||||||||||||||||||
| License—self-managed and other | 84,070 | 73,600 | 10,470 | 14 | |||||||||||||||||||||||||||||||||||||||||||
| Total revenue | $ | 759,249 | $ | 579,906 | $ | 179,343 | 31 | % | |||||||||||||||||||||||||||||||||||||||
Revenue increased $179.3 million, or 31%, to $759.2 million for fiscal year 2025 from $579.9 million for fiscal year 2024. The increase was primarily due to the ongoing demand for The DevSecOps platform, including adding new customers, the expansion within our existing paid customers, and an increase in our number of customers with $100,000 or greater in ARR. As of January 31, 2025 and 2024, our expansion
71
is reflected by our Dollar-Based Net Retention Rate being 123% and 130%, respectively. We had 1,229 customers with ARR over $100,000 as of January 31, 2025, increasing from 955 customers with ARR over $100,000 as of January 31, 2024.
Revenue attributed to our variable interest entity, JiHu, was $7.6 million and $6.5 million for fiscal year 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
Cost of Revenue, Gross Profit, and Gross Margin
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Cost of revenue | $ | 85,140 | $ | 59,708 | $ | 25,432 | 43 | % | |||||||||||||||||||||||||||||||||||||||
| Gross profit | 674,109 | 520,198 | 153,911 | 30 | |||||||||||||||||||||||||||||||||||||||||||
| Gross margin | 89 | % | 90 | % | (1) | % | |||||||||||||||||||||||||||||||||||||||||
Cost of revenue increased by $25.4 million, to $85.1 million for fiscal year 2025 from $59.7 million for fiscal year 2024, primarily due to an increase of $7.9 million in third party hosting costs for SaaS and cloud usage, an increase of $6.9 million in personnel-related expenses, driven by an increase in our average customer support and professional services headcount and an increase of $1.5 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below), and $6.1 million in the amortization of intangible assets. Gross margin decreased by 1% to 89% for fiscal year 2025 compared to fiscal year 2024.
Cost of revenue attributed to our variable interest entity, JiHu, was $2.3 million and $2.4 million for fiscal year 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
Sales and Marketing
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Sales and marketing expenses | $ | 384,295 | $ | 356,393 | $ | 27,902 | 8 | % | |||||||||||||||||||||||||||||||||||||||
Sales and marketing expenses increased by $27.9 million, to $384.3 million for fiscal year 2025 from $356.4 million for fiscal year 2024, primarily due to an increase of $28.6 million in personnel-related expenses, driven by an increase in our average sales and marketing headcount and an increase of $4.2 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below), partially offset by a $2.7 million decrease in restructuring expense.
Sales and marketing expenses attributed to our variable interest entity, JiHu, were $6.3 million and $7.4 million for fiscal year 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
72
Research and Development
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Research and development expenses | $ | 239,652 | $ | 200,840 | $ | 38,812 | 19 | % | |||||||||||||||||||||||||||||||||||||||
Research and development expenses increased by $38.8 million, to $239.7 million for fiscal year 2025 from $200.8 million for fiscal year 2024, primarily due to an increase of $34.3 million in personnel-related expenses, driven by an increase in our average research and development headcount and an increase of $7.5 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). The remaining change was mainly due to an increase of $4.1 million in hosting costs for internal usage partially offset by a decrease of $1.7 million in restructuring costs.
Research and development expenses attributed to our variable interest entity, JiHu, were $1.8 million and $5.3 million for fiscal year 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
General and Administrative
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| General and administrative expenses | $ | 192,877 | $ | 150,405 | $ | 42,472 | 28 | % | |||||||||||||||||||||||||||||||||||||||
General and administrative expenses increased by $42.5 million, to $192.9 million for fiscal year 2025 from $150.4 million for fiscal year 2024, primarily driven by an increase in expense of $14.3 million related to our in-person company-wide event, $11.0 million in personnel-related expenses, mainly attributable to an increase in our average general and administrative headcount and an increase of $9.6 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). Other factors contributing to the increase included $3.9 million from an accrual for indirect taxes on certain international sales, $3.8 million from a loss attributable to the fair value remeasurement of acquisition related contingent consideration, $2.4 million in consulting expenses, $1.7M in acquisition related expenses and $1.1 million in charitable donation of common stock.
General and administrative expenses attributed to our variable interest entity, JiHu, were $4.5 million and $1.9 million for fiscal year 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
73
Stock-Based Compensation Expense
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Cost of revenue | $ | 7,922 | $ | 6,400 | $ | 1,522 | 24 | % | |||||||||||||||||||||||||||||||||||||||
| Sales and marketing | 72,954 | 68,766 | 4,188 | 6 | |||||||||||||||||||||||||||||||||||||||||||
| Research and development | 58,312 | 50,804 | 7,508 | 15 | |||||||||||||||||||||||||||||||||||||||||||
| General and administrative | 46,711 | 37,079 | 9,632 | 26 | |||||||||||||||||||||||||||||||||||||||||||
| Total stock-based compensation expense | $ | 185,899 | $ | 163,049 | $ | 22,850 | 14 | % | |||||||||||||||||||||||||||||||||||||||
Stock-based compensation expense increased by $22.9 million, to $185.9 million for fiscal year 2025 from $163.0 million for fiscal year 2024, primarily due to an increase of $39.6 million of expense from RSUs, offset by decreases of $4.2 million for grant modifications, $7.3 million related to our ESPP, and $5.7 million related to stock options.
Stock-based compensation attributed to our variable interest entity, JiHu, was a net expense of $1.8 million and a net gain of $1.5 million for fiscal 2025 and 2024, respectively. See “Note 11. Joint Venture and Equity Method Investment” to our consolidated financial statements for additional details.
Interest Income and Other Income (Expense), Net
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Interest income | $ | 47,735 | $ | 39,114 | $ | 8,621 | 22 | % | |||||||||||||||||||||||||||||||||||||||
| Impairment loss of equity method investment in Arch, formerly Meltano | — | (8,858) | 8,858 | 100 | |||||||||||||||||||||||||||||||||||||||||||
| Foreign exchange gains (losses), net | 9,416 | (2,871) | 12,287 | (428) | |||||||||||||||||||||||||||||||||||||||||||
Other expense, net | (229) | (512) | 283 | (55) | |||||||||||||||||||||||||||||||||||||||||||
| Total other income (expense), net | $ | 9,187 | $ | (12,241) | $ | 21,428 | (175) | % | |||||||||||||||||||||||||||||||||||||||
For fiscal year 2025 compared to fiscal year 2024, interest income increased primarily due to income earned from our cash equivalents and short-term investments as a result of higher interest rates during fiscal year 2025 compared to fiscal year 2024.
The increase in other income (expense), net is mainly due the increase in interest income, an increase in foreign exchange gains and impairment loss of equity method investment in fiscal year 2024. The increase in foreign exchange gains is primarily related to the revaluation of non-functional currency denominated monetary assets and liabilities, and realized foreign exchange gain upon the payment of the BAPA tax assessment in fiscal year 2025.
74
Loss from Equity Method Investment, Net of Tax
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Loss from equity method investment, net of tax | $ | — | $ | (3,824) | $ | 3,824 | (100) | % | |||||||||||||||||||||||||||||||||||||||
We recorded an impairment charge of $8.9 million in other income (expense), net in the consolidated statement of operations during the year ended January 31, 2024 which reduced the equity method investment value to zero as of January 31, 2024. As a result there is no loss from equity method investment for fiscal year 2025.
Provision for (Benefit from) Income Taxes
| Fiscal Year Ended January 31, | Change | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | $ | % | ||||||||||||||||||||||||||||||||||||||||||||
| (in thousands, except percentages) | |||||||||||||||||||||||||||||||||||||||||||||||
| Provision for (benefit from) income taxes | $ | (76,674) | $ | 265,145 | $ | (341,819) | (128.9)% | ||||||||||||||||||||||||||||||||||||||||
| Effective tax rate | 89.4 | % | (165.1) | % | 254.5% | ||||||||||||||||||||||||||||||||||||||||||
Our effective tax rate increased by approximately 254.5% for fiscal year 2025 as compared to fiscal year 2024. A tax benefit is expressed as a positive rate because of our pretax loss. The increase in tax benefit was primarily due to the tax effects of the BAPA negotiations between the United States and Dutch tax authorities, as well as the execution of an agreement between GitLab B.V. and the Dutch tax authority to reduce the rate of tax imposed on the tax gain recognized upon the transfer of the economic rights of the Company’s intellectual property from the Netherlands to the United States.
Our effective tax rate for the year ended January 31, 2025 was higher than the U.S. federal statutory tax rate of 21%, primarily due to the tax effects of the BAPA negotiations between the United States and Dutch tax authorities, and the Company’s foreign and domestic operations.
We executed the BAPA agreements with the U.S. and Dutch tax authorities on October 10, 2024, and October 22, 2024, respectively. On October 28, 2024, we paid the tax assessment issued by the Dutch Tax Authority, or the DTA, which reflected the BAPA negotiations and the agreement to reduce the rate of tax on the gain from the transfer of economic IP rights. As a result of the BAPA and Dutch assessment, the 2015 through 2017 tax years are closed for GitLab B.V. Pursuant to the terms in the BAPA, the Company will file amended returns for the 2018 through 2023 fiscal years; the tax returns for the fiscal year ended January 31, 2024 were not yet due as of the end of the current fiscal year. All U.S. federal and state tax net operating losses (“NOLs”) and credits, as well as Netherlands NOLs, are not yet recognized due to the determination that they are not more likely than not to be realized.
Under the provisions of ASC 740, Income Taxes, the determination of our ability to recognize our deferred tax assets requires an assessment of both negative and positive evidence when determining our ability to recognize deferred tax assets. Consistent with prior years, we maintain that it is not more likely than not that we can recognize deferred tax assets in certain jurisdictions. The evidence we evaluated included operating results during the most recent three-year period and future projections. More weight is given to historical results than to expectations of future profitability, which are inherently uncertain. Certain entities’ net losses in recent periods represented sufficient negative evidence to require a valuation
75
allowance against its net deferred tax assets. This valuation allowance will be evaluated periodically and could be reversed partially or totally if business results have sufficiently improved to support realization of deferred tax assets.
As of January 31, 2025, our U.S. federal 2018 through 2024 tax years were open and subject to potential examination in one or more jurisdictions. In addition, in the United States, any net operating losses or credits that were generated in prior years but not yet fully utilized in a year that is closed under the statute of limitations may also be subject to examination. Our Netherlands tax years are currently open for the tax years from 2018 to 2024, subject to adjustments as a result of the recently negotiated BAPA. We believe that we have adequately reserved for the outcome of the BAPA. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for income taxes. We continue to monitor the progress of ongoing discussions with tax authorities and the effect, if any, of the expected expiration of the statute of limitations in various taxing jurisdictions.
As of January 31, 2025, unrecognized tax benefits were $25.6 million, of which $9.5 million would affect the effective tax rate if recognized. As of January 31, 2024, the unrecognized tax benefits were $402.7 million, of which $213.7 million would affect the effective tax rate if recognized. We have settled and paid the BAPA tax liability with the DTA, thereby reducing the current tax liability previously classified as an unrecognized tax benefit to an immaterial amount. For unrecognized tax benefits unrelated to the BAPA, we are unable to reasonably estimate the timing of the remaining long-term payments or the amount by which the liability will increase or decrease.
It is our policy to classify accrued interest and penalties related to unrecognized tax benefits in the provision for income taxes. For the years ended January 31, 2025, 2024 and 2023, the Company recognized interest and penalties of $5.3 million, $56.3 million and $1.3 million, respectively.
Liquidity and Capital Resources
Since inception, we have financed operations primarily through proceeds received from issuances of equity securities, preferred stock and payments received from our customers.
As of January 31, 2025 and January 31, 2024, our principal source of liquidity was cash, cash equivalents, and short-term investments aggregating to $992.4 million and $1.0 billion, respectively, which were held for working capital and strategic investment purposes. As of January 31, 2025, cash and cash equivalents consist of cash in banks, money markets funds, treasuries, and commercial paper, while short-term investments mainly consist of treasuries, corporate debt securities, agency securities, and commercial paper.
We believe that our existing cash, cash equivalents, and short-term investments will be sufficient to support working capital and capital expenditure requirements for at least the next 12 months. Our future capital requirements will depend on many factors, including our revenue growth rate, the timing and the amount of cash received from customers, the expansion of sales and marketing activities, the timing and extent of spending to support research and development efforts, the price at which we are able to procure third-party cloud infrastructure, expenses associated with our international expansion, the introduction of platform enhancements, and the continuing market adoption of The DevSecOps platform. In the future, we may enter into arrangements to acquire or invest in complementary businesses, products, and technologies. We may be required to seek additional equity or debt financing. In the event that we require additional financing, we may not be able to raise such financing on terms acceptable to us or at all. If we are unable to raise additional capital or generate cash flows necessary to expand our operations and invest in continued innovation, we may not be able to compete successfully, which would harm our business, operating results, and financial condition.
76
The following table shows a summary of our cash flows for the periods presented:
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| (in thousands) | |||||||||||||||||||||||||||||
| Net cash provided by (used in) operating activities | $ | (63,971) | $ | 35,040 | $ | (77,408) | |||||||||||||||||||||||
| Net cash used in investing activities | $ | (30,494) | $ | (86,238) | $ | (605,686) | |||||||||||||||||||||||
| Net cash provided by financing activities | $ | 32,620 | $ | 45,235 | $ | 97,482 | |||||||||||||||||||||||
Operating Activities
Our largest source of operating cash is payments received from our customers. Our primary uses of cash from operating activities are for personnel-related expenses, sales and marketing expenses, third-party cloud infrastructure expenses, and overhead expenses. We have generated positive cash flows in fiscal year 2024 and negative cash flows in fiscal years 2025 and 2023 from operating activities. We have supplemented working capital through net proceeds from the issuance of equity securities.
Cash used in operating activities during the year ended January 31, 2025 was $64.0 million, primarily consisting of our net loss of $9.1 million, adjusted for non-cash items of $236.8 million (mainly attributable to stock-based compensation expense of $185.9 million and amortization of deferred contract acquisition costs, net of $49.7 million), and net cash outflows of $291.7 million used in changes of our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the increase of accounts receivable of $99.6 million, the increase in deferred contract acquisition costs of $58.1 million, the decrease in accrued expenses and other liabilities of $253.4 million (mainly attributable to $187.7 million for the BAPA payment), and the decrease in other non-current liabilities of $7.8 million, partially offset by the decrease in prepaid expenses and other current assets of $8.4 million, the increase in accrued compensation and related expenses of $4.7 million, and the increase in deferred revenue of $108.7 million. These changes primarily reflect our strong sales growth driving higher accounts receivable, and increased deferred contract acquisition costs, the aforementioned BAPA payment impact driving lower accrued expenses and other liabilities, and continued expansion of our customer subscription base leading to increased deferred revenue.
Cash provided by operating activities during the year ended January 31, 2024 was $35.0 million, primarily consisting of our net loss of $429.5 million, adjusted for non-cash items of $222.2 million (mainly attributable to stock-based compensation expense of $163.0 million and amortization of deferred contract acquisition costs, net of $43.5 million), and net cash inflows of $242.3 million provided by changes in our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the increase in accrued expenses and other liabilities of $259.4 million, the increase in deferred revenue of $79.3 million and the increase in accrued compensation and related expenses of $15.2 million, partially offset by the increase in deferred contract acquisition costs of $53.1 million, the increase in accounts receivable of $36.3 million, and the increase in prepaid expenses and other current assets of $23.7 million.
Investing Activities
Cash used in investing activities during the year ended January 31, 2025 was $30.5 million, primarily consisting of a $20.2 million payment for a business combination, net of cash acquired, a $7.7 million payment for an asset acquisition, and $3.8 million in purchases of property and equipment, partially offset by $0.7 million in proceeds from maturities, net of purchases of short-term investments.
77
Cash used in investing activities during the year ended January 31, 2024 was $86.2 million, primarily consisting of $81.7 million in purchases of short-term investments, net of proceeds from maturities, $2.5 million outflow as a result of an escrow payment related to a prior business combination, $1.6 million in purchases of property and equipment, and $0.5 million of other investing activities.
Financing Activities
Cash provided by financing activities during the year ended January 31, 2025 was $32.6 million, attributable to $24.0 million proceeds from the issuance of common stock upon stock options exercises, and $13.6 million of proceeds from the issuance of common stock under the ESPP, partially offset by $4.9 million for the settlement of acquisition related contingent cash consideration.
Cash provided by financing activities during the year ended January 31, 2024 was $45.2 million, attributable to $32.3 million of proceeds from the issuance of common stock upon stock options exercises, and $12.9 million of proceeds from the issuance of common stock under the ESPP.
Adjusted Free Cash Flow
Adjusted free cash flow is a non-GAAP financial measure that we calculate as net cash provided by (used in) operating activities less cash used for purchases of property and equipment, plus any non-recurring income tax payments related to BAPA, plus any non-recurring payments related to the formation of JiHu. We believe that adjusted free cash flow is a useful indicator of liquidity that provides information to management and investors about the amount of cash generated from our operations that, after the investments in property and equipment, any non-recurring income tax payments related to BAPA, and any non-recurring payments related to the formation of JiHu, can be used for strategic initiatives, including investing in our business, and strengthening our financial position. One limitation of adjusted free cash flow is that it does not reflect our future contractual commitments. Additionally, adjusted free cash flow does not represent the total increase or decrease in our cash balance for a given period.
The following table presents a reconciliation of adjusted free cash flow to net cash provided by (used in) operating activities, the most directly comparable financial measure calculated in accordance with GAAP, for the periods presented (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
Computation of adjusted free cash flow (1) | |||||||||||||||||||||||||||||
| GAAP net cash provided by (used in) operating activities | $ | (63,971) | $ | 35,040 | $ | (77,408) | |||||||||||||||||||||||
| Less: Purchases of property and equipment | (3,765) | (1,598) | (6,070) | ||||||||||||||||||||||||||
| Add: Income tax payments related to BAPA | 187,735 | — | — | ||||||||||||||||||||||||||
| Non-GAAP adjusted free cash flow | $ | 119,999 | $ | 33,442 | $ | (83,478) | |||||||||||||||||||||||
(1) No non-recurring payments related to the formation of JiHu were recorded during the periods presented.
Contractual Obligations and Commitments
For more information regarding our contractual obligations, refer to “Note 14. Commitments and Contingencies” to our consolidated financial statements.
78
Critical Accounting Estimates
We prepare our consolidated financial statements in accordance with accounting principles generally accepted in the United States of America. In doing so, we have to make estimates and assumptions. Our critical accounting estimates are those estimates that involve a significant level of uncertainty at the time the estimate was made, and changes in them have had or are reasonably likely to have a material effect on our financial condition or results of operations. Accordingly, actual results could differ materially from our estimates. We base our estimates on past experience and other assumptions that we believe are reasonable under the circumstances, and we evaluate these estimates on an ongoing basis. We believe our judgments and estimates associated with the determination of standalone selling price for each performance obligation in revenue recognition, which we discuss further below, could have a material impact on our consolidated financial statements.
See “Note 2. Basis of Presentation and Summary of Significant Accounting Policies” to our consolidated financial statements for a summary of significant accounting policies and the effect on our financial statements.
Revenue Recognition
For contracts that contain multiple performance obligations, we allocate the transaction price for each contract to each performance obligation based on the relative standalone selling price or SSP for each performance obligation. We use judgment in determining SSP for our products and services. To determine SSP, we maximize the use of observable standalone sales and observable data, where available. In instances where performance obligations do not have observable standalone sales, we utilize available information that may include other observable inputs or use the expected cost-plus margin approach to estimate the price we would charge if the products and services were sold separately.
Self-managed subscriptions include both (i) a right to use the underlying software and (ii) a right to receive post-contract customer support during the subscription term. Post-contract customer support comprises maintenance services (including updates and upgrades to the software on a when and if available basis) and support services. We have concluded that the right to use the software, which is recognized upon delivery of the license, and the right to receive technical support and software fixes and updates, which is recognized ratably over the term of the arrangement, are two distinct performance obligations. Since neither of these performance obligations are sold on a standalone basis, we estimate the stand-alone selling price for each performance obligation using a model based on the “expected cost plus margin” approach and update the model on an annual basis or when facts and circumstances change. This model uses observable data points to develop the main inputs and assumptions which include the estimated historical costs to develop the paid features in the software license and the estimated future costs to provide post-contract customer support. Based on this model, we determined the SSP allocation for each of our paid tiers across various subscription tenures.
Compensation Recovery Analysis
As disclosed in “Note 2. Basis of Presentation and Summary of Significant Accounting Policies” to our consolidated financial statements, this Form 10-K reflects our identification and correction of certain errors in our prior year financial statements. The Compensation Committee of our Board of Directors, consisting entirely of independent directors, conducted a recovery analysis of incentive-based compensation received by our executive officers during the relevant period, as contemplated by Rule 10D-1 under the Exchange Act and in accordance with our Executive Officer Clawback Policy. Based on this analysis, no recovery of incentive-based compensation is required, as the financial statement adjustments did not impact the metrics used to determine incentive compensation during the relevant recovery period, and thus there was no erroneously awarded compensation.
79
Recently Issued Accounting Pronouncements
See “Note 2. Basis of Presentation and Summary of Significant Accounting Policies” to our consolidated financial statements included elsewhere in this Annual Report for more information regarding recently issued accounting pronouncements.
80
ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURE ABOUT MARKET RISK
We have operations both within the United States and internationally. We are exposed to market risk in the ordinary course of our business. Market risk represents the risk of loss that may impact our financial condition due to adverse changes in financial market prices and rates. Our market risk exposure is primarily the result of fluctuations in interest rates and foreign currency exchange rates.
Interest Rate Risk
As of January 31, 2025 and January 31, 2024, we had $992.4 million and $1.0 billion of cash, cash equivalents, and short-term investments, respectively. As of January 31, 2025 and January 31, 2024, our cash equivalents and short-term investments of $898.3 million and $955.3 million, respectively, mainly consist of money market funds, treasuries, corporate debt securities and commercial paper. Our cash, cash equivalents, and short-term investments are held for working capital and strategic investment purposes. We do not enter into investments for trading or speculative purposes. Our fixed-income portfolio is subject to fluctuations in interest rates, which could affect our results of operations. Based on our investment portfolio balance as of January 31, 2025, a hypothetical increase or decrease in interest rates of 1% (100 basis points) would result in a decrease or an increase in the fair value of our portfolio of approximately $4.7 million. Such losses would only be realized if we sell the investments prior to maturity. The weighted-average life of our investment portfolio was approximately 6 months as of January 31, 2025.
Foreign Currency Exchange Risk
To date, all of our sales contracts have been denominated in U.S. dollars, except for our variable interest entity, JiHu, which sells in local currency in its designated area. Our revenue is not subject to a material foreign currency risk. Operating expenses within the United States are primarily denominated in U.S. dollars, while operating expenses incurred outside the United States are primarily denominated in each country’s respective local currency. Our consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates.
Our reporting currency is the U.S. dollar, and the functional currency of our foreign subsidiaries is each country’s respective local currency. Assets and liabilities of the foreign subsidiaries are translated into U.S. dollars at the exchange rates in effect at the reporting date, and income and expenses are translated at average exchange rates during the period, with the resulting translation adjustments directly recorded as a component of accumulated other comprehensive income (loss). Foreign currency transaction gains and losses are recorded in other income (expense), net in the consolidated statements of operations. The volatility of exchange rates depends on many factors that we cannot forecast with reliable accuracy. In the event our foreign currency denominated assets, liabilities, or expenses increase, our operating results may be more greatly affected by fluctuations in the exchange rates of the currencies in which we do business. Moreover, as of January 31, 2025, we have $59.9 million of cash and cash equivalents denominated in currencies other than the U.S. dollar. The value of these cash balances may materially change along with the weakness or strength of the U.S. dollar. As of January 31, 2025, a hypothetical 10% change in foreign currency exchange rates would have a material impact on our consolidated financial statements.
We have not engaged in the hedging of foreign currency transactions to date, although we may choose to do so in the future.
81
ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA
INDEX TO CONSOLIDATED FINANCIAL STATEMENTS
| Page | |||||
Reports of Independent Registered Public Accounting Firm (KPMG LLP, Pittsburgh, PA, Auditor Firm ID: | |||||
82
Report of Independent Registered Public Accounting Firm
To the Stockholders and the Board of Directors
GitLab Inc.:
Opinion on the Consolidated Financial Statements
We have audited the accompanying consolidated balance sheets of GitLab Inc. and subsidiaries (the Company) as of January 31, 2025 and 2024, the related consolidated statements of operations, comprehensive loss, stockholders’ equity, and cash flows for each of the years in the three-year period ended January 31, 2025, and the related notes and financial statement schedule II - valuation and qualifying accounts (collectively, the consolidated financial statements). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company as of January 31, 2025 and 2024, and the results of its operations and its cash flows for each of the years in the three-year period ended January 31, 2025, in conformity with U.S. generally accepted accounting principles.
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company’s internal control over financial reporting as of January 31, 2025, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission, and our report dated March 21, 2025 expressed an unqualified opinion on the effectiveness of the Company’s internal control over financial reporting.
Basis for Opinion
These consolidated financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these consolidated financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.
We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. We believe that our audits provide a reasonable basis for our opinion.
Critical Audit Matter
The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the consolidated financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of the critical audit matter does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.
Evaluation of standalone selling prices (SSPs) for self-managed subscription and self-managed license performance obligations
83
As discussed in Note 3 to the consolidated financial statements, the Company recognized self-managed subscription revenue and self-managed license revenue of $458.9 million and $68.4 million, respectively, for the year ended January 31, 2025. The Company allocates the transaction price to each performance obligation based on the relative SSP. To determine SSP the Company maximizes the use of observable standalone sales and observable data where available. In instances where performance obligations do not have observable standalone sales, the Company utilizes available information that may include market conditions, pricing strategies, the economic life of the software, and other observable inputs and uses the expected cost plus margin approach to estimate the price the Company would charge if the products and services were sold separately.
We identified the evaluation of SSPs for self-managed subscription and self-managed license performance obligations as a critical audit matter. We performed a sensitivity analysis to determine the key assumption used to determine SSP, which required challenging auditor judgment. Specifically, challenging and subjective auditor judgment was required to evaluate the estimated costs to develop the paid features in the expected cost plus margin approach. Additionally, the estimate of SSP was sensitive to variation in this key assumption.
The following are the primary procedures we performed to address this critical audit matter.
•We tested certain controls over the Company’s revenue process, including controls over the development of SSPs and the relevance and reliability of the underlying data.
•We evaluated the overall methodology used to determine the estimate of SSPs based on the expected cost plus margin approach.
•We performed sensitivity analyses over the Company’s assumptions used to determine the SSPs to identify the costs to develop the paid features as the key assumption and to assess the impact of changes in the assumption on the Company’s SSPs.
•We assessed the reasonableness of the key assumption by comparing it to historical data, internal data, and relevant peer data, where available.
•We evaluated the data utilized by management to estimate the cost to develop the paid features by examining a selection of requests to merge code and interviewing the Company’s engineering team.
•We tested the mathematical accuracy of management’s calculations of estimated selling prices.
/s/ KPMG LLP
We have served as the Company’s auditor since 2019.
March 21, 2025
84
Report of Independent Registered Public Accounting Firm
To the Stockholders and the Board of Directors
GitLab Inc.:
Opinion on Internal Control Over Financial Reporting
We have audited GitLab Inc. and subsidiaries' (the Company) internal control over financial reporting as of January 31, 2025, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of January 31, 2025, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of January 31, 2025 and January 31, 2024, the related consolidated statements of operations, comprehensive loss, stockholders’ equity, and cash flows for each of the years in the three-year period ended January 31, 2025, and the related notes and financial statement schedule II - valuation and qualifying accounts (collectively, the consolidated financial statements), and our report dated March 21, 2025 expressed an unqualified opinion on those consolidated financial statements.
Basis for Opinion
The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.
We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.
Definition and Limitations of Internal Control Over Financial Reporting
A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.
85
Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
/s/ KPMG LLP
Pittsburgh, Pennsylvania
March 21, 2025
86
GitLab Inc.
Consolidated Balance Sheets
(in thousands, except per share data)
January 31, 2025(1) | January 31, 2024(1) | |||||||||||||||||||||||||||||||
| ASSETS | ||||||||||||||||||||||||||||||||
| CURRENT ASSETS: | ||||||||||||||||||||||||||||||||
| Cash and cash equivalents | $ | $ | ||||||||||||||||||||||||||||||
| Short-term investments | ||||||||||||||||||||||||||||||||
Accounts receivable, net of allowance for doubtful accounts of $ | ||||||||||||||||||||||||||||||||
| Deferred contract acquisition costs, current | ||||||||||||||||||||||||||||||||
| Prepaid expenses and other current assets | ||||||||||||||||||||||||||||||||
| Total current assets | ||||||||||||||||||||||||||||||||
| Property and equipment, net | ||||||||||||||||||||||||||||||||
| Operating lease right-of-use assets | ||||||||||||||||||||||||||||||||
| Goodwill | ||||||||||||||||||||||||||||||||
| Intangible assets, net | ||||||||||||||||||||||||||||||||
| Deferred contract acquisition costs, non-current | ||||||||||||||||||||||||||||||||
| Other non-current assets | ||||||||||||||||||||||||||||||||
| TOTAL ASSETS | $ | $ | ||||||||||||||||||||||||||||||
| LIABILITIES AND STOCKHOLDERS’ EQUITY | ||||||||||||||||||||||||||||||||
| CURRENT LIABILITIES: | ||||||||||||||||||||||||||||||||
| Accounts payable | $ | $ | ||||||||||||||||||||||||||||||
| Accrued expenses and other current liabilities | ||||||||||||||||||||||||||||||||
| Accrued compensation and benefits | ||||||||||||||||||||||||||||||||
| Deferred revenue, current | ||||||||||||||||||||||||||||||||
| Total current liabilities | ||||||||||||||||||||||||||||||||
| Deferred revenue, non-current | ||||||||||||||||||||||||||||||||
| Other non-current liabilities | ||||||||||||||||||||||||||||||||
| TOTAL LIABILITIES | ||||||||||||||||||||||||||||||||
Commitments and contingencies (Note 14) | ||||||||||||||||||||||||||||||||
| STOCKHOLDERS’ EQUITY: | ||||||||||||||||||||||||||||||||
Preferred stock, $ | ||||||||||||||||||||||||||||||||
Class A Common stock, $ | ||||||||||||||||||||||||||||||||
Class B Common stock, $ | ||||||||||||||||||||||||||||||||
| Additional paid-in capital | ||||||||||||||||||||||||||||||||
| Accumulated deficit | ( | ( | ||||||||||||||||||||||||||||||
| Accumulated other comprehensive income (loss) | ( | |||||||||||||||||||||||||||||||
| Total GitLab stockholders’ equity | ||||||||||||||||||||||||||||||||
| Noncontrolling interests | ||||||||||||||||||||||||||||||||
| TOTAL STOCKHOLDERS’ EQUITY | ||||||||||||||||||||||||||||||||
| TOTAL LIABILITIES AND STOCKHOLDERS’ EQUITY | $ | $ | ||||||||||||||||||||||||||||||
(1) As of January 31, 2025 and January 31, 2024, the consolidated balance sheet includes assets of the consolidated variable interest entity, GitLab Information Technology (Hubei) Co., LTD (“JiHu”), of $46.5 million and $51.2 million, respectively, and liabilities of $10.3 million and $10.1 million respectively. The assets of JiHu can be used only to settle obligations of JiHu and creditors of JiHu do not have recourse against the general credit of the Company. Refer to “Note 11. Joint Venture and Equity Method Investment” for further discussion.
The accompanying notes are an integral part of these consolidated financial statements.
87
GitLab Inc.
Consolidated Statements of Operations
(in thousands, except per share data)
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Revenue: | |||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | $ | $ | $ | ||||||||||||||||||||||||||
| License—self-managed and other | |||||||||||||||||||||||||||||
| Total revenue | |||||||||||||||||||||||||||||
| Cost of revenue: | |||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | |||||||||||||||||||||||||||||
| License—self-managed and other | |||||||||||||||||||||||||||||
| Total cost of revenue | |||||||||||||||||||||||||||||
| Gross profit | |||||||||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||||||||
| Total operating expenses | |||||||||||||||||||||||||||||
| Loss from operations | ( | ( | ( | ||||||||||||||||||||||||||
| Interest income | |||||||||||||||||||||||||||||
| Other income (expense), net | ( | ||||||||||||||||||||||||||||
Loss before income taxes and loss from equity method investment | ( | ( | ( | ||||||||||||||||||||||||||
| Loss from equity method investment, net of tax | ( | ( | |||||||||||||||||||||||||||
| Provision for (benefit from) income taxes | ( | ||||||||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss attributable to noncontrolling interest | ( | ( | ( | ||||||||||||||||||||||||||
| Net loss attributable to GitLab | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted: | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Weighted-average shares used to compute net income (loss) per share attributable to GitLab Class A and Class B common stockholders, basic and diluted: | |||||||||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
88
GitLab Inc.
Consolidated Statements of Comprehensive Loss
(in thousands)
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Foreign currency translation adjustments | ( | ( | ( | ||||||||||||||||||||||||||
| Net change in unrealized gains (losses) on available-for-sale securities | ( | ||||||||||||||||||||||||||||
| Comprehensive loss including noncontrolling interest | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss attributable to noncontrolling interest | ( | ( | ( | ||||||||||||||||||||||||||
| Foreign currency translation adjustments attributable to noncontrolling interest | ( | ( | ( | ||||||||||||||||||||||||||
| Comprehensive loss attributable to noncontrolling interest | ( | ( | ( | ||||||||||||||||||||||||||
| Comprehensive loss attributable to GitLab | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
89
GitLab Inc.
Consolidated Statements of Stockholders’ Equity
(in thousands)
| Class A Common Stock | Class B Common Stock | Additional Paid-in Capital | Accumulated Deficit | Accumulated Other Comprehensive Income (Loss) | Noncontrolling Interests | Total Stockholders’ Equity | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Shares | Amount | Shares | Amount | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Balance at January 31, 2022 | $ | $ | $ | $ | ( | $ | $ | $ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Conversion of Class B common stock to Class A common stock | — | ( | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to vested exercised stock options | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Repurchases, net of early exercised stock options | — | — | ( | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to RSUs vested | — | — | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vesting of early exercised stock options | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Change in noncontrolling interest ownership | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Deconsolidation of Arch, formerly Meltano | — | — | — | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Other comprehensive loss | — | — | — | — | — | — | ( | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | — | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Balances at January 31, 2023 | $ | $ | $ | $ | ( | $ | ( | $ | $ | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Conversion of Class B common stock to Class A common stock | — | ( | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to vested exercised stock options | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Repurchases, net of early exercised stock options | — | — | ( | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to RSUs vested | — | — | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Charitable donation of common stock | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vesting of early exercised stock options | — | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | — | — | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Change in noncontrolling interest ownership | — | — | — | — | ( | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Other comprehensive income (loss) | — | — | — | — | — | — | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | — | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Balances at January 31, 2024 | $ | $ | $ | $ | ( | $ | $ | $ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Conversion of Class B common stock to Class A common stock | — | ( | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock in connection with business combination, net | — | — | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to vested exercised stock options | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Issuance of common stock related to RSUs vested | — | — | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Charitable donation of common stock | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vesting of early exercised stock options | — | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
90
| Change in noncontrolling interest ownership | — | — | — | — | ( | — | — | — | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Other comprehensive loss | — | — | — | — | — | — | ( | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | — | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Balances at January 31, 2025 | $ | $ | $ | $ | ( | $ | ( | $ | $ | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
91
GitLab Inc.
Consolidated Statements of Cash Flows
(in thousands)
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| CASH FLOWS FROM OPERATING ACTIVITIES: | |||||||||||||||||||||||||||||
| Net loss, including amounts attributable to noncontrolling interest | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Adjustments to reconcile net loss to net cash provided by (used in) operating activities: | |||||||||||||||||||||||||||||
| Stock-based compensation expense | |||||||||||||||||||||||||||||
| Change in fair value of acquisition related contingent consideration | ( | ||||||||||||||||||||||||||||
| Charitable donation of common stock | |||||||||||||||||||||||||||||
| Amortization of intangible assets | |||||||||||||||||||||||||||||
| Depreciation expense | |||||||||||||||||||||||||||||
| Amortization of deferred contract acquisition costs | |||||||||||||||||||||||||||||
| Gain from deconsolidation of Arch, formerly Meltano | ( | ||||||||||||||||||||||||||||
| Loss from equity method investment | |||||||||||||||||||||||||||||
| Impairment of equity method investment | |||||||||||||||||||||||||||||
| Net amortization of premiums or discounts on short-term investments | ( | ( | ( | ||||||||||||||||||||||||||
| Unrealized foreign exchange loss (gain), net | ( | ( | |||||||||||||||||||||||||||
| Other non-cash expense, net | |||||||||||||||||||||||||||||
| Changes in assets and liabilities: | |||||||||||||||||||||||||||||
| Accounts receivable | ( | ( | ( | ||||||||||||||||||||||||||
| Prepaid expenses and other current assets | ( | ( | |||||||||||||||||||||||||||
| Deferred contract acquisition costs | ( | ( | ( | ||||||||||||||||||||||||||
| Other non-current assets | ( | ( | |||||||||||||||||||||||||||
| Accounts payable | ( | ||||||||||||||||||||||||||||
| Accrued expenses and other current liabilities | ( | ||||||||||||||||||||||||||||
| Accrued compensation and benefits | ( | ||||||||||||||||||||||||||||
| Deferred revenue | |||||||||||||||||||||||||||||
| Other non-current liabilities | ( | ( | |||||||||||||||||||||||||||
| Net cash provided by (used in) operating activities | ( | ( | |||||||||||||||||||||||||||
| CASH FLOWS FROM INVESTING ACTIVITIES: | |||||||||||||||||||||||||||||
| Purchases of short-term investments | ( | ( | ( | ||||||||||||||||||||||||||
| Proceeds from maturities of short-term investments | |||||||||||||||||||||||||||||
| Purchases of property and equipment | ( | ( | ( | ||||||||||||||||||||||||||
| Deconsolidation of Arch, formerly Meltano | ( | ||||||||||||||||||||||||||||
| Payments for business combination, net of cash acquired | ( | ||||||||||||||||||||||||||||
| Payments for asset acquisition | ( | ||||||||||||||||||||||||||||
| Escrow payment related to business combination, after acquisition date | ( | ||||||||||||||||||||||||||||
| Other investing activities | ( | ||||||||||||||||||||||||||||
| Net cash used in investing activities | ( | ( | ( | ||||||||||||||||||||||||||
| CASH FLOWS FROM FINANCING ACTIVITIES: | |||||||||||||||||||||||||||||
| Proceeds from the issuance of common stock upon exercise of stock options, including early exercises, net of repurchases | |||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | |||||||||||||||||||||||||||||
| Contributions received from noncontrolling interests, net of issuance costs | |||||||||||||||||||||||||||||
| Settlement of acquisition related contingent cash consideration | ( | ( | |||||||||||||||||||||||||||
| Net cash provided by financing activities | |||||||||||||||||||||||||||||
| Impact of foreign exchange on cash and cash equivalents | ( | ( | |||||||||||||||||||||||||||
| Net decrease in cash and cash equivalents | ( | ( | ( | ||||||||||||||||||||||||||
92
| Cash and cash equivalents at beginning of period | |||||||||||||||||||||||||||||
| Cash and cash equivalents at end of period | $ | $ | $ | ||||||||||||||||||||||||||
| Supplemental disclosure of cash flow information: | |||||||||||||||||||||||||||||
| Cash paid for income taxes related to the bilateral advance pricing agreement | $ | $ | $ | ||||||||||||||||||||||||||
| Other cash paid for income taxes | $ | $ | $ | ||||||||||||||||||||||||||
| Supplemental disclosure of non-cash investing and financing activities: | |||||||||||||||||||||||||||||
| Acquisition measurement period adjustment | $ | $ | $ | ||||||||||||||||||||||||||
| Vesting of early exercised stock options | $ | $ | $ | ||||||||||||||||||||||||||
| Unpaid property and equipment in accounts payable | $ | $ | $ | ||||||||||||||||||||||||||
| Reconciliation of cash, cash equivalents and restricted cash within the consolidated balance sheets to the amounts shown in the statements of cash flows above: | |||||||||||||||||||||||||||||
| Cash and cash equivalents | $ | $ | $ | ||||||||||||||||||||||||||
| Restricted cash, included in prepaid expenses and other current assets | |||||||||||||||||||||||||||||
| Total cash, cash equivalents and restricted cash | $ | $ | $ | ||||||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
93
GitLab Inc.
Notes to Consolidated Financial Statements
1. Organization and Description of Business
GitLab Inc. (the “Company”) began as an open source project in 2011 and was incorporated in Delaware on September 12, 2014. The Company operates on an all-remote model. The Company is a technology company and its primary offering is “GitLab”, a complete DevSecOps platform delivered as a single application. GitLab is used by a wide range of organizations. The Company also provides related training and professional services. GitLab is offered on both self-managed and software-as-a-service ("SaaS") models. The principal markets for GitLab are currently located in the United States, Europe, and Asia Pacific. The Company is focused on accelerating innovation and broadening the distribution of its platform to companies across the world to help them become better software-led businesses.
94
2. Basis of Presentation and Summary of Significant Accounting Policies
Basis of Presentation
The consolidated financial statements have been prepared in conformity with accounting principles generally accepted in the United States of America (“U.S. GAAP”).
Fiscal Year
The Company's fiscal year ends on January 31. For example, references to fiscal year 2025 and 2024 refer to the fiscal year ended January 31, 2025 and 2024, respectively.
Use of Estimates
The preparation of the consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the financial statements, and the reported amounts of revenue and expenses during the reporting period. Such estimates include, but are not limited to, allocation of revenue to the license element in the Company's self-managed subscriptions, estimating the amortization period for capitalized costs to obtain a contract, allowance for doubtful accounts, fair value of contingent consideration, taxation of intangible property in company formation, merger, or acquisition transactions, valuation allowance for deferred income taxes, reserves for unrecognized income tax benefits, valuation of acquired intangibles assets and impairment of goodwill. The Company bases these estimates on historical and anticipated results, trends, and various other assumptions that it believes are reasonable under the circumstances, including assumptions as to future events. Actual results could differ from those estimates.
Principles of Consolidation
The consolidated financial statements include 100% of the accounts of wholly owned and majority owned subsidiaries as well as a variable interest entity for which the Company is the primary beneficiary. The ownership interest of other investors is recorded as noncontrolling interest. All intercompany accounts and transactions have been eliminated in consolidation.
Foreign Currency
The reporting currency of the Company is the U.S. dollar. The Company determines the functional currency of each foreign subsidiary and the variable interest entity in accordance with ASC 830, Foreign Currency Matters, based on the currency of the primary economic environment in which each subsidiary and the variable interest entity operate. Items included in the financial statements of such subsidiaries and the variable interest entity are measured using that functional currency.
Gains and losses that arise from foreign exchange rate fluctuations on transactions denominated in a currency other than the functional currency are included in other income (expense), net on the consolidated statements of operations. For the years ended January 31, 2025, 2024 and 2023, the Company recognized foreign exchange gains (losses), net of $9.4 million, $(2.9 ) million and $5.1 million, respectively.
95
Cash, Cash Equivalents, and Restricted Cash
Restricted cash as of January 31, 2023, consists of a $2.5 million acquisition related security deposit withheld in an escrow for any potential post-closing indemnification claims. The Company fully paid this acquisition-related holdback during the year ended January 31, 2024. Refer to “Note 6. Acquisitions.”
Short-Term Investments - Marketable Securities
The Company classifies its marketable securities with stated maturities of three months and greater at the date of purchase as short-term investments due to its ability to use these securities to support the Company’s current operations.
As of January 31, 2025 and 2024, all short-term investments are classified as available-for-sale and are reported at fair value, which is based on quoted market prices for such securities, if available, or based on quoted market prices of financial instruments with similar characteristics. If the fair value of a security falls below its amortized cost, the carrying value is reduced to its fair value if management intends to sell or it is more likely than not that it will be required to sell before recovery of the amortized cost basis. If neither of these conditions are satisfied, impairment is assessed for credit losses by comparing the present value of expected cash flows with the amortized cost basis, and an allowance for credit losses is recorded for the excess of amortized cost over expected cash flows. Impairment losses not attributable to credit losses are reported as a separate component of other comprehensive loss, net of tax.
The cost of securities sold is based on the specific-identification method. Unrealized gains and losses are reported as a separate component of accumulated other comprehensive income (loss). Realized gains and losses on available-for-sale securities are recognized upon sale and are included in other income (expense), net in the consolidated statements of operations. Interest on securities classified as available-for-sale is included within interest income on our consolidated statements of operations.
Available-for-sale securities are recorded at fair value each reporting period and are adjusted for the amortization of premiums and accretion of discounts to maturity. Such amortization and accretion are included in interest income of the consolidated statements of operations.
Accounts Receivable and Allowance for Doubtful Accounts
Accounts receivable, which represent trade receivables from the Company’s customers, are recorded at the invoiced amount and do not bear interest. The Company extends credit of typically 30 to 60 days to its customers in the normal course of business and does not require collateral from its customers. The allowance for doubtful accounts is the Company’s best estimate of the amount of expected credit losses in existing accounts receivable.
As of January 31, 2025 and 2024, the allowance for doubtful accounts was $1.0 million and $0.7 million, respectively. Accounts receivable deemed uncollectible are written off against the allowance when identified.
Concentration of Credit Risk and Significant Customers
Financial instruments that potentially subject the Company to concentrations of credit risk consist primarily of cash, cash equivalents, restricted cash, short-term investments, and accounts receivable. At times, cash deposits may be in excess of insured limits. The Company believes that the financial institutions or corporations that hold its cash, cash equivalents, restricted cash, and short-term investments are financially sound and, accordingly, minimal credit risk exists with respect to these
96
balances. The Company maintains allowances for potential credit losses on accounts receivable when deemed necessary.
There were no individual customers whose revenue represented more than 10% of total revenue during the years ended January 31, 2025, 2024 and 2023.
Fair Value of Financial Instruments
We define fair value as the price that would be received from selling an asset, or paid to transfer a liability, in an orderly transaction between market participants at the measurement date. When determining the fair value measurements for assets and liabilities which are required to be recorded at fair value, we consider the principal or most advantageous market in which to transact and the market-based risk. We apply fair value accounting for all financial assets and liabilities that are recognized or disclosed at fair value in the financial statements on a recurring basis. The carrying amounts reported in the consolidated financial statements approximate the fair value for cash equivalents, restricted cash, short-term investments, accounts receivable, accounts payable and accrued liabilities due to their short-term nature. The Company also recorded acquisition related contingent considerations at fair value, as further discussed in “Note 4. Cash Equivalents and Short-Term Investments.”
The Company measures assets and liabilities at each reporting period using a fair value hierarchy which requires it to maximize the use of observable inputs and minimize the use of unobservable inputs when measuring fair value. U.S. GAAP describes a fair value hierarchy based on three levels of inputs, of which the first two are considered observable and the last unobservable, to measure the fair value:
Level 1 – Inputs are unadjusted quoted prices in active markets for identical assets or liabilities.
Level 2 – Inputs other than Level 1 that are observable, either directly or indirectly, such as quoted prices for similar assets or liabilities, quoted prices in markets that are not active, or other inputs that are observable or can be corroborated by observable market data for substantially the full term of the assets or liabilities.
Level 3 – Inputs are unobservable based on the Company’s own assumptions used to measure assets and liabilities at fair value. The inputs require significant management judgment or estimation.
Fair value estimates are made at a specific point in time based on relevant market information and information about the financial or nonfinancial asset or liability.
Revenue Recognition
The Company generates revenue primarily from offering self-managed (on-premise) and SaaS subscriptions. Revenue is also generated from professional services, including consulting and training.
In accordance with ASC 606, revenue is recognized when a customer obtains control of the promised products and services. The amount of revenue recognized reflects the consideration that the Company expects to be entitled to receive in exchange for these products and services. To achieve the core principle of this standard, the Company applies the following five-step model as a framework:
1)Identify the contract with a customer. We consider the terms and conditions of our arrangements with customers to identify contracts under ASC 606. We consider that we have a contract with a customer when the contract is approved, we can identify each party's rights regarding the products and services to be transferred, we can identify the payment terms for the products and
97
services, we have determined the customer has the ability and intent to pay, and the contract has commercial substance. We apply judgment in determining the customer's ability and intent to pay, which is based upon factors including the customer's historical payment experience or, for new customers, credit and financial information pertaining to the customers. At contract inception, we also evaluate whether two or more contracts should be combined and accounted for as a single contract. Further, contract modifications generally qualify as a separate contract.
The typical term of a subscription contract for a self-managed or SaaS offering is to three years . Our contracts are non-cancelable over the contract term and we act as principal in all our customer contracts. Customers have the right to terminate their contracts generally only if we breach the contract and we fail to remedy the breach in accordance with the contractual terms.
2)Identify the performance obligations in the contract. Performance obligations in our contracts are identified based on the products and services that will be transferred to the customer that are both capable of being distinct, whereby the customer can benefit from the product or service either on its own or together with other resources that are readily available from third parties or from us, and are distinct in the context of the contract, whereby the transfer of the product or service is separately identifiable from other promises in the contract.
Our self-managed subscriptions include two performance obligations: (i) to provide access to proprietary features in our software, and (ii) to provide support and maintenance (including the combined obligation to provide software updates on a when-and-if-available basis).
Our SaaS products provide access to hosted software as well as support, which is evaluated to be a single performance obligation.
Services-related performance obligations relate to the provision of consulting and training services. These services are distinct from subscriptions and do not result in significant customization of the software.
Some of our customers have the option to purchase additional licenses or renew at a stated price. These options are evaluated on a case-by-case basis but generally do not provide a material right as they are either at the same price as the existing licenses or are within our range of standalone selling price (“SSP”) and, as such, would not result in a separate performance obligation. Where material rights are identified in our contracts, they are treated as separate performance obligations.
3)Determine the transaction price. We determine transaction price based on the consideration to which we expect to be entitled in exchange for transferring products and services to the customer.
Our contracts are non-refundable and non-cancellable. We do not offer refunds, rebates, or credits to our customers in the normal course of business.
For contracts with a one year term, we applied a practical expedient available under ASC 606 and therefore do not make an evaluation for the existence of a significant financing component. In these contracts, at contract inception, the period between when we expect to transfer a promised product or service to the customer and when the customer pays for that product or service will be one year or less. For contracts with terms of more than a year, we have applied judgment in determining that advance payments in such contracts are not collected with the primary intention of availing finance and therefore, do not represent a significant financing component. Revenue is recognized net of any taxes collected from customers which are subsequently remitted to governmental entities (e.g., sales tax and other indirect taxes). We do not offer the right of refund in our contracts.
4)Allocate the transaction price to the performance obligations in the contract. If the contract contains a single performance obligation, the entire transaction price is allocated to the single performance obligation. For contracts that contain multiple performance obligations, we allocate the transaction price for each contract to each performance obligation based on the relative SSP
98
for each performance obligation. We use judgment in determining the SSP for our products and services. We typically assess the SSP for our products and services on an annual basis or when facts and circumstances change. To determine SSP, we maximize the use of observable standalone sales and observable data, where available. In instances where performance obligations do not have observable standalone sales, we utilize available information that may include other observable inputs or use the expected cost-plus margin approach to estimate the price we would charge if the products and services were sold separately. The expected cost-plus margin approach is currently used to determine SSP for each distinct performance obligation for self-managed subscriptions.
We have concluded that (i) the right to use the software and (ii) the right to receive technical support and software fixes and updates are two distinct performance obligations in our self-managed subscriptions. Since neither of these performance obligations are sold on a standalone basis, we estimate SSP for each performance obligation using a model based on the “expected cost-plus margin” approach and update the model on an annual basis or when facts and circumstances change. This model uses observable data points to develop the main inputs and assumptions, which include the estimated historical costs to develop the paid features in the software license and the estimated future costs to provide post-contract customer support.
5)Revenue is recognized when or as we satisfy a performance obligation. Revenue is recognized at the time the related performance obligation is satisfied by transferring the promised products and services to a customer. We recognize revenue when we transfer control of the products and services to our customers for an amount that reflects the consideration that we expect to receive in exchange for those products and services. All revenue is generated from contracts with customers.
Subscription - self-managed and SaaS
Subscription - self-managed
The Company's self-managed subscriptions include support, maintenance, upgrades, and updates on a when-and-if-available basis. Revenue for self-managed subscriptions is recognized ratably over the contract period based on the stand-ready nature of subscription elements.
The Company offers two tiers of paid subscriptions as part of the self-managed model: Premium and Ultimate.
The typical term of a subscription contract for self-managed offerings is to three years .
SaaS
We also offer two tiers of paid SaaS subscriptions: Premium and Ultimate. These subscriptions provide access to our latest managed version of our product hosted in a public or private cloud based on the customer’s preference. Revenue from our SaaS products (Subscription revenue - SaaS) is recognized ratably over the contract period when the performance obligation is satisfied.
The typical term of a subscription contract for SaaS offering is to three years .
License - self-managed and other
The license component of our self-managed subscriptions reflects the revenue recognized by providing customers with rights to use proprietary software features.
Other revenue consists of professional services revenue which is derived from fixed fee and time and materials offerings, subject to customer acceptance for certain fixed fee offerings. Uncertainty exists about customer acceptance and therefore, control is presumed to transfer upon confirmation from the customer, as defined in each professional services contract. Accordingly, revenue is recognized upon
99
satisfaction of all requirements per the applicable contract. Revenue from professional services provided on a time and material basis is recognized over the period services are delivered.
The Company presents financial information about disaggregation of revenue in “Note 3. Revenues” of the consolidated financial statements.
Deferred Revenue and Contract Assets
Contract liabilities consist of deferred revenue and include payments received in advance of performance under the contract. Such amounts are recognized as revenue over the contractual period. The portion of deferred revenue that the Company will recognize during the twelve-month period from the balance sheet date is recorded within current liabilities and the remaining portion is recorded as long-term.
The Company receives payments from customers based upon contractual billing schedules and accounts receivable are recorded when the right to consideration becomes unconditional. Customers are generally billed in advance, including some multi-year contracts, but the majority of customers in multi-year contracts specifically request to pay annually in advance. Where the value of revenue recognized exceeds the value of amounts invoiced for a contract at the end of a reporting period, the excess is reclassified from deferred revenue to contract assets until invoiced. Contract assets are included in prepaid expenses and other current assets on the consolidated balance sheets.
During the years ended January 31, 2025, 2024 and 2023, $331.8 million, $217.0 million and $145.9 million, respectively, of revenue was recognized, which was included in the corresponding deferred revenue balance at the beginning of the reporting periods presented.
Remaining Performance Obligations
As of January 31, 2025, the aggregate transaction price allocated to billed and unbilled remaining performance obligations for which revenue has not yet been recognized was approximately $945.0 million. Of this amount, the Company expects to recognize approximately 61 % over the next 12 months and 87 % over the next 24 months.
Deferred Contract Acquisition Costs
Sales commissions and bonuses that are recoverable and incremental costs of obtaining contracts with customers are capitalized.
Commissions and bonuses paid upon the acquisition of an initial contract are amortized over an estimated period of benefit which has been determined generally to be 3 years based on historical analysis of average customer life and useful life of our product offerings. Commissions paid for subsequent renewals are amortized over the renewal term. Amortization is recognized on a straight-line basis and included in sales and marketing expenses in the consolidated statements of operations. However, costs for commissions that are incremental to obtain a self-managed license contract are expensed immediately. The Company periodically reviews these deferred costs to determine whether events or changes in circumstances have occurred that could impact the period of benefit of these deferred costs. The Company did not recognize any impairment of deferred contract acquisition costs during the periods presented.
Cost of Revenue
Cost of revenue for self-managed and SaaS subscriptions consists primarily of allocated cloud-hosting costs paid to third party service providers, personnel-related costs associated with our customer
100
support personnel, including contractors, third-party payment processing fees, and allocated overhead. Personnel-related expenses consist of salaries, benefits, bonuses, and stock-based compensation.
Research and Development
Costs related to research and development of the Company’s software offerings are expensed as incurred. These costs consist primarily of compensation paid to the Company's research and development personnel, including contractors.
The Company’s internal customer software development process follows an iterative process that results in more frequent software releases than do traditional sequential or waterfall development methodologies and also results in internal validation of the software releases very shortly before they are made available to customers. Therefore, to date, costs to develop software that is marketed externally have not been capitalized as the current software development process is essentially completed concurrently with the establishment of technological feasibility through internal validation of the software releases. As such, all related software development costs are expensed as incurred and included in research and development expenses in the consolidated statements of operations. To date, software development for internal use has been immaterial and no such costs have been capitalized.
Advertising Costs
Loss Contingencies
If an exposure to any potential claim or legal proceeding is considered probable and the amount can be reasonably estimated, the Company records a liability for the estimated loss. Significant judgment is required in both the determination of probability and the determination as to whether an exposure is reasonably estimable. If applicable, the Company records receivables for probable insurance or other third-party recoveries. Due to uncertainties related to these matters, accruals are based on the best information available at the time. As additional information becomes available, the Company reassesses the potential liability and may revise its estimates. These revisions in the estimates of the potential liabilities could have a material impact on the Company’s results of operations and financial position. Legal fees and other costs associated with such actions are expensed as incurred.
Income Taxes
The Company is subject to income taxes in the United States and several foreign jurisdictions. The Company records a provision for income taxes for the anticipated tax consequences of the reported results of operations using the asset and liability method. Under this method, the Company recognizes deferred tax assets and liabilities for the expected future tax consequences of temporary differences between the financial reporting and the tax basis of assets and liabilities, as well as for operating losses and tax credit carryforwards. Deferred tax assets and liabilities are measured using the tax rates that are expected to apply to taxable income for the years in which those tax assets and liabilities are expected to be realized or settled.
Valuation allowances are established when necessary to reduce deferred tax assets to the amounts more likely than not expected to be realized. Management applies significant judgment in assessing the positive and negative evidence available in the determination of the amount of deferred tax assets that
101
were more likely than not to be realized in the future. Future realization of deferred tax assets ultimately depends on the existence of sufficient taxable income of the appropriate character (for example, ordinary income or capital gain) within the carryback or carryforward periods available under the tax law. The Company regularly reviews the deferred tax assets for recoverability based on historical taxable income, projected future taxable income, the expected timing of the reversals of existing temporary differences, and tax planning strategies. The Company’s judgments regarding future profitability may change due to many factors, including future market conditions and the ability to successfully execute its business plans and/or tax planning strategies. Should there be a change in the ability to recover deferred tax assets, the tax provision would increase or decrease in the period in which the assessment is changed.
Compliance with income tax regulations requires the Company to take certain tax positions. In assessing the exposure associated with various filing positions, the Company determines whether a tax position is more likely than not to be sustained upon examination, including resolution of any related appeals or litigation processes, based on the technical merits of the position. The Company uses a two-step approach to recognizing and measuring uncertain tax positions. The first step is to evaluate the tax position for recognition by determining if the weight of the available evidence indicates that it is more likely than not that the position will be sustained upon tax authority examination, including resolution of related appeals or litigation processes, if any. The second step is to measure the tax benefit as the largest amount that is more than fifty percent likely of being realized upon ultimate settlement. Interest and penalties related to unrecognized tax benefits, if any, are included within the provision for income taxes in the consolidated statement of operations.
Comprehensive Loss and Accumulated Other Comprehensive Income (Loss)
Comprehensive loss includes net loss and changes in stockholders’ equity that are excluded from net loss due to changes in the Company’s cumulative foreign currency translation account and unrealized gains or losses on short-term investments.
Net Loss per Share Attributable to Common Stockholders
Stock-Based Compensation
The Company has granted equity classified stock-based awards to team members, members of its board of directors, and non-employee advisors. The majority of the Company's stock-based awards have been granted to team members and the service-based vesting condition for the majority of these awards is satisfied over four years .
The cost of stock-based awards granted to team members is measured at the grant date, based on the fair value of the award, and is generally recognized as expense on a straight-line basis over the requisite service period. Forfeitures are recorded as they occur. The Company has elected to use the Black-Scholes option pricing model to determine the fair value of stock options.
In May 2021, the Company granted 3 million shares of restricted stock units (“RSUs”) tied to our Class B common stock to Mr. Sijbrandij, our Co-founder and former CEO. The RSUs contain a service condition and a performance condition based on the achievement of eight separate stock price hurdles/tranches ranging from $95 to $500 per share. The fair value of the RSUs was determined utilizing a
102
Monte Carlo valuation model. We recognize total stock-based compensation expense over the derived service period of each tranche using the accelerated attribution method, regardless of whether the stock price hurdles are achieved. The RSUs were forfeited during the year ended January 31, 2025. Refer to “Note 9. Equity” for further discussion.
In September 2021, our board of directors and our stockholders approved the 2021 Employee Stock Purchase Plan (“ESPP”) to enable eligible team members to purchase shares of our Class A common stock with accumulated payroll deductions. We recognize stock-based expenses related to the shares to be issued under the ESPP on a straight-line basis over the offering period, using the Black-Scholes option-pricing model. We have been determining the volatility input based on the historical volatility of our peer group until such time as we established a 2-year public trading history of our own stock price. For the new offering period starting December 2023, we transitioned to using an average blend of historical volatility of our peer group and volatility of our own stock price when determining the volatility input.
Since fiscal year 2023, JiHu has maintained an employee stock option plan ("JiHu 2022 ESOP") for its employees. In June 2024, the board of directors of JiHu approved a new employee stock option plan ("JiHu 2024 ESOP") for its employees in order to grant additional shares. The fair value of Restricted Stock Awards (“RSAs”) and stock option awards is measured on the date of grant and compensation costs related to these awards are recognized on a graded attribution method as the grants include a performance condition for both the JiHu 2022 ESOP and JiHu 2024 ESOP ("JiHu ESOPs"). The Company considers the RSAs and stock option awards granted pursuant to the JiHu ESOP as potentially dilutive equity instruments that will result in dilution of the Company’s stake in JiHu upon vesting of such awards (or, in the case of option awards granted pursuant to the JiHu ESOP, upon vesting and subsequent exercise into shares of JiHu common stock). Any such dilution will be accounted for as an equity transaction. Until such awards granted pursuant to the JiHu ESOP are vested (or, in the case of option awards, vested and ultimately exercised into shares of JiHu common stock), the Company will continue to record the recognized stock-compensation expense of JiHu as part of the noncontrolling interest.
In June 2022, the Company granted 0.4 million performance stock units (“2022 PSUs”) to senior members of its management team and in December 2024, the Company granted 0.3 million performance stock units (“2024 PSUs”) to its new Chief Executive Officer (“CEO”). The 2022 and 2024 PSUs are subject to the achievement of specified performance targets and continuous service through the applicable vesting dates. The fair value of 2022 and 2024 PSUs is measured at the market price of the Company’s Class A common stock on the date of grant and compensation costs related to awards expected to vest are recognized on a graded-vesting method over the requisite service periods. The estimate of awards expected to vest is reassessed by management at each reporting period.
Segment Reporting
The Company derives revenue globally and manages its business activities on a consolidated basis. The Company’s primary offering is GitLab, a complete DevSecOps platform delivered as a single application which is offered on both self-managed and SaaS models.
The Company operates its business as one
The Company’s CODM primarily uses consolidated net loss as the measure of profit or loss to facilitate analysis of the Company’s financial trends, and for internal planning and forecasting purposes. Consolidated expense information is included on the consolidated statements of operations. The measure of segment assets is reported on the consolidated balance sheet as total assets.
The Company presents financial information about geographical mix of revenue in “Note 3. Revenues” of the consolidated financial statements.
103
Business Combination
We include the results of operations of the businesses that we acquire beginning from the respective dates of acquisition. We allocate the fair value of the purchase price of our acquisitions to the tangible and intangible assets acquired, and liabilities assumed, based on their estimated fair values. The excess of the fair value of purchase price over the fair values of these identifiable assets and liabilities is recorded as goodwill.
We amortize our acquired intangible assets with definite lives on a straight-line basis over a period of three years .
The liabilities for any contingent consideration are established at the time of the acquisition and will be evaluated at each reporting date. Any change in the fair value adjustment is recorded in general and administrative expenses.
Property and Equipment, Net
Property and equipment are stated at cost, net of accumulated depreciation. Depreciation is calculated using the straight-line method over the estimated useful lives of the respective assets. The Company depreciates leasehold improvements over the shorter of the remaining lease term or estimated useful life of five years , and computers over two years .
Leases
The Company determines whether an arrangement is or contains a lease at inception, based on whether there is an identified asset and whether the Company controls the use of the identified asset throughout the period of use. At the lease commencement date, the Company determines the lease classification between finance and operating and recognizes a right-of-use asset and corresponding lease liability for each lease component. A right-of-use asset represents the Company’s right to use an underlying asset and a lease liability represents the Company’s obligation to make payments during the lease term. The Company has operating leases for office premises leased by JiHu, as well as for an immaterial short-term sales office in India. The Company accounts for lease components and non-lease components separately. The Company does not recognize operating lease right-of-use assets and operating lease liabilities that arise from short-term leases (i.e., leases with a term of 12 months or less).
The lease liability is initially measured as the present value of the remaining lease payments over the lease term. Lease terms may include options to extend or terminate the lease when it is reasonably certain that the Company will exercise that option. The discount rate used to determine the present value is the Company’s incremental borrowing rate unless the interest rate implicit in the lease is readily determinable. The Company estimates its incremental borrowing rate based on the information available at lease commencement date for borrowings with a similar term. The right-of-use asset is initially measured as the present value of the lease payments adjusted for prepaid lease payments to lessors.
Impairment of Long-lived Assets
We evaluate long-lived assets (including intangible assets) for impairment whenever events or changes in circumstances indicate that the carrying amount of a long-lived asset (including an intangible asset) may not be recoverable. An asset is considered impaired if its carrying amount exceeds the future undiscounted cash flow the asset is expected to generate. We measure recoverability of these assets by comparing the carrying amounts to the future undiscounted cash flows the assets are expected to generate. If a long-lived asset (including an intangible asset) is considered to be impaired, the impairment to be recognized equals the amount by which the carrying value of the asset exceeds its fair market value. We have made no material adjustments to our long-lived assets (including intangible assets) in any of the years presented.
104
We test our goodwill for impairment at least annually in the fourth fiscal quarter of each year, or more frequently if events or changes in circumstances indicate that this asset may be impaired. Based on an analysis of qualitative and quantitative factors, including our market capitalization, we determined there to be no impairment of goodwill in any of the periods presented.
Equity Method Investment
The Company applies the equity method of accounting to investments when it has significant influence, but not controlling interest in the investee. The Company’s equity method investments are reported at cost and adjusted each period for its proportionate share of the investee’s income or loss. The cost on initial recognition of retained interest in a former subsidiary is based on fair value on the date of loss of control. The Company’s proportionate share of the net loss resulting from the investment is reported under loss from equity method investment, net of tax in our consolidated statements of operations. The Company assesses investments for impairment whenever events or changes in circumstances indicate that the carrying value of an investment may not be recoverable. Refer to “Note 11. Joint Venture and Equity Method Investment” for more information.
Revision of Previously Issued Consolidated Financial Statements
During the quarter ended January 31, 2025, the Company identified errors related to the understatement of certain tax liabilities associated with the formation of our joint venture, JiHu in February 2021. The Company concluded that the impact of the errors on previously issued consolidated financial statements as of and for the annual periods ended January 31, 2024 and January 31, 2023 were immaterial. However, the Company has revised the prior-period consolidated financial statements to correct these errors.
The following tables summarize the revisions of previously-issued consolidated financial statements (in thousands):
Consolidated Balance Sheet
January 31, 2024 | ||||||||||||||||||||||||||||||||
| As Previously Reported | Adjustment | As Revised | ||||||||||||||||||||||||||||||
| ASSETS | ||||||||||||||||||||||||||||||||
| CURRENT ASSETS: | ||||||||||||||||||||||||||||||||
| Prepaid expenses and other current assets | $ | $ | $ | |||||||||||||||||||||||||||||
| Total current assets | ||||||||||||||||||||||||||||||||
| TOTAL ASSETS | $ | $ | $ | |||||||||||||||||||||||||||||
| LIABILITIES AND STOCKHOLDERS’ EQUITY | ||||||||||||||||||||||||||||||||
| CURRENT LIABILITIES: | ||||||||||||||||||||||||||||||||
| Accrued expenses and other current liabilities | $ | $ | $ | |||||||||||||||||||||||||||||
| Total current liabilities | ||||||||||||||||||||||||||||||||
| TOTAL LIABILITIES | ||||||||||||||||||||||||||||||||
| STOCKHOLDERS’ EQUITY: | ||||||||||||||||||||||||||||||||
| Accumulated deficit | ( | ( | ( | |||||||||||||||||||||||||||||
| Accumulated other comprehensive income | ||||||||||||||||||||||||||||||||
| Total GitLab stockholders’ equity | ( | |||||||||||||||||||||||||||||||
| Noncontrolling interests | ( | |||||||||||||||||||||||||||||||
| TOTAL STOCKHOLDERS’ EQUITY | ( | |||||||||||||||||||||||||||||||
| TOTAL LIABILITIES AND STOCKHOLDERS’ EQUITY | $ | $ | $ | |||||||||||||||||||||||||||||
105
Consolidated Statements of Operations and Consolidated Statements of Comprehensive Loss
| Year Ended January 31, 2024 | |||||||||||||||||||||||||||||
| As Previously Reported | Adjustment | As Revised | |||||||||||||||||||||||||||
| Other expense, net | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
Loss before income taxes and loss from equity method investment | ( | ( | ( | ||||||||||||||||||||||||||
| Provision for income taxes | |||||||||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss attributable to GitLab | ( | ( | ( | ||||||||||||||||||||||||||
| Foreign currency translation adjustments | $ | ( | $ | $ | ( | ||||||||||||||||||||||||
| Comprehensive loss attributable to GitLab | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Year Ended January 31, 2023 | |||||||||||||||||||||||||||||
| As Previously Reported | Adjustment | As Revised | |||||||||||||||||||||||||||
| Other income, net | $ | $ | $ | ||||||||||||||||||||||||||
Loss before income taxes and loss from equity method investment | ( | ( | |||||||||||||||||||||||||||
| Provision for income taxes | |||||||||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss attributable to GitLab | ( | ( | ( | ||||||||||||||||||||||||||
| Foreign currency translation adjustments | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Comprehensive loss attributable to GitLab | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
Impacted financial statement line items appearing in the Company’s consolidated statements of stockholders’ equity have also been revised accordingly. Cash flows from operating, investing and financing activities for the above periods were not impacted by this immaterial correction of an error. However, net loss was revised, as shown above, with an offset to the prepaid expenses and other current assets and accrued expenses and other current liabilities captions within operating activities on the consolidated statements of cash flows. Accordingly, a revision table for the consolidated statement of cash flows is not included.
Recently Adopted Accounting Standards
In November 2023, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) 2023-07, Segment Reporting (“Topic 280”): Improvements to Reportable Segment Disclosures, which requires public entities to disclose expanded information about their reportable segment(s)’ significant expenses and other segment items on an interim and annual basis. The Company adopted the ASU retrospectively on January 1, 2024 and the adoption did not have a material impact on the Company’s consolidated financial statements.
Recently Issued Accounting Standards Not Yet Adopted
In December 2023, the FASB issued ASU 2023-09, Income Taxes ("Topic 740"): Improvements to Income Tax Disclosures (“ASU 2023-09”), which requires public entities to disclose specific tax rate reconciliation categories, as well as income taxes paid disaggregated by jurisdiction, amongst other disclosure enhancements. The ASU is effective for annual periods beginning after December 15, 2024,
106
with early adoption permitted. The Company has not early adopted ASU 2023-09 and is currently evaluating the impact on the consolidated financial disclosures.
In November 2024, the FASB issued ASU 2024-03, Income Statement: Reporting Comprehensive Income - Expense Disaggregation Disclosures (“Subtopic 220-40”): Disaggregation of Income Statement Expenses, which requires disclosure of disaggregated information about certain expense captions presented in the Consolidated Statements of Operations as well as disclosure about selling expenses. The ASU is effective for fiscal years beginning after December 15, 2026, and interim reporting periods within fiscal years beginning after December 15, 2027, with early adoption permitted. The Company has not early adopted ASU 2024-03 and is currently evaluating the impact on the consolidated financial disclosures.
107
3. Revenues
Disaggregation of Revenue
The following table shows the components of revenues and their respective percentages of total revenue for the periods indicated (in thousands, except percentages):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Subscription—self-managed and SaaS | $ | % | $ | % | $ | % | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| Subscription—self-managed | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SaaS | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| License—self-managed and other | $ | % | $ | % | $ | % | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| License—self-managed | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Professional services and other | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Total revenue | $ | % | $ | % | $ | % | |||||||||||||||||||||||||||||||||||||||||||||||||||||
Total Revenue by Geographic Location
The following table summarizes the Company’s total revenue by geographic location based on the region of the Company’s contracting entity, which may be different than the region of the customer (in thousands):
| Fiscal Year Ended January 31, | ||||||||||||||||||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | ||||||||||||||||||||||||||||||||||||||||||
| United States | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
| Europe | ||||||||||||||||||||||||||||||||||||||||||||
| Asia Pacific | ||||||||||||||||||||||||||||||||||||||||||||
| Total revenue | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
During the years ended January 31, 2025, 2024 and 2023, the United States accounted for 82 %, 82 % and 83 % of total revenue for each period presented. No other individual country exceeded 10% of total revenue for any of the periods presented.
108
4. Cash Equivalents and Short-Term Investments
The following table summarizes the Company’s cash equivalents and short-term investments by category (in thousands):
As of January 31, 2025 | |||||||||||||||||||||||||||||||||||||||||
| Amortized Cost | Gross Unrealized Gains | Gross Unrealized Losses | Fair Value | ||||||||||||||||||||||||||||||||||||||
| Level 1: | |||||||||||||||||||||||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||||||||||||||||||||
| Level 2: | |||||||||||||||||||||||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | |||||||||||||||||||||||||||||||||||||||||
Total cash equivalents (1) | |||||||||||||||||||||||||||||||||||||||||
| Short-term investments | |||||||||||||||||||||||||||||||||||||||||
| Commercial paper | ( | ||||||||||||||||||||||||||||||||||||||||
| Corporate debt securities | ( | ||||||||||||||||||||||||||||||||||||||||
| U.S. Agency securities | ( | ||||||||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | ( | ||||||||||||||||||||||||||||||||||||||||
| Total short-term investments | ( | ||||||||||||||||||||||||||||||||||||||||
| Level 2 total | ( | ||||||||||||||||||||||||||||||||||||||||
| Total cash equivalents and short-term investments | $ | $ | $ | ( | $ | ||||||||||||||||||||||||||||||||||||
(1) Included in “cash and cash equivalents” in our consolidated balance sheet as of January 31, 2025, in addition to cash of $94.1 million.
109
As of January 31, 2024 | |||||||||||||||||||||||||||||||||||||||||
| Amortized Cost | Gross Unrealized Gains | Gross Unrealized Losses | Fair Value | ||||||||||||||||||||||||||||||||||||||
| Level 1: | |||||||||||||||||||||||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||||||||||||||||||||
| Level 2: | |||||||||||||||||||||||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | ( | ||||||||||||||||||||||||||||||||||||||||
| Commercial paper | ( | ||||||||||||||||||||||||||||||||||||||||
Total cash equivalents (1) | ( | ||||||||||||||||||||||||||||||||||||||||
| Short-term investments | |||||||||||||||||||||||||||||||||||||||||
| Commercial paper | ( | ||||||||||||||||||||||||||||||||||||||||
| Corporate debt securities | ( | ||||||||||||||||||||||||||||||||||||||||
| U.S. Agency securities | ( | ||||||||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | ( | ||||||||||||||||||||||||||||||||||||||||
| Total short-term investments | ( | ||||||||||||||||||||||||||||||||||||||||
| Level 2 total | ( | ||||||||||||||||||||||||||||||||||||||||
| Total cash equivalents and short-term investments | $ | $ | $ | ( | $ | ||||||||||||||||||||||||||||||||||||
(1) Included in “cash and cash equivalents” in our consolidated balance sheet as of January 31, 2024, in addition to cash of $81.0 million.
The fair value of the Company’s Level 1 financial instruments, such as money market funds which are traded in active markets, is based on quoted market prices for identical instruments. The fair value of the Company’s Level 2 financial instruments such as commercial paper, corporate debt and U.S. government securities are obtained from an independent pricing service, which may use inputs other than quoted prices that are directly or indirectly observable in the market, including readily available pricing sources for the identical underlying security that may not be actively traded. The Company’s marketable securities are held by custodians who obtain investment prices from a third-party pricing provider that incorporates standard inputs in various asset price models.
The Company uses the specific-identification method to determine any realized gains or losses from the sale of the Company’s short-term investments classified as available-for-sale. For the periods presented, the Company did not have any material realized gains or losses as a result of maturities or sales of short-term investments.
During the years ended January 31, 2025, 2024 and 2023, the Company recorded $47.7 million, $39.1 million and $14.5 million of interest income on cash and cash equivalents and short-term investments, respectively, which includes $16.7 million, $20.3 million and $6.1 million of net amortization of premiums or discounts on short-term investments during the years ended January 31, 2025, 2024 and 2023, respectively.
The following table summarizes unrealized losses on the Company’s cash equivalents and short-term investments aggregated by category and the length of time such aggregated investments have been in a continuous unrealized loss position as of the periods presented (in thousands):
110
| Less Than 12 Months | 12 Months or Greater | Total | ||||||||||||||||||||||||||||||||||||
| Carrying Value | Gross Unrealized Losses | Carrying Value | Gross Unrealized Losses | Fair Value | Gross Unrealized Losses | |||||||||||||||||||||||||||||||||
January 31, 2025 | ||||||||||||||||||||||||||||||||||||||
| U.S. Agency securities | $ | $ | ( | $ | $ | $ | $ | ( | ||||||||||||||||||||||||||||||
| Commercial paper | ( | ( | ||||||||||||||||||||||||||||||||||||
| Corporate debt securities | ( | ( | ( | |||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | ( | ( | ||||||||||||||||||||||||||||||||||||
| Total cash equivalents and short-term investments | $ | $ | ( | $ | $ | ( | $ | $ | ( | |||||||||||||||||||||||||||||
| Less Than 12 Months | 12 Months or Greater | Total | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Carrying Value | Gross Unrealized Losses | Carrying Value | Gross Unrealized Losses | Fair Value | Gross Unrealized Losses | ||||||||||||||||||||||||||||||||||||||||||||||||
January 31, 2024 | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| U.S. Agency securities | $ | $ | ( | $ | $ | ( | $ | $ | ( | ||||||||||||||||||||||||||||||||||||||||||||
| Commercial paper | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Corporate debt securities | ( | ( | ( | ||||||||||||||||||||||||||||||||||||||||||||||||||
| U.S. Treasury securities | ( | ( | ( | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Total cash equivalents and short-term investments | $ | $ | ( | $ | $ | ( | $ | $ | ( | ||||||||||||||||||||||||||||||||||||||||||||
The following table classifies the Company’s short-term investments by contractual maturities (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||||||||||||||||||||||||||
| Amortized cost | Fair Value | Amortized cost | Fair Value | ||||||||||||||||||||||||||||||||||||||
| Due within 1 year | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||
| Due between 1 year to 2 years | |||||||||||||||||||||||||||||||||||||||||
| Total | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||
All available-for-sale securities have been classified as current, based on management’s ability to use the funds in current operations.
Liabilities are measured at fair value on a recurring basis. The Company had contingent cash consideration from a business combination which was determined based upon the satisfaction of certain defined operational milestones and was remeasured at fair value at each reporting period through earnings. As the fair value is based on unobservable inputs, the liability is included in Level 3 of the fair value measurement hierarchy.
During the years ended January 31, 2025, 2024 and 2023, the Company reassessed the fair value of outstanding operational milestones and recorded a $3.8 million loss in fair value, zero and a $1.7 million gain in fair value, respectively. The change in fair value was included in general and administrative expenses in the consolidated statement of operations for the years ended January 31, 2025, 2024 and 2023, respectively.
111
In October 2024, the remaining operational milestones were achieved, and the Company paid $7.5 million of contingent cash consideration during the year ended January 31, 2025. The Company had zero and $3.6 million of Level 3 contingent consideration payable as of January 31, 2025 and January 31, 2024, respectively.
Interest accretion expense was $0.1 million, $0.2 million and $0.3 million for the years ended January 31, 2025, 2024 and 2023, respectively.
5. Supplemental Financial Statement Information
Prepaid Expenses and Other Current Assets
Prepaid expenses and other current assets consisted of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Prepaid software subscriptions | $ | $ | |||||||||||||||
| Prepaid income taxes | |||||||||||||||||
| Interest receivable | |||||||||||||||||
Indirect tax credit receivable (1) | |||||||||||||||||
| Prepaid insurance | |||||||||||||||||
| Revenue contract asset | |||||||||||||||||
| Other prepaid expenses | |||||||||||||||||
| Vendor receivable | |||||||||||||||||
| Prepaid expenses for the Company’s events | |||||||||||||||||
| Prepaid advertising costs | |||||||||||||||||
| Security and other deposits | |||||||||||||||||
| Other current assets | |||||||||||||||||
| Total prepaid expenses and other current assets | $ | $ | |||||||||||||||
(1) The Company revised prior-period balances. Refer to “Note 2. Basis of Presentation and Summary of Significant Accounting Policies”.
Property and Equipment, Net
Property and equipment, net of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Computer and office equipment | $ | $ | |||||||||||||||
| Leasehold improvements | |||||||||||||||||
Less: Accumulated depreciation (1) | ( | ( | |||||||||||||||
Total property and equipment, net (1) | $ | $ | |||||||||||||||
(1) The amounts in the table above include cumulative foreign currency translation adjustments, reflecting movement in the currencies of the underlying property and equipment. As of January 31, 2025 and January 31, 2024, the Company also wrote off $7.2 million and $1.1 million of fully depreciated assets as they were no longer in use, respectively.
Depreciation expense of property and equipment was $2.9 million, $4.4 million and $3.2 million for the years ended January 31, 2025, 2024 and 2023, respectively.
112
Other Non-Current Assets
Other non-current assets consisted of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Security and other deposits | $ | $ | |||||||||||||||
| Deferred software implementation costs | |||||||||||||||||
| Other non-current assets | |||||||||||||||||
| Total other non-current assets | $ | $ | |||||||||||||||
Accrued Expenses and Other Current Liabilities
Accrued expenses and other current liabilities consisted of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
Indirect taxes payable (1) | $ | $ | |||||||||||||||
| Accrued expenses | |||||||||||||||||
Income taxes payable (1) | |||||||||||||||||
| Customer refunds payable | |||||||||||||||||
| ESPP employee contributions | |||||||||||||||||
Income tax liability related to BAPA (2) | |||||||||||||||||
Acquisition related liabilities (3) | |||||||||||||||||
| Total accrued expenses and other current liabilities | $ | $ | |||||||||||||||
(1) The Company has revised prior-period balances. Refer to “Note 2. Basis of Presentation and Summary of Significant Accounting Policies”.
(2) Refer to “Note 12. Income Taxes”.
(3) Refer to “Note 4. Cash Equivalents and Short-Term Investments”.
Accrued Compensation and Benefits
Accrued compensation and benefits consisted of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Accrued commissions | $ | $ | |||||||||||||||
| Other accrued team member related payables | |||||||||||||||||
| Payroll taxes payable | |||||||||||||||||
| Total accrued compensation and benefits | $ | $ | |||||||||||||||
(1) Refer to “Note 10. Restructuring and Other Related Charges”.
113
Other Non-Current Liabilities
Other non-current liabilities consisted of the following (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Long term taxes payable | $ | $ | |||||||||||||||
Provision towards labor matters (1) | |||||||||||||||||
| Early exercised options liability | |||||||||||||||||
| Deferred tax liabilities, net | |||||||||||||||||
| Other non-current liabilities | |||||||||||||||||
| Total other non-current liabilities | $ | $ | |||||||||||||||
(1) Refer to “Note 14. Commitments and Contingencies”.
Other Income (Expense), Net
Other income (expense), net consisted of the following (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Gain from deconsolidation of Arch, formerly Meltano | $ | $ | $ | ||||||||||||||||||||||||||
| Impairment loss of equity method investment in Arch, formerly Meltano | ( | ||||||||||||||||||||||||||||
| Foreign exchange gains (losses), net | ( | ||||||||||||||||||||||||||||
| Other expense, net | ( | ( | ( | ||||||||||||||||||||||||||
| Total other income (expense), net | $ | $ | ( | $ | |||||||||||||||||||||||||
6. Acquisitions
Opstrace
On December 3, 2021, the Company completed the acquisition of Opstrace, Inc., a technology company based in San Francisco, California.
The transaction was accounted for as a business combination. The acquisition date fair value of the consideration transferred was $13.5 million, which included contingent cash consideration.
As of January 31, 2023, the Company held $2.5 million in an escrow as partial security for post-closing indemnification claims made within 18 months of the closing date. The Company fully paid out this acquisition-related holdback during the year ended January 31, 2024.
Rezilion
On May 23, 2024 (the “Asset Acquisition Date”), the Company completed its acquisition of certain assets, primarily software intellectual property, of Rezilion Inc. and its subsidiary, Rezilion Ltd. (collectively, “Rezilion”) for approximately $7.3 million in cash.
The Rezilion transaction was accounted for as an asset acquisition because substantially all of the fair value of gross assets acquired were concentrated in the developed intellectual property. Acquisition-related direct transaction costs were capitalized as a component of the cost of the assets acquired.
114
On the Asset Acquisition Date, the fair value of the developed technology was $7.7 million including $0.4 million of acquisition-related direct costs. The developed technology acquired has an estimated useful life of three years .
Oxeye
On March 20, 2024 (the “Acquisition Date”), the Company completed the acquisition of Oxeye Security Limited (“Oxeye”), a cloud-native application security and risk management solution company based in Israel. The Company believes this acquisition will allow the Company to strengthen its product offerings.
The transaction was accounted for as a business combination. The Acquisition Date fair value of the consideration transferred consisted of the following (in thousands):
| Closing cash consideration | $ | ||||
| Cash held in escrow | |||||
| Total consideration | $ | ||||
Total consideration includes $3.6 million deposited in an escrow account as partial security for post-closing indemnification claims made within 15 months of the Acquisition Date. As the Company is not the legal owner of the escrow account, it is not recorded on the consolidated balance sheet as of January 31, 2025.
As part of the acquisition, there was also a holdback in the amount of $3.2 million to be paid to the two co-founders (the “founder holdback”) in three equal tranches of 33.3 3.2 million from the purchase price to be allocated, and will recognize the amount as expense over the period of services rendered after factoring in the likelihood of achieving the milestones in the first year.
During the year ended January 31, 2025, the milestones attached to the first payment tranche were achieved and $1.1 million was paid out to the two co-founders. The Company recorded $1.1 million of the founder holdback in general and administrative expenses in its consolidated statement of operations for the year ended January 31, 2025.
Acquisition related transaction costs were $1.2 million for the year ended January 31, 2025, and were recorded by the Company in general and administrative expenses in its consolidated statement of operations.
The Company recorded the assets acquired and liabilities assumed at their estimated fair values, with the difference between the fair value of the net assets acquired and the purchase consideration reflected in goodwill. The total purchase price of $20.3 million was allocated using information available to the Company at the time of acquisition. The Company may continue to adjust the preliminary purchase price allocation after obtaining more information regarding asset valuations, liabilities assumed, tax-related items and revisions of preliminary estimates.
During the year ended January 31, 2025, The Company recorded an acquisition measurement period adjustment of $0.3 0.3
115
during the one year measurement period. They do not impact net income or the earnings per share in this period.
The following table reflects the fair values of assets acquired and liabilities assumed at the acquisition date (in thousands):
| Cash and cash equivalents | $ | ||||
| Developed technology | |||||
| Goodwill | |||||
| Prepaid expenses and other current assets | |||||
| Accrued expenses and payroll | ( | ||||
| Deferred tax liability | ( | ||||
| Net assets acquired | $ | ||||
As of the Acquisition Date, developed technology of the acquired business had an estimated useful life of three years . The fair value of the developed technology intangible asset was estimated using the replacement cost method, which utilizes assumptions for the cost to replace it, such as time and resources required, as well as a theoretical profit margin and opportunity costs. The goodwill is primarily attributed to the synergies expected to be realized following the acquisition. The goodwill is not deductible for Israeli income tax purposes.
Results of operations of the business acquired have been included in the Company’s consolidated financial statements subsequent to the date of acquisition. The revenue and net income (loss) earned by the business acquired following the acquisition are not material to the Company’s consolidated results of operations; and accordingly, pro forma financial statements have not been presented.
7. Goodwill and Intangible Assets, Net
Goodwill
The carrying amount of goodwill was as follows (in thousands):
| Carrying Amount | |||||
Balance as of January 31, 2024 | $ | ||||
| Acquisition of Oxeye | |||||
| Acquisition measurement period adjustment | ( | ||||
Foreign currency translation adjustments | |||||
Balance as of January 31, 2025 | $ | ||||
There was no goodwill impairment for any periods presented.
116
Intangible Assets
Intangible assets, net consisted of the following (in thousands):
January 31, 2025 | Gross Carrying Amount | Accumulated Amortization | Net Book Value | Weighted average remaining amortization period (years) | |||||||||||||||||||
Developed technology from business combination (1) | $ | $ | ( | $ | |||||||||||||||||||
Developed technology from asset acquisitions (2) | ( | ||||||||||||||||||||||
| Total | $ | $ | ( | $ | |||||||||||||||||||
January 31, 2024 | Gross Carrying Amount | Accumulated Amortization | Net Book Value | Weighted average remaining amortization period (years) | |||||||||||||||||||
| Developed technology from business combination | $ | $ | ( | $ | |||||||||||||||||||
Developed technology from asset acquisitions (1) (2) | ( | ||||||||||||||||||||||
| Total | $ | $ | ( | $ | |||||||||||||||||||
(1) The amounts in the tables above include cumulative foreign currency translation adjustments, reflecting movement in the currencies of the underlying intangibles.
(2) During the years ended January 31, 2025 and 2024, the Company wrote off $0.9 million and $0.4 million of fully amortized intangible assets as the technology had become obsolete, respectively.
Amortization expense was $8.1 million, $2.2 million and $2.4 million for the years ended January 31, 2025, 2024 and 2023, respectively.
As of January 31, 2025, future amortization expense related to the intangibles assets is expected to be as follows (in thousands):
| Fiscal Years | |||||
| 2026 | $ | ||||
| 2027 | |||||
| 2028 | |||||
| Total future amortization | $ | ||||
117
9. Equity
In connection with the Company’s initial public offering (the “IPO”), on October 18, 2021, the Company filed a restated certificate of incorporation that authorized the issuance of 1,500,000,000 shares of Class A common stock, 250,000,000 shares of Class B common stock, and 50,000,000 shares of preferred stock at $0.0000025 one vote and the holder of each share of Class B common stock is entitled to ten votes.
Common Stock
The Company had shares of common stock reserved for future issuance as follows (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Class A and Class B common stock | |||||||||||||||||
| Options issued and outstanding | |||||||||||||||||
| Shares available for issuance under Equity Incentive Plans | |||||||||||||||||
| RSUs and PSUs issued and outstanding | |||||||||||||||||
| Shares reserved for issuance to charitable organizations | |||||||||||||||||
| ESPP | |||||||||||||||||
| Total | |||||||||||||||||
Equity Incentive Plans
In September 2021, in connection with the IPO, the board of directors and stockholders approved the 2021 Equity Incentive Plan (the “2021 Plan”) as a successor to the Company’s 2015 Plan (together the “Plans”). The 2021 Plan authorizes the award of both stock options, which are intended to qualify for tax treatment under Section 422 of the Internal Revenue Code, and nonqualified stock options, as well for the award of restricted stock awards (“RSAs”), stock appreciation rights (“SARs”), restricted stock units (“RSUs”), performance stock units (“PSUs”) and stock bonus awards. Pursuant to the 2021 Plan, incentive stock options may be granted only to the Company’s team members. The Company may grant all other types of awards to its team members, directors, and consultants. The Company initially reserved 13,032,289 shares of its Class A common stock, plus any reserved shares of Class B common stock not issued or subject to outstanding grants under the 2015 Plan on the effective date of the 2021 Plan, for issuance as Class A common stock pursuant to awards granted under the 2021 Plan. The number of shares reserved for issuance under the 2021 Plan increases automatically on February 1 of each of the years from 2022 through 2031.
118
The awards available for grant under the above Plans for the periods presented were as follows (in thousands):
| January 31, 2025 | January 31, 2024 | ||||||||||||||||
| Available at beginning of period | |||||||||||||||||
| Awards authorized | |||||||||||||||||
| RSUs and PSUs granted | ( | ( | |||||||||||||||
| RSUs and PSUs canceled and forfeited | |||||||||||||||||
| Options canceled and forfeited | |||||||||||||||||
| Options repurchased | |||||||||||||||||
| Available at end of period | |||||||||||||||||
In the event that shares previously issued under the above Plans are reacquired by the Company, such shares shall be added to the number of shares then available for issuance under the 2021 Plan. In the event that an outstanding stock option for any reason expires or is canceled, the shares allocable to the unexercised portion of such stock option will be added to the number of shares then available for issuance under the 2021 Plan.
Both Plans allow the grantees to early exercise stock options.
Stock Options, RSUs and PSUs
The following table summarizes options activity under the Plans, and related information:
| Number of Stock Options Outstanding (in thousands) | Weighted Average Exercise Price | Weighted Average Remaining Years | Aggregate Intrinsic value (in millions) | ||||||||||||||||||||
| Balances at January 31, 2024 | $ | $ | |||||||||||||||||||||
| Options exercised | ( | ||||||||||||||||||||||
| Options canceled | ( | ||||||||||||||||||||||
| Options forfeited | ( | ||||||||||||||||||||||
Balances at January 31, 2025 | $ | $ | |||||||||||||||||||||
Options vested at January 31, 2025 | $ | $ | |||||||||||||||||||||
Options vested and expected to vest at January 31, 2025 | $ | $ | |||||||||||||||||||||
As of January 31, 2025, approximately $21.5 million of total unrecognized stock-based compensation cost was related to stock options granted of which $19.4 million relates to the modification of stock options previously granted to our former CEO. Total unrecognized stock-based compensation cost related to stock options is expected to be recognized over a weighted-average period of 1.0 year. The
119
expected stock compensation expense remaining to be recognized reflects only outstanding stock awards as of the periods presented, and assumes no forfeitures.
The following table summarizes the Company’s RSU activity:
Number of Shares (in thousands) (1) | Weighted- Average grant date fair value | ||||||||||
| Balances at January 31, 2024 | $ | ||||||||||
| Granted | |||||||||||
| Vested | ( | ||||||||||
| Canceled/forfeited | ( | ||||||||||
Balances at January 31, 2025 | $ | ||||||||||
(1) The table above does not include 3 million RSUs granted to the Co-founder and former CEO described below.
These RSUs are grants of shares of the Company’s Class A common stock, the vesting of which is based on the requisite service requirement. Generally, the Company’s RSUs are subject to forfeiture and are expected to vest over to four years ratably on a combination of bi-annual and quarterly basis. During the years ended January 31, 2025, 2024 and 2023, the Company recorded $157.2 million, $117.6 million and $61.6 million stock-based compensation expense related to RSUs, respectively.
As of January 31, 2025, approximately $394.0 million of total unrecognized compensation cost was related to RSUs granted to team members that is expected to be recognized over a weighted-average period of 2.6 years. The expected stock compensation expense remaining to be recognized reflects only outstanding stock awards as of the periods presented, and assumes no forfeitures.
PSUs
In December 2024, the Company granted 0.3 million PSUs to its CEO subject to the achievement of specified performance targets and continuous service through the applicable vesting dates. The number of awards granted represents 100 % of the target goal; under the terms of the awards, the recipient may earn between 0 % and 200 % of the original grant. The performance condition is set to be achieved in three equal tranches in fiscal year 2026, 2027 and 2028 and the service condition on each vest date. The Company recorded $1.3 million of stock-based compensation expense related to these PSUs during the year ended January 31, 2025. As of January 31, 2025, unrecognized stock-based compensation expense related to these PSUs was $17.8 million to be recognized over a period of 3.4 years.
In June 2022, the Company granted 0.4 million PSUs to senior members of its management team subject to the achievement of specified performance targets and continuous service through the applicable vesting dates. The number of awards granted represents 100 % of the target goal; under the terms of the awards, the recipients may earn between 0 % and 200 % of the original grant. The performance condition was achieved in fiscal year 2025 and 0.1 million PSUs are expected to vest in fiscal year 2026, subject to continuous service through the applicable vesting dates. The Company recorded $2.3 million, $1.3 million and $1.6 million of stock-based compensation expense related to PSUs during the years ended January 31, 2025, 2024 and 2023, respectively. As of January 31, 2025, unrecognized stock-based compensation expense related to these PSUs was $0.9 million to be recognized over a period of 0.9 years.
120
Former CEO Restricted Stock Units (“Former CEO RSU”)
In May 2021, the Company granted 3 million RSUs tied to its Class B common stock to Sytse Sijbrandij, the Company’s co-founder and former CEO, with an estimated aggregate grant date fair value of $8.8 million. As measured from the grant date, the derived service period of the respective tranches ranges from 2 to 7 years. In December 2024, Mr. Sijbrandij resigned from his position as CEO and as a result, all unvested RSUs were forfeited, which resulted in a $3.4 million net gain of stock-based compensation expense for the year ended January 31, 2025. During the years ended January 31, 2024 and 2023, the Company recorded $1.7 million and $1.7 million, respectively, of stock-based compensation expense related to the former CEO RSU. As of January 31, 2025, there was no unrecognized stock-based compensation expense remaining related to these RSUs.
2021 Employee Stock Purchase Plan (“ESPP”)
In September 2021, the Company’s board of directors and its stockholders approved the ESPP and participation of eligible team members.
During the quarter ended July 31, 2024, the Company’s stock price on the purchase date, May 31, 2024, was lower than the Company’s stock price on the previously applicable offering date. As a result, the offering in effect was reset with the lower stock price becoming the new offering price and rolled over to a new 24-month offering period. The reset was treated as a modification resulting in incremental expense totaling $1.0 million, which is being recognized over the remaining requisite service period as of the date of reset.
During the quarter ended July 31, 2023, the Company’s stock price on the purchase date, May 31, 2023, was lower than the Company’s stock price on the previously applicable offering date. As a result, the offering in effect was reset with the lower stock price becoming the new offering price and rolled over to a new 24-month offering period. The reset was treated as a modification resulting in incremental expense totaling $9.4 million, which is being recognized over the remaining requisite service period as of the date of reset.
The following table summarizes assumptions used in estimating the fair value of the ESPP for the offering period in effect using the Black-Scholes option-pricing model:
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Risk-free interest rate | |||||||||||||||||||||||||||||
| Volatility | |||||||||||||||||||||||||||||
| Expected term (in years) | |||||||||||||||||||||||||||||
| Dividend yield | —% | —% | —% | ||||||||||||||||||||||||||
The Company recorded $11.8 million, $19.0 million, and $25.7 million of stock-based compensation expense related to the ESPP during the years ended January 31, 2025, 2024 and 2023, respectively. As of January 31, 2025, approximately $8.1 million of total unrecognized compensation cost was related to the ESPP that is expected to be recognized over 1.8 years.
Stock-Based Compensation Expense
The Company recognized stock-based compensation expense as follows (in thousands):
121
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Cost of revenue | $ | $ | $ | ||||||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||||||||
Total stock-based compensation expense (1) | $ | $ | $ | ||||||||||||||||||||||||||
(1) The table above includes stock-based compensation of JiHu. Refer to “Note 11. Joint Venture and Equity Method Investment” for further discussion.
The corporate income tax benefit recognized in the consolidated statements of operations for stock-based compensation expense was zero 7.7 million for the year ended January 31, 2023, respectively.
Charitable Donation of Common Stock
In September 2021, the Company’s board of directors approved the reservation of up to 1,635,545 shares of Class A common stock for issuance to charitable organizations. In March 2024 and 2023, the Company’s board of directors approved the donation of $11.8 million and $10.7 million aggregate principal amount of shares of Class A common stock to the GitLab Foundation (the “Foundation”), a California nonprofit public benefit corporation, respectively. The Foundation is also a related party as certain of the Company’s officers serve as directors of the Foundation. These donations shall occur in four equal quarterly distributions.
During the years ended January 31, 2025 and 2024, the Company donated 221,195 shares and 231,408 shares of Class A common stock at fair value to the Foundation, respectively. The fair value of the common stock was determined based on the quoted market price on the grant date. The donation expense of $11.8 million and $10.7 million was recorded in general and administrative expense in the consolidated statements of operations for the years ended January 31, 2025 and 2024, respectively.
10. Restructuring and Other Related Charges
In fiscal year 2025, the Company restructured certain departments to better align functions and recognized total restructuring charges of $1.9 million. In fiscal year 2024, the Company reduced its total global headcount by approximately 7 % and recognized total restructuring charges of $8.0 million.
The Company recognized severance and other termination benefit costs as follows (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 (1) | ||||||||||||||||||||||||||||
| Cost of revenue | $ | $ | |||||||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||||||||
| Total | $ | $ | |||||||||||||||||||||||||||
(1) Excludes stock-based compensation of $1.3 million for the year ended January 31, 2024.
The changes in liabilities resulting from the restructuring charges and related accruals were as follows (in thousands):
122
Balance as of January 31, 2024 | $ | ||||||||||||||||||||||||||||
| Charges | |||||||||||||||||||||||||||||
| Cash payments | ( | ||||||||||||||||||||||||||||
Balance as of January 31, 2025 | $ | ||||||||||||||||||||||||||||
11. Joint Venture and Equity Method Investment
Joint Venture
In February 2021, the Company along with Sequoia CBC Junyuan (Hubei) Equity Investment Partnership (Limited Partnership) and Suzhou Gaocheng Xinjian Equity Investment Fund Partnership (Limited Partnership) executed an investment agreement (the “Investment Agreement”) to establish GitLab Information Technology (Hubei) Co., LTD (“JiHu”), a legal entity in the People’s Republic of China. The Company accounted for JiHu as a variable interest entity and consolidated the entity in accordance with ASC Topic 810, Consolidation. As of January 31, 2025 and 2024, the Company retains control over JiHu with its equity stake at approximately 54
Since fiscal year 2023, JiHu has maintained an employee stock option plan (“JiHu 2022 ESOP”) for its employees. In June 2024, the board of directors of JiHu approved a new employee stock option plan (“JiHu 2024 ESOP”) for its employees in order to grant additional shares. The fair value of restricted stock awards (“RSAs”) and stock option awards is measured on the date of grant and compensation costs related to these awards are recognized on a graded attribution method; as the grants include a performance condition for both the JiHu 2022 ESOP and JiHu 2024 ESOP (“JiHu ESOPs”).
As a result of forfeitures triggered by the departure of certain executives from JiHu in fiscal year 2025 and fiscal year 2024, the Company reversed stock-based compensation previously recorded for such executives. There were no forfeitures in fiscal year 2023. For the years ended January 31, 2025, 2024 and 2023, the Company recorded $1.8 million stock-based compensation net expense, $1.5 million net gain and $7.8 million stock-based compensation expense, respectively.
As of January 31, 2025, approximately $7.1 million of total unrecognized compensation cost was related to the JiHu ESOPs that is expected to be recognized over 3.8 years.
Operating Leases
JiHu entered into three new operating leases during the year ended January 31, 2025 and has various non-cancelable long-term operating leases maturing by June 25, 2027 with total lease payments of $0.4 million and a total present value of lease liabilities of $0.4 million. In addition, JiHu has various other short-term leases. Lease expense associated with short-term leases was $0.1 million during the year ended January 31, 2025 and immaterial
The Company recognized $0.4 million, $0.6 million and $0.6 million of operating lease expense during the the years ended January 31, 2025, 2024 and 2023, respectively.
The table below presents supplemental information related to operating leases for the year ended January 31, 2025 (in thousands, except weighted-average information):
| Weighted-average remaining lease term (in years) | |||||||||||||||||
| Weighted-average discount rate | % | ||||||||||||||||
| Right-of-use assets obtained in exchange for new operating lease liabilities | $ | ||||||||||||||||
Cash paid for amounts included in the measurement of lease liabilities | $ | ||||||||||||||||
123
Selected Financial Information
Selected financial information of JiHu, post intercompany eliminations, is as follows (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Revenue | $ | $ | $ | ||||||||||||||||||||||||||
| Cost of revenue | |||||||||||||||||||||||||||||
| Gross profit | |||||||||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||||||||
| Total operating expenses | |||||||||||||||||||||||||||||
| Loss from operations | ( | ( | ( | ||||||||||||||||||||||||||
| Interest income | |||||||||||||||||||||||||||||
| Other income, net | |||||||||||||||||||||||||||||
| Net loss before income taxes | ( | ( | ( | ||||||||||||||||||||||||||
| Provision for income taxes | |||||||||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Net loss attributable to noncontrolling interest | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| January 31, 2025 | January 31, 2024 (1) | ||||||||||
| Cash and cash equivalents | $ | $ | |||||||||
| Property and equipment, net | |||||||||||
| Operating lease right-of-use assets | |||||||||||
| Other assets | |||||||||||
| Total assets | $ | $ | |||||||||
| Total liabilities | $ | $ | |||||||||
(1) The Company revised the prior-period balances. Refer to “Note 2. Basis of Presentation and Summary of Significant Accounting Policies”.
Equity Method Investment
In April 2021, the Company reorganized Meltano Inc. (“Meltano”), now operating as Arch Data, Inc. (“Arch”), which started as an internal project within the Company in July 2018, into a separate legal entity.
The Company recorded an impairment charge of $8.9 million in other income (expense), net in the consolidated statement of operations during the year ended January 31, 2024 which reduced the equity method investment value to zero as of January 31, 2024.
124
During the years ended January 31, 2024 and 2023, the Company recorded a loss from equity method investment of $3.8 million and $2.5 million, net of tax on the consolidated statements of operations, respectively.
12. Income Taxes
The components of total loss from continuing operations before income taxes are as follows (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||
| 2025 | 2024 (1) | 2023 (1) | |||||||||||||||
| US | $ | ( | $ | $ | ( | ||||||||||||
| Foreign | ( | ( | |||||||||||||||
| Loss before income taxes | $ | ( | $ | ( | $ | ( | |||||||||||
(1) The Company revised the prior-period balances. Refer to “Note 2. Basis of Presentation and Summary of Significant Accounting Policies”.
The provision for (benefit from) income taxes consisted of the following (in thousands):
| Fiscal Year Ended January 31, | |||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||
| Current: | |||||||||||||||||
| Federal and State | $ | $ | ( | $ | |||||||||||||
| Foreign | ( | ||||||||||||||||
| Total current | $ | ( | $ | $ | |||||||||||||
| Deferred: | |||||||||||||||||
| Federal and State | $ | ( | $ | ( | $ | ||||||||||||
| Foreign | ( | ||||||||||||||||
| Total deferred | $ | ( | $ | $ | |||||||||||||
| Provision for (benefit from) income taxes | $ | ( | $ | $ | |||||||||||||
A reconciliation of the statutory U.S. federal income tax rate to the Company's effective tax rate is as follows:
| Fiscal Year Ended January 31, | |||||||||||||||||
| 2025 | 2024 (1) | 2023 (1) | |||||||||||||||
| Tax at federal statutory rate | % | % | % | ||||||||||||||
| State, net of federal benefit | ( | ( | ( | ||||||||||||||
| Stock-based compensation | ( | ||||||||||||||||
| Non-deductible Executive Compensation | ( | ( | ( | ||||||||||||||
| Research tax credit | |||||||||||||||||
| Foreign rate differential | ( | ( | |||||||||||||||
| Change in valuation allowance | ( | ( | ( | ||||||||||||||
| Foreign derived intangible income deduction | |||||||||||||||||
| Unrecognized tax benefits | ( | ( | |||||||||||||||
| Other | ( | ||||||||||||||||
| Total | % | ( | % | ( | % | ||||||||||||
125
(1) The Company revised the prior-period balances. Refer to “Note 2. Basis of Presentation and Summary of Significant Accounting Policies”.
Deferred income taxes reflect the net tax effects of temporary differences between the carrying amount of assets and liabilities for financial reporting purposes and the amounts for income tax purposes.
Significant components of the Company's deferred tax assets and liabilities are as follows (in thousands):
| January 31, | |||||||||||
| 2025 | 2024 | ||||||||||
| Deferred tax assets: | |||||||||||
| Net operating loss carryforwards | $ | $ | |||||||||
| Research tax credits | |||||||||||
| Deferred revenue | |||||||||||
| Accruals and other assets | |||||||||||
| Capitalized R&D | |||||||||||
| Intangibles | |||||||||||
| Interest expense limitation | |||||||||||
| Unrealized FX | |||||||||||
| Stock-based compensation | |||||||||||
| Gross deferred tax assets | |||||||||||
| Valuation allowance | ( | ( | |||||||||
| Net deferred tax assets | |||||||||||
| Deferred tax liabilities: | |||||||||||
| Deferred contract acquisition costs | ( | ( | |||||||||
| Fixed assets | ( | ( | |||||||||
| Unrealized foreign exchange adjustments | ( | ||||||||||
| Federal effects of disregarded entities | ( | ||||||||||
| Other | ( | ||||||||||
| Net deferred tax assets (liabilities) | $ | $ | ( | ||||||||
The Company executed the Bilateral Advanced Pricing Agreement (“BAPA”) agreements with the United States Internal Revenue Services (“IRS”) and the Netherlands’ Dutch Tax Authority (“DTA”) on October 10, 2024, and October 22, 2024, respectively. On October 28, 2024, the Company paid $187.7 million to satisfy the tax assessment issued by the DTA, including accrued interest, which reflected the BAPA negotiations and the agreement to reduce the rate of tax on the gain from the transfer of economic IP rights. As a result of the BAPA and the DTA assessment, the 2015 through 2017 tax years are closed for GitLab B.V. Pursuant to the terms in the BAPA, the Company will file amended returns for the 2018 through 2023 fiscal years; the tax returns for the fiscal year ended January 31, 2024 were filed. All U.S. federal and state tax net operating losses (“NOLs”) and credits, as well as Netherlands NOLs, are not yet recognized due to the determination that they are not more likely than not to be realized.
As of January 31, 2025, the Company’s U.S. federal 2018 through 2024 tax years were open and subject to potential examination in one or more jurisdictions. In addition, in the United States, any net operating losses or credits that were generated in prior years but not yet fully utilized in a year that is closed under the statute of limitations may also be subject to examination. The Company’s Netherlands tax years are currently open from tax years 2018 to 2024, subject to adjustments as a result of the
126
recently negotiated BAPA. The Company believes that it has adequately reserved for the outcome of the BAPA. The Company regularly assesses the likelihood of adverse outcomes resulting from all existing and potential examinations to determine the adequacy of its provision for income taxes. The Company continues to monitor the progress of ongoing discussions with tax authorities and the effect, if any, of the expected expiration of the statute of limitations in various taxing jurisdictions.
As of January 31, 2025, unrecognized tax benefits approximated $25.6 million, of which $9.5 million would affect the effective tax rate if recognized. As of January 31, 2024, unrecognized tax benefits approximated $402.7 million, of which $213.7 million would affect the effective tax rate if recognized. The Company has settled and paid the BAPA tax liability with the DTA, thereby reducing the current tax liability previously classified as an unrecognized tax benefit. For unrecognized tax benefits unrelated to the BAPA, the Company is unable to reasonably estimate the timing of the remaining long-term payments or the amount by which the liability will increase or decrease.
The reconciliation of the Company's unrecognized tax benefits is as follows (in thousands):
| January 31, | |||||||||||
| 2025 | 2024 | ||||||||||
| Beginning balance | $ | $ | |||||||||
| Gross increases due to tax positions taken in prior periods | |||||||||||
| Gross increases due to tax position taken in current period | |||||||||||
| Gross decreases due to settlement tax payment | ( | ||||||||||
| Gross decreases due to settlements with taxing authorities | ( | ||||||||||
| Gross decreases due to lapses in applicable statutes of limitations | ( | ||||||||||
| Ending balance | $ | $ | |||||||||
It is the Company's policy to classify accrued interest and penalties related to unrecognized tax benefits in the provision for income taxes. For the years ended January 31, 2025, 2024 and 2023, the Company recognized interest and penalties of $5.3 million, $56.3 million and $1.3 million, respectively; these amounts are not included in the above table.
13. Net Income (Loss) per Share
The following table sets forth basic and diluted income (loss) per share for each of the periods presented (in thousands, except per share data):
| Fiscal Year Ended January 31, | |||||||||||||||||||||||||||||
| 2025 | 2024 | 2023 | |||||||||||||||||||||||||||
| Numerator: | |||||||||||||||||||||||||||||
| Net loss attributable to GitLab | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
| Denominator: | |||||||||||||||||||||||||||||
| Weighted-average shares used to compute net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted | |||||||||||||||||||||||||||||
| Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted | $ | ( | $ | ( | $ | ( | |||||||||||||||||||||||
127
Potentially dilutive securities that were not included in the diluted per share calculations because they would be anti-dilutive were as follows (in thousands):
| As of | |||||||||||||||||
| January 31, 2025 | January 31, 2024 | January 31, 2023 | |||||||||||||||
| Shares subject to outstanding common stock options | |||||||||||||||||
| Unvested restricted stock in connection with business combination | |||||||||||||||||
| Unvested early exercised stock options | |||||||||||||||||
| Unvested RSUs and PSUs | |||||||||||||||||
| Shares subject to the ESPP | |||||||||||||||||
| Total | |||||||||||||||||
14. Commitments and Contingencies
Contractual Obligations and Commitments
The Company’s purchase obligations represent third-party non-cancelable hosting infrastructure agreements, subscription arrangements and other commitments used in the ordinary course of business to meet operational requirements.
Future minimum payments under the Company’s non-cancelable purchase commitments as of January 31, 2025 were as follows (in thousands):
| Total | Less than 1 Year | 1-3 Years | 4-5 Years | ||||||||||||||||||||||||||
Purchase commitments (1) | $ | $ | $ | $ | |||||||||||||||||||||||||
(1) The table above includes $32 million of remaining non-cancelable contractual commitments as of January 31, 2025 related to one of the Company’s hosting infrastructure vendors, under which the Company committed to spend an aggregate of at least $171 million between October 2020 and September 2025.
Loss Contingencies
In accordance with ASC 450, Loss Contingencies, the Company accrues for contingencies when losses become probable and reasonably estimable. Accordingly, the Company has recorded an estimated liability related to certain labor matters regarding its use of contractors in certain foreign countries. As of January 31, 2025 and January 31, 2024, the estimated liability relating to these matters was $1.4 million and $2.2 million, respectively, is recorded in other non-current liabilities on the consolidated balance sheets.
Warranties and Indemnifications
The Company enters into service level agreements with customers which warrant defined levels of uptime and support response times and permit those customers to receive credits for prepaid amounts in the event that those performance and response levels are not met. To date, the Company has not experienced any significant failures to meet defined levels of performance and response. In connection with the service level agreements, the Company has not incurred any significant costs and has not accrued any liabilities in the consolidated financial statements.
In the ordinary course of business, the Company enters into contractual arrangements under which the Company agrees to provide indemnification of varying scope and terms to business partners and other parties with respect to certain matters, including, but not limited to, losses arising out of the breach
128
of such agreements, intellectual property infringement claims made by third parties, and other liabilities relating to or arising from the Company’s platform or the Company’s acts or omissions. In these circumstances, payment may be conditional on the other party making a claim pursuant to the procedures specified in the particular contract. Further, the Company’s obligations under these agreements may be limited in terms of time and/or amount, and in some instances, the Company may have recourse against third parties for certain payments.
In addition, the Company has agreed to indemnify its directors and executive officers for costs associated with any fees, expenses, judgments, fines, and settlement amounts incurred by any of these persons in any action or proceeding to which any of those persons is, or is threatened to be, made a party by reason of the person’s service as a director or officer, including any action by the Company, arising out of that person’s services as the Company’s director or officer or that person’s services provided to any other company or enterprise at the Company’s request. The Company maintains director and officer insurance coverage that may enable the Company to recover a portion of any future amounts paid.
Legal Proceedings
GitLab Securities Class Action and Shareholder Derivative Cases
On September 4, 2024, a putative class action was filed in the United States District Court for the Northern District of California, captioned Dolly v. GitLab et al., Case No. 5:24-cv-06244-EKL, naming GitLab and certain of our officers. The complaint purports to assert claims under Section 10(b) of the Securities Exchange Act of 1934 (“1934 Act”), SEC Rule 10b-5, and Section 20(a) of the 1934 Act, on behalf of persons and entities who acquired our common stock between June 5, 2023 and June 3, 2024 (the “Class Period”). Plaintiff alleges that, during the Class Period, defendants made material misrepresentations or omissions regarding the Company’s use of AI features and ability to monetize the Company’s AI capabilities that artificially inflated the Company’s stock price. Plaintiff seeks, among other things, damages in an unspecified amount, as well as fees and costs. Plaintiff amended his complaint on February 5, 2025 and March 7, 2025, and we will move to dismiss the second amended complaint in April 2025.
Two putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action. The cases were filed on February 14, 2025, in the United States District Court for the Northern District of California, captioned Preciado v. Sijbrandij et al., Case No. 3:25-cv-01597 (“Preciado”); and on February 19, 2025 in United States District Court for the Northern District of California, captioned Jones v. Sijbrandij et al., Case No. 3:25-cv-01735 (“Jones”). Both cases are allegedly brought on the Company’s behalf. Each of the lawsuits name the Company as a nominal defendant, and also certain of the Company’s officers and current and former members of the Company’s board of directors. The Jones complaint purports to assert claims under Section 14(a) of the Exchange Act as well as breach of fiduciary duty, while the Preciado complaint purports to assert those claims as well as unjust enrichment and related corporate torts. The complaints seek to recover unspecified damages and other relief on the Company’s behalf.
Based on the preliminary nature of the proceedings in these actions, the outcomes remain uncertain and the Company cannot estimate the potential impact, if any, on its business or financial statements at this time.
In addition to the shareholder matters described above, the Company is, and from time to time may become, involved in legal proceedings or be subject to claims arising in the ordinary course of business. The Company is not presently a party to any legal proceedings that in the opinion of management, if determined adversely to the Company, would individually or taken together have a material adverse effect on its business, financial condition or operating results.
Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless
129
of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.
15. Subsequent Events
ITEM 9. CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURES
None.
130
ITEM 9A. CONTROLS AND PROCEDURES
Evaluation of Disclosure Controls and Procedures
Our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") ("certifying officers") have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of January 31, 2025. Our certifying officers concluded that our disclosure controls and procedures were effective as of January 31, 2025.
Management's Report on Internal Control Over Financial Reporting
Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). The Company's management, with participation of the CEO and CFO, under the oversight of our board of directors, evaluated the effectiveness of the Company's internal control over financial reporting as of January 31, 2025 using the framework in Internal Control - Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on that evaluation, management concluded that the Company's internal control over financial reporting was effective as of January 31, 2025.
Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an unqualified opinion on the effectiveness of the Company's internal control over financial reporting. KPMG LLP's report appears in Item 8 of this Annual Report on Form 10-K.
Remediation of Previously Disclosed Material Weakness
As disclosed in our previously issued Annual Report on Form 10-K for the year ended January 31, 2024, we identified a material weakness in our internal control over financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. During fiscal year 2024, we determined that a material weakness existed due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the Company. In particular:
•We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems used in the financial reporting processes related to revenue. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.
We implemented remediation actions during fiscal year 2025 to address this material weakness and enhance our control environment. Our remediation actions included:
•Strengthening IT governance and designing IT general controls related to certain revenue systems, including program change management, restricting user access to our internal systems used for financial reporting and enhancing the retention of contemporaneous documentation of reviews over IT general controls, and
131
•Developing and deploying training programs regarding the operation and importance of internal controls.
We have tested and evaluated the implementation of these new and revised processes and internal controls to determine whether they are designed and operating effectively to provide reasonable assurance that they will prevent or detect a material error in our consolidated financial statements. Based on our assessment, we have concluded that this material weakness has been remediated as of January 31, 2025.
Changes in Internal Control over Financial Reporting
Other than the remediation efforts described above, there were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.
Limitations on Effectiveness of Controls and Procedures
Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the Company have been detected.
132
ITEM 9B. OTHER INFORMATION
Sytse Sijbrandij 10b5-1 Plan
On December 26, 2024 , Sytse Sijbrandij , Co-Founder and Executive Chair of the Board of Directors of the Company, entered into, through Mr. Sibrandij’s revocable trust and the Sijbrandij Foundation, a new pre-arranged written stock sale plan in accordance with Rule 10b5-1 (the “Sijbrandij Rule 10b5-1 Plan”) under the Exchange Act for the sale of shares of the Company’s Class A common stock resulting from the conversion of shares of the Company’s Class B common stock. The Sijbrandij Rule 10b5-1 Plan was entered into during an open trading window in accordance with the Company’s policies regarding transactions in the Company’s securities and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act. The Sijbrandij Rule 10b5-1 Plan provides for the potential sale of approximately 2,173,416 shares, which reflects the aggregate number of shares of the Company’s Class A common stock resulting from the conversion of shares of the Company’s Class B common stock, as applicable, so long as the market price of the Company’s Class A common stock is higher than certain minimum threshold prices specified in the Sijbrandij Rule 10b5-1 Plan, between April 15, 2025 and March 18, 2026 .
The Sijbrandij Rule 10b5-1 Plan includes a representation from Mr. Sijbrandij to the broker administering the plan that he was not in possession of any material nonpublic information regarding the Company or the securities subject to the Sijbrandij Rule 10b5-1 Plan at the time it was entered into. A similar representation was made to the Company in connection with the adoption of the Sijbrandij Rule 10b5-1 Plan under the Company’s policies regarding transactions in the Company’s securities. Those representations were made as of the date of adoption of the Sijbrandij Rule 10b5-1 Plan, and speak only as of such date. In making those representations, there is no assurance with respect to any material nonpublic information of which Mr. Sijbrandij was unaware, or with respect to any material nonpublic information acquired by Mr. Sijbrandij or the Company after the date of the representation.
Brian Robins 10b5-1 Plan
On December 31, 2024 , Brian Robins , the Company’s Chief Financial Officer , along with The Robins Family Trust, entered into a new pre-arranged written stock sale plan in accordance with Rule 10b5-1 (the “Robins Rule 10b5-1 Plan”) under the Exchange Act for the sale of shares of the Company’s Class A common stock resulting from the exercise of vested stock options for shares of the Company’s Class B common stock and subsequent conversion to Class A common stock prior to consummating any sale in connection with the exercise of vested stock options. The Robins Rule 10b5-1 Plan was entered into during an open trading window in accordance with the Company’s policies regarding transactions in the Company’s securities and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act. The Robins Rule 10b5-1 Plan provide for the potential sale of approximately 230,000 shares, which reflects shares of the Company’s Class A common stock resulting from the exercise of vested stock options for shares of the Company’s Class B common stock and subsequent conversion to Class A common stock prior to consummating any sale in connection with the exercise of vested stock options, so long as the market price of the Company’s Class A common stock is higher than certain minimum threshold prices specified in the Robins Rule 10b5-1 Plan between April 1, 2025 and February 27, 2026 .
The Robins Rule 10b5-1 Plan includes a representation from Mr. Robins and The Robins Family Trust trustee to the broker administering the plan that neither was in possession of any material nonpublic information regarding the Company or the securities subject to the Robins Rule 10b5-1 Plan at the time it was entered into. A similar representation was made to the Company in connection with the adoption of the Robins Rule 10b5-1 Plan under the Company’s policies regarding transactions in the Company’s securities. Those representations were made as of the date of adoption of the Robins Rule 10b5-1 Plan, and speak only as of such date. In making those representations, there is no assurance with respect to any material nonpublic information of which Mr. Robins or the trustee was unaware, or with respect to any
133
material nonpublic information acquired by Mr. Robins, the trustee or the Company after the date of the representation.
Sabrina Farmer 10b5-1 Plan
On December 31, 2024 , Sabrina Farmer , the Company’s Chief Technology Officer , entered into a new pre-arranged written stock sale plan in accordance with Rule 10b5-1 (the “Farmer Rule 10b5-1 Plan”) under the Exchange Act for the sale of shares of the Company’s Class A common stock resulting from vesting and settlement of restricted stock units. The Farmer Rule 10b5-1 Plan was entered into during an open trading window in accordance with the Company’s policies regarding transactions in the Company’s securities and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act. The aggregate number of shares of Class A common stock that will be available for sale under the Farmer Rule 10b5-1 Plan is not yet determinable because the shares available will be net of shares sold to satisfy tax withholding obligations that arise in connection with the vesting and settlement of such restricted stock units. As such, for purposes of this disclosure, the aggregate number of shares of the Company’s Class A common stock available for sale is approximately 93,175 shares, which reflects the aggregate maximum number of shares underlying Ms. Farmer’s restricted stock units which may be sold, without excluding the shares that will be sold to satisfy the tax withholding obligations, so long as the market price of the Company’s Class A common stock is higher than certain minimum threshold prices specified in the Farmer Rule 10b5-1 Plan between April 1, 2025 and December 26, 2025 .
The Farmer Rule 10b5-1 Plan includes a representation from Ms. Farmer to the broker administering the plan that she was not in possession of any material nonpublic information regarding the Company or the securities subject to the Farmer Rule 10b5-1 Plan at the time it was entered into. A similar representation was made to the Company in connection with the adoption of the Farmer Rule 10b5-1 Plan under the Company’s policies regarding transactions in the Company’s securities. Those representations were made as of the date of adoption of the Farmer Rule 10b5-1 Plan, and speak only as of such date. In making those representations, there is no assurance with respect to any material nonpublic information of which Ms. Farmer was unaware, or with respect to any material nonpublic information acquired by Ms. Farmer or the Company after the date of the representation.
Once executed, transactions under each of the Sijbrandij Rule 10b5-1 Plan, the Robins Rule 10b5-1 Plan and the Farmer 10b5-1 Plan will be disclosed publicly through Form 4 and/or Form 144 filings with the Securities and Exchange Commission in accordance with applicable securities laws, rules, and regulations. Except as may be required by law, the Company does not undertake any obligation to update or report any modification, termination, or other activity under current or future Rule 10b5-1 plans that may be adopted by Mr. Sijbrandij, Mr. Robins, Ms. Farmer or other officers or directors of the Company.
134
ITEM 9C. DISCLOSURES REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS
Not applicable.
135
PART III
ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE
The information required by this item will be set forth in our definitive proxy statement to be filed with the Securities and Exchange Commission not later than 120 days after the end of our fiscal year ended January 31, 2025 in connection with our 2025 annual meeting of shareholders, or the Proxy Statement, and is incorporated herein by reference.
ITEM 11. EXECUTIVE COMPENSATION
The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.
ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNER AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS
The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.
ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS, AND DIRECTOR INDEPENDENCE
The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.
ITEM 14. PRINCIPAL ACCOUNTING FEES AND SERVICES
The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.
136
PART IV
ITEM 15. EXHIBITS AND FINANCIAL STATEMENTS SCHEDULES
(1) All Financial Statements
See Index to Consolidated Financial Statements in Item 8 herein.
(2) Financial Statements Schedules
The following additional financial statement schedules should be considered in conjunction with our consolidated financial statements. All other financial statement schedules have been omitted because the required information is not present in amounts sufficient to require submission of the schedule, not applicable, or because the required information is included in the consolidated financial statements or notes thereto.
Schedule II: Valuation and Qualifying Accounts
The table below details the activity of the deferred tax valuation allowance for the fiscal years ended January 31, 2025, 2024, and 2023:
| Balance at Beginning of Year | Additions | Write-offs or Deductions | Balance at End of Year | ||||||||||||||||||||
| (in thousands) | |||||||||||||||||||||||
| Year ended January 31, 2025 | |||||||||||||||||||||||
| Deferred tax valuation allowance | $ | $ | $ | $ | |||||||||||||||||||
| Year ended January 31, 2024 | |||||||||||||||||||||||
| Deferred tax valuation allowance | $ | $ | $ | $ | |||||||||||||||||||
| Year ended January 31, 2023 | |||||||||||||||||||||||
| Deferred tax valuation allowance | $ | $ | $ | $ | |||||||||||||||||||
(3) Exhibits
| Incorporated by Reference | Filed or Furnished Herewith | |||||||||||||||||||||||||||||||||||||
| Exhibit Number | Description | Form | File Number | Exhibit | Filing Date | |||||||||||||||||||||||||||||||||
| 3.1 | 10-Q | 001-40895 | 3.1 | 9/3/2024 | ||||||||||||||||||||||||||||||||||
| 3.2 | 8-K | 001-40895 | 3.1 | 12/15/2022 | ||||||||||||||||||||||||||||||||||
| 4.1 | S-1/A | 333-259602 | 4.1 | 10/12/2021 | ||||||||||||||||||||||||||||||||||
| 4.2 | S-1/A | 333-259602 | 4.3 | 10/4/2021 | ||||||||||||||||||||||||||||||||||
| 4.3 | 10-K | 001-40895 | 4.4 | 4/8/2022 | ||||||||||||||||||||||||||||||||||
| 10.1† | S-1 | 333-259602 | 10.1 | 9/17/2021 | ||||||||||||||||||||||||||||||||||
| 10.2† | S-1 | 333-259602 | 10.2 | 9/17/2021 | ||||||||||||||||||||||||||||||||||
| 10.3† | 10-K | 001-40895 | 10.3 | 3/26/2024 | ||||||||||||||||||||||||||||||||||
137
| 10.4† | 10-Q | 001-40895 | 10.4 | 6/7/2022 | ||||||||||||||||||||||||||||||||||
| 10.5† | S-1/A | 333-259602 | 10.5 | 10/4/2021 | ||||||||||||||||||||||||||||||||||
| 10.6†‡ | 10-Q | 001-40895 | 10.6 | 9/7/2022 | ||||||||||||||||||||||||||||||||||
| 10.7† | 8-K | 001-40895 | 10.1 | 6/25/2024 | ||||||||||||||||||||||||||||||||||
| 10.8† | X | |||||||||||||||||||||||||||||||||||||
| 19.1 | X | |||||||||||||||||||||||||||||||||||||
| 21.1 | X | |||||||||||||||||||||||||||||||||||||
| 23.1 | X | |||||||||||||||||||||||||||||||||||||
| 31.1 | X | |||||||||||||||||||||||||||||||||||||
| 31.2 | X | |||||||||||||||||||||||||||||||||||||
| 32.1* | X | |||||||||||||||||||||||||||||||||||||
| 32.2* | X | |||||||||||||||||||||||||||||||||||||
| 97.1 | 10-K | 001-40895 | 97.1 | 3/26/2024 | ||||||||||||||||||||||||||||||||||
| 101.INS | XBRL Instance Document - the instance document does not appear in the Interactive Data File because its XBRL tags are embedded within the Inline XBRL document. | X | ||||||||||||||||||||||||||||||||||||
| 101.SCH | Inline XBRL Taxonomy Extension Schema Document. | X | ||||||||||||||||||||||||||||||||||||
| 101.CAL | Inline XBRL Taxonomy Extension Calculation Linkbase Document. | X | ||||||||||||||||||||||||||||||||||||
| 101.DEF | Inline XBRL Taxonomy Extension Definition Linkbase Document. | X | ||||||||||||||||||||||||||||||||||||
| 101.LAB | Inline XBRL Taxonomy Extension Label Linkbase Document. | X | ||||||||||||||||||||||||||||||||||||
| 101.PRE | Inline XBRL Taxonomy Extension Presentation Linkbase Document. | X | ||||||||||||||||||||||||||||||||||||
| 104 | Cover Page Interactive Data File (formatted as inline XBRL with applicable taxonomy extension information contained in Exhibits 101). | X | ||||||||||||||||||||||||||||||||||||
† Indicates management contract or compensatory plan.
‡ Registrant has omitted schedules and exhibits pursuant to Item 601(a)(5) of Regulation S-K. The Registrant agrees to furnish supplementally a copy of the omitted schedules and exhibits to the SEC upon request.
138
* The certifications furnished in Exhibits 32.1 and 32.2 hereto are deemed to accompany this Annual Report on Form 10-K and are not deemed “filed” for purposes of Section 18 of the Exchange Act, or otherwise subject to the liability of that section, nor shall they be deemed incorporated by reference into any filing under the Securities Act or the Exchange Act, irrespective of any general incorporation language contained in such filing.
ITEM 16. FORM 10-K SUMMARY
None.
139
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.
| GITLAB INC. | ||||||||
Date: March 21, 2025 | ||||||||
| By: | /s/ William Staples | |||||||
| Name: William Staples | ||||||||
| Title: Chief Executive Officer | ||||||||
Date: March 21, 2025 | ||||||||
| By: | /s/ Brian Robins | |||||||
| Name: Brian Robins | ||||||||
| Title: Chief Financial Officer | ||||||||
KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints Brian Robins and Robin Schulman, and each or any one of them, his or her true and lawful attorney-in-fact and agent, with full power of substitution and resubstitution, for him or her and in his or her name, place and stead, in any and all capacities, to sign any and all amendments to this report, and to file the same, with all exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-facts and agents, and each of them, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully to all intents and purposes as he or she might or could do in person, hereby ratifying and confirming all that said attorneys-in-fact and agents, or any of them, or their or his or her substitute or substitutes, may lawfully do or cause to be done by virtue hereof.
Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, this Report has been signed below by the following persons on behalf of the Registrant in the capacities and on the dates indicated.
| Name | Title | Date | ||||||
| /s/ William Staples | Chief Executive Officer | March 21, 2025 | ||||||
| William Staples | (principal executive officer) | |||||||
| /s/ Brian Robins | Chief Financial Officer | March 21, 2025 | ||||||
| Brian Robins | (principal financial officer and the interim principal accounting officer) | |||||||
| /s/ Sytse Sijbrandij | Director | March 21, 2025 | ||||||
| Sytse Sijbrandij | ||||||||
| /s/ Sundeep Bedi | Director | March 21, 2025 | ||||||
| Sundeep Bedi | ||||||||
| /s/ Karen Blasing | Director | March 21, 2025 | ||||||
| Karen Blasing | ||||||||
| /s/ Sue Bostrom | Director | March 21, 2025 | ||||||
| Sue Bostrom | ||||||||
| /s/ David Henshall | Director | March 21, 2025 | ||||||
| David Henshall | ||||||||
| /s/ Matthew Jacobson | Director | March 21, 2025 | ||||||
| Matthew Jacobson | ||||||||
140
| /s/ Merline Saintil | Director | March 21, 2025 | ||||||
| Merline Saintil | ||||||||
| /s/ Godfrey Sullivan | Director | March 21, 2025 | ||||||
| Godfrey Sullivan | ||||||||
141
 | Exhibit 10.8 | ||||
December 4, 2024
William Staples
Dear William,
I am very pleased to confirm our offer to you of employment with GitLab, Inc. (the “Company”). This letter agreement (“Letter Agreement”) describe the terms of our offer and the benefits currently provided by the Company.
1.Position. You are being offered the position of Chief Executive Officer (CEO), reporting to the Company’s Board of Directors (the “Board”). This is an exempt position based in Utah. While you serve as Chief Executive Officer, you will also serve on the Board. You agree that, in the event you cease to serve as Chief Executive Officer, you shall resign your position as a member of the Board effective no later than your Chief Executive Officer termination date. Your anticipated start date will be on or before December 5, 2024 (your actual commencement of employment with the Company, your “Start Date”).
2.Compensation.
a)Salary. You will be paid an annual base salary of $600,000, payable in semi-monthly installments in accordance with the Company’s standard payroll practices. This compensation will be subject to periodic review.
b)Bonus. You will be eligible to participate in the Company’s Executive and Director performance bonus program pursuant to the terms of that plan. Your actual bonus, if any, will be determined by the Company’s Board of Directors, in its sole discretion, based upon the Company’s performance, and any other considerations it deems relevant. Payment of the bonus, if any, will be subject to your continuous employment with the Company on the date of payment and will be subject to any required payroll deductions and withholdings. The Annual Bonus Target is 100% of your base salary based upon 100% Bonus Plan Overall Achievement.
3.Benefits. You will be eligible to participate in all Company medical, vision, dental and 401(k) benefits made available to employees. The amount and extent of these benefits, including employee-paid premiums, copayments and deductibles, shall be governed by the specific benefit plan, as it may be amended from time to time. In addition, the Company will reimburse you for a portion of your attorneys’ fees incurred in connection with the review, negotiation, drafting and execution of this Letter Agreement, in an amount not to exceed $15,000.
4.Initial Equity Awards.
a)Restricted Stock Units. Subject to approval of the Board, the Company will grant you time-vesting RSUs (the “RSUs”) for a number of shares to be determined by dividing $24,000,000 by (x) the average closing trading price of the Company's Class A Common Stock during the 30 calendar days immediately preceding and including the 5th day of the month the grant was awarded, rounding down to the nearest whole share or (y) the average closing trading price of the Company's Class A Common Stock during the 5 trading days immediately following the most recent quarterly earnings release issued by
1
the Company prior to the date of grant, rounding down to the nearest whole share only if (x) exceeds (y) by more than 25% (the “Equity Conversion Method”).
The RSUs will be granted as soon as reasonably practicable following your Start Date (the “RSUs Grant Date”) and will be subject to the terms and conditions of the Company’s 2021 Equity Incentive Plan (the “Plan”) and form of Restricted Stock Unit Agreement thereunder. 12.5% or 2/16ths of the RSUs shall vest on the first Vesting Date, June 15, 2025 (the “First Vesting Date”) and thereafter, following the First Vesting Date, an additional 1/16th of the RSUs will vest at a quarterly cadence on the relevant Vesting Date (i.e., the Vesting Date that occurs in each third month), subject to your continuous Service (as defined in the Plan) on such vesting dates (except as set forth under the Severance Policy, as set forth on Section 6 below). “Vesting Date” means the fifteenth (15th) day of March, June, September and December.
b)Performance Stock Units. Subject to approval of the Board, the Company will grant you performance-based RSUs (“PSUs”) with an aggregate target fair market value of $16,000,000 (as determined pursuant to the Equity Conversion Method) which shall vest in three equal tranches, each representing one-third of the total number of PSUs, based on the satisfaction of applicable Net ARR and Non-GAAP Operating Income Margin goals for each of fiscal years 2026, 2027 and 2028, and subject to your continuous Service (as defined in the Plan) on the relevant certification dates, as further set forth in Exhibit A attached hereto.
The PSUs will be granted as soon as reasonably practicable following your Start Date (the “PSU Grant Date”), and will be granted subject to the terms and conditions of the Plan and form of Performance Stock Unit Agreement thereunder.
5.Annual Equity Awards. You may be eligible for annual equity awards at the discretion of the Compensation Leadership Development Committee and Board. You will first be eligible for annual equity awards in fiscal year 2027.
6.Termination Benefits. You will be eligible to receive change in control and severance payment benefits under the Change in Control and Severance Policy attached hereto as Exhibit B (the “Severance Policy”). In the event of your death or Disability, as defined in the Company’s Death and Disability Policy, any unvested RSUs will accelerate in accordance with that Policy and any unvested PSUs will be forfeited without acceleration.
7.Protection of Confidential and Proprietary Information. As an employee of the Company, you will have access to certain confidential information of the Company and you may, during the course of your employment, develop certain information or inventions that will be the property of the Company. To protect the Company’s interests, as a condition of employment, you must sign and abide by the Company’s standard “Employee Invention Assignment and Confidentiality Agreement. (the “Employee Invention Assignment and Confidentiality Agreement”).
8.No Breach of Obligations to Prior Employers. We wish to impress upon you that we do not want you to, and we hereby direct you not to, bring with you any confidential or proprietary material of any former employer or violate any other obligations you may have to any former employer. You represent that your signing of this Letter Agreement, agreement(s) concerning equity awards granted to you, if any, and the Employee Invention Assignment and Confidentiality Agreement and your commencement of employment
2
with the Company will not violate any agreement currently in place between yourself and current or past employers.
9.No Competition During Employment. During the period that you render services to the Company, you agree to not engage in any employment, business or activity without the written consent of the Company. You will disclose to the Company in writing any other gainful employment, business or activity that you are currently associated with or participate in that competes with the Company. Additionally, during the period you render services to the Company, you will not assist any other person or organization in competing with the Company or in preparing to engage in competition with the business or proposed business of the Company or in hiring any employees or consultants of the Company.
10.Use of Name/Likeness. You understand and agree that the Company may use your picture, likeness, image, name, or voice in connection with its website, blog posts, or other Company publicity or business-related activities.
11.At Will Employment. Employment with the Company is for no specific period of time. Should you accept our offer, you will be an at-will employee of the Company, which means the employment relationship can be terminated by either of us for any reason, at any time, with or without prior notice and with or without cause. Any statements or representations to the contrary (and, indeed, any statements contradicting any provision in this letter) are superseded by this agreement. Further, your participation in any equity award or benefit program is not to be regarded as assuring you of continuing employment for any particular period of time. Although your job duties, title, compensation and benefits, as well as the Company’s personnel policies and practices, may change from time to time, the “at-will” nature of your employment may be changed only in an express, written employment agreement signed by you and a duly authorized officer of the Company (other than you).
12.Tax Matters. All forms of compensation referred to in this Letter Agreement are subject to reduction to reflect applicable withholding and payroll taxes and other deductions required by law.
13.Code of Conduct and Ethics. Your employment is contingent on your compliance with the GitLab Code of Business Conduct & Ethics which may be viewed at https://about.gitlab.com/handbook/legal/gitlab-code-of-business-conduct-and-ethics/. Any violations of this Code may result in disciplinary action, up to and including termination of your employment.
14.GitLab Values. GitLab also puts a significant emphasis on its six values of Collaboration, Results for Customers, Efficiency, Diversity and Inclusion, Iteration, and Transparency, in everything we do. Our values give guidelines on how to behave to help us to know how to behave in the organization and what to expect from others. All team members are expected to consistently demonstrate our Values which together spell the CREDIT we give each other by assuming good intent. You can view more information about our values at https://about.gitlab.com/handbook/values/.
15.Location. Your employment with GitLab is conditioned upon your permanent legal residence being near Lehi, Utah. If your permanent legal residence changes from that location you must notify the Company prior to any such changes. Changes to your permanent legal residence could result in a change to your compensation, benefits, and in some circumstances, termination of your employment.
16.Arbitration. To the fullest extent permitted by law, and subject to the limitations on arbitration set forth in subsection (a)(i) and (ii) below, you and the Company (collectively, the “parties”) agree as follows:
a)The parties agree to submit to mandatory binding arbitration any and all claims arising out of or related to your employment with the Company and the termination thereof (the “Arbitrable Claims”), except as follows:
3
i.This arbitration section does not restrict your right to file (A) claims in court for violation of the California Labor Code, including on a representative action basis under California Labor Code Sections 2698, et seq, or the California Fair Employment and Housing Act; or (B) administrative claims before any government agency where, as a matter of law, you have the right to file such administrative claims (including, but not limited to, the National Labor Relations Board, the Equal Employment Opportunity Commission, the Department of Labor, and applicable state and local agencies); and
ii.Each party may seek injunctive relief in court related to the improper use, disclosure or misappropriation of that party’s private, proprietary, confidential and/or trade secret information.
b)For all (i) Arbitrable Claims, and (ii) claims covered by subsection (a)(i) above that you voluntarily elect to adjudicate through arbitration rather that in court, the arbitration shall be conducted in [San Francisco, California] through JAMS before a single neutral arbitrator, in accordance with the JAMS employment arbitration rules then in effect. The JAMS rules may be found and reviewed at http://www.jamsadr.com/rules-employment-arbitration. If you are unable to access these rules, please let me know and I will provide you with a hardcopy. The arbitrator shall issue a written decision that contains the essential findings and conclusions on which the decision is based.
c)This arbitration section is governed by and will be construed in accordance with the Federal Arbitration Act, 9 U.S.C. 1, et seq. If, for any reason, any term of this arbitration provision is held to be invalid or unenforceable, all other valid terms and conditions of this arbitration provision shall be severable in nature, and remain fully enforceable.
17.Background Check. The Company may conduct a verification of your criminal, education, driving and/or employment background. This offer is contingent upon a satisfactory verification and can be rescinded based upon data received in the verification.
18.Entire Agreement. This Letter Agreement, once accepted, the Employee Invention Assignment and Confidentiality Agreement, and the Severance Policy constitutes the entire agreement between you and the Company with respect to the subject matter hereof and supersedes all prior offers, negotiations and agreements, if any, whether written or oral, relating to such subject matter. You acknowledge that neither the Company nor its agents have made any promise, representation or warranty whatsoever, either express or implied, written or oral, which is not contained in this agreement for the purpose of inducing you to execute this Letter Agreement, and you acknowledge that you have executed this agreement in reliance only upon such promises, representations and warranties as are contained herein.
19.Amendment and Governing Law. This Letter Agreement may not be amended or modified except by an express written agreement signed by you and a duly authorized officer of the Company. The terms of this Letter Agreement and the resolution of any disputes will be governed by the laws of the State of California.
Sincerely,
GitLab Inc.
4
/s/ Godfrey Sullivan
Godfrey Sullivan
Lead Independent Director
I have read this Letter Agreement and agree to be bound by its terms and conditions.
/s/ William Staples
William Staples
December 4, 2024
5
Exhibit A
PSU Vesting Schedule
6
EXHIBIT B
Severance Policy
Severance. In the event that Executive’s employment is involuntarily terminated by the Company for any reason other than Cause or by Executive for Good Reason (each as defined herein) the Company shall continue paying CEO’s salary and benefits (or COBRA, if applicable) for a period of twelve (12) months from CEO’s termination date and the pro-rata portion of CEO’s bonus earned through the date of termination.
CIC Severance. In the event that CEO’s employment is involuntarily terminated by the Company for any reason other than Cause or by CEO for Good Reason, in each case in connection with or within three (3) months prior to or within twelve (12) months following a Corporate Transaction, CEO shall be entitled to CEO’s salary and benefits (or COBRA, if applicable) for a period of eighteen (18) months from CEO’s termination date; the pro-rata portion of CEO’s bonus earned through the date of termination plus the amount of bonus that would have accrued during the severance period; and all equity awards shall become immediately vested, effective as of CEO’s termination date, provided that, notwithstanding Section 21.1(f) of the Company’s 2021 Equity Incentive Plan, the vested and unvested portion of Executive’s equity awards will not be subject to cancellation without consideration in connection with a Corporate Transaction.
The benefits described above shall not apply unless the CEO (i) has executed a general release (substantially in the form prescribed by the Company) of all known and unknown claims that he may then have against the Company or persons affiliated with the Company and such release has become effective and (ii) has agreed not to prosecute any legal action or other proceeding based upon any of such claims. The CEO must execute and return the Release within the time period specified in the form.
“Cause” means any of the following: (a) CEO engages in conduct that is in bad faith and materially injurious to the Company, including but not limited to, misappropriation of trade secrets, fraud or embezzlement; (b) CEO commits a material breach of any written agreement between CEO and the Company that causes harm to the Company, which breach is not cured within thirty (30) days after receipt of written notice describing in detail such breach to CEO from the Company;(c) CEO willfully refuses to implement or follow a legal directive by CEO’s supervisor, directly related to CEO’s duties, which breach is not cured within thirty (30) days after receipt of written notice describing in detail such breach to CEO from the Company; or (d) CEO engages in material misfeasance or malfeasance demonstrated by a continued pattern of material failure to perform the essential job duties associated with CEO’s position, which breach is not cured within thirty (30) days after receipt of written notice describing in detail such breach to CEO from the Company.
“Corporate Transaction” mean any of the following transactions to which the Company is a party: (a) any consolidation or merger of the Company with or into any other corporation or other entity or person, or any other corporate reorganization, in which the Stockholders of the Company immediately prior to such consolidation, merger or reorganization, own less than 50% of the voting power of the surviving entity immediately after such consolidation, merger or reorganization (other than in connection with a bona fide equity financing of the Company); (b) any transaction or series of related transactions to which the Company is a party in which in excess of 50% of the Company’s voting power is transferred, excluding any consolidation or merger effected exclusively to change the domicile of the Company; or (c) the sale, transfer or other disposition of all or substantially all of the assets of the Company unless the Company’s Stockholders immediately prior to such sale, transfer or other disposition hold (by virtue of securities received in exchange for their shares in the Company) securities of the purchaser or other transferee representing more than 50% of the total voting power of such entity immediately after such transaction.
“Good Reason” means any of the following actions by the Company without CEO’s written consent: (a) a material reduction in CEO’s duties or responsibilities or title or authority that is inconsistent with CEO’s
7
position , which, for the avoidance of doubt and for clarification only, includes the following circumstances: (x) you remain the CEO of the Company but the Company has ceased to be a public company or (y) in connection with an acquisition of the Company, the Company operates as a department, business unit or division of the acquiring company and your duties and responsibilities are performed at the level of this department, business unit or division; (b) the requirement that CEO change his principal office to a facility that increases CEO’s commute by more than thirty (30) miles from CEO’s commute to the location at which CEO is employed prior to such change; or (c) reduction in CEO’s annual base salary or a material reduction in CEO’s employee benefits (e.g., medical, dental, insurance, short and long term disability insurance and 401(k) retirement play benefits, collectively, the “Employee Benefits”) to which CEO is entitled immediately prior to such reduction (other than in connection with a general decrease in the salary or Employee Benefits of all similarly situated employees). CEO will not resign for Good Reason without first providing the Company with written notice of the acts or omissions constituting the grounds for “Good Reason” within thirty (30) days of the initial existence of the grounds for “Good Reason”; and if curable the Company shall notify CEO if it elects to attempt to cure, in which case Company shall have a reasonable cure period (but not exceeding thirty (30) days following the notification.) Any termination of employment under this provision must occur within ten (10) days of the earlier of expiration of the Company cure period or written notice from the Company that it will not undertake to cure the condition asserted by the CEO.
[REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK]
8
Exhibit 19.1
INSIDER TRADING POLICY
1.PURPOSE
GitLab Inc. (the “Company”) is committed to promoting high standards of honest and ethical business conduct and compliance with laws, rules and regulations. Because stock is an important part of the Company’s compensation program, our Board of Directors (“Board”) has adopted this Insider Trading Policy (“Policy”) to promote compliance with insider trading laws.
Insider trading happens when someone who is in possession of material nonpublic information (“MNPI”) trades securities on the basis of that information or discloses MNPI to someone else who trades on the basis of that information.
If you are considering trading our stock or other securities, please keep these three key points in mind:
●Never buy or sell our securities based on MNPI;
●Keep all MNPI confidential, including from your family and friends; and
●When in doubt about whether you have MNPI, ask before trading.
Team members are responsible for understanding and following this Policy and for the consequences of any actions they may take. Our Chief Legal Officer (“CLO”) will assist with implementing, interpreting and enforcing this Policy, pre-clearing trading activities of certain people, and pre-approving any Rule 10b5-1 Plans (plans that permit insiders to sell Company securities on a pre-determined schedule that the insider does not control, discussed more fully later in this Policy).
2.PERSONS COVERED BY THIS POLICY
This Policy applies to our team members, contractors, consultants and Board members (collectively, “Team Members”), as well as to their immediate family members, people sharing their households and anyone subject to their influence or control. It applies as well to entities such as venture capital funds, partnerships, trusts and corporations which are associated or affiliated with our Team Members; provided, however, that this Policy shall not apply to any entity that engages in the investment of securities in the ordinary course of its business (e.g., an investment fund or partnership) if such entity has established its own written insider trading controls and procedures in compliance with applicable securities laws, and such policy or policies have been provided or made available to the Company’s CLO (including any amendments thereto from time to time). An “immediate family member” under this Policy means any child, stepchild, parent, stepparent, spouse, domestic partner, sibling, mother-in-law, father- in-law, son-in-law, daughter-in-law, brother-in-law, or sister-in-law of a person security holder, and includes any person (other than a tenant or employee) sharing the household of that person. We will refer to all of these individuals and entities in this Policy collectively as “Insiders.”
Additional trading restrictions in this Policy apply to our officers (as defined in Rule 16a-1(f) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”)), and directors (together with the officers, the “Section 16 Insiders”) and to the individuals listed on Exhibit A (“Designated Insiders”) who are not Section 16 Insiders but who have regular access to MNPI in the normal course of their job. The list of Designated Insiders may be modified by our CLO from time to time.
If you are aware of MNPI when your employment or service relationship with the Company ends, you still may not trade our securities until that MNPI has become public or is no longer material.
Additionally, the Company will not transact in its securities unless in compliance with applicable U.S. securities laws, rules and regulations.
3.WHAT THIS POLICY COVERS
The primary purpose of this Policy is to prevent people who are in possession of MNPI from trading in our stock or other securities on the basis of that MNPI or disclosing MNPI to someone else who trades on the basis of that information.
“Material information” is information about our Company, positive or negative, that a reasonable stockholder would consider important in making a decision to purchase or sell the Company’s securities. Material information can be positive or negative and can relate to virtually any aspect of the Company’s business or its securities.
Examples of material information may include:
●historical or forecasted revenues, earnings or other financial results;
●significant new products or services or other product developments;
●significant new contracts or partners or the loss of a significant contract or partner;
●significant developments regarding the Company’s technology or business operations;
●possible mergers or acquisitions or dispositions of significant subsidiaries or assets;
●major new litigation or regulatory inquiries or developments in existing litigation or inquiries;
●significant cybersecurity incidents or data breaches;
●significant developments in borrowings, or financings or capital investments;
●significant changes in financial condition or asset value or liquidity issues;
●changes in our Board or senior management;
●significant changes in corporate strategy;
●restatements of historical financial statements;
●changes in accounting methods and write-offs; and
●stock offerings, stock splits or changes in dividend policy.
This list is illustrative only and is not intended to provide a comprehensive list of circumstances that could result in material information. Determination of what may constitute material information will depend upon the facts and circumstances in each particular situation.
“Nonpublic” means that the confidential information has not yet been shared broadly outside the Company. Please remember as well that we may possess confidential information relating to, belonging to or impacting our customers, partners or other third parties and that it is equally important that we treat this information with the same care with which we treat our own information. Otherwise, you can be liable for trading in another company’s securities while in possession of MNPI about that company or
for disclosing such information to others who may trade while in possession of it. For example, you may be involved in a proposed transaction involving a prospective business relationship or transaction with another company. If information about that transaction constitutes MNPI that could impact another company, including a company not involved in the transaction, you could be liable for engaging in transactions involving the securities of such other company (as well as transactions involving the Company’s securities, if that information is material to the Company). It is important to note that “materiality” is different for different companies. Information that is not material to the Company may be material to another company. If a Team Member is not sure whether information is considered public, they should either consult with our CLO or assume that the information is nonpublic and treat it as confidential.
This Policy applies to all transactions involving our securities, including common stock, restricted stock units (“RSUs”), options and warrants to purchase common stock and any other debt or equity securities the Company may issue from time to time, such as bonds, preferred stock, convertible notes, as well as to derivative securities relating to the Company’s securities, whether or not issued by the Company, such as exchange-traded options.
4.PROHIBITED ACTIVITIES AND OTHER RESTRICTIONS
Insider Restrictions
The following is a list of prohibited activities for all Insiders:
●Trade our securities while in possession of any MNPI (other than pursuant to a 10b5-1 Plan or a non-Rule 10b5-1 trading arrangement (as defined below) entered into in accordance with this Policy).
●Trade our securities outside of an Open Window or during a Closed Window designated by our CLO (other than pursuant to a 10b5-1 Plan or a non-Rule 10b5-1 trading arrangement entered into in accordance with this Policy). See the definition of “Open Window” and “Closed Window” below.
●Unless approved in advance by our CLO, make a gift, charitable contribution or other transfer without consideration, of our securities during a period when the Insider cannot trade.
●Share MNPI with any outside person, unless required by your job and such person is under NDA, or as authorized by our CLO.
●Give trading advice about the Company, unless the advice is to tell someone not to trade our securities because the trade would violate this Policy or the law.
●Other than the exercise of equity awards issued by us, engage in transactions involving options or other derivative securities on our stock, such as puts and calls, whether on an exchange or in any other market.
●Engage in hedging or monetization transactions involving our securities, such as zero cost collars and forward sale contracts, or contribute our securities to exchange funds in a manner that could be interpreted as hedging in our stock.
●Engage in short sales of our securities, meaning a sale of securities that you do not own, including
short sales “against the box.”
●Use or pledge our securities as collateral in a margin account or as collateral for a loan unless
the pledge has been approved by our CLO.
●Distribute our securities to limited partners, general partners or stockholders of any entity outside of an Open Window or during a Closed Window, unless those limited partners, general partners or stockholders have agreed in writing to hold the securities until the next Open Window.
●Engage in any of the above activities for securities you own in any other company if you have MNPI about that company obtained in the course of your service to the Company.
Additional Restrictions Applicable to Section 16 Insiders and Designated Insiders
All of the restrictions noted above for Insiders also apply to our Section 16 Insiders and Designated Insiders.
All members of the Company’s E-Group and all direct reports of the Company’s Chief Executive Officer may not trade in our securities other than pursuant to an approved 10b5-1 Plan or non-Rule 10b5-1 trading arrangement entered into in accordance with this Policy.
Prior to trading our securities, members of our Board and Designated Insiders must obtain pre-approval from our CLO by: (a) providing written notification via email of the amount and nature of the proposed trade, (b) certifying no earlier than two business days prior to the proposed trade that you have no MNPI and (c) receiving email confirmation from our CLO approving the trade, which approval can be granted or denied at their discretion. You may satisfy (a) and (b) by emailing the required information and certification to our CLO at tradingpreclearance@gitlab.com and must notify our CLO promptly via email of any changes to the certification in (b) prior to the proposed trade.
Exceptions to Prohibited Activities
The trading restrictions of this Policy do not apply to the following:
●401(k) Plan. Investing 401(k) plan contributions in a company stock fund in accordance with the terms of our 401(k) plan. However, any changes in your investment election regarding the Company’s securities are subject to trading restrictions under this Policy.
●ESPP. Purchasing our stock through periodic, automatic payroll contributions under our Employee Stock Purchase Plan. Team Members, other than the Company’s Chief Executive Officer and each direct report of the Company’s Chief Executive Officer, may make changes in elections under the ESPP outside of an Open Window or during a Closed Window. Neither the Company’s Chief Executive Officer nor any direct report of the Company’s Chief Executive Officer may make any decrease in such participant’s elections under, or withdraw from, the ESPP outside an Open Window or during a Closed Window. Moreover, any sales of stock acquired under the ESPP are subject to trading restrictions under this Policy.
●Options. Exercising stock options granted under our equity incentive plans for cash or by delivering to the Company previously owned Company stock or through a net exercise of a stock option that is permitted by the Company’s equity incentive plan and that does not involve a sale
of shares in the open market. Payment of taxes in connection with exercising stock options granted under our equity incentive plans pursuant to net settlement arrangements approved by the Company for the payment of taxes upon the exercise of stock options and that does not involve a sale of shares in the open market. However, the sale of any shares issued on the exercise of Company-granted stock options, as well as any cashless exercise of Company-granted stock options in which stock is sold on the open market to pay the exercise price or taxes (i.e., “same- day sales”) are subject to trading restrictions under this Policy.
●RSUs. The settlement of RSUs pursuant to a net settlement or a “sale to cover” for non- discretionary, automatic tax withholdings initiated and approved by the Company for the payment of taxes upon the vesting of RSUs.
Other Legal Restrictions
The trading prohibitions of this Policy are not the only stock-trading rules and regulations Team Members need to follow. Team Members should be aware of additional prohibitions and restrictions set by contract or by federal and state securities laws and regulations (e.g., contractual restrictions on the resale of securities, rules on short swing trading by Section 16 Insiders, compliance with Rule 144 under the Securities Act of 1933, as amended, and others). Each Insider must maintain, hold, and trade their Company equity (in a Company controlled account, unless an exception has been previously approved by the CLO for administrative complications or due to legal or regulatory requirements. Any Insider who is uncertain whether other prohibitions or restrictions apply should ask our CLO.
5.WHEN TRADING IS ALLOWED
To promote compliance with insider trading laws, we have designated periods where Insiders can trade in our securities, which are described below:
Open Windows and Closed Windows
●You Can Only Trade in an Open Window. Other than pursuant to an approved 10b5-1 Plan or a non-Rule 10b5-1 trading arrangement, Insiders are allowed to trade our securities only during an Open Window, which opens after the close of trading on the second full trading day following the widespread public release of our quarterly or year-end operating results, and closes at the close of trading on the first calendar day of the third month of the then-current quarter. For example, if we publicly announce our quarterly financial results after close of trading on a Monday (or before trading begins on a Tuesday), then the first time an Insider can trade our securities is after the close of market on Wednesday (effectively at the opening of the market on Thursday for regular trading). However, if we announce quarterly financial results after trading begins on that Tuesday, then the first time the Insider can trade is after the close of market on Thursday (effectively at the opening of the market on Friday for regular trading).
●Even During an Open Window, You Are Not Allowed to Trade While in Possession of MNPI. Even during an Open Window, a Team Member still may not trade our securities if they possess MNPI at that time. An Insider who possesses MNPI during an Open Window may only trade our securities after the close of trading on the third full trading day following our widespread public release of that MNPI.
●You Cannot Trade During a Closed Window. Even during an Open Window, our CLO, at their discretion, may designate special Closed Windows that apply to specific individuals or groups of
people (including all Insiders) for as long as our CLO determines. No Insider may trade our securities during any such Closed Window. Additionally, no Insider subject to a Closed Window may tell anyone not subject to the Closed Window that a Closed Window has been designated or that one previously was in place because that also is confidential information that cannot be disclosed internally or externally.
Permitted Trades Under 10b5-1 Plans
We allow Insiders to trade in our securities while in possession of MNPI, outside of an Open Window or during a Closed Window, pursuant to a “10b5-1 Plan.”
What Is a 10b5-1 Plan? A 10b5-1 Plan is a written plan for selling or purchasing a predetermined number of shares that is entered into while an Insider is not in possession of MNPI as contemplated in Rule 10b5- 1.
Who Can Enter Into a 10b5-1 Plan? We allow any Section 16 Insiders and Designated Insiders to enter into a 10b5-1 Plan. Because Designated Insiders are more likely than other Insiders to have access to MNPI, we strongly encourage all of our Designated Insiders to establish a 10b5-1 Plan for trading. In addition, we require our Section 16 Insiders and Chief Executive Officer’s direct reports to trade pursuant to a 10b5-1 Plan.
How Do I Adopt a 10b5-1 Plan? We have engagedMorgan Stanley to administer our 10b5-1 Plans and any 10b5-1 Plan that you adopt must be adopted through Morgan Stanley. If you are interested in setting up a 10b5-1 Plan, you should consult with our CLO or her designee for the purpose of this Policy and make sure that:
●The 10b5-1 Plan complies with the requirements of Rule 10b5-1 under the Exchange Act and this Policy.
●You have certified to our CLO in writing, no earlier than two business days prior to the date that the 10b5-1 Plan is formally adopted (and shall not have withdrawn such certification prior to such adoption), that as of such date and as of the adoption date of the 10b5-1 Plan, (i) you are not and, to your knowledge, will not be, aware of MNPI, (ii) all trades to be made pursuant to the 10b5-1 Plan will be in accordance with applicable SEC rules, (iii) you are adopting the 10b5-1 Plan in good faith and not as part of a plan or scheme to evade the prohibitions of Section 10(b) of the Exchange Act and Rule 10b-5 of the Exchange Act, and (iv) you will act in good faith with respect to the 10b5-1 Plan throughout its duration. This certification may be made in an email to our CLO. You must notify the CLO promptly via email and withdraw the certification if any changes of circumstances prior to the adoption date of the 10b5-1 Plan have or will render such certification to be inaccurate as of that time.
●The first trade under the 10b5-1 Plan does not occur for a Section 16 Insider: until the later of
(A) ninety-one (91) days after adoption of the 10b5-1 Plan and (B) three (3) business days following the disclosure of the Company’s financial results in a Form 10-Q or Form 10-K for the completed fiscal quarter in which the 10b5-1 Plan was adopted that discloses the Company’s financial results (but not to exceed 121 days following the adoption of the 10b5-1 Plan), following our CLO’s approval of the 10b5-1 Plan. These waiting periods are collectively referred to as the “Cooling-Off Period.”
●The 10b5-1 Plan is not a single-trade 10b5-1 Plan adopted during the 12-month period
immediately following the person’s adoption of another single-trade 10b5-1 Plan, subject to the exceptions noted in Rule 10b5-1, which are provided for you in the Appendix.
●The 10b5-1 Plan is adopted during an Open Window and not during any Closed Window.
An individual may have no more than one 10b5-1 Plan adopted at any point in time (i.e., multiple concurrent or overlapping plans are prohibited), subject to the exceptions noted in Rule 10b5-1, which are provided for you in the Appendix. One of these exceptions is for plans authorizing certain “sell-to-cover” transactions.
Approval of a 10b5-1 Plan by our CLO and/or acknowledgment of a 10b5-1 Plan by the Company shall not be considered a determination by us or our CLO that the 10b5-1 Plan satisfies the requirements of Rule 10b5-1.
How Do I Modify a 10b5-1 Plan? Once you have an approved 10b5-1 Plan in place, you will need approval from our CLO to make certain changes to it. Modifying or changing the amount, price or timing of the purchase or sale of our securities underlying the 10b5-1 Plan (or a modification or change to a written formula or algorithm, or computer program that affects the amount, price or timing of the purchase or sale of such securities) (any such modification or change, a “Plan Modification”) will be deemed to be the same as terminating your existing 10b5-1 Plan and entering into a new 10b5-1 Plan. As a result, the approval process for a Plan Modification is the same as the approval process for initially adopting a 10b5-1 Plan, including being subject to a new Cooling-Off Period. We discourage you from making multiple Plan Modifications, as that may give the appearance that you are trading on MNPI under the guise of that plan. Plan Modifications can only be made during an Open Window and not during any Closed Window and only when you are not in possession of MNPI. For other modifications to a 10b5-1 Plan, you must notify our CLO of such modification in writing at least two business days prior to the modification and such modification must be approved by the CLO.
How Do I Terminate a 10b5-1 Plan? Once you have an approved 10b5-1 Plan in place, you will need approval from our CLO to terminate it.
Other Trading Arrangement
Insiders are not allowed to enter into “non-Rule 10b5-1 trading arrangements” (as defined in Regulation S-K Item 408(c)) unless otherwise approved in advance by the CLO.
6.THERE ARE SIGNIFICANT CONSEQUENCES FOR VIOLATING INSIDER TRADING LAWS
The consequences of violating the insider trading laws can be severe. People who violate insider trading laws may be required to disgorge profits made or losses avoided by trading, pay the loss suffered by the persons who purchased securities from or sold securities to the insider tippee, pay civil fines of up to three times the profit made or loss avoided, pay a criminal penalty of up to $5 million for individuals and
$25 million for entities and serve a prison term of up to 20 years. In addition, individual directors, officers and other supervisory personnel may also be required to pay major civil or criminal penalties for failure to take appropriate steps to prevent insider trading by those under their supervision, influence or control.
7.CONSEQUENCES OF VIOLATING THIS POLICY
We may impose discipline on anyone violating this Policy, up to and including termination of
employment, and we may issue stop transfer orders to our transfer agent to prevent any attempted trades that would violate this Policy.
8.ADMINISTRATION
The CLO will administer and interpret this Policy and enforce compliance as needed. The CLO may consult with the Company’s outside legal counsel as needed. The CLO may designate other individuals to perform the CLO’s duties under this Policy.
Neither the Company nor the CLO will be liable for any act made under this Policy. Neither the Company nor the CLO is responsible for any failure to approve a trade or for imposing any Closed Window.
9.REPORTING VIOLATIONS
Any Insider who violates this Policy or any federal or state laws governing insider trading or tipping, or who knows of any such violation by any other Insider, must report the violation immediately to our CLO. If you want to submit a concern or complaint regarding a possible violation of this Policy anonymously, you should follow the procedures outlined in our Whistleblower Policy. Anyone who violates this Policy may be subject to disciplinary measures, which may include termination of employment.
10.CHANGES TO THIS POLICY
Our Board reserves the right in its sole discretion to modify or grant waivers to this Policy. Any amendments or waiver may be publicly disclosed if required by applicable laws, rules and regulations. For the avoidance of doubt, unless explicitly stated by the Board, any waiver, amendment or modification of the Policy by the Board shall not be considered a waiver of the Company’s Code of Business Conduct and Ethics.
11.EFFECTIVE DATE
The effective date of this Policy is [ ], 2025. The amendments to this Policy will not apply to any existing 10b5-1 Plan that was entered into prior to February 27, 2023.
EXHIBIT A
Appendix
Exceptions to the Multiple, Overlapping 10b5-1 Plan Restriction Such exceptions are:
●An eligible “sell-to-cover” 10b5-1 Plan where such plan authorizes an agent to sell only such securities as are necessary to satisfy tax withholding obligations arising exclusively from the vesting of a compensatory award, such as restricted stock or stock appreciation rights, and the Insider does not otherwise exercise control over the timing of such sales. For the avoidance of doubt, this exception does not extend to sales incident to the exercise of option awards.
●One later-commencing 10b5-1 Plan for purchases or sales of any securities of the Company on the open market under which trading is not authorized to begin until after all trades under the earlier-commencing 10b5-1 Plan are completed or expired without execution. However, the first trade under such later-commencing 10b5-1 Plan must be scheduled after the “Effective Cooling- Off Period,” or the Cooling-Off Period that would be applicable to the later-commencing 10b5-1 Plan if the date of adoption of the later-commencing 10b5-1 Plan was deemed to be the date of termination of the earlier-commencing 10b5-1 Plan.
Exceptions to the Single-Trade 10b5-1 Plan Restriction
There is an exception for eligible “sell-to-cover” 10b5-1 Plans where the plan authorizes an agent to sell only such securities as are necessary to satisfy tax withholding obligations arising exclusively from the vesting of a compensatory award, such as restricted stock or stock appreciation rights, and the Insider does not otherwise exercise control over the timing of such sales.
Exhibit 21.1
List of Subsidiaries of GitLab Inc.
(including place of incorporation)
GitLab Federal, LLC – (United States)
GitLab GK – (Japan)
GitLab Korea Limited – (South Korea)
GitLab B.V. – (Netherlands)
GitLab IT B.V. – (Netherlands)
GitLab UK Limited – (United Kingdom)
GitLab GmbH – (Germany)
GITLAB PTY LTD – (Australia)
GITLAB CANADA CORP. – (Canada)
GitLab France SAS – (France)
GitLab Iberia, S.L. - (Spain)
GitLab India Private Limited - (India)
GITLAB IRELAND LIMITED – (Ireland)
GitLab Israel Ltd. - (Israel)
GitLab Services Inc. – (United States)
GITLAB SINGAPORE HOLDING PTE. LTD. – (Singapore)
GITLAB SINGAPORE PTE. LTD. – (Singapore)
GitLab Information Technology (Hubei) Co., Ltd. – (China)
JiHu Innovation (Beijing) Information Technology Co., Ltd - (China)
JiHu GitLab Technology Limited - (Hong Kong)
JiHu Information Technology (Chongqing) Co., Ltd - (China)
JiHu Information and Technology Hefei Co., Ltd. - (China)
JiHu Effective (Shanghai) Information Technology Co., Ltd. - (China)
JiHu Innovation (Shenzhen) Information Technology Co., Ltd. - (China)
Opstrace, LLC - (USA)
Oxeye Security Inc. - (USA)
Arch Data, Inc. - (USA)
JiHu Yuansheng (Beijing) Internet Technology Co. Ltd. - (China)
Exhibit 23.1
Consent of Independent Registered Public Accounting Firm
We consent to the incorporation by reference in the registration statements (File Nos. 333-260245, 333-261537, 333-264224, 333-271047, and 333-278405) on Form S-8 and (No. 333-271040) on Form S-3 of our reports dated March 21, 2025, with respect to the consolidated financial statements of GitLab Inc. and subsidiaries and the effectiveness of internal control over financial reporting.
/s/ KPMG LLP
Pittsburgh, Pennsylvania
March 21, 2025
Exhibit 31.1
CERTIFICATION OF PRINCIPAL EXECUTIVE OFFICER PURSUANT TO
RULE 13a-14(a) OR 15d-14(a) OF THE SECURITIES EXCHANGE ACT OF 1934,
AS ADOPTED PURSUANT TO SECTION 302 OF THE SARBANES-OXLEY ACT OF 2002
I, William Staples, certify that:
1.I have reviewed this Annual Report on Form 10-K of GitLab Inc.;
2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;
3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report;
4.The registrant’s other certifying officer and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have:
a.designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;
b.designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;
c.evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and
d.disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.
5.The registrant’s other certifying officer and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of directors (or persons performing the equivalent functions):
a.all significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting, which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information; and
b.any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting.
Date: March 21, 2025
| By: | /s/ William Staples | |||||||
| William Staples | ||||||||
| Chief Executive Officer | ||||||||
| (Principal Executive Officer) | ||||||||
Exhibit 31.2
CERTIFICATION OF PRINCIPAL FINANCIAL OFFICER PURSUANT TO
RULE 13a-14(a) OR 15d-14(a) OF THE SECURITIES EXCHANGE ACT OF 1934,
AS ADOPTED PURSUANT TO SECTION 302 OF THE SARBANES-OXLEY ACT OF 2002
I, Brian Robins, certify that:
1.I have reviewed this Annual Report on Form 10-K of GitLab Inc.;
2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;
3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report;
4.The registrant’s other certifying officer and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have:
1.designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;
2.designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;
3.evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and
4.disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.
5.The registrant’s other certifying officer and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of directors (or persons performing the equivalent functions):
a.all significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting, which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information; and
b.any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting.
Date: March 21, 2025
| By: | /s/ Brian Robins | |||||||
| Brian Robins | ||||||||
| Chief Financial Officer | ||||||||
| (Principal Financial Officer) | ||||||||
Exhibit 32.1
CERTIFICATION OF PRINCIPAL EXECUTIVE OFFICER PURSUANT TO
18 U.S.C. SECTION 1350, AS ADOPTED PURSUANT TO
SECTION 906 OF THE SARBANES-OXLEY ACT OF 2002
I, William Staples, Chief Executive Officer of GitLab Inc. (the “Company”), do hereby certify, pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, that to the best of my knowledge:
1.the Annual Report on Form 10-K of the Company for the year ended January 31, 2025 (the “Report”) fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended; and
2.the information contained in the Report fairly presents, in all material respects, the financial condition, and results of operations of the Company.
Date: March 21, 2025
| By: | /s/ William Staples | |||||||
| William Staples | ||||||||
| Chief Executive Officer | ||||||||
| (Principal Executive Officer) | ||||||||
Exhibit 32.2
CERTIFICATION OF PRINCIPAL FINANCIAL OFFICER PURSUANT TO
18 U.S.C. SECTION 1350, AS ADOPTED PURSUANT TO
SECTION 906 OF THE SARBANES-OXLEY ACT OF 2002
I, Brian Robins, Chief Financial Officer of GitLab Inc. (the “Company”), do hereby certify, pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, that to the best of my knowledge:
1.the Annual Report on Form 10-K of the Company for the year ended January 31, 2025 (the “Report”) fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended; and
2.the information contained in the Report fairly presents, in all material respects, the financial condition, and results of operations of the Company.
Date: March 21, 2025
| By: | /s/ Brian Robins | |||||||
| Brian Robins | ||||||||
| Chief Financial Officer | ||||||||
| (Principal Financial Officer) | ||||||||