UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)

[X] QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended ~~October~~April 3130, ~~2025~~2026

[ ] TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number: 001-40895

GITLAB INC.

(Exact name of registrant as specified in its charter)

Delaware

47-1861035

(State or other jurisdiction of incorporation or organization)

(I.R.S. Employer Identification Number)

Address Not Applicable1

Zip Code Not Applicable1

(Address of Principal Executive Offices)

Zip Code

Not Applicable

(Registrant’s telephone number, including area code)

Not Applicable

(Former name, former address and former fiscal year, if changed since last report)

Securities registered pursuant to Section 12(b) of the Act:


Title of Each Class	Trading Symbol(s)	Name of each exchange on which registered
Class A common stock, par value $0.0000025 per share	GTLB	The Nasdaq Stock Market LLC

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. x Yes ☐ No

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). x Yes o No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer

Accelerated filer

Non-accelerated filer

Smaller reporting company

Emerging growth company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). ☐ Yes x No

As of ~~November~~May 1819, ~~2025~~2026, the number of shares of the registrant’s Class A common stock outstanding was ~~149~~167.8 million and the number of shares of the registrant’s Class B common stock outstanding was 181.61 million.

_____________________________

1 We are a remote-only company. Accordingly, we do not maintain a headquarters. For purposes of compliance with applicable requirements of the Securities Act of 1933, as amended, or the Securities Act and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act, any stockholder communication required to be sent to our principal executive offices may be directed to the agent for service of process at Corporation Service Company, 251 Little Falls Drive, Wilmington, Delaware 19808, or to the email address: [email protected].

Table of Contents

TABLE OF CONTENTS

		Page
	Special Note Regarding Forward-Looking Statements
PART I.	Financial Information	5
Item 1.	Financial Statements (Unaudited)	5
	Condensed Consolidated Balance Sheets	5
	Condensed Consolidated Statements of Operations	6
	Condensed Consolidated Statements of Comprehensive Income (Loss)	7
	Condensed Consolidated Statements of Comprehensive Loss	7
	Condensed Consolidated Statements of Stockholders’ Equity	8
	Condensed Consolidated Statements of Cash Flows	109
	Notes to Condensed Consolidated Financial Statements	1110
Item 2.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	2927
Item 3.	Quantitative and Qualitative Disclosures about Market Risk	4641
Item 4.	Controls and Procedures	4742
PART II.	Other Information	4843
Item 1.	Legal Proceedings	4843
Item 1A.	Risk Factors	4944
Item 2.	Unregistered Sales of Equity Securities and Use of Proceeds	9086
Item 3.	Defaults Upon Senior Securities	9086
Item 4.	Mine Safety Disclosures	9086
Item 5.	Other Information	9187
Item 6.	Exhibits	9388
	Signatures	9489

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Quarterly Report on Form 10-Q, or this Quarterly Report, contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. All statements contained in this Quarterly Report other than statements of historical fact, including statements regarding our future operating results and financial condition, our business strategy and plans, market growth, and our objectives for future operations, are forward-looking statements. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “target,” “plan,” “expect,” and similar expressions are intended to identify forward-looking statements.

Forward-looking statements contained in this Quarterly Report include, but are not limited to, statements about:

•our future financial performance, including our expectations regarding our total revenue, cost of revenue, gross profit or gross margin, operating expenses, including changes in operating expenses and our ability to achieve and maintain future profitability;

•our business plan and our ability to effectively manage our growth;

•our total market opportunity;

•anticipated trends, growth rates, and challenges in our business and in the markets in which we operate;

•market acceptance of ~~The~~our ~~DevSecOps~~intelligent orchestration platform for DevSecOps and our ability to increase adoption of ~~The~~such ~~DevSecOps~~ platform;

•beliefs and objectives for future operations;

•our ability to further penetrate our existing customer base and attract, retain, and expand our customer base;

•our ability to timely and effectively scale and adapt ~~The~~our ~~DevSecOps~~intelligent orchestration platform for DevSecOps;

•our ability to develop new features and bring them to market in a timely manner;

•our incorporation of artificial intelligence features into our products;

•our expectations to grow our partner network;

•our ability to maintain, protect, and enhance our intellectual property;

•our ability to continue to expand internationally;

•the effects of increased competition in our markets and our ability to compete effectively;

•future acquisitions or investments in complementary companies, products, services, or technologies;

•our ability to stay in compliance with laws and regulations that currently apply or become applicable to our business both in the United States and internationally;

•the impact of any data breaches, cyberattacks or other malicious activity on our technology systems;

•economic and industry trends, projected growth, or trend analysis;

Table of Contents

•the impact of macroeconomic conditions, including inflation, tariffs, volatile interest rates, regulatory uncertainty, including with respect to the federal budget, debt ceiling and potential government shutdowns, and volatility in the capital markets, and regional and other global events, including ongoing armed conflicts in different regions of the world, on our operations, financial results, and liquidity and capital resources, including on customers, sales, expenses, and team members; and

•other statements regarding our future operations, financial condition, and prospects and business strategies.

These forward-looking statements are subject to a number of risks, uncertainties, and assumptions, including those described in the section titled “Risk Factors” and elsewhere in this Quarterly Report. Moreover, we operate in a very competitive and rapidly changing environment, and new risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties, and assumptions, the forward-looking events and circumstances discussed in this Quarterly Report may not occur, and actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements.

You should not rely upon forward-looking statements as predictions of future events. The events and circumstances reflected in the forward-looking statements may not be achieved or occur. We undertake no obligation to update any of these forward-looking statements for any reason after the date of this Quarterly Report or to conform these statements to actual results or to changes in our expectations, except as required by law.

You should read this Quarterly Report and the documents that we reference in this Quarterly Report and have filed with the Securities and Exchange Commission, or the SEC, as exhibits to this Quarterly Report with the understanding that our actual future results, performance, and events and circumstances may be materially different from what we expect.

Summary Risk Factors

Our business is subject to numerous risks and uncertainties, including those risks more fully described below in the section titled “Risk Factors.” These risks include, among others, the following, which we consider our most material risks:

•Our business and operations have experienced rapid growth, and if we do not appropriately and effectively manage future growth, if any, or are unable to improve our systems, processes and controls, our business, financial condition, results of operations, and prospects will be adversely affected.

•Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

•We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected.

•Security and privacy breaches may hurt our business.

•We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source and community contributed code in our products.

Table of Contents

•We face intense competition and could lose market share to our competitors, which would adversely affect our business, operating results, and financial condition.

•We may not be able to respond to rapid technological changes with new solutions, which could have a material adverse effect on our operating results.

•If our services fail to perform properly, whether due to material defects with the software or external issues, our reputation could be adversely affected, our market share could decline, and we could be subject to liability claims.

•The market for our services is ~~relatively new and~~ rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

•We are dependent on sales and marketing strategies to drive our growth in our revenue. These sales and marketing strategies may not be successful in continuing to generate sufficient sales opportunities. Any decline in our customer renewals and expansions could harm our future operating results.

•Our operating results may fluctuate significantly, which could make our future results difficult to predict and could adversely affect the trading price of our Class A common stock.

•As our product offerings mature and expand, our pricing and packaging for new and existing products may result in customers purchasing products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

•The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations.

•Transparency is one of our core values. While we will continue to prioritize transparency, we must also promote "responsible" transparency as transparency can have unintended negative consequences.

•The publicly available GitLab Handbook, or Handbook, may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

•Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer.

•Failure to effectively expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our services.

•We rely on our management team and other key team members and will need additional personnel to grow our business, and the loss of one or more key team members or our inability to hire, integrate, train and retain qualified personnel, could harm our business.

•Our corporate culture has contributed to our success, and if we cannot maintain this culture ~~as we grow~~, we could lose the innovation, creativity, and teamwork fostered by our culture, and our business may be harmed.

•We engage our team members in various ways, including direct hires, through PEOs and as independent contractors. As a result of these methods of engagement, we face certain challenges and risks that can affect our business, operating results, and financial condition.

Table of Contents

PART I - FINANCIAL INFORMATION

ITEM 1. FINANCIAL STATEMENTS (UNAUDITED)

GitLab Inc.

Condensed Consolidated Balance Sheets

(in thousands, except per share data)

(unaudited)

October 31, 2025(1)

January 31, 2025(1)

April 30, 2026(1)

January 31, 2026(1)

ASSETS

CURRENT ASSETS:

Cash and cash equivalents

~~224~~335,~~231~~395

~~227~~229,~~649~~576

Short-term investments

~~980~~1,~~077~~022,117

~~764~~1,~~728~~030,327

Accounts receivable, net of allowance for doubtful accounts of $1,080 and $991 as of October 31, 2025 and January 31, 2025, respectively

221,140

264,565

Accounts receivable, net of allowance for doubtful accounts of $1,019 and $967 as of April 30, 2026 and January 31, 2026, respectively

200,302

304,301

Deferred contract acquisition costs, current

3639,~~522~~108

3842,~~964~~676

Prepaid expenses and other current assets

4442,~~979~~483

4048,~~411~~899

Total current assets

1,~~506~~639,~~949~~405

1,~~336~~655,~~317~~779

Property and equipment, net

1012,~~193~~777

411,~~013~~815

Goodwill

1617,~~919~~798

1617,~~139~~379

Intangible assets, net

117,~~789~~759

179,~~834~~774

Deferred contract acquisition costs, non-current

2023,~~288~~810

2023,~~142~~705

Other non-current assets

43,~~701~~984

4,~~818~~295

TOTAL ASSETS

1,~~570~~705,~~839~~533

1,~~399~~722,~~263~~747

LIABILITIES AND STOCKHOLDERS’ EQUITY

CURRENT LIABILITIES:

Accounts payable

98,~~187~~847

79,~~519~~205

Accrued expenses and other current liabilities

5872,~~406~~680

5458,~~680~~185

Accrued compensation and benefits

3328,~~402~~538

4039,~~233~~657

Deferred revenue, current

~~464~~532,~~813~~983

~~442~~545,~~599~~096

Total current liabilities

~~565~~643,~~808~~048

~~545~~652,~~031~~143

Deferred revenue, non-current

2823,~~977~~991

26,~~369~~994

Other non-current liabilities

87,~~057~~108

67,~~557~~362

TOTAL LIABILITIES

~~602~~674,~~842~~147

~~577~~686,~~957~~499

Commitments and contingencies (Note 13)

STOCKHOLDERS’ EQUITY:

Preferred stock, $0.0000025 par value; 50,000 shares authorized; no shares issued and outstanding as of October 31, 2025 and January 31, 2025

—

Preferred stock, $0.0000025 par value; 50,000 shares authorized; no shares issued and outstanding as of April 30, 2026 and January 31, 2026

—

Class A Common stock, $0.0000025 par value; 1,500,000 shares authorized; 149,723 and 144,444 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively

—

Class A Common stock, $0.0000025 par value; 1,500,000 shares authorized; 152,614 and 153,336 shares issued and outstanding as of April 30, 2026 and January 31, 2026, respectively

—

Class B Common stock, $0.0000025 par value; 250,000 shares authorized; 18,581 and 19,469 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively

—

Class B Common stock, $0.0000025 par value; 250,000 shares authorized; 16,250 and 16,732 shares issued and outstanding as of April 30, 2026 and January 31, 2026, respectively

—

Additional paid-in capital

2,~~141~~209,~~732~~247

12,~~952~~207,~~031~~361

Accumulated deficit

(1,~~220~~228,~~973~~542)

(1,~~167~~223,~~614~~570)

Accumulated other comprehensive income (loss)

1,956

(8,508)

Accumulated other comprehensive income

4,499

6,877

Total GitLab stockholders’ equity

~~922~~985,~~715~~204

~~775~~990,~~909~~668

Noncontrolling interests

4546,~~282~~182

45,~~397~~580

TOTAL STOCKHOLDERS’ EQUITY

~~967~~1,~~997~~031,386

~~821~~1,~~306~~036,248

TOTAL LIABILITIES AND STOCKHOLDERS’ EQUITY

1,~~570~~705,~~839~~533

1,~~399~~722,~~263~~747

___________

(1) As of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, the condensed consolidated balance ~~sheet~~sheets ~~includes~~include assets of the condensed consolidated variable interest entity, GitLab Information Technology (Hubei) Co., LTD (“JiHu”), of $4140.6 million and $4641.50 million, respectively, and liabilities of $76.26 million and $107.31 million respectively. The assets of JiHu can be used only to settle obligations of JiHu and creditors of JiHu do not have recourse against the general credit of the Company. Refer to “Note 10. Joint Venture” for further discussion.

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Condensed Consolidated Statements of Operations

(in thousands, except per share data)

(unaudited)

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Revenue:
Subscription—self-managed and SaaS	$	~~223~~239,~~262~~306	$	~~175~~194,~~257~~481	$	~~630,427~~	$	~~489,617~~
License—self-managed and other	2124,~~091~~852		20,~~790~~028		~~64,395~~		~~58,201~~
Total revenue	~~244~~264,~~353~~158		~~196~~214,~~047~~509		~~694,822~~		~~547,818~~
Cost of revenue:
Subscription—self-managed and SaaS	2530,~~184~~591		1719,~~170~~268		~~66,205~~		~~47,639~~
License—self-managed and other	76,~~037~~897		45,~~955~~767		~~19,556~~		~~14,632~~
Total cost of revenue	3237,~~221~~488		2225,~~125~~035		~~85,761~~		~~62,271~~
Gross profit	~~212~~226,~~132~~670		~~173~~189,~~922~~474		~~609,061~~		~~485,547~~
Operating expenses:
Sales and marketing	~~104~~119,~~974~~358		95107,~~340~~587		~~322,144~~		~~285,542~~
Research and development	6871,~~715~~482		6165,~~354~~410		~~205,613~~		~~176,767~~
General and administrative	5051,~~799~~579		4551,~~960~~087		~~146,621~~		~~146,615~~
Total operating expenses	~~224~~242,~~488~~419		~~202~~224,~~654~~084		~~674,378~~		~~608,924~~
Loss from operations	(1215,~~356~~749)		(2834,~~732~~610)		~~(65,317)~~		~~(123,377)~~
Interest income	11,~~704~~947		1210,~~586~~862		~~34,077~~		~~37,443~~
Other income (expense), net	~~(6,334)~~255		4(9,~~799~~971)		~~(17,216)~~		~~5,170~~
Loss before income taxes	(63,~~986~~547)		(1133,~~347~~719)		~~(48,456)~~		~~(80,764)~~
Provision for (benefit from) income taxes	1,811		(39,152)		6,595		(65,330)
Provision for income taxes	2,032		2,539
Net income (loss)	$	(8,797)	$	27,805	$	(55,051)	$	(15,434)
Net loss	$	(5,579)	$	(36,258)
Net loss attributable to noncontrolling interest	(~~521~~607)		(~~1,298~~383)		~~(1,692)~~		~~(2,216)~~
Net income (loss) attributable to GitLab	$	(8,276)	$	29,103	$	(53,359)	$	(13,218)
Net loss attributable to GitLab	$	(4,972)	$	(35,875)
Net income (loss) per share attributable to GitLab Class A and Class B common stockholders:
Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted:	$	(0.03)	$	(0.22)
Basic	$	(0.05)	$	0.18	$	(0.32)	$	(0.08)
Weighted-average shares used to compute net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted:	169,948		164,491
Diluted	$	(0.05)	$	0.17	$	(0.32)	$	(0.08)
Weighted-average shares used to compute net income (loss) per share attributable to GitLab Class A and Class B common stockholders:
Basic	167,407		161,317		165,965		159,756
Diluted	167,407		167,436		165,965		159,756

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Condensed Consolidated Statements of Comprehensive ~~Income (~~Loss)

(in thousands)

(unaudited)

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Net Income (loss)	$	(8,797)	$	27,805	$	(55,051)	$	(15,434)
Net loss	$	(5,579)	$	(36,258)
Foreign currency translation adjustments	~~1,751~~(18)		(56,~~792)~~197		~~10,070~~		~~(8,348)~~
Net change in unrealized gains on available-for-sale securities	1,786		682		614		581
Net change in unrealized gains (losses) on available-for-sale securities	(2,047)		410
Comprehensive income (loss) including noncontrolling interest	$	(5,260)	$	22,695	$	(44,367)	$	(23,201)
Comprehensive loss including noncontrolling interest	$	(7,644)	$	(29,651)
Net loss attributable to noncontrolling interest	(~~521~~607)		(~~1,298~~383)		~~(1,692)~~		~~(2,216)~~
Foreign currency translation adjustments attributable to noncontrolling interest	70313		~~611~~(442)		~~220~~		~~(271)~~
Comprehensive loss attributable to noncontrolling interest	(~~451~~294)		(~~687~~825)		~~(1,472)~~		~~(2,487)~~
Comprehensive income (loss) attributable to GitLab	$	(4,809)	$	23,382	$	(42,895)	$	(20,714)
Comprehensive loss attributable to GitLab	$	(7,350)	$	(28,826)

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Condensed Consolidated Statements of Stockholders’ Equity

(in thousands)

(unaudited)

		Three Months Ended October 31, 2025
		Three Months Ended April 30, 2026
	Class A Common Stock	Class B Common Stock			Additional Paid-in Capital		Accumulated Deficit		Accumulated Other Comprehensive Income (Loss)			Noncontrolling Interests		Total Stockholders’ Equity
		Shares	Amount			Shares					Amount
Balances at July 31, 2025		147,834	$	—	18,876		$	—	$	2,080,759		$	(1,212,697)	$	(1,511)	$	45,031	$	911,582
Balances at January 31, 2026		153,336	$	—	16,732		$	—	$	2,207,361		$	(1,223,570)	$	6,877	$	45,580	$	1,036,248
Conversion of Class B common stock to Class A common stock		~~880~~660	—		(~~888~~660)		—		—			—		—		—		—
Issuance of common stock related to vested exercised stock options		—	—		~~593~~178		—		82,~~182~~373			—		—		—		82,~~182~~373
Issuance of common stock related to RSUs and PSUs vested		~~979~~963	—		—		—		—			—		—		—		—
Common stock withheld related to net share settlement of equity awards		(117)	—		—		—		(~~529~~160)			—		—		—		(~~529~~160)
Charitable donation of common stock		41	—		—		—		1,970			—		—		—		1,970
Common stock repurchased		(2,379)	—		—		—		(50,313)			—		—		—		(50,313)
Vesting of early exercised stock options		—	—		—		—		3			—		—		—		3
Charitable donation of common stock		41	—		—		—		821			—		—		—		821
Stock-based compensation expense		—	—		—		—		5149,~~353~~165			—		—		~~696~~896		5250,~~049~~061
Change in noncontrolling interest ownership		—	—		—		—		(6)			—		—		6		—
Other comprehensive income (loss)		—	—		—		—		—			—		(2,378)		313		(2,065)
Other comprehensive income (loss)		—	—		—		—		—			—		3,467		70		3,537
Net loss		—	—		—		—		—			(4,972)		—		(607)		(5,579)
Net loss		—	—		—		—		—			(8,276)		—		(521)		(8,797)
Balances at April 30, 2026		152,614	$	—	16,250		$	—	$	2,209,247		$	(1,228,542)	$	4,499	$	46,182	$	1,031,386
Balances at October 31, 2025		149,723	$	—	18,581		$	—	$	2,141,732		$	(1,220,973)	$	1,956	$	45,282	$	967,997

		Three Months Ended October 31, 2024
		Three Months Ended April 30, 2025
	Class A Common Stock	Class B Common Stock			Additional Paid-in Capital		Accumulated Deficit		Accumulated Other Comprehensive Income (~~Loss~~loss)			Noncontrolling Interests		Total Stockholders’ Equity
		Shares	Amount			Shares					Amount
Balances at July 31, 2024		136,462	$	—	23,963		$	—	$	1,833,786		$	(1,203,609)	$	623	$	45,026	$	675,826
Balances at January 31, 2025		144,444	$	—	19,469		$	—	$	1,952,031		$	(1,167,614)	$	(8,508)	$	45,397	$	821,306
Conversion of Class B common stock to Class A common stock		~~3,255~~622	—		(~~3,255~~622)		—		—			—		—		—		—
Issuance of common stock related to vested exercised stock options		—	—		~~847~~357		—		73,~~830~~338			—		—		—		73,~~830~~338
Issuance of common stock related to RSUs vested		758	—		—		—		—			—		—		—		—
Repurchases, net of early exercised stock options		—	—		(1)		—		—			—		—		—		—
Charitable donation of common stock		53	—		—		—		2,957			—		—		—		2,957
Issuance of common stock related to RSUs and PSUs vested		787	—		—		—		—			—		—		—		—
Vesting of early exercised stock options		—	—		—		—		78			—		—		—		78
Charitable donation of common stock		41	—		—		—		1,739			—		—		—		1,739
Stock-based compensation expense		—	—		—		—		47,002			—		—		1,040		48,042
Vesting of early exercised stock options		—	—		—		—		38			—		—		—		38
Other comprehensive loss		—	—		—		—		—			—		(5,721)		611		(5,110)
Stock-based compensation expense		—	—		—		—		55,984			—		—		(157)		55,827
Net income (loss)		—	—		—		—		—			29,103		—		(1,298)		27,805
Change in noncontrolling interest ownership		—	—		—		—		98			—		—		(98)		—
Balances at October 31, 2024		140,528	$	—	21,555		$	—	$	1,891,653		$	(1,174,506)	$	(5,098)	$	45,379	$	757,428
Other comprehensive income (loss)		—	—		—		—		—			—		7,049		(442)		6,607
Net loss		—	—		—		—		—			(35,875)		—		(383)		(36,258)
Balances at April 30, 2025		145,894	$	—	19,203		$	—	$	2,013,228		$	(1,203,489)	$	(1,459)	$	44,317	$	852,597

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Condensed Consolidated Statements of ~~Stockholders’~~Cash ~~Equity~~Flows

(in thousands)

(unaudited)

						Nine Months Ended October 31, 2025
	Three Months Ended April 30,
					Class A Common Stock	Class B Common Stock			Additional Paid-in Capital		Accumulated Deficit		Accumulated Other Comprehensive Income (Loss)			Noncontrolling Interests		Total Stockholders’ Equity
	2026		2025
						Shares	Amount			Shares					Amount
CASH FLOWS FROM OPERATING ACTIVITIES:
Balances at January 31, 2025						144,444	$	—	19,469		$	—	$	1,952,031		$	(1,167,614)	$	(8,508)	$	45,397	$	821,306
Net loss, including amounts attributable to noncontrolling interest	$	(5,579)	$	(36,258)
Conversion of Class B common stock to Class A common stock						2,114	—		(2,122)		—		—			—		—		—		—
Adjustments to reconcile net loss to net cash provided by operating activities:
Issuance of common stock related to vested exercised stock options						—	—		1,235		—		15,471			—		—		—		15,471
Stock-based compensation expense, net of amounts capitalized	50,061		55,827
Issuance of common stock under employee stock purchase plan						256	—		—		—		8,404			—		—		—		8,404
Charitable donation of common stock	821		1,739
Repurchases, net of early exercised stock options						—	—		(1)		—		—			—		—		—		—
Amortization of intangible assets	2,015		2,020
Issuance of common stock related to RSUs and PSUs vested						2,797	—		—		—		—			—		—		—		—
Depreciation and amortization	1,295		556
Common stock withheld related to net share settlement of equity awards						(11)	—		—		—		(529)			—		—		—		(529)
Amortization of deferred contract acquisition costs	12,924		13,899
Charitable donation of common stock						123	—		—		—		5,496			—		—		—		5,496
Net amortization of premiums or discounts on short-term investments	(324)		(2,996)
Vesting of early exercised stock options						—	—		—		—		56			—		—		—		56
Unrealized foreign exchange loss (gain), net	(1,011)		9,901
Stock-based compensation expense						—	—		—		—		160,711			—		—		1,449		162,160
Other non-cash expense, net	189		208
Change in noncontrolling interest ownership						—	—		—		—		92			—		—		(92)		—
Changes in assets and liabilities:
Other comprehensive income						—	—		—		—		—			—		10,464		220		10,684
Accounts receivable	103,356		65,928
Net loss						—	—		—		—		—			(53,359)		—		(1,692)		(55,051)
Prepaid expenses and other current assets	6,387		1,527
Balances at October 31, 2025						149,723	$	—	18,581		$	—	$	2,141,732		$	(1,220,973)	$	1,956	$	45,282	$	967,997
Deferred contract acquisition costs	(9,745)		(8,126)
Other non-current assets	228		379
Accounts payable	(353)		3,586
Accrued expenses and other current liabilities	14,451		9,979
Accrued compensation and benefits	(10,970)		(13,084)
Deferred revenue	(14,288)		1,205
Other non-current liabilities	(260)		12
Net cash provided by operating activities	149,197		106,302
CASH FLOWS FROM INVESTING ACTIVITIES:
Purchases of short-term investments	(222,196)		(245,952)
Proceeds from maturities of short-term investments	218,824		163,606
Proceeds from sales of short-term investments	9,922		1,367
Additions to property and equipment	(2,393)		(912)
Net cash provided by (used in) investing activities	4,157		(81,891)
CASH FLOWS FROM FINANCING ACTIVITIES:
Proceeds from the issuance of common stock upon exercise of stock options, including early exercises, net of repurchases	2,373		3,328
Common stock repurchased	(50,048)		—
Payments for taxes related to net share settlement of equity awards	(160)		—
Net cash provided by (used in) financing activities	(47,835)		3,328
Impact of foreign exchange on cash and cash equivalents	300		331
Net increase in cash and cash equivalents	105,819		28,070
Cash and cash equivalents at beginning of period	229,576		227,649
Cash and cash equivalents at end of period	$	335,395	$	255,719
Supplemental disclosure of cash flow information:
Cash refunds for income taxes related to the bilateral advance pricing agreement	$	(77)	$	(1,293)
Other cash paid for income taxes	$	139	$	(2)
Supplemental disclosure of non-cash investing and financing activities:
Unpaid property and equipment in accounts payable and accrued expenses	$	—	$	135
Excise tax on share repurchases included in accrued expenses	$	265	—

		Nine Months Ended October 31, 2024
	Class A Common Stock	Class B Common Stock			Additional Paid-in Capital		Accumulated Deficit		Accumulated Other Comprehensive Income (Loss)			Noncontrolling Interests		Total Stockholders’ Equity
		Shares	Amount			Shares					Amount
Balances at January 31, 2024		114,670	$	—	42,887		$	—	$	1,718,661		$	(1,161,288)	$	2,398	$	46,621	$	606,392
Conversion of Class B common stock to Class A common stock		23,110	—		(23,110)		—		—			—		—		—		—
Issuance of common stock related to vested exercised stock options		—	—		1,778		—		17,904			—		—		—		17,904
Issuance of common stock under employee stock purchase plan		252	—		—		—		7,932			—		—		—		7,932
Issuance of common stock related to RSUs vested		2,323	—		—		—		—			—		—		—		—
Charitable donation of common stock		173	—		—		—		8,871			—		—		—		8,871
Vesting of early exercised stock options		—	—		—		—		267			—		—		—		267
Stock-based compensation expense		—	—		—		—		138,427			—		—		836		139,263
Change in noncontrolling interest ownership		—	—		—		—		(409)			—		—		409		—
Other comprehensive loss		—	—		—		—		—			—		(7,496)		(271)		(7,767)
Net loss		—	—		—		—		—			(13,218)		—		(2,216)		(15,434)
Balances at October 31, 2024		140,528	$	—	21,555		$	—	$	1,891,653		$	(1,174,506)	$	(5,098)	$	45,379	$	757,428

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Condensed Consolidated Statements of Cash Flows

(in thousands)

(unaudited)

	Nine Months Ended October 31,
	2025		2024
CASH FLOWS FROM OPERATING ACTIVITIES:
Net loss, including amounts attributable to noncontrolling interest	$	(55,051)	$	(15,434)
Adjustments to reconcile net loss to net cash provided by operating activities:
Stock-based compensation expense, net of amounts capitalized	161,793		139,263
Change in fair value of acquisition related contingent consideration	—		3,750
Charitable donation of common stock	5,496		8,871
Amortization of intangible assets	6,050		5,931
Depreciation expense	2,184		2,361
Amortization of deferred contract acquisition costs	40,747		35,650
Net amortization of premiums or discounts on short-term investments	(7,346)		(12,933)
Unrealized foreign exchange loss (gain), net	13,386		(5,443)
Other non-cash expense, net	631		768
Changes in assets and liabilities:
Accounts receivable	46,315		(31,658)
Prepaid expenses and other current assets	(4,290)		2,497
Deferred contract acquisition costs	(36,328)		(35,706)
Other non-current assets	414		851
Accounts payable	812		33
Accrued expenses and other current liabilities	1,862		(240,614)
Accrued compensation and benefits	(7,895)		(8,815)
Deferred revenue	17,500		34,503
Other non-current liabilities	819		(11,068)
Net cash provided by (used in) operating activities	187,099		(127,193)
CASH FLOWS FROM INVESTING ACTIVITIES:
Purchases of short-term investments	(798,283)		(503,394)
Proceeds from maturities of short-term investments	589,527		524,862
Proceeds from sales of short-term investments	1,367		—
Additions to property and equipment	(6,854)		(2,608)
Payments for business combination, net of cash acquired	—		(20,210)
Payments for asset acquisition	—		(7,660)
Other investing activities	—		457
Net cash used in investing activities	(214,243)		(8,553)
CASH FLOWS FROM FINANCING ACTIVITIES:
Proceeds from the issuance of common stock upon exercise of stock options, including early exercises, net of repurchases	15,457		17,895
Issuance of common stock under employee stock purchase plan	8,404		7,932
Payments for taxes related to net share settlement of equity awards	(529)		—
Settlement of acquisition related contingent cash consideration	—		(4,900)
Net cash provided by financing activities	23,332		20,927
Impact of foreign exchange on cash and cash equivalents	394		3,455
Net decrease in cash and cash equivalents	(3,418)		(111,364)
Cash and cash equivalents at beginning of period	227,649		287,996
Cash and cash equivalents at end of period	$	224,231	$	176,632
Supplemental disclosure of cash flow information:
Cash paid (refunds) for income taxes related to the bilateral advance pricing agreement	$	(2,451)	$	187,735
Other cash paid for income taxes	$	1,157	$	2,585
Supplemental disclosure of non-cash investing and financing activities:
Unpaid property and equipment in accounts payable and accrued expenses	$	990	$	377
Stock-based compensation capitalized as internal-use software cost	$	367	$	—

The accompanying notes are an integral part of these condensed consolidated financial statements.

Table of Contents

GitLab Inc.

Notes to Condensed Consolidated Financial Statements

(unaudited)

1. Organization and Description of Business

GitLab Inc. (the “Company”) began as an open source project in 2011 and was incorporated in Delaware on September 12, 2014. The Company operates on an all-remote model. The Company is a technology company and its primary offering is “GitLab”, aan ~~complete~~intelligent ~~DevSecOps~~orchestration platform for DevSecOps delivered as a single application. GitLab is used by a wide range of organizations. The Company also provides related training and professional services. GitLab is offered on both self-managed and software-as-a-service ("SaaS") models. The principal markets for GitLab are currently located in the United States, Europe, and Asia Pacific. The Company is focused on accelerating innovation and broadening the distribution of its platform to companies across the world to help them become better software-led businesses.

1110

Table of Contents

2. Basis of Presentation and Summary of Significant Accounting Policies

Basis of Presentation

The accompanying unaudited condensed consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States of America (“U.S. GAAP”) and applicable rules and regulations of the U.S. Securities and Exchange Commission (the “SEC”) regarding interim financial reporting. Accordingly, they do not include all disclosures normally required in annual consolidated financial statements prepared in accordance with U.S. GAAP.

Fiscal Year

The Company's fiscal year ends on January 31. For example, references to fiscal year ~~2026~~2027 and ~~2025~~2026 refer to the fiscal year ending January 31, ~~2026~~2027 and the fiscal year ended January 31, ~~2025~~2026, respectively.

Use of Estimates

The preparation of the condensed consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the financial statements, and the reported amounts of revenue and expenses during the reporting period. Such estimates include, but are not limited to, allocation of revenue to the license element in the Company's self-managed subscriptions, stock-based compensation, estimating the amortization period for capitalized costs to obtain a contract, allowance for doubtful accounts, taxation of intangible property in company formation, merger, or acquisition transactions, ~~valuation~~realizability ~~allowance~~of ~~for~~ deferred income ~~taxes~~tax assets, reserves for unrecognized income tax benefits, ~~valuation of acquired intangibles assets~~ and impairment of goodwill and long-lived assets. The Company bases these estimates on historical and anticipated results, trends, and various other assumptions that it believes are reasonable under the circumstances, including assumptions as to future events. Actual results could differ from those estimates.

Principles of Consolidation

The condensed consolidated financial statements include 100% of the accounts of wholly owned subsidiaries as well as a variable interest entity for which the Company is the primary beneficiary. The ownership interest of other investors is recorded as noncontrolling interest. All intercompany accounts and transactions have been eliminated in consolidation.

Summary of Significant Accounting Policies

There were no significant changes to the Company’s significant accounting policies disclosed in “Note 2” of the Company’s Annual Report on Form 10-K for the fiscal year ended January 31, ~~2025~~2026.

Segment Reporting

The Company derives revenue globally and manages its business activities on a consolidated basis. The Company’s primary offering is GitLab, aan ~~complete~~intelligent ~~DevSecOps~~orchestration platform for DevSecOps delivered as a single application which is offered on both self-managed and SaaS models.

The Company operates its business as one operating and reportable segment as the Company’s chief operating decision maker (“CODM”), the Company’s CEO, reviews financial information on a consolidated basis for purposes of allocating resources and evaluating financial performance.

The Company’s CODM primarily uses consolidated net loss as the measure of profit or loss to facilitate analysis of the Company’s financial trends, and for internal planning and forecasting purposes. Consolidated expense information is included on the ~~condensed~~ consolidated statements of operations. The measure of segment assets is reported on the ~~condensed~~ consolidated balance ~~sheet~~sheets as total assets. The Company presents

Table of Contents

financial information about geographical mix of revenue in “Note 3. Revenues” of the condensed consolidated financial statements.

Table of Contents

The Company presents financial information about geographical mix of revenue in “Note 3. Revenues” of the condensed consolidated financial statements.

Revision of Previously Issued Condensed Consolidated Financial Statements

As previously disclosed in the Company’s Annual Report on Form 10-K for the fiscal year ended January 31, 2025, in connection with the Consolidated Financial Statements as of and for the fiscal year ended January 31, 2025, the Company identified errors related to the understatement of certain tax liabilities associated with the formation of our joint venture, JiHu in February 2021. The Company concluded that the impact of the errors on previously issued condensed consolidated financial statements were immaterial. However, the Company has revised the prior-period condensed consolidated financial statements to correct these errors.

The following tables summarize the revisions of previously-issued condensed consolidated financial statements (in thousands) for the periods presented:

Condensed Consolidated Statements of Operations and Condensed Consolidated Statements of Comprehensive Loss

	Three Months Ended October 31, 2024						Nine Months Ended October 31, 2024
	As Previously Reported		Adjustment		As Revised		As Previously Reported		Adjustment		As Revised
Other income, net	$	4,992	$	(193)	$	4,799	$	5,457	$	(287)	$	5,170
Loss before income taxes	(11,154)		(193)		(11,347)		(80,477)		(287)		(80,764)
Benefit from income taxes	(39,421)		269		(39,152)		(66,131)		801		(65,330)
Net income (loss)	$	28,267	$	(462)	$	27,805	$	(14,346)	$	(1,088)	$	(15,434)
Net income (loss) attributable to GitLab	29,565		(462)		29,103		(12,130)		(1,088)		(13,218)
Foreign currency translation adjustments	(5,637)		(155)		(5,792)		(8,183)		(165)		(8,348)
Comprehensive income (loss) attributable to GitLab	$	23,999	$	(617)	$	23,382	$	(19,461)	$	(1,253)	$	(20,714)

Impacted financial statement line items appearing in the Company’s condensed consolidated statements of stockholders’ equity have also been revised accordingly. Cash flows from operating, investing and financing activities for the above periods were not impacted by this immaterial correction of an error. However, net loss was revised, as shown above, with an offset to the prepaid expenses and other current assets and accrued expenses and other current liabilities captions within operating activities on the condensed consolidated statements of cash flows. Accordingly, a revision table for the condensed consolidated statement of cash flows is not included.

Recently Issued Accounting Standards Not Yet Adopted

In September 2025, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) 2025-06, Intangibles - Goodwill and Other - Internal-Use Software (“Subtopic 350-40”): Targeted Improvements to the Accounting for Internal-Use Software. This ASU amends the guidance in ASC 350-40 to reflect that software is not always developed in a linear manner, removing all references to development stages and adding new guidance on how to evaluate whether the probable-to-complete threshold has been met. ASU 2025-06 is effective for fiscal years beginning after December 15, 2027 and for interim periods within those fiscal years. The Company is currently evaluating the impact of adopting this ASU on its consolidated financial statements.

Table of Contents

3. Revenues

Disaggregation of Revenue

The following table shows the components of revenues and their respective percentages of total revenue for the periods indicated (in thousands, except percentages):

	Three Months Ended October 31,								Nine Months Ended October 31,
	Three Months Ended April 30,
	2025				2024				2025				2024
	2026				2025
Subscription—self-managed and SaaS	$	~~223~~239,~~262~~306	9190	%	$	~~175~~194,~~257~~481	8991	%	$	~~630,427~~	91	%	$	~~489,617~~	89	%
Subscription—self-managed	~~146~~151,~~379~~082		6057		~~118~~130,~~525~~296		6061		~~417,329~~		59		~~333,744~~		61
SaaS	7688,~~883~~224		3133		5664,~~732~~185		2930		~~213,098~~		32		~~155,873~~		28
License—self-managed and other	$	2124,~~091~~852	910	%	$	20,~~790~~028	119	%	$	~~64,395~~	9	%	$	~~58,201~~	11	%
License—self-managed	1518,~~525~~190		7		1615,~~655~~028		97		~~48,696~~		7		~~47,294~~		9
Professional services and other	56,~~566~~662		23		45,~~135~~000		2		~~15,699~~		2		~~10,907~~		2
Total revenue	$	~~244~~264,~~353~~158	100	%	$	~~196~~214,~~047~~509	100	%	$	~~694,822~~	~~100~~	%	$	~~547,818~~	~~100~~	%

Total Revenue by Geographic Location

The following table summarizes the Company’s total revenue by geographic location based on the region of the Company’s contracting entity, which may be different than the region of the customer (in thousands):

Three Months Ended October 31,

Nine Months Ended October 31,

Three Months Ended April 30,

2025

2024

2025

2024

2026

2025

United States

~~201~~217,~~391~~645

~~159~~176,~~013~~886

~~572,861~~

~~445,896~~

Europe

3739,~~118~~924

3233,~~397~~078

~~106,357~~

~~88,938~~

Asia Pacific

56,~~844~~589

4,~~637~~545

~~15,604~~

~~12,984~~

Total revenue

~~244~~264,~~353~~158

~~196~~214,~~047~~509

~~694,822~~

~~547,818~~

Deferred Revenue and Contract Assets

During the three ~~and nine~~ months ended ~~October~~April 3130, 2026 and 2025, $~~193~~213.42 million and $~~372~~161.27 million, respectively, of revenue was recognized, which was included in the corresponding deferred revenue balance at the beginning of the reporting periods presented. During the three and nine months ended October 31, 2024, $145.0 million and $276.6 million, respectively, of revenue was recognized, which was included in the corresponding deferred revenue balance at the beginning of the periods presented.

Contract assets were $3.3 million and $4.5 million as of April 30, 2026 and January 31, 2026, respectively, and are included in prepaid expenses and other current assets on the Condensed Consolidated Balance Sheets.

Remaining Performance Obligations

As of ~~October~~April 3130, ~~2025~~2026, the aggregate transaction price allocated to billed and unbilled remaining performance obligations for which revenue has not yet been recognized was approximately $1.01 billion. As of ~~October~~April 3130, ~~2025~~2026, the Company expects to recognize approximately 64% over the next 12 months and 8990% over the next 24 months.

Concentration of Credit Risk and Significant Customers

Financial instruments that potentially subject the Company to concentrations of credit risk consist primarily of cash, cash equivalents, ~~restricted cash,~~ short-term investments, and accounts receivable. At times, cash deposits may be in excess of insured limits. The Company believes that the financial institutions or

1413

Table of Contents

~~times, cash deposits may be in excess of insured limits. The Company believes that the financial institutions or~~ corporations that hold its cash, cash equivalents, ~~restricted cash,~~ and short-term investments are financially sound and, accordingly, minimal credit risk exists with respect to these balances. The Company maintains allowances for potential credit losses on accounts receivable when deemed necessary.

The Company uses various distribution channels. As of ~~October~~April 3130, ~~2025~~2026, ~~two~~three channel partners represented 18%, 15% and 1213% of the accounts receivable balance, respectively, while as of January 31, ~~2025~~2026, two channel partners represented 1117% and 1213% of the accounts receivable balance, respectively. There were no individual customers whose balance represented more than 10% of accounts receivable as of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026.

There were no individual customers whose revenue represented more than 10% of total revenue during the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025.

4. Cash Equivalents and Short-Term Investments

The following table summarizes the Company’s cash equivalents and available-for-sale short-term investments by significant investment category as of April 30, 2026 (in thousands):

	As of October 31, 2025
	As of April 30, 2026
	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Fair Value
Level 1:
Cash equivalents
Money market funds	$	~~139~~275,~~742~~248	$	—	$	—	$	~~139~~275,~~742~~248
Total cash equivalents (1)	275,248		—		—		275,248
Level 2:
Cash equivalents
U.S. Treasury securities	9,976		3		—		9,979
Total cash equivalents (1)	149,718		3		—		149,721
Short-term investments
Commercial paper	172,~~031~~413		3—		(21)		172,~~032~~412
Corporate debt securities	~~286~~366,~~065~~841		~~568~~179		(50398)		~~286~~366,~~583~~622
U.S. Agency securities	7292,~~482~~566		8016		(9142)		7292,~~553~~440
U.S. Treasury securities	~~603~~528,~~372~~284		~~630~~204		(93456)		~~603~~528,~~909~~032
Total short-term investments	~~978~~990,~~950~~104		~~1,281~~399		(~~154~~997)		~~980~~989,~~077~~506
Level 2 total	988,926		1,284		(154)		990,056
Total cash equivalents and short-term investments	$	1,265,352	$	399	$	(997)	$	1,264,754
Total cash equivalents and short-term investments	$	1,128,668	$	1,284	$	(154)	$	1,129,798

(1) Included in “cash and cash equivalents” in ~~our~~the condensed consolidated balance sheet as of ~~October~~April 3130, ~~2025~~2026, in addition to cash of $7460.51 million.

15The following table summarizes equity securities classified as short-term investments held by JiHu, the company’s consolidated joint venture (in thousands):


	Level	Fair Value
Wealth Management Products	2	$	32,611

JiHu does not have significant influence or control over these investees. These equity securities have readily determinable fair values, are classified as Level 2 financial instruments, and are measured at fair value, with changes in fair value recorded in other income (expense), net in the condensed consolidated statements of operations. All equity securities have been classified as current, based on management’s ability to use the funds in current operations. Refer to Note 10. Joint Venture for further information on JiHu.

Table of Contents

	As of January 31, 2025
	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Fair Value
Level 1:
Cash equivalents
Money market funds	$	97,093	$	—	$	—	$	97,093
Level 2:
Cash equivalents
U.S. Treasury securities	36,429		8		—		36,437
Total cash equivalents (1)	133,522		8		—		133,530
Short-term investments
Commercial paper	19,400		4		(11)		19,393
Corporate debt securities	220,326		327		(148)		220,505
U.S. Agency securities	61,020		20		(65)		60,975
U.S. Treasury securities	463,474		521		(140)		463,855
Total short-term investments	764,220		872		(364)		764,728
Level 2 total	800,649		880		(364)		801,165
Total cash equivalents and short-term investments	$	897,742	$	880	$	(364)	$	898,258

The following table summarizes the Company’s cash equivalents and available-for-sale short-term investments by significant investment category as of January 31, 2026 (in thousands):

(1) Included in “cash and cash equivalents” in our condensed consolidated balance sheet as of January 31, 2025, in addition to cash of $94.1 million.


	As of January 31, 2026
	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Fair Value
Level 1:
Cash equivalents
Money market funds	$	152,741	$	—	$	—	$	152,741





Total cash equivalents (1)	152,741		—		—		152,741
Level 2:
Short-term investments
Commercial paper	7,452		1		—		7,453
Corporate debt securities	294,930		677		(35)		295,572


U.S. Agency securities	93,997		87		(28)		94,056
U.S. Treasury securities	632,499		768		(21)		633,246
Total short-term investments	1,028,878		1,533		(84)		1,030,327

Total cash equivalents and short-term investments	$	1,181,619	$	1,533	$	(84)	$	1,183,068

~~The fair value of the Company’s Level~~ (1) ~~financial~~Included ~~instruments, such as money market funds which are traded~~ in ~~active~~“cash ~~markets, is based on quoted market prices for identical instruments. The fair value of the Company’s Level 2 financial instruments such as commercial paper, corporate debt~~ and ~~U.S.~~cash ~~government~~equivalents” ~~securities are obtained from an independent pricing service, which may use inputs other than quoted prices that are directly or indirectly observable~~ in the ~~market,~~condensed ~~including~~consolidated ~~readily~~balance ~~available~~sheet ~~pricing~~as sources for the identical underlying security that may not be actively traded. The Company’s marketable securities are held by custodians who obtain investment prices from a third-party pricing provider that incorporates standard inputs in various asset price models. As of ~~October~~January 31, ~~2025 and January 31~~2026, ~~2025,~~in ~~the~~addition ~~Company~~to ~~did~~cash ~~not~~of ~~have any Level 3 financial instruments~~$76.8 million.

The fair value of the Company’s Level 1 financial instruments, such as money market funds which are traded in active markets, is based on quoted market prices for identical instruments. The fair value of the Company’s Level 2 financial instruments such as commercial paper, corporate debt and U.S. government securities are obtained from an independent pricing service, which may use inputs other than quoted prices that are directly or indirectly observable in the market, including readily available pricing sources for the identical underlying security that may not be actively traded. The fair value of the Company’s equity securities held by JiHu is determined based on net asset value ("NAV"). As of April 30, 2026 and January 31, 2026, the Company did not have any Level 3 financial instruments.

The Company uses the specific-identification method to determine any realized gains or losses from the sale of the Company’s short-term investments classified as available-for-sale. For the periods presented, the Company did not have any material realized gains or losses as a result of maturities or sales of short-term investments.

During the three ~~and nine~~ months ended ~~October~~April 3130, 2026 and 2025, the Company recorded $11.79 million and $3410.1 9 million of interest income on cash and cash equivalents and short-term investments, respectively, which includes $10.~~7 million and $7.~~3 million of net amortization of premiums or discounts on short-term investments during the three and nine months ended October 31, 2025, respectively. During the three and nine months ended October 31, 2024, the Company recorded $12.6 million and $~~37.4 million of interest income on cash and cash equivalents and short-term investments, respectively, which includes $~~3.80 million ~~and $12.9 million~~ of net amortization of premiums or discounts on short-term investments during the three ~~and nine~~ months ended ~~October~~April 3130, ~~2024~~2026 and 2025, respectively.

The following table summarizes unrealized losses on the Company’s cash equivalents and available-for-sale short-term investments aggregated by category and the length of time such aggregated investments have been in a continuous unrealized loss position as of the periods presented (in thousands):

1615

Table of Contents

Less Than 12 Months

12 Months or Greater

Total

Carrying Value

Gross Unrealized Losses

Carrying Value

Gross Unrealized Losses

Fair Value

Gross Unrealized Losses

October 31, 2025

April 30, 2026

U.S. Agency securities

1363,~~935~~629

(8142)

~~2,005~~—

~~(1)~~—

1563,~~940~~629

(9142)

Commercial paper

62,~~624~~412

(21)

—

62,~~624~~412

(21)

Corporate debt securities

61214,~~141~~667

(48398)

~~3,488~~—

~~(2)~~—

64214,~~629~~667

(50398)

U.S. Treasury securities

~~146~~226,~~508~~997

(90456)

~~12,000~~—

~~(3)~~—

~~158~~226,~~508~~997

(93456)

Total cash equivalents and short-term investments

~~228~~507,~~208~~705

(~~148~~997)

~~17,493~~—

~~(6)~~—

~~245~~507,~~701~~705

(~~154~~997)

Less Than 12 Months

12 Months or Greater

Total

Carrying Value

Gross Unrealized Losses

Carrying Value

Gross Unrealized Losses

Fair Value

Gross Unrealized Losses

January 31, 2025

January 31, 2026

U.S. Agency securities

4838,~~445~~754

(6528)

—

4838,~~445~~754

(6528)

Commercial paper

134,~~430~~976

~~(11)~~—

—

134,~~430~~976

~~(11)~~—

Corporate debt securities

7253,~~022~~640

(~~146~~35)

~~5,988~~—

~~(2)~~—

7853,~~010~~640

(~~148~~35)

U.S. Treasury securities

~~100~~73,~~921~~619

(~~140~~21)

—

~~100~~73,~~921~~619

(~~140~~21)

Total cash equivalents and short-term investments

~~234~~170,~~818~~989

(~~362~~84)

~~5,988~~—

~~(2)~~—

~~240~~170,~~806~~989

(~~364~~84)

The following table classifies the Company’s available-for-sale short-term investments by contractual maturities (in thousands):

October 31, 2025

January 31, 2025

April 30, 2026

January 31, 2026

Amortized cost

Fair Value

Amortized cost

Fair Value

Due within 1 year

~~586~~619,~~551~~164

~~587~~619,~~055~~386

~~590~~610,~~193~~087

~~590~~611,~~832~~036

Due between 1 year to 2 years

~~392~~370,~~399~~940

~~393~~370,~~022~~120

~~174~~418,~~027~~791

~~173~~419,~~896~~291

Total

~~978~~990,~~950~~104

~~980~~989,~~077~~506

~~764~~1,~~220~~028,878

~~764~~1,~~728~~030,327

All available-for-sale securities have been classified as current, based on management’s ability to use the funds in current operations.

~~There was no interest accretion expense for the three and nine months ended October 31, 2025. Interest accretion expense was $0.1 million for both the three and nine months ended October 31, 2024.~~16

Table of Contents

5. Supplemental Financial Statement Information

Other Income (Expense), Net

Other income (expense), net consisted of the following (in thousands):


	Three Months Ended April 30,
	2026		2025

Foreign exchange gains (losses), net	$	536	$	(9,954)
Other expense, net	(281)		(17)
Total other income (expense), net	$	255	$	(9,971)

Table of Contents

	Three Months Ended October 31,				Nine Months Ended October 31,
	2025		2024		2025		2024
Foreign exchange gains (losses), net	$	(2,362)	$	5,074	$	(13,433)	$	5,556
Other expense, net	(3,972)		(275)		(3,783)		(386)
Total other income (expense), net	$	(6,334)	$	4,799	$	(17,216)	$	5,170

6. Acquisitions

In March 2024, the Company acquired Oxeye Security Limited for $20.3 million. The acquisition includes a $3.2 million founder holdback payable over three years, recognized as compensation expense.

~~The~~During ~~Company~~the ~~recorded~~three ~~founder~~months ~~holdback~~ended ~~compensation~~April ~~expense~~30, of2026, ~~$0.3 million~~the milestone attached to the second payment tranche was achieved and $01.1 million ~~for~~was paid out to the ~~three~~two ~~months~~co-founders. ~~ended~~The ~~October~~Company ~~31,~~recorded ~~2025~~founder ~~and~~holdback ~~2024,~~compensation ~~respectively,~~expense ~~and~~of $0.63 million and $10.1 million for the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively, in general and administrative expenses in ~~its~~the condensed consolidated statements of operations.

7. Goodwill and Intangible Assets, Net

Goodwill

The carrying amount of goodwill was as follows (in thousands):

	Carrying Amount
Balance as of January 31, 2025	$	16,139
Balance as of January 31, 2026	$	17,379
Foreign currency translation adjustments	~~780~~419
Balance as of October 31, 2025	$	16,919
Balance as of April 30, 2026	$	17,798

There was no goodwill impairment for any periods presented.

Intangible Assets

Intangible assets, net consisted of the following (in thousands):

October 31, 2025	Gross Carrying Amount		Accumulated Amortization		Net Book Value		Weighted average remaining amortization period (years)
April 30, 2026	Gross Carrying Amount		Accumulated Amortization		Net Book Value		Weighted average remaining amortization period (years)
Developed technology from business combination (1)	$	16,713	$	(8,913)	$	7,800	1.4
Developed technology from business combination	$	16,713	$	(11,666)	$	5,047	0.9
Developed technology from asset acquisitions	7,660		(34,~~671~~948)		32,~~989~~712		1.61
Total	$	24,373	$	(1216,~~584~~614)	$	117,~~789~~759

1817

Table of Contents

January 31, 2025	Gross Carrying Amount		Accumulated Amortization		Net Book Value		Weighted average remaining amortization period (years)
January 31, 2026	Gross Carrying Amount		Accumulated Amortization		Net Book Value		Weighted average remaining amortization period (years)
Developed technology from business combination (2)	$	22,913	$	(10,982)	$	11,931	2.2
Developed technology from business combination	$	16,713	$	(10,289)	$	6,424	1.2
Developed technology from asset acquisitions	7,660		(14,~~757~~310)		53,~~903~~350		21.3
Total	$	3024,~~573~~373	$	(1214,~~739~~599)	$	179,~~834~~774

~~(1)~~Amortization Asexpense ofwas ~~October 31, 2025, the Company wrote off~~ $6.2.0 million for each of ~~fully~~the ~~amortized~~three ~~intangible~~months ~~assets~~ended asApril ~~the~~30, ~~technology~~2026 ~~had~~and ~~become~~2025, ~~obsolete~~respectively.

~~(2)~~As ~~The~~of ~~amounts~~April 30, in2026, ~~the~~future ~~table~~amortization ~~above~~expense ~~include~~related ~~cumulative~~to ~~foreign~~the ~~currency~~intangibles ~~translation~~assets ~~adjustments,~~is ~~reflecting~~expected ~~movement~~to inbe ~~the~~as ~~currencies~~follows of(in ~~the underlying intangibles.~~thousands):

Amortization expense was $2.0 million and $6.0 million for the three and nine months ended October 31, 2025, respectively, and $2.5 million and $5.9 million for the three and nine months ended October 31, 2024, respectively.


Fiscal Years

Remainder of 2027	$	6,045
2028	1,714
Total future amortization	$	7,759

As of October 31, 2025, future amortization expense related to the intangibles assets is expected to be as follows (in thousands):

Fiscal Years
Remainder of 2026	$	2,014
2027	8,060
2028	1,715
Total future amortization	$	11,789

8. Team Member Benefit Plans

The Company contributes to defined contribution plans in a number of countries including a 401(k) savings plan for U.S. based team members and defined contribution arrangements in the United Kingdom, Australia, New Zealand and select other countries based on the legislative and tax requirements of the respective countries. Total contributions to these plans were $12.4 million and $52.3 million for the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025,~~2026 ~~respectively,~~ and ~~$1.1 million and $4.1 million for the three and nine months ended October 31~~2025, ~~2024,~~ respectively.

9. Equity

Equity Incentive Plans

In September 2021, the Company adopted the 2021 Equity Incentive Plan (the “2021 Plan”) as a successor of the Company’s 2015 Equity Incentive Plan (together the “Plans”). Effective February 1, 2026, the number of shares available under the 2021 Plan was automatically increased by 8,503,382 shares pursuant to the terms of the 2021 Plan.

In the event that shares previously issued under the above Plans are reacquired by the Company, such shares shall be added to the number of shares then available for issuance under the 2021 Plan. In the event that an outstanding stock option for any reason expires or is canceled, the shares allocable to the unexercised portion of such stock option will be added to the number of shares then available for issuance under the 2021 Plan.

Both Plans allow the grantees to early exercise stock options.

1918

Table of Contents

Share Repurchase Program

In March 2026, the Company's Board of Directors authorized the repurchase of up to $400.0 million of the Company's Class A common stock (the "2026 Repurchase Program"). The 2026 Repurchase Program may be modified, suspended, or terminated at any time and does not require the Company to repurchase any specific number or dollar amount of shares. Repurchases may be made from time to time in the open market, through privately negotiated transactions, through Rule 10b5-1 trading plans, or by other means, subject to market conditions, applicable legal requirements, and the Company's capital allocation priorities.

During the three months ended April 30, 2026, the Company repurchased 2,378,892 shares of its Class A common stock for an aggregate consideration of $50.0 million (including commissions) at an average price of $21.04 per share. Repurchased shares were retired immediately upon settlement. As of April 30, 2026, $350.0 million remained available for repurchase under the 2026 Repurchase Program.

Stock Options, RSUs and PSUs

The following table summarizes options activity under the Plans, and related information:

	Number of Stock Options Outstanding (in thousands)	Weighted Average Exercise Price		Weighted Average Remaining Years	Aggregate Intrinsic value (in millions)
Balances at January 31, 2025	5,896	$	14.27	5.41	$	344.8
Balances at January 31, 2026	4,011	$	15.38	4.27	$	78.6
Options exercised	(~~1,235~~178)	1213.5335
Options canceled	(1512)	1123.8319
Options forfeited	(26)	18.45
Balances at April 30, 2026	3,821	$	15.45	4.04	$	25.9
Balances at October 31, 2025	4,620	$	14.72	4.12	$	157.2
Options vested at April 30, 2026	3,796	$	15.44	4.03	$	25.8
Options vested at October 31, 2025	4,440	$	14.60	4.06	$	151.6
Options vested and expected to vest at April 30, 2026	3,821	$	15.45	4.04	$	25.9
Options vested and expected to vest at October 31, 2025	4,620	$	14.72	4.12	$	157.2

During the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025,~~2026 ~~the Company recorded $3.9 million~~ and ~~$13.2 million of stock-based compensation expense related to options~~2025, ~~respectively. During~~ the ~~three and nine months ended October 31, 2024, the~~ Company recorded $3.17 million and $104.09 million of stock-based compensation expense related to options, respectively.

As of ~~October~~April 3130, ~~2025~~2026, ~~approximately $8.2 million of~~ total unrecognized stock-based compensation ~~relates to the modification of stock options previously granted to the Company’s former CEO. Total unrecognized stock-based compensation~~ cost related to stock options of $0.7 million is expected to be recognized over a weighted-average period of 0.51 years. ~~The expected stock compensation expense remaining to be recognized reflects only outstanding stock awards as of the periods presented, and assumes no forfeitures.~~

The following table summarizes the Company’s RSU activity:

	Number of Shares (in thousands)	Weighted-Averagegrant datefair value
Balances at January 31, 2025	8,259	$	50.64
Balances at January 31, 2026	8,505	$	47.15
Granted	53,~~472~~600	4522.2478
Vested	(~~2,701~~963)	4948.4147
Canceled/forfeited	(~~2,168~~668)	4746.9980
Balances at October 31, 2025	8,862	$	48.32
Balances at April 30, 2026	10,474	$	38.68

These RSUs are grants of shares of the Company’s Class A common stock, the vesting of which is based on the requisite service requirement. Generally, the Company’s RSUs are subject to forfeiture and are expected to vest over two to four years ratably on a combination of bi-annual and quarterly basis. During the three and nine months ended October 31, 2025, the Company recorded $44.4 million and $136.4 million of stock-based compensation expense related to RSUs, respectively. During the three and nine months ended October 31, 2024, the Company recorded $40.3 million and $117.1 million of stock-based compensation expense related to RSUs, respectively.

~~As of October 31, 2025, approximately $399.2 million of total unrecognized compensation cost was related to RSUs granted to team members that is expected to be recognized over a weighted-average~~ 19

Table of Contents

~~period~~During ofthe ~~2.8~~three ~~years.~~months ~~The~~ended ~~expected~~April ~~stock~~30, ~~compensation~~2026 ~~expense~~and ~~remaining~~2025, tothe beCompany ~~recognized~~recorded ~~reflects~~$41.4 million ~~only~~and ~~outstanding~~$45.1 million stock-based ~~awards~~compensation asexpense ofrelated ~~the~~to ~~periods presented~~RSUs, ~~and assumes no forfeitures~~respectively.

As of April 30, 2026, total unrecognized stock-based compensation cost related to RSUs of $380.7 million is expected to be recognized over a weighted-average period of 2.9 years.

PSUs

During the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026, the Company granted 01.36 million PSUs with a weighted-average grant date fair value of $21.92 per share to ~~senior~~certain members of its ~~management~~executive leadership team subject to the achievement of specified performance targets and continuous service through the applicable vesting dates. ~~Under the terms of the awards, the recipient may earn between 0% and 200% of the original grant.~~ The performance ~~conditions~~condition ~~are~~has ~~set~~ to be achieved in fiscal year ~~2026~~2027 ~~through fiscal year 2028~~ and the service condition must be met on each vest date.

~~The~~During ~~Company~~the ~~has~~three ~~also~~months ended April 30, 2026, the Company granted 0.8 million PSUs to certain members of its executive ~~officers~~leadership inteam ~~prior~~subject ~~years~~to the achievement of a specified market condition based on the Company's relative total shareholder return ("TSR") and continuous service through the applicable vesting dates. The Company estimated the aggregate grant date fair value of $25.52 per share on the grant date using the Monte Carlo simulation model with the following assumptions: (i) expected volatility of 57.16% and (ii) risk-free interest rate of 3.85%. Provided that the requisite service is rendered, the total fair value of the awards at the date of grant will be recognized as compensation expense on a straight-line basis over the requisite service period, even if the market condition is not achieved.

During the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025,~~2026 ~~the Company recorded a net gain of $0.2 million~~ and ~~a net expense of $1.1 million~~2025, ~~respectively related to PSUs. During~~ the ~~three and nine months ended October 31, 2024, the~~ Company recorded total stock-based compensation expense of $0.94 million and $13.85 million, respectively.

As of ~~October~~April 3130, ~~2025~~2026, total unrecognized stock-based compensation expense related to PSUs was $335.89 million, which is expected to be recognized over a weighted-average period of 21.54 years.

2021 Employee Stock Purchase Plan (“ESPP”)

In September 2021, the Company’s board of directors and its stockholders approved the ESPP and participation of eligible team members. Effective February 1, 2026, the number of shares available under the ESPP was automatically increased by 1,700,677 shares pursuant to the terms of the ESPP.

The Company recorded $3.05 million and $92.75 million of stock-based compensation expense related to the ESPP during the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025,~~2026 ~~respectively. The Company recorded $2.5 million~~ and ~~$8.6 million of stock-based compensation expense related to the ESPP during the three and nine months ended October 31~~2025, ~~2024,~~ respectively. As of ~~October~~April 3130, ~~2025~~2026, approximately $1613.5 2 million of total unrecognized compensation cost was related to the ESPP that is expected to be recognized over 1.6 years.

Stock-Based Compensation Expense

The Company recognized stock-based compensation expense as follows (in thousands):

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Cost of revenue	$	2,~~300~~864	$	1,~~993~~929	$	~~6,490~~	$	~~5,924~~
Sales and marketing	17,~~354~~445		1722,~~012~~091		~~59,395~~		~~54,290~~
Research and development	1513,~~560~~630		14,~~384~~272		~~49,029~~		~~42,834~~
General and administrative	16,~~468~~122		1417,~~653~~535		~~46,879~~		~~36,215~~
Stock-based compensation expense, net of amounts capitalized	51,682		48,042		161,793		139,263
Total stock-based compensation expense (1)	$	50,061	$	55,827
Capitalized stock-based compensation	367		—		367		—
Total stock-based compensation expense (1)	$	52,049	$	48,042	$	162,160	$	139,263

(1) The table above includes stock-based compensation of JiHu. Refer to “Note 10. Joint Venture” for further discussion.

2120

Table of Contents

The corporate income tax benefit recognized in the condensed consolidated statements of operations for stock-based compensation expense was zero for each of the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively.

Charitable Donation of Common Stock

In September 2021, the Company’s board of directors approved the reservation of up to 1,635,545 shares of Class A common stock for issuance to charitable organizations. In March ~~2025~~2026 and ~~2024~~2025, the Company’s board of directors approved annual donations of 163,~~555~~556 and ~~221~~163,~~195~~555 shares of Class A common stock, ~~respectively,~~ to the GitLab Foundation (the “Foundation”), a California nonprofit public benefit corporation, respectively. The Foundation is also a related party as certain of the Company’s officers serve as directors of the Foundation. These donations shall occur in four equal quarterly distributions.

During the three ~~and nine~~ months ended ~~October~~April 3130, 2026 and 2025, the Company donated 40,889 shares ~~and 122,667 shares~~ of Class A common stock at fair value to the Foundation, ~~respectively~~in each period presented. ~~During~~The fair value of the ~~three~~common ~~and~~stock ~~nine~~was ~~months~~determined ~~ended~~based ~~October~~on ~~31,~~the ~~2024,~~quoted market price on the ~~Company~~grant ~~donated~~date. ~~52,940~~The ~~shares~~donation expense of $0.8 million and ~~173,181~~$1.7 million ~~shares~~was ofrecorded ~~Class~~in Ageneral ~~common~~and ~~stock~~administrative atexpense ~~fair~~in ~~value~~the tocondensed consolidated statements of operations for the ~~Foundation~~three months ended April 30, 2026 and 2025, respectively.

The fair value of the common stock was determined based on the quoted market price on the grant date. The donation expense of $2.0 million and $5.5 million was recorded in general and administrative expense in the condensed consolidated statements of operations for the three and nine months ended October 31, 2025, respectively. The donation expense of $3.0 million and $8.9 million was recorded in general and administrative expense in the condensed consolidated statements of operations for the three and nine months ended October 31, 2024, respectively.21

10. Joint Venture

Joint Venture

In February 2021, the Company along with Sequoia CBC Junyuan (Hubei) Equity Investment Partnership (Limited Partnership) and Suzhou Gaocheng Xinjian Equity Investment Fund Partnership (Limited Partnership) executed an investment agreement (the “Investment Agreement”) to establish GitLab Information Technology (Hubei) Co., LTD (“JiHu”), a legal entity in the People’s Republic of China. The Company accounted for JiHu as a variable interest entity and consolidated the entity in accordance with ASC Topic 810, Consolidation. As of October 31, 2025 and 2024, the Company retains control over JiHu with its equity stake at approximately 54% for each period presented.

Since fiscal year 2023, JiHu has maintained an employee stock option plan (“JiHu 2022 ESOP”) for its employees. In June 2024 and June 2025, the board of directors of JiHu approved new employee stock option plans (“JiHu 2024 ESOP” and “JiHu 2025 ESOP”, respectively) for its employees in order to grant additional shares. The fair value of restricted stock awards (“RSAs”) and stock option awards is measured on the date of grant and compensation costs related to these awards are recognized on a graded attribution method; as the grants include a performance condition for the JiHu 2022 ESOP, JiHu 2024 ESOP, and JiHu 2025 ESOP (“JiHu ESOPs”).

During the three and nine months ended October 31, 2025, the Company recorded $0.7 million and $1.4 million of stock-based compensation expense, respectively. During the three and nine months ended

Table of Contents

~~October 31, 2024, the Company recorded $1~~10.~~0 million~~ ~~stock-based~~Joint ~~compensation expense and $0.8 million stock-based compensation net expense (net of forfeitures), respectively.~~Venture

AsThe ofCompany ~~October 31,~~accounted ~~2025,~~for ~~approximately~~JiHu ~~$4.2 million~~as ofa ~~total~~variable ~~unrecognized~~interest ~~compensation~~entity ~~cost~~and ~~was~~consolidated ~~related~~the toentity ~~the~~in ~~JiHu~~accordance ~~ESOPs~~with ~~that~~ASC isTopic ~~expected~~810, toConsolidation. beAs ~~recognized~~of April 30, 2026 and 2025, the Company retained control over aJiHu ~~weighted-average~~with ~~period~~its ofequity ~~2.6~~stake ~~years.~~at approximately 54% for each period presented.

JiHu maintains employee stock option plans for its employees (the "JiHu ESOPs"). Compensation costs related to these awards are recognized on a graded attribution method, as the grants include a performance condition.

During the three months ended April 30, 2026 and 2025, the Company recorded $0.9 million stock-based compensation expense and net gain of $0.2 million, respectively.

As of April 30, 2026, approximately $2.0 million of total unrecognized compensation cost was related to the JiHu ESOPs that is expected to be recognized over a weighted-average period of 2.1 years.

Selected Financial Information

Selected financial information of JiHu, post intercompany eliminations, is as follows (in thousands):

Three Months Ended October 31,

Nine Months Ended October 31,

Three Months Ended April 30,

2025

2024

2025

2024

2026

2025

Revenue

2,~~312~~537

1,~~900~~885

~~6,371~~

~~5,321~~

Cost of revenue

~~450~~529

~~523~~524

~~1,384~~

~~1,542~~

Gross profit

12,~~862~~008

1,~~377~~361

~~4,987~~

~~3,779~~

Operating expenses:

Sales and marketing

1,~~712~~507

1,~~805~~472

~~4,684~~

~~4,850~~

Research and development

~~473~~601

~~603~~(381)

~~749~~

~~970~~

General and administrative

1,~~334~~315

1,~~616~~288

~~4,258~~

~~3,362~~

Total operating expenses

3,~~519~~423

42,~~024~~379

~~9,691~~

~~9,182~~

Loss from operations

(1,~~657~~415)

(21,~~647~~018)

~~(4,704)~~

~~(5,403)~~

Interest income

~~137~~107

~~168~~165

~~457~~

~~625~~

Other income (expense), net

~~387~~(13)

~~(342)~~26

~~568~~

~~(36)~~

Net loss before income taxes

(1,~~133~~321)

(~~2,821~~827)

~~(3,679)~~

~~(4,814)~~

Provision for income taxes

—1

—

Net loss

(1,~~133~~322)

(~~2,821~~828)

~~(3,682)~~

~~(4,814)~~

Net loss attributable to noncontrolling interest

(~~521~~607)

(~~1,298~~383)

~~(1,692)~~

~~(2,216)~~

	October 31, 2025		January 31, 2025
	April 30, 2026		January 31, 2026
Cash and cash equivalents	$	374,~~386~~970	$	37,~~991~~179
Property and equipment, net	536		322
Short Term Investments	32,611		—
Other assets	3,644		8,185
Property and equipment, net	287		465
Total assets	$	41,566	$	46,498
Other assets	2,769		3,342
Total liabilities	$	7,234	$	10,278
Total assets	$	40,637	$	40,986
Total liabilities	$	6,591	$	7,086

~~11. Income Taxes~~22

On July 4, 2025, the United States enacted the One Big Beautiful Bill Act (“OBBBA”) which extended or modified certain corporate tax provisions under the 2017 Tax Cuts and Jobs Act (“TCJA”). The OBBBA modified certain business deductions, including allowing for immediate expensing of U.S. research & development (“R&D”) expenditures, effective in the Company’s current fiscal year. The OBBBA also

Table of Contents

~~modified various international tax provisions which were set to change or expire after 2025 under the TCJA~~11. ~~Such~~Income modifications, including U.S. taxation of profits derived from foreign operations and associated foreign tax credit limitations, are effective in the Company’s next fiscal year. The immediate expensing of U.S. R&D expenditures had a favorable impact to the Company’s domestic tax liability. The Company will continue to evaluate the impact of the OBBBA on the Company’s condensed consolidated financial statements.Taxes

~~For~~On July 4, 2025, the ~~three~~United ~~and~~States ~~nine~~enacted ~~months~~the ~~ended~~One ~~October~~Big ~~31,~~Beautiful ~~2025,~~Bill ~~the~~Act ~~Company~~(“OBBBA”) ~~recorded~~which ~~income~~extended or modified certain corporate tax ~~expense~~provisions ofunder ~~$1.8 million~~the 2017 Tax Cuts and $6Jobs Act (“TCJA”).~~6 million~~ onThe ~~pretax~~OBBBA ~~loss~~modified certain business deductions, including allowing for immediate expensing of $7U.~~0 million~~S. ~~and~~research ~~$48.5 million~~& development (“R&D”) expenditures, ~~respectively~~effective in the Company’s current fiscal year. The ~~income~~OBBBA also modified various international tax ~~expense~~provisions ~~for~~which were set to change or expire after 2025 under the ~~three~~TCJA. Such modifications, including U.S. taxation of profits derived from foreign operations and ~~nine~~associated ~~months~~foreign ~~ended~~tax ~~October~~credit 31limitations, ~~2025~~are ~~was~~effective ~~primarily~~in ~~related~~this tofiscal year. The immediate expensing of U.S. R&D expenditures had a favorable impact on the Company’s ~~foreign~~domestic ~~operations~~tax liability. The Company will continue to evaluate the impact of the OBBBA on the Company’s condensed consolidated financial statements.

For the three ~~and nine~~ months ended ~~October~~April 3130, ~~2024~~2026 and 2025, the Company recorded income tax ~~benefit~~expense of $~~39.~~2.0 million and $652.35 million on a pretax loss of $~~11.~~3.5 million and $8033.87 million, respectively. The income tax ~~benefit~~expense for the three ~~and nine~~ months ended ~~October~~April 3130, ~~2024~~2026 and 2025 was primarily related to the ~~conclusion~~Company’s offoreign ~~negotiations relating to Bilateral Advance Pricing Agreements (“BAPA”) with the U~~operations.S. ~~Internal Revenue Service (“IRS”) and Dutch Tax Authority (“DTA”).~~

The Company executed the BAPA agreements with the IRS and the DTA on October 10, 2024, and October 22, 2024, respectively. On October 28, 2024, the Company paid $187.7 million to satisfy the tax assessment issued by the DTA, including accrued interest, which reflected the BAPA negotiations and the agreement to reduce the rate of tax on the gain from the transfer of economic IP rights. As a result of the BAPA and the DTA assessment, the 2015 through 2017 tax years are closed for GitLab B.V., the Company’s Netherlands subsidiary. Pursuant to the terms in the BAPA, the Company has filed amended returns for the 2018 through 2023 fiscal years.

The Company's provision for income taxes is based on its worldwide estimated annualized effective tax rate, except for jurisdictions for which a loss is expected for the year and no benefit can be realized for those losses, jurisdictions for which forecasted pre-tax income or loss cannot be estimated, and the tax effect of discrete items occurring during the period. The tax for jurisdictions that are excluded from the worldwide estimated annual effective tax rate is calculated separately.

Under the provisions of ASC 740, Income Taxes, the determination of the Company’s ability to recognize its deferred tax asset requires an assessment of both negative and positive evidence when determining the Company’s ability to recognize its deferred tax assets. As in prior years, the Company maintained that it was not more likely than not that the Company could recognize deferred tax assets in certain jurisdictions. All attributes agreed upon in the BAPA, including U.S. federal and state tax net operating losses (“NOLs”) and credits, as well as Netherlands NOLs, are not yet recognized due to the determination that they are not more likely than not to be realized. The evidence evaluated by the Company included operating results during the most recent three-year period and future projections. More weight was given to historical results than to expectations of future profitability, which are inherently uncertain. Certain entities’ net losses in recent periods represented sufficient negative evidence to require a valuation allowance against its net deferred tax assets. This valuation allowance will be evaluated periodically and could be reversed partially or totally if business results have sufficiently improved to support realization of deferred tax assets.

As of ~~October~~April 3130, ~~2025~~2026, unrecognized tax benefits were $3031.25 million, of which $10.48 million would affect the effective tax rate if recognized. As of January 31, ~~2025~~2026, the unrecognized tax benefits were $2531.63 million, of which $910.56 million would affect the effective tax rate if recognized. The Company is unable to reasonably estimate the timing of the remaining long-term payments or the amount by which the liability will increase or decrease.

It is the Company's policy to classify accrued interest and penalties related to unrecognized tax benefits in the provision for income taxes. Accrued interest and penalties were $67.63 million as of ~~October~~April 3130, ~~2025~~2026 and $57.32 million as of January 31, ~~2025~~2026, respectively.

24As of April 30, 2026, the Company’s U.S. federal 2018 through 2025 tax years were open and subject to potential examination in one or more jurisdictions. In addition, in the United States, any net operating losses or credits that were generated in prior years but not yet fully utilized in a year that is closed under the statute of limitations may also be subject to examination. The Company’s Netherlands tax years are currently open from tax years 2019 to 2024, subject to adjustments as a result of the recently negotiated BAPA. The Company believes that it has adequately reserved for the outcome of the BAPA. The Company regularly assesses the likelihood of adverse outcomes resulting from all existing and potential

Table of Contents

As of October 31, 2025, the Company’s U.S. federal 2018 through 2024 tax years were open and subject to potential examination in one or more jurisdictions. In addition, in the United States, any net operating losses or credits that were generated in prior years but not yet fully utilized in a year that is closed under the statute of limitations may also be subject to examination. The Company’s Netherlands tax years are currently open from tax years 2018 to 2024, subject to adjustments as a result of the recently negotiated BAPA. The Company believes that it has adequately reserved for the outcome of the BAPA. The Company regularly assesses the likelihood of adverse outcomes resulting from all existing and potential examinations to determine the adequacy of its provision for income taxes. The Company continues to monitor the progress of ongoing discussions with tax authorities and the effect, if any, of the expected expiration of the statute of limitations in various taxing jurisdictions.

12. Net ~~Income (~~Loss) per Share

The following table sets forth basic and diluted ~~income (~~loss) per share for each of the periods presented (in thousands, except per share data):

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Numerator:
Net income (loss) attributable to GitLab	$	(8,276)	$	29,103	$	(53,359)	$	(13,218)
Net loss attributable to GitLab	$	(4,972)	$	(35,875)
Denominator:
Weighted-average shares used to compute net income (loss) per share attributable to GitLab Class A and Class B common stockholders, basic	167,407		161,317		165,965		159,756
Weighted-average shares used to compute net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted	169,948		164,491
Effect of dilutive securities:
Net loss per share attributable to GitLab Class A and Class B common stockholders, basic and diluted	$	(0.03)	$	(0.22)
Stock options	—		4,897		—		—
RSUs	—		1,102		—		—
ESPP	—		98		—		—
Common stock in connection with business combination	—		22		—		—
Weighted-average shares used to compute net income (loss) per share attributable to GitLab Class A and Class B common stockholders, diluted	167,407		167,436		165,965		159,756
Net income (loss) per share attributable to GitLab Class A and Class B common stockholders, basic	$	(0.05)	$	0.18	$	(0.32)	$	(0.08)
Net income (loss) per share attributable to GitLab Class A and Class B common stockholders, diluted	$	(0.05)	$	0.17	$	(0.32)	$	(0.08)

Table of Contents

Potentially dilutive securities that were not included in the diluted per share calculations because they would be anti-dilutive were as follows (in thousands):

As of

October 31, 2025

October 31, 2024

April 30, 2026

April 30, 2025

Shares subject to outstanding common stock options

43,~~620~~821

—5,526

Unvested restricted stock in connection with business combination

—

Unvested early exercised stock options

—

Unvested RSUs and PSUs

912,~~344~~324

610,~~377~~775

Shares subject to the ESPP

~~133~~340

~~219~~186

Total

1416,~~097~~485

616,~~598~~488

13. Commitments and Contingencies

Contractual Obligations and Commitments

The Company’s purchase obligations ~~of $242.6 million as of October 31, 2025,~~ represent third-party non-cancelable hosting infrastructure agreements, subscription arrangements and other commitments used in the ordinary course of business to meet operational requirements. ~~During~~There ~~the~~were ~~nine~~no ~~months~~material ~~ended~~changes ~~October~~to ~~31,~~the ~~2025,~~Company's wenon-cancelable ~~entered~~purchase ~~into~~obligations ~~two~~disclosed ~~new~~in ~~cloud~~our ~~infrastructure~~Annual ~~agreements.~~Report ~~The~~on ~~first~~Form ~~is a five~~10-~~year~~K ~~agreement~~for ~~with~~the ~~$130 million~~fiscal inyear ~~total~~ended ~~minimum~~January 31, ~~commitments~~2026, ~~with~~other ~~annual~~than ~~amounts~~a ~~ranging~~new ~~from~~ $1710.30 million, toone-year ~~$36.3 million.~~agreement ~~The~~with ~~second is~~ a ~~one~~third-~~year~~party ~~contract~~cloud ~~with~~services ~~$42.5 million~~provider inentered ~~annual~~into ~~minimum~~during ~~commitments.~~the three months ended April 30, 2026.

Loss Contingencies

In accordance with ASC 450, Loss Contingencies, the Company accrues for contingencies when losses become probable and reasonably estimable. Accordingly, the Company has recorded an estimated liability related to certain labor matters regarding its use of contractors in certain foreign countries. As of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, the estimated liability relating to these matters was ~~$1.6 million and $1.4 million recorded in other non-current liabilities on the condensed consolidated balance sheets, respectively.~~

Table of Contents

$0.9 million, recorded in other non-current liabilities on the condensed consolidated balance sheets, respectively.

Warranties and Indemnifications

The Company enters into service level agreements with customers which warrant defined levels of uptime and support response times and permit those customers to receive credits for prepaid amounts in the event that those performance and response levels are not met. To date, the Company has not experienced any significant failures to meet defined levels of performance and response. In connection with the service level agreements, the Company has not incurred any significant costs and has not accrued any liabilities in the condensed consolidated financial statements.

In the ordinary course of business, the Company enters into contractual arrangements under which the Company agrees to provide indemnification of varying scope and terms to business partners and other parties with respect to certain matters, including, but not limited to, losses arising out of the breach of such agreements, intellectual property infringement claims made by third parties, and other liabilities relating to or arising from the Company’s platform or the Company’s acts or omissions. In these circumstances, payment may be conditional on the other party making a claim pursuant to the procedures specified in the particular contract. Further, the Company’s obligations under these agreements may be limited in terms of time and/or amount, and in some instances, the Company may have recourse against third parties for certain payments.

In addition, the Company has agreed to indemnify its directors and executive officers for costs associated with any fees, expenses, judgments, fines, and settlement amounts incurred by any of these persons in any action or proceeding to which any of those persons is, or is threatened to be, made a party by reason of the person’s service as a director or officer, including any action by the Company, arising out of that person’s services as the Company’s director or officer or that person’s services provided to any other company or enterprise at the Company’s request. The Company maintains director and officer insurance coverage that may enable the Company to recover a portion of any future amounts paid.

Table of Contents

persons in any action or proceeding to which any of those persons is, or is threatened to be, made a party by reason of the person’s service as a director or officer, including any action by the Company, arising out of that person’s services as the Company’s director or officer or that person’s services provided to any other company or enterprise at the Company’s request. The Company maintains director and officer insurance coverage that may enable the Company to recover a portion of any future amounts paid.

Legal Proceedings

~~GitLab~~We ~~Securities~~are, ~~Class~~and ~~Action~~from ~~and~~time ~~Shareholder~~to ~~Derivative~~time ~~Cases~~may become, involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results.

On September 4, 2024, a putative class action was filed in the United States District Court for the Northern District of California, captioned Dolly v. GitLab et al., Case No. 24-cv-06244-EKL (“Dolly”), naming the Company and certain of its officers. The complaint purports to assert claims under Section 10(b) of the Securities Exchange Act of 1934 (“1934 Act”), SEC Rule 10b-5, and Section 20(a) of the 1934 Act, on behalf of persons and entities who acquired our common stock between June 5, 2023 and June 3, 2024 (the “Class Period”). Plaintiff alleges that, during the Class Period, defendants made material misrepresentations or omissions regarding, among other things, the Company’s use of AI features and ability to monetize the Company’s AI capabilities that artificially inflated the Company’s stock price. Plaintiff seeks, among other things, damages in an unspecified amount, as well as fees and costs. Plaintiff amended his complaint on February 5, 2025 and March 7, 2025, and we moved to dismiss the second amended complaint in April 2025. On August 14, 2025, the court granted the Company’s motion to dismiss with leave for the Plaintiff to amend and refile a third amended complaint. On September 8, 2025, the Plaintiff filed a stipulation stating that he had decided not to file an amended complaint or to appeal the motion to dismiss order, and asked the Court to dismiss his claims with prejudice and enter final judgment in favor of the defendants.

Three putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action. The cases were filed on February 14, 2025, in the United States District Court for the Northern District of California, captioned Preciado v. Sijbrandij et al., Case No. 25-cv-01597 (“Preciado”); on February 19, 2025 in the United States District Court for the Northern District of California, captioned Jones v. Sijbrandij et al., Case No. 25-cv-01735 (“Jones”); and on March 28, 2025 in the United States District Court for the Northern District of California, captioned Lianto v. Sijbrandij et al., Case No. 25-cv-02924 (“Lianto”). Each of the three cases are allegedly brought on the Company’s behalf. Each of the lawsuits name the Company as a nominal defendant, and also certain of the Company’s officers and current and former members of the Company’s board of directors. The Jones complaint purports to assert claims under Section 14(a) of the Exchange Act as well as breach of fiduciary duty, while the Preciado and Lianto complaints purport to assert those claims as well as unjust enrichment and related corporate torts. The complaints seek to recover unspecified damages and other relief on the Company’s behalf. As of May 2025, proceedings in each of these three putative shareholder derivative cases have been stayed during the pendency of the Dolly matter.

Based on the preliminary nature of the proceedings in these derivative actions, the outcomes remain uncertain and the Company cannot estimate the potential impact, if any, on its business or financial statements at this time.

In addition to the shareholder matters described above, the Company is, and from time to time may become, involved in legal proceedings or be subject to claims arising in the ordinary course of business. The Company is not presently a party to any legal proceedings that in the opinion of management, if determined adversely to the Company, would individually or taken together have a material adverse effect on its business, financial condition or operating results.

Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on the Company because of defense and settlement costs, diversion of management resources and other factors.

2714. Subsequent Events

On June 1, 2026, the board of directors of the Company approved a restructuring plan (the “Plan”). The Company anticipates approximately 14% of its global workforce as of January 31, 2026 may be impacted by the Plan. The Plan is intended to help position the Company for long-term success by realigning its operating structure to optimize execution against its strategic priorities. The Company also expects to exit 22 countries to reduce its team member geographic footprint by approximately 37%. As a result of the Plan, the Company expects to incur approximately $30 million to $35 million in pre-tax restructuring charges, consisting primarily of one-time severance, employee termination benefit costs, and retention costs associated with the execution of the Plan, of which approximately $19 million is expected to be incurred in the second quarter of fiscal year 2027, with the majority of the remainder expected to be recognized over the following three quarters. The Company expects the Plan to be substantially complete by the end of fiscal 2027. Additional costs associated with the Plan may be

Table of Contents

14identified and will be disclosed when reasonably estimable. ~~Subsequent~~The ~~Event~~charges that the Company expects to incur are subject to a number of assumptions, including legal requirements in various jurisdictions.

On ~~November~~May 2514, ~~2025~~2026, the Company’s ~~entered~~Executive ~~into~~Chair aSytse ~~Right~~Sijbrandij ofconverted ~~First~~15,134,451 ~~Refusal~~shares ~~Agreement~~of ~~(the~~Class ~~“Agreement”)~~B ~~with~~common ~~Kilo~~stock ~~Code~~into 15,134,451 ~~Inc~~shares of Class A common stock. ~~(“Kilo”),~~Each anshare ~~affiliate~~of Class B common stock carries 10 votes per share and is convertible into one share of ~~Sytse~~Class ~~Sijbrandij~~A common stock, ~~the~~which ~~executive~~carries ~~chair~~one ofvote ~~the~~per ~~Company’s~~share. ~~Board~~Following ofthe ~~Directors~~conversion, Mr. ~~The~~Sijbrandij remains the Company's ~~Audit~~largest ~~Committee~~individual ~~reviewed~~Class ~~and~~A ~~approved the Agreement~~shareholder.

The Agreement grants the Company a right of first refusal, for certain cash consideration, if Kilo receives a bona fide third-party acquisition proposal that it intends to accept or negotiate exclusively before August 24, 2026. The Company has 10 business days after receiving the offer to exercise its right to pursue the transaction on substantially matching terms. If the Company declines, Kilo may proceed with the third party. 26

Table of Contents

ITEM 2. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited condensed consolidated financial statements and the related notes included elsewhere in this Quarterly Report on Form 10-Q. You should review the section titled “Special Note Regarding Forward-Looking Statements” above in this Quarterly Report on Form 10-Q for a discussion of forward-looking statements and important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Factors that could cause or contribute to such differences include, but are not limited to, those identified below, and those discussed in the section titled “Risk Factors” in this Quarterly Report on Form 10-Q. Our historical results are not necessarily indicative of the results that may be expected for any period in the future.

Overview

InGitLab ~~today’s~~is ~~world, software defines~~ the ~~speed~~intelligent oforchestration ~~innovation.~~platform ~~Every~~for ~~industry~~DevSecOps, ~~business,~~where software teams and ~~function~~their ~~within~~Artificial aIntelligence ~~company~~(“AI”) isagents ~~dependent~~stay onin flow to ship software faster. ToBuilt ~~remain~~with ~~competitive~~a ~~and~~unified ~~survive~~data model, ~~nearly~~our ~~all~~platform ~~companies~~brings ~~must~~together ~~digitally~~development, ~~transform~~operations, Information Technology (“IT”), security, and ~~become~~business ~~experts~~teams atacross ~~developing,~~the ~~delivering~~entire software development lifecycle to deliver better, ~~and~~more ~~securing~~secure software faster.

ToAI ~~meet~~has ~~these~~accelerated ~~market~~individual ~~needs~~coding, ~~GitLab~~but ~~created~~teams ~~The~~lose ~~DevSecOps~~momentum ~~platform,~~coordinating aacross ~~fundamentally~~planning, ~~new~~testing, ~~approach~~security, todeployment, ~~software development~~ and ~~delivery~~operations. ~~Built~~Fragmented ~~with~~toolchains aand ~~unified~~tool-specific ~~data~~AI ~~model,~~agents ~~our~~create ~~platform~~bottlenecks ~~brings~~that ~~together~~slow ~~all~~software ~~stakeholders~~delivery. inGitLab's ~~the~~intelligent ~~software~~orchestration ~~delivery~~helps ~~lifecycle~~solve –this ~~from~~by ~~development~~enabling teams to ~~operations~~orchestrate ~~teams~~AI agents to ~~security~~execute ~~teams.~~tasks ~~With~~autonomously ~~GitLab,~~across ~~all~~the ~~stakeholders~~software ~~can~~lifecycle ~~build~~while ~~better~~maintaining quality, ~~more secure software~~security, ~~faster~~and speed.

GitLab isaccelerates ~~the~~customer ~~solution~~innovation ~~for~~by ~~significant~~reducing ~~business~~software ~~transformation~~development ~~needs.~~cycles ~~Across~~from ~~every~~weeks ~~industry – and across companies of every size – technology leaders want~~ to ~~make~~minutes. ~~developers~~The ~~more~~platform ~~productive~~eliminates sothe ~~they~~need ~~can~~for ~~deliver~~point ~~better~~tools, ~~products~~increases ~~faster; they want to measure~~ productivity, soand ~~they~~embeds ~~can~~security ~~increase~~into ~~operational~~development ~~efficiency;~~workflows ~~they~~with ~~want~~automated enforcement to ~~secure~~improve ~~the~~ software ~~supply chain so they can reduce~~ security ~~and compliance risk; and~~, ~~they want to accelerate secure cloud migration~~quality, ~~so they can unlock digital transformation results. These technology leaders need a platform that enables a value stream-driven mindset that shortens the time from idea to customer value~~ and ~~establishes~~compliance awhile ~~powerful~~enabling ~~flywheel~~faster ~~for data collection and aggregation~~delivery. ~~They are looking for a platform approach that unifies the entire development experience, so that customers can outpace and out-innovate their competition.~~

We ~~believe~~serve ~~GitLab~~teams ~~offers~~of ~~the~~all ~~shortest~~sizes, ~~path~~scopes, toand ~~unlock~~complexities. ~~technology~~As ~~transformation~~a ~~and~~result, ~~business~~we ~~value.~~have ~~GitLab~~more ~~accelerates~~than ~~our~~50 ~~customers’~~million ~~ability~~registered tousers, ~~innovate~~and byapproximately ~~accelerating~~50% ~~their~~of ~~software~~the ~~development~~Fortune ~~cycles~~100 ~~from~~companies ~~weeks~~are toGitLab ~~minutes~~customers1. ItWe ~~removes~~define ~~the~~our ~~need~~active ~~for~~customers ~~point~~as ~~tools~~those ~~and~~with ~~delivers~~more ~~enhanced~~than ~~operational~~$5,000 ~~efficiency~~of byAnnual ~~eliminating~~Recurring ~~manual~~Revenue, ~~work~~or ARR, ~~increasing~~in ~~productivity~~a given period, ~~and~~who ~~creating~~we arefer ~~culture~~to ofas ~~innovation~~our ~~and~~Base ~~velocity~~Customers. ~~Embedding~~A ~~security~~single ~~earlier~~organization inwith ~~the~~separate ~~development~~subsidiaries, ~~process~~segments, ~~GitLab~~or ~~enables~~divisions ~~customers~~that touses ~~improve~~our ~~software~~platform ~~security,~~is ~~quality,~~considered ~~and~~a ~~overall~~single ~~compliance~~customer for determining ARR.

GitLab is ~~available~~the toonly ~~any~~intelligent ~~team,~~orchestration ~~regardless~~platform offor ~~the~~DevSecOps ~~size,~~built ~~scope,~~on ~~and~~an ~~complexity~~open-core ofbusiness ~~their deployment~~model. AsAny acustomer ~~result,~~or wecontributor ~~have~~can ~~more~~add ~~than~~or 50enhance ~~million~~functionality ~~registered~~by ~~users,~~contributing ~~and~~code ~~more~~to ~~than~~the ~~50%~~core ofproduct ~~the~~or ~~Fortune~~extending ~~100~~our ~~companies~~Continuous ~~are~~Integration ~~GitLab~~(“CI”)/Continuous ~~customers.~~Delivery ~~For~~(“CD”) ~~purposes~~Catalog ofand ~~determining~~AI ~~the~~Catalog. ~~number~~In ofcalendar ~~our~~year ~~active customers~~2025, weusers ~~look~~contributed ~~at our customers with~~ more than $56,~~000~~500 ofmerge ~~Annual Recurring Revenue~~requests, orextending ~~ARR,~~our in-house aresearch ~~given~~and ~~period,~~development ~~who~~(“R&D”) weand ~~refer~~empowering toour asusers ~~our~~to ~~Base~~improve ~~Customers.~~the ~~For~~DevSecOps ~~purposes~~solution ofthey ~~determining~~use ~~our~~daily. ~~Base~~Our ~~Customers,~~open-core aapproach ~~single~~builds ~~organization~~trust with ~~separate~~our ~~subsidiaries,~~customers ~~segments,~~and orenables ~~divisions~~us ~~that~~to ~~use~~maintain ~~The~~our ~~DevSecOps~~high ~~platform~~velocity isof ~~considered~~innovation. aWe ~~single~~make ~~customer~~our ~~for~~strategy, ~~determining~~direction, ~~each~~and ~~organization’s~~product ~~ARR~~roadmap publicly available.

GitLab isoffers ~~the~~flexible ~~only~~deployment ~~DevSecOps~~options. ~~platform~~Customers ~~built~~can oninstall ~~an open~~self-~~core~~managed ~~business~~GitLab ~~model.~~instances Wein ~~enable~~their ~~any~~own ~~customer~~on-premises ~~and~~or ~~contributor~~hybrid tocloud ~~add~~environments, ~~functionality~~use to our ~~platform.~~fully Inmanaged ~~calendar~~SaaS ~~year~~offering ~~2024,~~in ~~nearly~~public ~~900~~or ~~people~~private ~~contributed more than 3~~clouds,~~000~~ ~~merge~~or ~~requests~~deploy ~~back~~GitLab ~~to the core product~~Dedicated, ~~extending~~our ~~GitLab’s in~~single-~~house~~tenant ~~R&D~~SaaS ~~efforts and empowering our most passionate users to make improvements to the DevSecOps~~ solution ~~they~~for ~~use~~organizations ~~every day. Our open-core approach engenders trust~~ with ~~our~~complex ~~customers~~security and ~~enables~~compliance ~~us to maintain our high velocity of innovation~~requirements.

291Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab.

See the section entitled “Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for additional information about how we define ARR.

Table of Contents

Our transparent business value also helps us grow the open source community. We make our strategy, direction, and product roadmap available to the wider community in order to encourage and solicit their feedback. Through responsible transparency, we create a deeper level of trust with our customers and make it easier to solicit contributions and collaboration from our users and customers.

GitLab offers a flexible deployment model for our customers. For our self-managed offering, the customer installs GitLab in their own on-premise or hybrid cloud environment. For our SaaS offering, the platform is managed by GitLab and hosted either in our public cloud or in our private cloud based on the customer’s preference. We also offer GitLab Dedicated, our single tenant SaaS solution, well suited for organizations with complex security and compliance requirements. See the section entitled “Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for additional information about how we define ARR.

Factors Affecting Our Performance

Sustaining innovation and technology leadership

We believe we have built a highly differentiated platform that gives us an advantage over our competitors by empowering business, development, security, operations, and IT teams to collaborate in a single application across the entire DevSecOps lifecycle. Our technology leadership is an outcome of various factors, including our strong community, network of contributors, and continued enhancement of The ~~DevSecOps~~GitLab platform by developing new features and expanding the functionality of existing features with speed and consistency. We have had a history of releasing enhancements to The ~~DevSecOps~~GitLab platform every month and, as of ~~October~~April 3130, ~~2025~~2026, had done so for the last ~~169~~175 months. We intend to continue releasing new software on a monthly cadence.

We also intend to continue investing in research and development to further enhance The ~~DevSecOps~~GitLab platform and sustain our innovation and technology leadership. We have a history of investing in our open source community and intend to continue to leverage our open core software to accelerate innovation. We also intend to continue to add headcount to our research and development team to extend the functionality and range of The ~~DevSecOps~~GitLab platform by bringing new and improved products and services to our customers.

We expect our research and development expenses to increase on an absolute basis in future periods. We foresee that such investment in research and development will contribute to our long-term growth, but may also negatively impact our short-term profitability. As engaged members of the GitLab open-source community, our contributors often serve as subject matter experts at market-leading developer events and The ~~DevSecOps~~GitLab platform is presented on the cutting edge of innovation. We intend to continue to invest in building out this community to foster more contributions and collaboration in the space. Our open source community, in turn, accelerates our ability to innovate and provide a better platform to our customers. We intend to expend additional resources in the future to continue enhancing The ~~DevSecOps~~GitLab platform and introducing new products, features and functionality.

Acquiring New Customers

Our future growth depends in large part on our ability to acquire new customers. This, in turn, relies on our ability to reach teams and organizations through our marketing and sales efforts. To this end, we are making investments in our sales and marketing efforts to expand our reach and differentiate The ~~DevSecOps~~GitLab platform from competitive products and services. We believe that eventually the vast majority of organizations will switch to a ~~DevSecOps~~GitLab platform and embrace a single application approach, creating a substantial opportunity to continue to grow our customer base. As a result, our Base Customers increased to 10,~~475~~831 as of ~~October~~April 3130, ~~2025~~2026 from 910,~~519~~104 as of ~~October~~April 3130, ~~2024~~2025, an increase of 107% and our $100,000 ARR customers increased to 1,~~405~~519 as of ~~October~~April 3130, ~~2025~~2026 from 1,~~144~~288 as of ~~October~~April 3130, ~~2024~~2025, an increase of 2318%. See the section entitled “—Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for information about how we define ARR.

30Our operating results and growth prospects will depend in part on our ability to attract new customers. While we believe we have a significant market opportunity that The GitLab platform addresses, we will need to continue to invest in sales and marketing, research and development, and customer support to further grow our customer base, both in the United States and internationally. We believe that we have more than 50 million registered users, which includes users of our free tier offering, providing a base of potential new customers. We intend to continue to add headcount to our global sales and marketing team to acquire new customers and to increase sales to existing customers.

Table of Contents

Our operating results and growth prospects will depend in part on our ability to attract new customers. While we believe we have a significant market opportunity that The DevSecOps platform addresses, we will need to continue to invest in sales and marketing, research and development, and customer support to further grow our customer base, both in the United States and internationally. We believe that we have more than 50 million registered users, which includes users of our free tier offering, providing a base of potential new customers. We intend to continue to add headcount to our global sales and marketing team to acquire new customers and to increase sales to existing customers.

Retaining and Expanding Our Existing Customers

We employ a “land and expand” business strategy that focuses on efficiently acquiring new customers and growing our relationships with existing customers over time. We believe that as our customers realize the benefits of a single application approach, they will increase the use of The ~~DevSecOps~~GitLab platform, enhancing our ability to expand revenue generation within our existing customers over time. As a result of our approach, as of October 31, 2025 and 2024, our Dollar-Based Net Retention Rate was 119% and 124%, respectively. See the section entitled “—Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for information about how we define Dollar-Based Net Retention Rate.

We plan to continue investing in sales and marketing, with a focus on expanding usage of our platform with our existing customers. We believe that this expansion will provide us with substantial operating leverage because the costs to expand sales within existing customers are significantly less than the costs to acquire new customers. Our future revenue growth and our ability to achieve and maintain profitability is dependent upon our ability to continue landing new customers, expanding the adoption of The DevSecOps platform by additional users within their organizations, selling add-on offerings, and upgrading customers to higher-priced tiers. Ultimately, our ability to increase sales to existing customers will depend on several factors, including our customers’ satisfaction with The DevSecOps platform, our pricing, competition, and overall changes in our customers’ spending levels. 28

Table of Contents

platform, enhancing our ability to expand revenue generation within our existing customers over time. As a result of our approach, as of April 30, 2026 and 2025, our Dollar-Based Net Retention Rate was 117% and 122%, respectively. See the section entitled “—Key Business Metrics—Dollar-Based Net Retention Rate and ARR” below for information about how we define Dollar-Based Net Retention Rate.

We plan to continue investing in sales and marketing, with a focus on expanding usage of our platform with our existing customers. We believe that this expansion will provide us with substantial operating leverage because the costs to expand sales within existing customers are significantly less than the costs to acquire new customers. Our future revenue growth and our ability to achieve and maintain profitability is dependent upon our ability to continue landing new customers, expanding the adoption of The GitLab platform by additional users within their organizations, selling add-on offerings, and upgrading customers to higher-priced tiers. Ultimately, our ability to increase sales to existing customers will depend on several factors, including our customers’ satisfaction with The GitLab platform, our pricing, competition, and overall changes in our customers’ spending levels.

Partnerships, Alliances, Channels, and Integrations

We believe that our further growth depends in part on our ability to build and maintain successful partnerships, alliances, channels and integrations. We are continuously investing in developing a strong ecosystem and partner network, comprised of cloud and technology partners, resellers, and system integrators, as a way to expand our go-to-market strategy. We plan to continue investing in and developing these relationships to broaden our distribution footprint and drive greater awareness of our brand and The ~~DevSecOps~~GitLab platform. We believe that these partnerships will extend our sales reach and provide product and technology integrations that will accelerate implementation of The ~~DevSecOps~~GitLab platform in the United States and internationally. While expending resources in developing these partnerships and alliances may adversely impact our short-term profitability, we believe these investments will lead to longer term growth for the business as a whole.

Continuing to Scale our Business

We plan to continue investing in our business so that we can capitalize on our market opportunity. We believe that these investments will contribute to our long-term growth, although they may adversely affect our operating results in the near term. Furthermore, we expect our general and administrative expenses to increase in absolute amount for the foreseeable future given the additional expenses for accounting, compliance, and insurance as a public company. We plan to balance these investments in future growth with a continued focus on managing our operating results.

Key Business Metrics

We monitor the following key metrics to help us evaluate our business, identify trends affecting our business, formulate business plans, and make strategic decisions.

Table of Contents

Dollar-Based Net Retention Rate and ARR

We believe that our ability to retain and expand our revenue generated from our existing customers is an indicator of the long-term value of our customer relationships and our potential future business opportunities. Dollar-Based Net Retention Rate measures the percentage change in our ARR derived from our customer base at a point in time. Our calculation of ARR and by extension Dollar-Based Net Retention Rate, includes both self-managed and SaaS subscription revenue. We report Dollar-Based Net Retention Rate on a threshold basis of 130% each quarter or the actual number if below 130%.

We calculate ARR by taking the monthly recurring revenue, or MRR, and multiplying it by 12. MRR for each month is calculated by aggregating, for all customers during that month, monthly revenue from committed contractual amounts of subscriptions, including our self-managed and SaaS offerings but excluding professional services. We calculate Dollar-Based Net Retention Rate as of a period end by starting with our customers as of the 12 months prior to such period end, or the Prior Period ARR. We then calculate the ARR from these customers as of the current period end, or the Current Period ARR. The calculation of Current Period ARR includes any upsells, price adjustments, user growth within a customer, contraction, and attrition. We then divide the total Current Period ARR by the total Prior Period ARR to arrive at the Dollar-Based Net Retention Rate.

	As of October 31,
	2025	2024
Dollar-Based Net Retention Rate	119%	124%

Table of Contents

then calculate the ARR from these customers as of the current period end, or the Current Period ARR. The calculation of Current Period ARR includes any upsells, price adjustments, user growth within a customer, contraction, and attrition. We then divide the total Current Period ARR by the total Prior Period ARR to arrive at the Dollar-Based Net Retention Rate.



	As of April 30,
	2026	2025
Dollar-Based Net Retention Rate	117%	122%

Customers with ARR of $100,000 or More

We believe that our ability to increase the number of $100,000 ARR customers is an indicator of our market penetration and strategic demand for The ~~DevSecOps~~GitLab platform. A single organization with separate subsidiaries, segments, or divisions that use The ~~DevSecOps~~GitLab platform is considered a single customer for determining each organization’s ARR. We do not count our reseller or distributor channel partners as customers. In cases where customers subscribe to The ~~DevSecOps~~GitLab platform through our channel partners, each end customer is counted separately.

	As of October 31,
	As of April 30,
	2025	2024
	2026	2025
$100,000 ARR customers	1,~~405~~519	1,~~144~~288

Components of Our Results of Operations

Revenue

Subscription - self-managed and SaaS

Subscription revenue primarily consists of support, maintenance, upgrades, and updates on a when-and-if-available basis for our self-managed ~~customers~~offering and the right to access our product in a cloud-based-infrastructure that we host for our SaaS ~~customers~~offering. Subscription revenue is recognized ratably over the ~~contract~~contractual ~~period~~term as the performance obligation is satisfied.

The typical term of a subscription contract is one to three years.

License - self-managed and other

The license component of our self-managed ~~subscriptions~~offering ~~reflects~~provides the ~~revenue~~right ~~recognized~~to byuse ~~providing~~our ~~customers with access to~~ proprietary software ~~features~~. License revenue is recognized up-front when control of the software license istransfers ~~made available~~ to ~~our~~the ~~customers~~customer.

32Other revenue consists of professional services, including consulting, implementation, and training which is recognized as services are performed.

Table of Contents

Other revenue consists of professional services revenue which is derived from fixed fee and time and materials engagements. Revenue from professional services is recognized as the services are performed and control is transferred. For fixed fee engagements that include acceptance clauses, control is deemed to transfer upon customer confirmation, as defined in the respective contract. Accordingly, revenue is recognized upon satisfaction of all contractual requirements.

Cost of Revenue

Subscription - self-managed and SaaS

Cost of revenue for self-managed and SaaS subscriptions consists primarily of allocated cloud-hosting costs paid to third-party service providers, personnel-related costs associated with our customer support personnel, including contractors, third-party payment processing fees, and allocated overhead. Personnel-related expenses consist of salaries, benefits, bonuses, and stock-based compensation. We expect our cost of revenue for self-managed and SaaS subscriptions to increase in absolute dollars as our self-managed and SaaS subscription revenue increases. As our SaaS ~~offering~~and ~~makes~~Duo Agent Platform offerings make up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and managing costs, which may adversely impact our gross margins.

Table of Contents

License - self-managed and other

Cost of self-managed license and other revenue consists primarily of contractor and personnel-related costs, including stock-based compensation expense, associated with the professional services team, third-party payment processing fees, and allocated overhead. We expect our cost of revenue for self-managed license and other to increase in absolute dollars as our self-managed and other revenue increases.

Operating Expenses

Our operating expenses consist of sales and marketing, research and development, and general and administrative expenses. Personnel-related expenses are the most significant component of operating expenses and consist of salaries, benefits, bonuses, stock-based compensation, and sales commissions. Operating expenses also include IT overhead costs.

Sales and Marketing

Sales and marketing expenses consist primarily of personnel-related expenses associated with our sales and marketing personnel, advertising, travel and entertainment related expenses, branding and marketing events, promotions, software subscriptions, and our allocated cloud infrastructure expenses for our free tier. Sales and marketing expenses also include sales commissions paid to our sales force. Such costs incurred on acquisition of an initial contract are capitalized and amortized over an estimated period of benefit of three years, and any such expenses paid for the renewal of a subscription are capitalized and amortized over the contractual term of the renewal. However, prorated costs for sales commissions that are incremental to obtain a self-managed license contract are expensed immediately.

We expect sales and marketing expenses to increase in absolute dollars as we continue to make strategic investments in our sales and marketing organization to drive additional revenue, further penetrate the market, and expand our global customer base, but to decrease as a percentage of our total revenue over time, although our sales and marketing expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.

Research and Development

Research and development expenses consist primarily of personnel-related expenses, including contractors, as well as cloud infrastructure expenses to support our internal development efforts, and software and subscription services. Costs related to research and development are expensed as incurred.

Table of Contents

We expect research and development expenses to increase in absolute dollars as we continue to increase investments in our existing products and services. However, we anticipate research and development expenses to decrease as a percentage of our total revenue over time, although our research and development expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.

General and Administrative

General and administrative expenses consist primarily of personnel-related expenses for our ~~executives,~~ finance, legal, ~~and~~ human resources, ~~teams~~and corporate administrative functions. General and administrative expenses also include external legal, accounting, and director and officer insurance, as well as other consulting and professional services fees, software and subscription services, in-person company-wide event expenses, and any contract termination fees.

We incur expenses as a result of operating as a public company, including costs to comply with the rules and regulations applicable to companies listed on a national securities exchange, costs related to compliance and reporting obligations, costs related to Sarbanes-Oxley compliance, and expenses for insurance, investor relations, and related professional services. We expect that our general and administrative expenses will increase in absolute dollars as our business grows but will decrease as a percentage of our total revenue over time, although our general and administrative expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.

Table of Contents

percentage of our total revenue over time, although our general and administrative expenses may fluctuate as a percentage of our total revenue from period-to-period depending on the timing of these expenses.

Interest Income, and Other Income (Expense), Net

Interest income consists primarily of interest earned on our cash equivalents and short-term investments.

Other income (expense), net consists primarily of foreign currency transaction gains and losses and indirect tax credit expense related to the JiHu formation.

Provision for ~~(Benefit from)~~ Income Taxes

Provision for ~~(benefit from)~~ income taxes consists primarily of income taxes in the foreign and state jurisdictions in which we conduct business. We maintain a full valuation allowance against our deferred tax assets in certain jurisdictions because we have concluded that it is not more likely than not that the deferred tax assets will be realized.

Table of Contents

Results of Operations

The following table sets forth our results of operations for the periods presented (in thousands):

Three Months Ended October 31,

Nine Months Ended October 31,

Three Months Ended April 30,

2025

2024

2025

2024

2026

2025

Revenue:

Subscription—self-managed and SaaS

~~223~~239,~~262~~306

~~175~~194,~~257~~481

~~630,427~~

~~489,617~~

License—self-managed and other

2124,~~091~~852

20,~~790~~028

~~64,395~~

~~58,201~~

Total revenue

~~244~~264,~~353~~158

~~196~~214,~~047~~509

~~694,822~~

~~547,818~~

Cost of revenue:(1)

Subscription—self-managed and SaaS

2530,~~184~~591

1719,~~170~~268

~~66,205~~

~~47,639~~

License—self-managed and other

76,~~037~~897

45,~~955~~767

~~19,556~~

~~14,632~~

Total cost of revenue

3237,~~221~~488

2225,~~125~~035

~~85,761~~

~~62,271~~

Gross profit

~~212~~226,~~132~~670

~~173~~189,~~922~~474

~~609,061~~

~~485,547~~

Operating expenses:

Sales and marketing(1)

~~104~~119,~~974~~358

95107,~~340~~587

~~322,144~~

~~285,542~~

Research and development(1)

6871,~~715~~482

6165,~~354~~410

~~205,613~~

~~176,767~~

General and administrative(1)

5051,~~799~~579

4551,~~960~~087

~~146,621~~

~~146,615~~

Total operating expenses

~~224~~242,~~488~~419

~~202~~224,~~654~~084

~~674,378~~

~~608,924~~

Loss from operations

(1215,~~356~~749)

(2834,~~732~~610)

~~(65,317)~~

~~(123,377)~~

Interest income

11,~~704~~947

1210,~~586~~862

~~34,077~~

~~37,443~~

Other income (expense), net

~~(6,334)~~255

4(9,~~799~~971)

~~(17,216)~~

~~5,170~~

Loss before income taxes

(63,~~986~~547)

(1133,~~347~~719)

~~(48,456)~~

~~(80,764)~~

Provision for (benefit from) income taxes

1,811

(39,152)

6,595

(65,330)

Provision for income taxes

2,032

2,539

Net income (loss)

(8,797)

27,805

(55,051)

(15,434)

Net loss

(5,579)

(36,258)

Net loss attributable to noncontrolling interest(2)

(~~521~~607)

(~~1,298~~383)

~~(1,692)~~

~~(2,216)~~

Net income (loss) attributable to GitLab

(8,276)

29,103

(53,359)

(13,218)

Net loss attributable to GitLab

(4,972)

(35,875)

~~(1)Includes stock-based compensation expense as follows:~~32

	Three Months Ended October 31,				Nine Months Ended October 31,
	2025		2024		2025		2024
	(in thousands)				(in thousands)
Cost of revenue	$	2,300	$	1,993	$	6,490	$	5,924
Sales and marketing	17,354		17,012		59,395		54,290
Research and development	15,560		14,384		49,029		42,834
General and administrative	16,468		14,653		46,879		36,215
Total stock-based compensation expense	$	51,682	$	48,042	$	161,793	$	139,263

Table of Contents

(1)Includes stock-based compensation expense as follows:


	Three Months Ended April 30,
	2026		2025

	(in thousands)
Cost of revenue	$	2,864	$	1,929
Sales and marketing	17,445		22,091
Research and development	13,630		14,272
General and administrative	16,122		17,535
Total stock-based compensation expense	$	50,061	$	55,827

(2)Our results of operations include our variable interest entity, JiHu. The ownership interest of other investors is recorded as a noncontrolling interest. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

The following table sets forth the components of our condensed consolidated statements of operations as a percentage of total revenue for each of the periods presented:

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Revenue	100	%	100	%	~~100~~	%	~~100~~	%
Cost of revenue	1314		1112		12		11
Gross profit	8786		8988		88		89
Operating expenses:
Sales and marketing	4345		4950		46		52
Research and development	2827		3130		30		32
General and administrative	2120		2324		21		27
Total operating expenses	92		~~103~~104		97		~~111~~
Loss from operations	(56)		(1516)		~~(9)~~		~~(23)~~
Interest income	5		65		5		7
Other income (expense), net	~~(3)~~—		2(5)		~~(2)~~		1
Loss before income taxes	(31)		(616)		~~(7)~~		~~(15)~~
Provision for (benefit from) income taxes	1		(20)		1		(12)
Provision for income taxes	1		1
Net income (loss)	(4)	%	14	%	(8)	%	(3)	%
Net loss	(2)	%	(17)	%
Net loss attributable to noncontrolling interest	—	%	~~(1)~~—	%	—	%	—	%
Net income (loss) attributable to GitLab	(3)	%	15	%	(8)	%	(2)	%
Net loss attributable to GitLab	(2)	%	(17)	%

~~Comparison of the Three and Nine Months Ended October 31, 2025 and 2024~~33

Revenue

	Three Months Ended October 31,				Change				Nine Months Ended October 31,				Change
	2025		2024		$		%		2025		2024		$		%
	(in thousands, except percentages)								(in thousands, except percentages)
Subscription—self-managed and SaaS	$	223,262	$	175,257	$	48,005	27	%	$	630,427	$	489,617	$	140,810	29	%
License—self-managed and other	21,091		20,790		301		1		64,395		58,201		6,194		11
Total revenue	$	244,353	$	196,047	$	48,306	25	%	$	694,822	$	547,818	$	147,004	27	%

Revenue increased $48.3 million, or 25%, to $244.4 million for the three months ended October 31, 2025 from $196.0 million for the three months ended October 31, 2024. Revenue increased $147.0 million, or 27%, to $694.8 million for the nine months ended October 31, 2025 from $547.8 million for the nine months ended October 31, 2024. The increase was primarily due to the ongoing demand for The DevSecOps platform, including adding new customers, the expansion within our existing paid customers, and an increase in our number of customers with $100,000 or greater in ARR. As of October 31, 2025

Table of Contents

~~and~~Comparison ~~2024, our expansion is reflected by our Dollar-Based Net Retention Rate being 119% and 124%, respectively. We had 1,405 customers with ARR over $100,000 as~~ of ~~October 31,~~the ~~2025,~~Three ~~increasing~~Months ~~from~~Ended ~~1,144~~April ~~customers with ARR over $100~~30,~~000~~ as2026 ofand ~~October 31, 2024.~~2025

Revenue attributed to our variable interest entity, JiHu, was $2.3 million and $1.9 million for the three months ended October 31, 2025 and 2024, respectively, and $6.4 million and $5.3 million for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.


	Three Months Ended April 30,				Change
	2026		2025		$		%

	(in thousands, except percentages)
Subscription—self-managed and SaaS	$	239,306	$	194,481	$	44,825	23	%
License—self-managed and other	24,852		20,028		4,824		24
Total revenue	$	264,158	$	214,509	$	49,649	23	%

Revenue increased $49.6 million, or 23%, to $264.2 million for the three months ended April 30, 2026 from $214.5 million for the three months ended April 30, 2025. The increase was primarily due to the ongoing demand for the GitLab platform, including adding new customers, the expansion within our existing paid customers, and an increase in our number of customers with $100,000 or greater in ARR. As of April 30, 2026 and 2025, our expansion is reflected by our Dollar-Based Net Retention Rate being 117% and 122%, respectively. We had 1,519 customers with ARR over $100,000 as of April 30, 2026, increasing from 1,288 customers with ARR over $100,000 as of April 30, 2025.

Revenue attributed to our variable interest entity, JiHu, was $2.5 million and $1.9 million for the three months ended April 30, 2026 and 2025, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

Cost of Revenue, Gross Profit, and Gross Margin

	Three Months Ended October 31,						Change				Nine Months Ended October 31,						Change
	Three Months Ended April 30,						Change
	2025			2024			$		%		2025			2024			$		%
	2026			2025			$		%
	(in thousands, except percentages)										~~(in thousands, except percentages)~~
Cost of revenue	$	3237,~~221~~488		$	2225,~~125~~035		$	1012,~~096~~453	4650	%	$	~~85,761~~		$	~~62,271~~		$	~~23,490~~	38	%
Gross profit	~~212~~226,~~132~~670			~~173~~189,~~922~~474			3837,~~210~~196		2220		~~609,061~~			~~485,547~~			~~123,514~~		25
Gross margin	8786		%	8988		%			(2)	%	88		%	89		%			~~(1)~~	%

Cost of revenue increased by $1012.15 million, to $3237.25 million for the three months ended ~~October~~April 3130, ~~2025~~2026 from $2225.10 million for the three months ended ~~October~~April 3130, ~~2024~~2025, primarily due to an increase of $5.7.5 million in third party hosting ~~expenses~~costs for ~~increased~~ SaaS and cloud usage. The remaining change was primarily attributable to an increase of $23.28 million in personnel-related expenses, driven by an increase in our average customer support and professional services headcount and an increase of $0.39 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below)~~, an increase of $1~~.6 ~~million in fees associated with professional services revenue delivery and an increase of $0.5 million of marketplace transaction processing fees.~~ Gross margin decreased by 2% atto 8786% for the three months ended ~~October~~April 3130, ~~2025~~2026 compared to 8988% for the three months ended ~~October~~April 3130, ~~2024~~2025.

Cost of revenue ~~increased~~attributed ~~by $23.5 million,~~ to ~~$85.8~~our ~~million~~variable ~~for~~interest ~~the nine months ended October 31~~entity, ~~2025 from $62.3 million for the nine months ended October 31~~JiHu, ~~2024,~~was ~~primarily due to an increase of~~ $120.15 million ~~in third-party hosting costs~~ for ~~increased~~each ~~SaaS and cloud usage. The remaining change was primarily attributable to an increase~~ of $4.7 million in personnel-related expenses, driven by an increase in our average customer support and professional services headcount and an increase of $0.6 million in stock-based compensation expenses (as discussed in the ~~section~~three ~~titled~~months ~~“Stock-Based~~ended ~~Compensation~~April ~~Expense” below)~~30, an2026 ~~increase of $3.3 million in fees associated with professional services revenue delivery,~~ and ~~an increase of $1~~2025.8 ~~million~~See of“Note ~~marketplace transaction processing fees~~10. ~~Gross~~Joint ~~margin~~Venture” ~~decreased by 1%~~ to ~~88%~~our ~~for~~condensed ~~the~~consolidated ~~nine~~financial ~~months~~statements ~~ended October 31, 2025 compared to 89%~~ for ~~the~~additional ~~nine months ended October 31, 2024~~details.

Cost of revenue attributed to our variable interest entity, JiHu, was $0.5 million for each of the three months ended October 31, 2025 and 2024, and $1.4 million and $1.5 million for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.34

Table of Contents

Sales and Marketing

	Three Months Ended October 31,				Change				Nine Months Ended October 31,				Change
	Three Months Ended April 30,				Change
	2025		2024		$		%		2025		2024		$		%
	2026		2025		$		%
	(in thousands, except percentages)								~~(in thousands, except percentages)~~
Sales and marketing expenses	$	~~104~~119,~~974~~358	$	95107,~~340~~587	$	911,~~634~~771	1011	%	$	~~322,144~~	$	~~285,542~~	$	~~36,602~~	13	%

Sales and marketing expenses increased by $911.68 million, to $~~105~~119.04 million for the three months ended ~~October~~April 3130, ~~2025~~2026 from $95107.36 million for the three months ended ~~October~~April 3130, ~~2024~~2025, primarily due to an increase of $6.63 million in ~~personnel-related~~hosting expenses, ~~driven~~and by an increase inof ~~our~~$5.9 ~~average~~million ~~sales~~from ~~and~~company ~~marketing~~events. ~~headcount~~This ~~and~~was anpartially ~~increase~~offset by a decrease of $2.0 million in personnel-related expenses, driven by a decrease of $4.36 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below) ~~and an increase of $0~~.~~8 million in sales commissions expense. The remaining change was primarily attributed to an increase of $1.6 million in hosting expenses.~~

Sales and marketing expenses ~~increased~~attributed ~~by $36.6 million,~~ to ~~$322.1~~our ~~million~~variable ~~for~~interest ~~the~~entity, ~~nine months ended October 31~~JiHu, ~~2025~~were ~~from~~ $~~285~~1.5 million for each of the ~~nine~~three months ended ~~October~~April 3130, ~~2024,~~2026 ~~primarily due to an increase of $28.7 million in personnel-related expenses, driven by an increase in our average sales~~ and ~~marketing headcount and an increase of $5~~2025.1 ~~million~~See ~~in stock-based compensation expenses (as discussed in the section titled~~ “~~Stock-Based~~Note ~~Compensation Expense” below) and an increase of $5~~10.8 ~~million~~Joint inVenture” ~~sales commissions expense. The remaining change was primarily attributed~~ to anour ~~increase~~condensed ofconsolidated ~~$4.3~~financial ~~million~~statements infor ~~hosting~~additional ~~expenses~~details.

Sales and marketing expenses attributed to our variable interest entity, JiHu, were $1.7 million and $1.8 million for the three months ended October 31, 2025 and 2024, respectively, and $4.7 million and $4.9 million for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

Research and Development

	Three Months Ended October 31,				Change				Nine Months Ended October 31,				Change
	Three Months Ended April 30,				Change
	2025		2024		$		%		2025		2024		$		%
	2026		2025		$		%
	(in thousands, except percentages)								~~(in thousands, except percentages)~~
Research and development expenses	$	6871,~~715~~482	$	6165,~~354~~410	$	76,~~361~~072	129	%	$	~~205,613~~	$	~~176,767~~	$	~~28,846~~	16	%

Research and development expenses increased by $76.41 million, to $6871.75 million for the three months ended ~~October~~April 3130, ~~2025~~2026 from $6165.4 million for the three months ended ~~October~~April 3130, ~~2024~~2025, primarily ~~due~~driven toby an increase of $52.46 million in hosting expenses and an increase of $2.2 million in personnel-related expenses, driven by an increase in our average research and development headcount and ana ~~increase~~decrease of $10.26 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). ~~The remaining change was primarily attributed to an increase of $1.9 million in hosting expenses.~~

Research and development expenses ~~increased~~attributed byto ~~$28.8~~our ~~million~~variable interest entity, toJiHu, were $~~205~~0.6 million ~~for~~and ~~the nine months ended October 31, 2025 from~~ $~~176~~0.84 million for the ~~nine~~three months ended ~~October~~April 3130, ~~2024,~~2026 ~~primarily~~and ~~due~~2025, torespectively. anSee ~~increase~~“Note ~~of $22~~10.9 ~~million~~Joint inVenture” ~~personnel-related~~to ~~expenses, driven by an increase in~~ our ~~average~~condensed ~~research~~consolidated ~~and~~financial ~~development~~statements ~~headcount~~for ~~and~~additional ~~an increase of $6~~details.~~2 million in stock-based~~

Table of Contents

compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). The remaining change was primarily attributed to an increase of $5.2 million in hosting expenses.

Research and development expenses attributed to our variable interest entity, JiHu, were $0.5 million and $0.6 million for the three months ended October 31, 2025 and 2024, respectively, and $0.7 million and $1.0 million for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

General and Administrative

	Three Months Ended October 31,				Change				Nine Months Ended October 31,				Change
	Three Months Ended April 30,				Change
	2025		2024		$		%		2025		2024		$		%
	2026		2025		$		%
	(in thousands, except percentages)								~~(in thousands, except percentages)~~
General and administrative expenses	$	5051,~~799~~579	$	4551,~~960~~087	$	~~4,839~~492	111	%	$	~~146,621~~	$	~~146,615~~	$	6	—	%

General and administrative expenses increased by $4.8 million, to $50.8 million for the three months ended October 31, 2025 from $46.0 million for the three months ended October 31, 2024, primarily driven by an increase of $5.7 million in personnel-related expenses, driven by an increase in our average general and administrative headcount and an increase of $1.8 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). This was partially offset by a decrease of $1.0 million in charitable donation of common stock.35

General and administrative expenses were $146.6 million for both the nine months ended October 31, 2025 and 2024. This reflects a decrease of $15.4 million in expense related to our in-person company-wide event that took place in the nine months ended October 31, 2024, a decrease from the prior year $3.8 million expense related to fair value remeasurement of acquisition-related contingent consideration and a decrease of $3.4 million in charitable donations of common stock. This was offset by an increase of $18.0 million in personnel-related expenses, mainly attributable to an increase in our average general and administrative headcount and an increase of $10.7 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below) and an increase of $3.0 million in consulting and software expense.

General and administrative expenses attributed to our variable interest entity, JiHu, were $1.3 million and $1.6 million for the three months ended October 31, 2025 and 2024, respectively, and $4.3 million and $3.4 million for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

Table of Contents

General and administrative expenses increased by $0.5 million to $51.6 million for the three months ended April 30, 2026 from $51.1 million for the three months ended April 30, 2025, primarily due to an increase of $2.4 million in personnel-related expenses, mainly attributable to an increase in our average general and administrative headcount and a decrease of $1.4 million in stock-based compensation expenses (as discussed in the section titled “Stock-Based Compensation Expense” below). This was partially offset by a decrease of $1.7 million mainly in charitable donations of common stock.

General and administrative expenses attributed to our variable interest entity, JiHu, were $1.3 million for each of the three months ended April 30, 2026 and 2025. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

Stock-Based Compensation Expense

	Three Months Ended October 31,				Change				Nine Months Ended October 31,				Change
	Three Months Ended April 30,				Change
	2025		2024		$		%		2025		2024		$		%
	2026		2025		$		%
	(in thousands, except percentages)								~~(in thousands, except percentages)~~
Cost of revenue	$	2,~~300~~864	$	1,~~993~~929	$	~~307~~935	1548	%	$	~~6,490~~	$	~~5,924~~	$	~~566~~	10	%
Sales and marketing	17,~~354~~445		1722,~~012~~091		~~342~~(4,646)		2(21)		~~59,395~~		~~54,290~~		~~5,105~~		9
Research and development	1513,~~560~~630		14,~~384~~272		~~1,176~~(642)		8(4)		~~49,029~~		~~42,834~~		~~6,195~~		14
General and administrative	16,~~468~~122		1417,~~653~~535		(1,~~815~~413)		12(8)		~~46,879~~		~~36,215~~		~~10,664~~		29
Total stock-based compensation expense	$	5150,~~682~~061	$	4855,~~042~~827	$	3(5,~~640~~766)	8(10)	%	$	~~161,793~~	$	~~139,263~~	$	~~22,530~~	16	%

Stock-based compensation expense ~~increased~~decreased by $35.68 million, to $5150.71 million for the three months ended ~~October~~April 3130, ~~2025~~2026 from $4855.08 million for the three months ended ~~October~~April 3130, ~~2024~~2025, primarily due to ana ~~increase~~decrease of $43.17 million of expense from RSUs, ~~partially~~and ~~offset by a~~ $1.01 million ~~decrease~~related into ~~PSUs~~stock options.

Stock-based compensation ~~expense~~attributed ~~increased~~to byour ~~$22.5 million,~~variable tointerest ~~$161.8 million~~entity, ~~for~~JiHu, ~~the~~was ~~nine~~an ~~months~~expense ~~ended~~of ~~October~~$0.9 million ~~31,~~and ~~2025~~net ~~from~~gain of $~~139~~0.32 million for the ~~nine~~three months ended ~~October~~April 3130, ~~2024,~~2026 ~~primarily~~and ~~due~~2025, torespectively. anSee ~~increase~~“Note ~~of $19~~10.~~3 million~~ ofJoint ~~expense~~Venture” ~~from~~to ~~RSUs~~our ~~and~~condensed ~~$3.2 million~~consolidated ~~related~~financial tostatements ~~stock~~for ~~options~~additional details.

Stock-based compensation attributed to our variable interest entity, JiHu, were $0.7 million net expense and $1.0 million expense for the three months ended October 31, 2025 and 2024, respectively, and $1.4 million net expense and $0.8 million net expense for the nine months ended October 31, 2025 and 2024, respectively. See “Note 10. Joint Venture” to our condensed consolidated financial statements for additional details.

Interest Income and Other Income (Expense), Net

Three Months Ended October 31,

Change

Nine Months Ended October 31,

Change

Three Months Ended April 30,

Change

2025

2024

2025

2024

2026

2025

(in thousands, except percentages)

~~(in thousands, except percentages)~~

Interest income

11,~~704~~947

1210,~~586~~862

~~(882)~~1,085

~~(7)~~10

~~34,077~~

~~37,443~~

~~(3,366)~~

~~(9)~~

Foreign exchange gains (losses), net

~~(2,362)~~536

5(9,~~074~~954)

(710,~~436)~~490

(~~147~~105)

~~(13,433)~~

~~5,556~~

~~(18,989)~~

~~(342)~~

Other expense, net

(~~3,972~~281)

(~~275~~17)

(~~3,697~~264)

1,~~344~~553

~~(3,783)~~

~~(386)~~

~~(3,397)~~

~~880~~

Total other income (expense), net

~~(6,334)~~255

4(9,~~799~~971)

~~(11~~10,~~133)~~226

(~~232~~103)

~~(17,216)~~

~~5,170~~

~~(22,386)~~

~~(433)~~

40 Interest income increased for the three months ended April 30, 2026 compared to the three months ended April 30, 2025, primarily due to income earned from our cash, cash equivalents, and short-term investments, driven by higher average balances during the three months ended April 30, 2026 compared to the three months ended April 30, 2025.

Table of Contents

Foreign ~~Interest~~exchange ~~income~~gains ~~decreased~~(losses) increased for the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025~~2026 compared to the three ~~and nine~~ months ended ~~October~~April 3130, ~~2024,~~2025 primarily ~~due~~related to ~~income~~the ~~earned~~revaluation ~~from~~of ~~our cash, cash equivalents and short~~non-~~term~~functional ~~investments~~currency asdenominated amonetary ~~result~~assets ~~of lower interest rates during the three~~ and ~~nine months ended October 31, 2025 compared to the three and nine months ended October 31, 2024~~liabilities.

~~Foreign~~Provision ~~exchange losses increased~~ for ~~the~~Income three and nine months ended October 31, 2025 compared to the three and nine months ended October 31, 2024 primarily related to the revaluation of non-functional currency denominated monetary assets and liabilities.Taxes

Other expense, net for the three and nine months ended October 31, 2025 includes a $3.5 million indirect tax credit expense related to the JiHu formation, reflecting a change in accounting estimate.


	Three Months Ended April 30,				Change
	2026		2025		$		%

	(in thousands, except percentages)
Provision for income taxes	$	2,032	$	2,539	$	(507)	(20.0)%
Effective tax rate	(57.3)%		(7.6)%		(49.7)%

~~Provision~~Our effective tax rate decreased by approximately 49.7% for ~~(Benefit~~the ~~from)~~three ~~Income~~months ~~Taxes~~ended April 30, 2026 as compared to the three months ended April 30, 2025. A tax expense is expressed as a negative rate because of our pretax loss. The decrease in tax expense was primarily due to a lower year-to-date pre-tax loss in the current period, which resulted in a smaller interim provision under the estimated annual effective tax rate method.

	Three Months Ended October 31,				Change			Nine Months Ended October 31,						Change
	2025		2024		$		%	2025			2024			$		%
	(in thousands, except percentages)							(in thousands, except percentages)
Provision for (benefit from) income taxes	$	1,811	$	(39,152)	$	40,963	(104.6)%	$	6,595		$	(65,330)		$	71,925	(110.1)%
Effective tax rate	(28.0)%		389.6%		(417.6)%			(14.1)		%	83.2		%	(97.3)%

Our effective tax rate for the three months ended April 30, 2026 was different from the U.S. federal statutory tax rate of 21%, primarily due to the Company’s foreign and domestic operations, Base Erosion Anti-abuse Tax (“BEAT”), nondeductible expenses and losses not benefited, offset by tax credits.

On July 4, 2025, the United States enacted OBBBA which extended or modified certain corporate tax provisions under the TCJA. The OBBBA modified certain business deductions, including allowing for immediate expensing of U.S. research & development expenditures, effective in our current fiscal year. The OBBBA also modified various international tax provisions which were set to change or expire after 2025 under the TCJA. Such modifications, including U.S. taxation of profits derived from foreign operations and associated foreign tax credit limitations, are effective in our next fiscal year. The deduction of domestic R&D expenditure significantly reduced U.S. taxable income to a loss position, resulting in a material reduction in the current provision for the quarter. We will continue to evaluate the impact of the OBBBA on our condensed consolidated financial statements.

Our effective tax rate decreased by approximately 417.6% for the three months ended October 31, 2025 as compared to the three months ended October 31, 2024. A tax expense is expressed as a negative rate because of our pretax loss. The increase in tax expense from 2024 to 2025 in the same three month period was primarily due to the tax benefit recorded in the three months ended October 31, 2024 related to the BAPA negotiations between the United States and Dutch tax authorities, and the Company’s recurring foreign operations.

Our effective tax rate decreased by approximately 97.3% for the nine months ended October 31, 2025 as compared to the nine months ended October 31, 2024. A tax expense is expressed as a negative rate because of our pretax loss. The increase in tax expense from 2024 to 2025 for the same nine month period was primarily due to the tax benefit recorded in the nine months ended October 31, 2024 related to the BAPA negotiations between the United States and Dutch tax authorities, and the Company’s recurring foreign operations.

Our effective tax rate for the three and nine months ended October 31, 2025 was different than the U.S. federal statutory tax rate of 21%, primarily due to the Company’s foreign and domestic operations and losses not benefited.

We executed the BAPA agreements with the U.S. IRS and the Netherlands DTA on October 10, 2024, and October 22, 2024, respectively. On October 28, 2024, we paid $187.7 million to satisfy the tax

Table of Contents

assessment issued by the DTA, including accrued interest, which reflected the BAPA negotiations and the agreement to reduce the rate of tax on the gain from the transfer of economic IP rights. As a result of the BAPA and DTA assessment, the 2015 through 2017 tax years are closed for GitLab B.V. Pursuant to the terms in the BAPA, we have filed amended returns for the 2018 through 2023 fiscal years. All U.S. federal and state tax net operating losses (“NOLs”) and credits, as well as Netherlands NOLs, are not yet recognized due to the determination that they are not more likely than not to be realized.

Liquidity and Capital Resources

Since inception, we have financed operations primarily through proceeds received from issuances of equity securities, preferred stock and payments received from our customers.

As of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, our principal source of liquidity was cash, cash equivalents, and short-term investments aggregating to $1,357.25 ~~billion~~million and $~~992~~1,259.49 million, respectively, which were held for working capital and strategic investment purposes. As of ~~October~~April 3130, ~~2025~~2026, cash and cash equivalents consist of cash in banks, and money markets funds, ~~treasuries, and commercial paper,~~ while short-term investments mainly consist of treasuries, corporate debt securities, agency securities, and commercial paper.

We believe that our existing cash, cash equivalents, and short-term investments will be sufficient to support working capital and capital expenditure requirements for at least the next 12 months. Our future capital requirements will depend on many factors, including our revenue growth rate, the timing and the amount of cash received from customers, the expansion of sales and marketing activities, the timing and extent of spending to support research and development efforts, the price at which we are able to procure third-party cloud infrastructure, expenses associated with our international expansion, the introduction of platform enhancements, ~~and~~ the continuing market adoption of ~~The~~the ~~DevSecOps~~GitLab platform, and the amount and timing of any share repurchases. In the future, we may enter into arrangements to acquire or invest in complementary businesses, products, and technologies. We may be required to seek additional equity or debt financing. In the event that we require additional financing, we may not be able to raise such financing on terms acceptable to us or at all. If we are unable to raise additional capital or generate cash flows necessary to expand our operations and invest in continued innovation, we may not be able to compete successfully, which would harm our business, operating results, and financial condition.

Table of Contents

The following table shows a summary of our cash flows for the periods presented:

	Nine Months EndedOctober 31, 2025
	Three Months Ended April 30,
	2025		2024
	2026		2025
	(in thousands)
Net cash provided by (used in) operating activities	$	187,099	$	(127,193)
Net cash provided by operating activities	$	149,197	$	106,302
Net cash used in investing activities	$	(214,243)	$	(8,553)
Net cash provided by (used in) investing activities	$	4,157	$	(81,891)
Net cash provided by financing activities	$	23,332	$	20,927
Net cash provided by (used in) financing activities	$	(47,835)	$	3,328

Operating Activities

Our largest source of operating cash is payments received from our customers. Our primary uses of cash from operating activities are for personnel-related expenses, sales and marketing expenses, third-party cloud infrastructure expenses, and overhead expenses. We have generated positive ~~and negative~~ cash flows for each of the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025 from operating activities~~, respectively~~.

42Cash provided by operating activities during the three months ended April 30, 2026 was $149.2 million, primarily consisting of our net loss of $5.6 million, adjusted for non-cash items of $66.0 million (mainly attributable to stock-based compensation expense of $50.1 million and amortization of deferred contract acquisition costs, net of $12.9 million), and net cash inflows of $88.8 million provided by changes of our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the decrease in accounts receivable of $103.4 million, the increase in accrued expenses and other current liabilities of $14.5 million, and the decrease in prepaid expenses and other current assets of $6.4 million, partially offset by the decrease in deferred revenue of $14.3 million, the decrease in accrued compensation and benefits of $11.0 million, and the increase in deferred contract acquisition costs of $9.7 million. These changes primarily reflect our strong collections activity following high billings in the fourth quarter of fiscal 2026, driving the reduction in accounts receivable, while the increase in accrued expenses primarily relates to ESPP contributions and research and development expenses.

~~Table~~Cash provided by operating activities during the three months ended April 30, 2025 was $106.3 million, primarily consisting of ~~Contents~~our net loss of $36.3 million, adjusted for non-cash items of $81.2 million (mainly attributable to stock-based compensation expense of $55.8 million and amortization of deferred contract acquisition costs, net of $13.9 million), and net cash inflows of $61.4 million provided by changes of our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the decrease of accounts receivable of $65.9 million, the increase in accrued expenses and other liabilities of $10.0 million and the increase in accounts payable of $3.6 million, partially offset by the decrease in accrued compensation and related expenses of $13.1 million and the decrease in deferred contract acquisition costs of $8.1 million. These changes primarily reflect our successful collections driving lower accounts receivable and the decrease in accrued compensation is largely due to the payment of prior period commissions and bonuses, while the increase in accrued expenses primarily relates to ESPP contributions and accrued marketing and research and development spending.

Cash provided by operating activities during the nine months ended October 31, 2025 was $187.1 million, primarily consisting of our net loss of $55.1 million, adjusted for non-cash items of $222.9 million (mainly attributable to stock-based compensation expense of $161.8 million and amortization of deferred contract acquisition costs, net of $40.7 million), and net cash inflows of $19.2 million provided by changes of our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the decrease of accounts receivable of $46.3 million, the increase in deferred revenue of $17.5 million and the increase in accrued expenses and other liabilities of $1.9 million, partially offset by the decrease in deferred contract acquisition costs of $36.3 million and the decrease in accrued compensation and related expenses of $7.9 million. These changes primarily reflect improved operational performance with successful collections driving lower accounts receivable, higher accrued expenses for research and development spending, ongoing customer subscription growth contributing to increased deferred revenue, and the seasonal payment of prior period sales commissions and bonuses impacting accrued compensation balances.

Cash used in operating activities during the nine months ended October 31, 2024 was $127.2 million, primarily consisting of our net loss of $15.4 million, adjusted for non-cash items of $178.2 million (mainly attributable to stock-based compensation expense of $139.3 million and amortization of deferred contract acquisition costs, net of $35.7 million), and net cash outflows of $290.0 million used in changes in our operating assets and liabilities. The main drivers of the changes in operating assets and liabilities were the increase of accounts receivable of $31.7 million, the increase in deferred contract acquisition costs of $35.7 million, the decrease in accrued expenses and other liabilities of $240.6 million (mainly attributable to $187.7 million for the BAPA payment), the decrease in accrued compensation and related expenses of $8.8 million, and the decrease in other non-current liabilities of $11.1 million, partially offset by the decrease in prepaid expenses and other current assets of $2.5 million, and the increase in deferred revenue of $34.5 million.

Investing Activities

Cash ~~used~~provided inby investing activities during the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 was $~~214~~4.2 million, primarily consisting of $~~207~~6.46 million in ~~purchases of short-term investments, net of~~ proceeds from maturities and sales of short-term investments, ~~and~~net of purchases, partially offset by $62.94 million in additions to property and equipment.

Cash used in investing activities during the ~~nine~~three months ended ~~October~~April 3130, ~~2024~~2025 was $881.69 million, primarily consisting of $2181.50 million in ~~proceeds from maturities, net of~~ purchases of short-term investments, ~~partially offset by a $20.2 million payment for a business combination,~~ net of ~~cash~~proceeds ~~acquired,~~from amaturities ~~$7.7~~and ~~million~~sales ~~payment~~of ~~for~~short-term ~~an asset acquisition~~investments, and $20.69 million in ~~additions~~purchases toof property and equipment.

~~Financing Activities~~38

Cash provided by financing activities during the nine months ended October 31, 2025 was $23.3 million, attributable to $15.5 million proceeds from the issuance of common stock upon stock options exercises and $8.4 million of proceeds from the issuance of common stock under the ESPP, partially offset by $0.5 million of payments for taxes related to net share settlement of equity awards.

Cash provided by financing activities during the nine months ended October 31, 2024 was $20.9 million, attributable to $17.9 million proceeds from the issuance of common stock upon stock options exercises, and $7.9 million of proceeds from the issuance of common stock under the ESPP, partially offset by $4.9 million of settlement of acquisition related contingent cash consideration.

Table of Contents

Financing Activities

Cash used in financing activities during the three months ended April 30, 2026 was $47.8 million, primarily attributable to $50.0 million in repurchases of common stock and $0.2 million of payments for taxes related to net share settlement of equity awards, partially offset by $2.4 million in proceeds from the issuance of common stock upon exercise of stock options.

During the quarter ended April 30, 2026, we repurchased 2,378,892 shares of our Class A common stock for aggregate consideration of $50.0 million under our 2026 Repurchase Program, representing 12.5% of the $400.0 million authorized. We funded these repurchases from the existing cash and short-term investments. As of April 30, 2026, $350.0 million remained available for future repurchases.

Cash provided by financing activities during the three months ended April 30, 2025 was $3.3 million, attributable to proceeds from the issuance of common stock upon stock options exercises.

Adjusted Free Cash Flow

Adjusted free cash flow is a non-GAAP financial measure that we calculate as net cash provided by operating activities less cash used for additions to property and equipment, plus any non-recurring income tax payments related to the BAPA or minus any non-recurring income tax refunds related to the BAPA, plus any non-recurring payments related to the formation of JiHu. We believe that adjusted free cash flow is a useful indicator of liquidity that provides information to management and investors about the amount of cash generated from our operations that, after the investments in additions to property and equipment, any non-recurring income tax payments or refunds related to the BAPA, and any non-recurring payments related to the formation of JiHu, can be used for strategic initiatives, including investing in our business, repurchasing shares of our common stock, and strengthening our financial position. One limitation of adjusted free cash flow is that it does not reflect our future contractual commitments. Additionally, adjusted free cash flow does not represent the total increase or decrease in our cash balance for a given period.

The following table presents a reconciliation of adjusted free cash flow to net cash provided by operating activities, the most directly comparable financial measure calculated in accordance with GAAP, for the periods presented (in thousands):

	Three Months Ended October 31,				Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		2025		2024
	2026		2025
Computation of adjusted free cash flow (1)
GAAP net cash provided by (used in) operating activities	$	31,428	$	(177,028)	$	187,099	$	(127,193)
GAAP net cash provided by operating activities	$	149,197	$	106,302
Less: Additions to property and equipment	(32,~~038~~393)		(~~1,057~~912)		~~(6,854)~~		~~(2,608)~~
Add: Income tax payments (refunds) related to BAPA	(1,146)		187,735		(2,451)		187,735
Less: Income tax refunds related to BAPA	(77)		(1,293)
Non-GAAP adjusted free cash flow	$	27146,~~244~~727	$	9104,~~650~~097	$	~~177,794~~	$	~~57,934~~

(1) No non-recurring payments related to the formation of JiHu were recorded during the periods presented.

Contractual Obligations and Commitments

For more information regarding our contractual obligations, refer to “Note 13. Commitments and Contingencies” to our condensed consolidated financial statements.

~~Critical Accounting Estimates~~39

Our condensed consolidated financial statements have been prepared in conformity with U.S. generally accepted accounting principles, or GAAP. The preparation of the condensed consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the condensed consolidated financial statements, and the reported amounts of revenue and expenses during the reporting period. We base these estimates on historical and anticipated results, trends, and various other assumptions that it believes are reasonable under the circumstances, including assumptions as to future events. Actual results could differ from those estimates. To the extent that there are differences between our estimates and actual results, our future financial statement presentation, financial condition, operating results, and cash flows will be affected.

For additional information about our critical accounting policies and estimates, see the disclosure included in our Annual Report on Form 10-K for the fiscal year ended January 31, 2025, which was filed with the SEC on March 21, 2025.

Table of Contents

Critical Accounting Estimates

Our condensed consolidated financial statements have been prepared in conformity with U.S. generally accepted accounting principles, or GAAP. The preparation of the condensed consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the condensed consolidated financial statements, and the reported amounts of revenue and expenses during the reporting period. We base these estimates on historical and anticipated results, trends, and various other assumptions that we believe are reasonable under the circumstances, including assumptions as to future events. Actual results could differ from those estimates. To the extent that there are differences between our estimates and actual results, our future financial statement presentation, financial condition, operating results, and cash flows will be affected.

Recently Issued Accounting Pronouncements

~~See~~Aside ~~“Note~~from 2.the ~~Basis~~new ofaccounting ~~Presentation~~pronouncements ~~and~~already ~~Summary~~discussed ofin ~~Significant~~our ~~Accounting~~Annual ~~Policies”~~Report toon ~~our~~Form ~~condensed~~10-K ~~consolidated~~for ~~financial~~the ~~statements~~fiscal ~~included~~year ~~elsewhere~~ended inJanuary ~~this~~31, ~~Quarterly~~2026, ~~Report~~there onwere ~~Form~~no ~~10-Q~~additional ~~for~~pronouncements ~~more~~issued ~~information~~or ~~regarding~~effective ~~recently~~during ~~issued~~the ~~accounting~~period ~~pronouncements~~that would materially affect our condensed consolidated financial statements.

4540

Table of Contents

ITEM 3. QUANTITATIVE AND QUALITATIVE DISCLOSURE ABOUT MARKET RISK

We have operations both within the United States and internationally. We are exposed to market risk in the ordinary course of our business. Market risk represents the risk of loss that may impact our financial condition due to adverse changes in financial market prices and rates. Our market risk exposure is primarily the result of fluctuations in interest rates and foreign currency exchange rates.

Interest Rate Risk

As of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, we had $1,357.25 ~~billion~~million and $~~992~~1,259.49 million of cash, cash equivalents, and short-term investments, respectively. As of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, our cash equivalents and short-term investments of $1,357.15 ~~billion~~million and $~~898~~1,259.39 million, respectively, mainly consist of money market funds, treasuries, agency securities, corporate debt securities and commercial paper. Our cash, cash equivalents, and short-term investments are held for working capital and strategic investment purposes. We do not enter into investments for trading or speculative purposes. Our fixed-income portfolio is subject to fluctuations in interest rates, which could affect our results of operations. Based on our investment portfolio balance as of ~~October~~April 3130, ~~2025~~2026, a hypothetical increase or decrease in interest rates of 1% (100 basis points) would result in a decrease or an increase in the fair value of our portfolio of approximately $76.08 million. Such losses would only be realized if we sell the investments prior to maturity. The weighted-average life of our investment portfolio was approximately 86 months as of ~~October~~April 3130, ~~2025~~2026.

Foreign Currency Exchange Risk

To date, all of our sales contracts have been denominated in U.S. dollars, except for our variable interest entity, JiHu, which sells in local currency in its designated area. Our revenue is not subject to a material foreign currency risk. Operating expenses within the United States are primarily denominated in U.S. dollars, while operating expenses incurred outside the United States are primarily denominated in each country’s respective local currency. Our consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates.

Our reporting currency is the U.S. dollar, and the functional currency of our foreign subsidiaries is each country’s respective local currency. Assets and liabilities of the foreign subsidiaries are translated into U.S. dollars at the exchange rates in effect at the reporting date, and income and expenses are translated at average exchange rates during the period, with the resulting translation adjustments directly recorded as a component of accumulated other comprehensive income ~~(loss)~~. Foreign currency transaction gains and losses are recorded in other income (expense), net in the condensed consolidated statements of operations. The volatility of exchange rates depends on many factors that we cannot forecast with reliable accuracy. In the event our foreign currency denominated assets, liabilities, or expenses increase, our operating results may be more greatly affected by fluctuations in the exchange rates of the currencies in which we do business. Moreover, as of ~~October~~April 3130, ~~2025~~2026, we have $5924.16 million of cash and cash equivalents denominated in currencies other than the U.S. dollar. The value of these cash balances may materially change along with the weakness or strength of the U.S. dollar. As of ~~October~~April 3130, ~~2025~~2026, a hypothetical 10% change in foreign currency exchange rates would have a material impact on our condensed consolidated financial statements.

We have not engaged in the hedging of foreign currency transactions to date, although we may choose to do so in the future.

4641

Table of Contents

ITEM 4. CONTROLS AND PROCEDURES

Evaluation of Disclosure Controls and Procedures

In connection with the preparation of this Quarterly Report on Form 10-Q, as of ~~October~~April 3130, ~~2025~~2026, an evaluation was performed under the supervision and with the participation of our management, including the Chief Executive Officer and ~~Interim~~ Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act). Based on that evaluation, our Chief Executive Officer and our ~~Interim~~ Chief Financial Officer have concluded that, as of ~~October~~April 3130, ~~2025~~2026, our disclosure controls and procedures were, in design and operation, effective at a reasonable assurance level.

Changes in Internal Control over Financial Reporting

There were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended ~~October~~April 3130, ~~2025~~2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the Company have been detected.

4742

Table of Contents

PART II - OTHER INFORMATION

ITEM 1. LEGAL PROCEEDINGS

On September 4, 2024, a putative class action was filed in the United States District Court for the Northern District of California, captioned Dolly v. GitLab et al., Case No. 24-cv-06244-EKL (“Dolly”), naming GitLab and certain of our officers. The complaint purports to assert claims under Section 10(b) of the Securities Exchange Act of 1934 (“1934 Act”), SEC Rule 10b-5, and Section 20(a) of the 1934 Act, on behalf of persons and entities who acquired our common stock between June 5, 2023 and June 3, 2024 (the “Class Period”). Plaintiff alleges that, during the Class Period, defendants made material misrepresentations or omissions regarding, among other things, our use of AI features and ability to monetize our AI capabilities that artificially inflated our stock price. Plaintiff seeks, among other things, damages in an unspecified amount, as well as fees and costs. Plaintiff amended his complaint on February 5, 2025 and March 7, 2025, and we moved to dismiss the second amended complaint in April 2025. On August 14, 2025, the court granted our motion to dismiss with leave for the Plaintiff to amend and refile a third amended complaint. On September 8, 2025, the Plaintiff filed a stipulation stating that he had decided not to file an amended complaint or to appeal the motion to dismiss order, and asked the Court to dismiss his claims with prejudice and enter final judgment in favor of the defendants.

Three putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action. The cases were filed on February 14, 2025, in the United States District Court for the Northern District of California, captioned Preciado v. Sijbrandij et al., Case No. 25-cv-01597 (“Preciado”); on February 19, 2025 in the United States District Court for the Northern District of California, captioned Jones v. Sijbrandij et al., Case No. 25-cv-01735 (“Jones”); and on March 28, 2025 in the United States District Court for the Northern District of California, captioned Lianto v. Sijbrandij et al., Case No. 25-cv-02924 (“Lianto”). Each of the three cases are allegedly brought on our behalf. Each of the lawsuits name us as a nominal defendant, and also certain of our officers and current and former members of our board of directors. The Jones complaint purports to assert claims under Section 14(a) of the Exchange Act as well as breach of fiduciary duty, while the Preciado and Lianto complaints purport to assert those claims as well as unjust enrichment and related corporate torts. The complaints seek to recover unspecified damages and other relief on our behalf. As of May 2025, proceedings in each of these three putative shareholder derivative cases have been stayed during the pendency of the Dolly matter.

Based on the preliminary nature of the proceedings in these derivative actions, the outcomes remain uncertain and we cannot estimate the potential impact, if any, on its business or financial statements at this time.

In addition to the shareholder matters described above, we are, and from time to time may become, involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that in the opinion of management, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition or operating results.

Defending such proceedings is costly and can impose a significant burden on management and team members. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.

4843

Table of Contents

ITEM 1A. RISK FACTORS

Investing in our Class A common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our condensed consolidated financial statements and the accompanying notes included elsewhere in this Quarterly Report on Form 10-Q before making a decision to invest in our Class A common stock. Our business, financial condition, operating results, or prospects could also be adversely affected by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks occur, our business, financial condition, operating results, and prospects could be adversely affected. In that event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Risks Related to Our Business and Financial Position

Our business and operations have experienced rapid growth, and if we do not appropriately and effectively manage future growth, if any, or are unable to improve our systems, processes and controls, our business, financial condition, results of operations, and prospects will be adversely affected.

We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 10,~~475~~831 as of ~~October~~April 3130, ~~2025~~2026 from 910,~~519~~104 as of ~~October~~April 3130, ~~2024~~2025. The growth and expansion of our business places a continuous strain on our management and operational and financial resources. In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and investment decisions by our customers.

We may not be able to sustain the pace of improvements to our products successfully or implement systems, processes, and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations. Failure to effectively manage growth or improve our systems, processes, and controls, or the failure to operate in the intended manner could result in the following adverse impacts to our business: difficulty or delays in deploying customers, declines in quality or customer satisfaction, increases in costs, difficulties in introducing new features or other operational difficulties, inability to manage the growth of our business and to forecast our revenue, expenses, and earnings accurately, or to prevent losses.

Our recent growth may not be indicative of our future growth, and we may not be able to sustain our revenue growth rate in the future. Our growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

Our total revenue for the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025 was $~~694~~264.82 million and $~~547~~214.85 million, respectively, representing a growth rate of 2723%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth, and our

4944

Table of Contents

~~future~~usage ~~growth~~(or consumption) billing model. Our historical revenue growth should not be considered indicative of our future performance.

Further, in future periods, our revenue could decline or our revenue growth rate could slow. Many factors may contribute to this decline, including changes to technology, ~~our~~such ~~plans~~as toincreased ~~introduce~~AI adoption, our usage billing models, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our Class A common stock could be adversely affected.

In addition, we expect to continue to responsibly expend financial and other resources to align with our:

•product development, including investments in our product development team and the development of new features and functionality for The DevSecOps platform, including those related to artificial intelligence, or AI;

•expansion and enablement of our sales, services, and marketing organization to increase brand awareness and drive adoption of The DevSecOps platform;

•technology and sales channel partnerships;

•international expansion;

•acquisitions or strategic investments; and

•general administration, including increased legal and accounting expenses associated with being a public company.

These investments may not result in increased revenue in our business. In addition, we have made, or intend to make, investments in AI tools whose costs are subject to third-party pricing increases, usage-based variability, and contractual minimums and if these AI tooling costs increase, our operating expenses and cash flow could be adversely affected. If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth and our ~~plans to introduce~~ usage billing models. We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business would be harmed. Moreover, if the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, or we are unable to maintain consistent revenue or revenue growth, our share price could be volatile, and it may be difficult to achieve and maintain profitability.

We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability on a consistent basis. If we cannot achieve and sustain profitability, our business, financial condition, and operating results may be adversely affected.

We have incurred losses in each year since our inception, including net losses of approximately $~~425~~6.73 million, $656.30 million and $535.40 million in fiscal year ~~2024~~2025, ~~2025~~2026 and ~~nine~~the three months ended ~~October~~April 3130, ~~2025~~2026, respectively. As of ~~October~~April 3130, ~~2025~~2026, we had an accumulated deficit of approximately $1.2 billion. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including ~~expanding~~implementing ~~our~~usage ~~research and development function to drive further development of The DevSecOps platform (including related to AI capabilities)~~billing, expanding our research and

5045

Table of Contents

development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to continue to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, usage billing, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

As we continue to invest in infrastructure, develop our services and features, responsibly manage our headcount and expand our sales and marketing activity, we may continue to have losses in future periods and these may increase significantly. As a result, our losses in future periods may be significantly greater than the losses we would incur if we developed our business more slowly. In addition, we may find that these efforts require greater investment of time and human and capital resources than we currently anticipate and/or that they may not result in increases in our revenues or billings. Any failure by us to achieve and sustain profitability on a consistent basis could cause the value of our Class A common stock to decline.

Security and privacy breaches may hurt our business.

The DevSecOps platform hosts, processes, stores, and transmits our customers’ proprietary and sensitive data, including personal data, and financial data. We also use third-party service providers and sub-processors to help us deliver services to our customers and their end-users. These vendors may host, process, store, or transmit personal data, or other confidential information of our team members, our partners, our customers, or our customers’ end-users. We collect such information from individuals located both in the United States and abroad and may host, process, store, or transmit such information outside the country in which it was collected. While we, our third-party cloud providers, our third-party processors, and our customers have implemented security measures designed to protect against security breaches, these measures could fail or may be insufficient, resulting in the unauthorized access or disclosure, modification, misuse, destruction, or loss of our or our customers’ data or other sensitive information. Any security breach of our DevSecOps platform, our operational systems, physical facilities, or the systems of our third-party processors, or the perception that a breach has occurred, could result in litigation, indemnity obligations, regulatory enforcement actions, investigations, compulsory audits, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of our customers and other third parties, we may be considered responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach, if it is found that GitLab failed to conduct comprehensive third party risk due diligence. In addition, any failure by our vendors to comply with applicable law or regulations could result in proceedings against us by governmental entities or others.

Security incidents of our or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result in sensitive data exposure. Cyber attacks may also occur, including, but not limited to, denial-of-service attacks, ~~ransomware attacks, application security attacks, software-supply chain attacks, compromised~~

5146

Table of Contents

ransomware attacks, application security attacks, software-supply chain attacks, compromised credentials, business email compromises, computer malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. AI has shifted previously defined security boundaries for GitLab and our providers, including new and novel language-based attack vectors. AI incorporated into our and our third-party service provider’s products may introduce security risks including, but not limited to, AI-enabled social engineering, automated vulnerability exploitation, inadvertent data exposure due to model training, inappropriate data access using AI-enabled features, and AI supply-chain attacks. On the other hand, we could increase our vulnerability to cybersecurity incidents or other technology related failures due to, or as a result of, the timing of our evaluation, updating, or integration of new technology or AI enabled systems used in our business. Any security breach, disruption or ~~disruption~~other technology related failure could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential data of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Techniques used to obtain unauthorized access or to sabotage systems change frequently, including novel AI-specific attack vectors and vulnerabilities. AsThe ause ~~result~~of agentic AI is changing the fundamental ways that we secure and defend our platform and operations as both threat actors and security teams are using AI to industrialize their attacks. Traditional perimeter controls and static security rules are no longer the most effective security mechanisms and we, in alignment with our industry, are reinforcing our defensive capabilities in areas such as, but not limited to, behavioral analysis, automated detection response, and zero-trust. However, we may be unable to fully anticipate these techniques or to implement adequate preventative measures. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers. If we are, or are perceived to be, not in compliance with data protection, consumer privacy, or other legal or regulatory requirements or operational norms bearing on the collection, processing, storage, or other treatment of data records, including personal data, our reputation and operating performance may suffer. Further, we need to continually monitor and remain compliant with all applicable changes in local, state, national, or international legal or regulatory requirements. Any significant violations of data privacy could result in the loss of business, litigation, and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition.

Because code is executed on our infrastructure on behalf of customers and users, including open source projects hosted on GitLab, we face heightened security risks beyond those of standard SaaS providers. Unlike platforms that primarily store and transmit data, we operate a platform on which code can be executed, which creates additional attack surface and potential for harm.

We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify affected individuals, regulatory authorities, and relevant others of security breaches involving certain types of data, including personal data. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and may require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach.

A security breach may cause us to breach customer contracts. Our agreements with certain customers may require us to use industry-standard or reasonable measures to safeguard sensitive personal data or confidential information. A security breach could lead to claims by our customers, their end-users, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages.

Litigation resulting from security breaches may adversely affect our business. Unauthorized access to The DevSecOps platform, systems, networks, or physical facilities could result in litigation with our customers, our customers’ end-users, or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify The DevSecOps platform capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity, or availability of our data or the data of our partners, our customers or our customers’ end-users was disrupted, we could incur significant liability, or The DevSecOps platform, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.47

Table of Contents

obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages.

If we fail to detect, contain, or remediate a security breach in a timely manner, or a breach otherwise affects a large amount of data of one or more customers, or if we suffer a cyber attack that impacts our ability to operate The DevSecOps platform, we may suffer material damage to our reputation, business, financial condition, and results of operations. Further, while we maintain cyber insurance that may provide coverage for these types of incidents, such coverage may not be adequate to cover the costs and other liabilities related to these incidents. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim. Our risks are likely to increase as we continue to expand The DevSecOps platform, grow our customer base, and host, process, store, and transmit increasingly large amounts of proprietary and confidential data.

We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source and community contributed code in our products.

The DevSecOps platform is built using open-source technology and GitLab accepted community code contributions. Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber attacks as a result of our use of open source code, it may substantially damage our reputation and adversely affect our business, financial condition, and operating results.

We face intense competition and could lose market share to our competitors, which would adversely affect our business, operating results, and financial condition.

The markets for our services are highly competitive, with limited barriers to entry. Competition presents an ongoing threat to the success of our business. We expect competition in the software business generally, and in all of the stages of the software development lifecycle that our product covers, in particular, to continue to increase. We expect to continue to face intense competition from current competitors, as well as from new entrants into the market or from adjacent markets. If we are unable to anticipate or react to these challenges, our competitive position would weaken, and we would experience a decline in revenue or reduced revenue growth, and loss of market share that would adversely affect our business, financial condition, and operating results.

We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which ~~has~~means uswe ~~competing~~compete with many providers with offerings across all stages. We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.

Table of Contents

with offerings across all stages. We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI, including AI-native coding tools. Competition in these markets may intensify further as advances in AI enable rapid, low-cost development of software applications.

We believe that our ability to compete depends upon many factors both within and beyond our control, including the following:

•the ability of our products or of those of our competitors to deliver the positive business outcomes prioritized and valued by our customers and prospects;

•our ability to price our products competitively, including our usage billing model and our ability to transition users of our free product offering to a paid version of The DevSecOps platform;

•the timing and market acceptance of services, including the developments and enhancements to those services offered by us or our competitors, including incorporation of AI into such services;

Table of Contents

•the amount and quality of communications, postings, and sharing by our users on public forums, which can promote improvements on The DevSecOps platform but may also lead to disclosure of commercially sensitive details;

•our ability to monetize activity on our services;

•customer service and support efforts;

•sales and marketing efforts;

•ease of use, performance and reliability of solutions developed either by us or our competitors;

•our ability to manage our operations in a cost effective manner;

•insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our product offering;

•our reputation and brand strength relative to our competitors;

•introduction of new technologies or standards that compete with or are unable to be adopted in our products;

•ability to attract new team members or retain existing team members which could affect our ability to attract new customers, service existing customers, enhance our product or handle our business needs;

•our ability to maintain and grow our community of users; and

•the length and complexity of our sales cycles.

Many of our current and potential competitors have greater financial, technical, marketing and other resources and larger customer bases than we do. Furthermore, our current or potential competitors may be acquired by third parties with greater available resources and the ability to initiate or withstand substantial price competition. In addition, many of our competitors have established sales and marketing relationships and have access to larger customer bases. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their product offerings or resources. These factors may allow our competitors to respond more quickly than we can to new or emerging technologies and changes in customer preferences. These competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may undercut our pricing policies and allow them to build a larger user base or to monetize that user base more effectively than us. If our competitors’ products, platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected.

In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels, our operating results would be negatively affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.49

Many of our users extend the functionality of The DevSecOps platform using third-party code editors and integrated development environments, or IDEs, including editors and IDEs developed by our competitors. Our development and distribution of integrations with such tools is subject to the integration policies and technical specifications imposed by the developer of the tool. A change to the policies and specifications pertaining to any of these third-party tools (including those developed by Microsoft), could

Table of Contents

~~cause~~larger ususer base or to ~~lose~~monetize that user base more effectively than us. If our competitors’ products, platforms, services or technologies maintain or achieve greater market ~~share~~acceptance than ours, if they are successful in bringing their products or services to ~~competitors~~market ~~whose~~earlier than ours, or if their products, ~~and~~platforms or services ~~continue~~are tomore ~~support~~technologically ~~integrations~~capable ~~with~~than ~~such~~ours, ~~tools~~then our revenues could be adversely affected.

In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels or successfully implement usage billing, our operating results would be negatively affected. Pricing pressures, usage billing, and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

We may not be able to respond to rapid technological changes with new solutions, which could have a material adverse effect on our operating results.

The DevSecOps market is characterized by rapid technological change, fluctuating price points, and frequent new product and service introductions. Our ability to increase our user base and increase revenue from existing customers will depend heavily on our ability to enhance and improve our existing solutions, introduce new features and products, both independently and in conjunction with third-party developers and technology partners, reach new platforms and sell into new markets. Customers may require features and capabilities that our current solutions do not have. If we fail to develop solutions that satisfy customer preferences in a timely and cost-effective manner, we may fail to renew our subscriptions with existing customers and create or increase demand for our solutions, and our business may be materially and adversely affected.

The introduction of new services by competitors or the development of entirely new technologies to replace existing offerings could make our solutions obsolete or adversely affect our business. In addition, any new markets or countries into which we attempt to sell our solutions may not be receptive. We may experience difficulties, including delayed releases and upgrades, with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new solutions and enhancements. Delayed releases or upgrades, or releases with defects, could result in adverse publicity, loss of revenue, delay in market acceptance, or claims by customers brought against us, all of which could have a material adverse effect on our reputation, business, operating results, and financial condition. Moreover, upgrades and enhancements to our solutions may require substantial investment and we have no assurance that such investments will be successful. If users do not widely adopt enhancements to our solutions, we may not be able to realize a return on our investment. If we are unable to develop, license, or acquire enhancements to our existing solutions on a timely and cost-effective basis, or if such enhancements do not achieve market acceptance, our business, operating results, and financial condition may be adversely affected.

If our services fail to perform properly, whether due to material defects with the software or external issues, our reputation could be adversely affected, our market share could decline, and we could be subject to liability claims.

Our products are inherently complex and may contain material defects, software “bugs” or errors. Any defects in functionality or operational procedures that cause interruptions in the availability of our products could result in:

Table of Contents

•loss or delayed market acceptance and sales;

•loss of customer data;

•breach of warranty claims;

•sales credits or refunds for prepaid amounts related to unused subscription services;

•loss of customers;

•diversion of development and customer service resources;

•loss of operational time;

•destruction or compromised integrity of data and/or intellectual property; and

•injury to our reputation.

Table of Contents

The costs incurred in correcting any material defects, software “bugs” or errors might be substantial and could adversely affect our operating results.

We rely on information technology systems to process, transmit and store electronic information. Our ability to effectively manage our business depends significantly on the reliability and capacity of these systems. The operation, success and growth of our business (whether now or in the future) depends on streamlined processes made available through information systems, global communications, internet activity, and other network processes. The future operation, success and growth of our business depends on streamlined processes made available through information systems, global communications, internet activity, and other network processes.

Our information technology systems may be subject to damage or interruption from telecommunications problems, data corruption, software errors, fire, flood, acts of terror and armed conflicts, global pandemics and natural disasters, power outages, systems disruptions, system conversions, and/or human error. Our existing safety systems, data backup, access protection, user management and information technology emergency planning may not be sufficient to prevent data loss or long-term network outages. In addition, we may have to upgrade our existing information technology systems or choose to incorporate new technology systems from time to time in order for such systems to support the increasing needs of our expanding business. Introduction of new technology, or upgrades and maintenance to our existing systems, could result in increased costs or unforeseen problems which may disrupt or reduce our operating efficacy.

We may also encounter service interruptions, outage, or disruption due to issues interfacing with our customers’ IT systems, including stack misconfigurations or improper environment scaling, defective updates or upgrades, or due to cybersecurity attacks on ours or our customers’ IT systems. Any such service interruption may have an adverse impact on our reputation and future operating results.

Because of the nature and importance of the data that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including: customers’ inability to access the internet, customers’ inappropriate use of our software, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events. If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.

While we currently maintain errors and omissions insurance, it may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.51

Table of Contents

~~The~~adversely ~~market~~affect ~~for~~their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, isour ~~relatively~~reputation ~~new~~could be adversely affected and ~~rapidly~~we ~~evolving~~could ~~with~~lose ~~uncertain~~customers. ~~growth~~Our ~~expectations~~production ~~which~~systems ~~would~~might ~~adversely~~not ~~affect~~be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our ~~future~~data ~~results~~backup systems might fail and ~~the~~our ~~trading~~data ~~price~~recovery plans may be insufficient to fully recover all of ours or our ~~Class~~customers’ Adata ~~common~~hosted ~~stock~~on our system.

~~Because~~While ~~the~~we ~~market~~currently ~~for~~maintain ~~our~~errors ~~services is relatively new~~ and ~~rapidly~~omissions ~~evolving~~insurance, it ismay ~~difficult~~be toinadequate ~~predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products~~ or the success of existing competitive services. Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide. Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be ~~able~~available ~~to compete effectively or achieve market acceptance of our products. If we or other software and SaaS providers experience security incidents, loss of customer data, or disruptions~~ in ~~delivery or service,~~ the ~~market~~future ~~for~~on ~~these~~acceptable ~~applications as a whole~~terms, ~~including~~or ~~The~~at ~~DevSecOps~~all. ~~platform~~In ~~and products~~addition, ~~may be negatively affected. If the market for~~ our ~~services~~policy ~~does~~may not ~~achieve~~cover ~~widespread~~all ~~adoption,~~claims wemade doagainst ~~not~~us compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and ~~services,~~defending ~~decreases in corporate spending, including as~~ a ~~result of global business or macroeconomic conditions~~suit, ~~including~~regardless ~~inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility~~ of ~~the~~its ~~global debt and equity markets~~merit, ~~actual or perceived instability in the global banking sector, or otherwise, it~~ could ~~result~~be incostly ~~reduced customer orders~~ and ~~decreased~~divert ~~revenues,~~management’s ~~which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results~~attention.

The market for our services is rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Because the market for our services is rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services. Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide. Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be able to compete effectively or achieve market acceptance of our products. If we or other software and SaaS providers experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected. If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.

We are dependent on sales and marketing strategies to drive our growth in our revenue. These sales and marketing strategies may not be successful in continuing to generate sufficient sales opportunities. Any decline in our customer renewals and expansions could harm our future operating results.

Our business model depends on generating and maintaining a large user base that is satisfied with The DevSecOps platform. We rely on satisfied customers to expand their footprint by buying new products and services and onboarding additional users. We have implemented user limits on our free SaaS product, and have limited historical data with respect to the number of current and previous free users and the rates in which customers convert to paying customers. As a result, we may not accurately predict future customer purchasing trends.

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, usage billing, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

It could also become increasingly difficult to predict revenue and timing of collections as our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings. Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.52

Our future success also depends in part on our ability to sell more subscriptions and additional services to our current customers. Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease

Table of Contents

~~the number of seats in their subscription. If our customers do not purchase additional subscriptions and services from us~~sector, ~~our revenue may decline and our operating results may be harmed. Paying customers may decline~~ or ~~fluctuate as a result of a number of factors~~otherwise, ~~including~~or ~~their satisfaction with~~ our ~~services and our end-customer support~~failure, ~~the~~for ~~frequency~~any ~~and severity of product outages~~reason, ~~our~~to ~~product~~continue ~~uptime~~to orcapitalize ~~latency, their satisfaction with the speed of delivering new features, the pricing of our, or competing, services, and the impact of macroeconomic conditions~~ on ~~our~~growth ~~customers and their corporate spending~~opportunities. We ~~have~~may ~~limited~~be ~~historical~~forced ~~data with respect~~ to ~~rates~~change ofor ~~paying~~abandon ~~customers~~our ~~buying~~subscription ~~more~~based ~~seats,~~revenue ~~uptiering,~~model ~~downtiering~~in ~~and~~order ~~churning,~~to socompete wewith ~~may~~our ~~not~~competitors’ ~~accurately predict future customer trends~~offerings.

It could also become increasingly difficult to predict revenue and timing of collections given our usage billing model and our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings. Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.

Our future success also depends in part on our ability to increase usage or consumption, sell more subscriptions and additional services to our current customers. Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease the number of seats or usage in their subscription. If our customers do not purchase additional subscriptions and services from us, our revenue may decline and our operating results may be harmed. Paying customers may decline or fluctuate as a result of a number of factors, including their satisfaction with our services and our end-customer support, the frequency and severity of product outages, our product uptime or latency, their satisfaction with the speed of delivering new features, the pricing of our, or competing, services, and the impact of macroeconomic conditions on our customers and their corporate spending. We have limited historical data with respect to rates of paying customers buying more seats, uptiering, downtiering and churning, so we may not accurately predict future customer trends.

Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and down-tiers may increase, or fluctuate, as a result of a number of factors, including: quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices (including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.

Further, we have previously discontinued certain lower priced product offerings, requiring users of these products to switch to another paid offering, switch to our free product, or discontinue using our products. Additionally, we have implemented user limits on our free SaaS product. To the extent we discontinue or add additional limits on our free or lower-priced product offerings, we cannot assure you that our customers will purchase our products, and if our end customers do not purchase our products, our revenues may grow more slowly than expected or decline.

Our operating results may fluctuate significantly, which could make our future results difficult to predict and could adversely affect the trading price of our Class A common stock.

Our operating results may vary significantly from period to period, which could adversely affect our business and financial condition. Our operating results have varied significantly from period to period in the past, and we expect that our operating results will continue to vary significantly in the future such that period-to-period comparisons of our operating results may not be meaningful. Accordingly, our financial results in any one quarter or fiscal year should not be relied upon as indicative of future performance. Our ~~quarterly or annual financial results may fluctuate as a result of several factors, many of which are outside of our control and may be difficult to predict, including:~~

Table of Contents

quarterly or annual financial results may fluctuate as a result of several factors, many of which are outside of our control and may be difficult to predict, including:

•our ability to attract and retain new customers;

•the addition or loss of material customers, including through acquisitions or consolidations;

•the timing of recognition of revenues; and impact of usage billing;

•the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;

Table of Contents

health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;

•customer renewal rates;

•the timing and success of new service introductions by us or our competitors or any other change in the competitive dynamics of our industry, including consolidation among competitors, customers or strategic partners;

•our ability to convert users of our free product offerings into subscribing customers;

•increases or decreases in the number of elements of our services or pricing changes upon any renewals of customer agreements;

•allocation of software development in customers’ budget;

•seasonal variations in sales of our products;

•decisions by potential customers to use products of our competitors;

•the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill from acquired companies;

•extraordinary expenses such as litigation or other dispute-related settlement payments or outcomes;

•future accounting pronouncements or changes in our accounting policies or practices;

•negative media coverage or publicity;

•political events;

•the amount and timing of operating costs and capital expenditures related to the expansion of our business, in the U.S. and foreign markets;

•the cost to develop and upgrade The DevSecOps platform to incorporate new technologies; and

•increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our last two fiscal quarters as compared to the first two fiscal quarters due to the annual budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, and volatile interest rates.

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. As a result of this variability, our historical operating results should not be relied upon as an indication of future performance. Moreover, this variability and unpredictability could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for the reasons described above or any other reasons, our stock price could fall substantially.54

Table of Contents

budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, and volatile interest rates.

As our product offerings mature and expand, our pricing and packaging for new and existing products may result in customers purchasing products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

As our product offerings and the markets for our services mature, or as new competitors introduce new products or services that are similar to or compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, some customers may demand greater price concessions or additional functionality at the same price levels, and some customers may choose to adjust their usage rates due to our usage billing. As a result, in the future we may be required to reduce our prices or adjust existing products or packaging, or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.

In addition, our customers have no obligation to renew their subscriptions for our services after the expiration of the initial subscription period. A majority of our subscriptions are on a one-year period. Our customers may renew for fewer or other elements of our services or negotiate for different pricing terms. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization. Changes in product packaging, pricing strategy, or product offerings, or the implementation or execution of the foregoing, may not be seen favorably by our customers and may have an adverse effect on our ability to retain our current customers and acquire new ones. For example, we have previously discontinued certain lower priced product offerings, and we have in the past implemented price increases, which may cause customers who previously used these tiers to opt for our free version or to cease using our products completely. We may also decide to raise the prices of our product offerings in the future. If our customers do not renew their subscriptions on similar pricing terms, our revenues may decline, and our business could suffer. In addition, over time the average term of our contracts could change based on renewal rates or for other reasons.

The implementation of AI and machine learning technologies in our services may result in reputational harm, liability, increased expenditures, or other adverse consequences to our business operations.

We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features. The technologies underpinning these features exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies. These regulations impose prescriptive obligations related to the development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area. Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation. 55

Furthermore, many of our generative AI features involve the processing of personal data and any processing of personal data is subject to comprehensive privacy and data protection laws, including the E.U. General Data Protection Regulation, or the GDPR, and the California Consumer Privacy Act, or the CCPA. Specific obligations under these regulations, such as requirements for lawful basis, data minimization, automated decision-making, and storage limitation, apply equally to personal data processed by the GitLab Duo suite of AI features. Any difficulties in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Table of Contents

~~Our~~Additionally, ~~generative~~issues relating to intellectual property rights in AI-generated ~~features~~content ~~may~~have ~~also~~not ~~generate~~been ~~output~~fully ~~that~~addressed isby ~~misleading,~~the ~~insecure~~courts, ~~inaccurate~~laws, ~~harmful,~~ or ~~otherwise~~regulations ~~flawed~~and there has been an increase in litigation in this area. Accordingly, ~~which~~the ~~may~~implementation ~~harm~~of generative AI technologies into our ~~reputation,~~services ~~business,~~may orresult ~~customers,~~in orexposure ~~expose~~to usclaims related to ~~legal~~copyright ~~liability~~infringement or other intellectual property misappropriation.

Furthermore, many of our AI features involve the processing of personal data and any processing of personal data is subject to comprehensive privacy and data protection laws, including the E.U. General Data Protection Regulation, or the GDPR, and the California Consumer Privacy Act, or the CCPA. Specific obligations under these regulations, such as requirements for lawful basis, data minimization, automated decision-making, and storage limitation, apply equally to personal data processed by the GitLab Duo suite of AI features. Any difficulties in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Our AI features may also generate output or perform actions, as applicable, that are misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.

Some of our AI-powered features, including those offered through the GitLab Duo Agent Platform, are designed to automate elements of the software development lifecycle based on user-defined goals and context. As the prevalence and scrutiny of such agentic AI systems increases, we may face regulatory, litigation, ethical, reputational, and financial risks.

We rely on third-party vendors for the provision of the AI models which power many of our AI features. In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, are subject to regulatory or other national security actions by governmental authorities, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected. Any such events could also impact our customers’ ability to use GitLab features powered by specific third-party vendors’ AI models in certain deployment contexts.

Further, developing, testing, and offering AI-powered features may lead to greater than expected expenditures for our company because deploying AI systems involves high computing costs, which could adversely affect our gross margin, profitability, financial position, and cash flow.

Transparency is one of our core values. While we will continue to prioritize transparency, we must also promote "responsible" transparency as transparency can have unintended negative consequences.

Transparency is one of our core values. As an all-remote open-source software company, we believe transparency is essential to how we operate our business and interact with our team members, the community, and our customers. We also find it to be critical for team member recruitment, retention, efficiency and our culture. In addition, our transparency is highly valued by both our customers and our contributors. While we will continue to emphasize transparency, we also promote and educate our team members about responsible internal and external transparency, as openly sharing certain types of information can potentially lead to unintended, and sometimes negative, consequences.

As a result of our transparency, our competitors and other outside parties may have access to certain information that is often kept confidential or internal at other companies through our Handbook, our team members’ open and public use of The DevSecOps platform to run our business, and other avenues of communication we commonly use. The public availability of this information may allow our competitors to take advantage of certain of our innovations, and may allow parties to take other actions, including litigation, that may have an adverse impact on our operating results or cause reputational harm, which in turn may have a negative economic impact.

Table of Contents

We are also subject to Regulation FD, which imposes restrictions on the selective disclosure of material information to stockholders and other market participants, and other regulations. While we have implemented internal controls to maintain compliance with Regulation FD, if as a result of our transparency, we disclose material information in a non-Regulation FD compliant matter, we may be subject to heightened regulatory and litigation risk.

The publicly available GitLab Handbook, or Handbook, may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

Consistent with our commitment to our transparency and efficiency values, we maintain a publicly available company Handbook that contains important information about our operations and business practices. This Handbook is open to the public and may be used by our competitors or bad actors in malicious ways that may adversely affect our business, operating results, and financial condition. Although we aim to keep the Handbook updated, the information in the Handbook may not be up to date at all times. Also, because any of our team members can contribute to the Handbook, the information in the Handbook may not be accurate. We have implemented disclosure controls and procedures, including internal controls over financial reporting, that comply with the U.S. securities laws; however, if we fail to successfully maintain the appropriate controls, we may face unintended disclosures of material information about the company through our Handbook, which may lead to disclosure control failures, potential securities law violations, and reputational harm.

Table of Contents

successfully maintain the appropriate controls, we may face unintended disclosures of material information about the company through our Handbook, which may lead to disclosure control failures, potential securities law violations, and reputational harm.

Customers may choose to stay on our free self-managed or SaaS product offerings instead of converting into a paying customer.

Our future success depends, in part, on our ability to convert users of our free self-managed or SaaS product offerings into paying customers by selling additional products, and by upselling additional subscription services. The total number of users of our free SaaS product may decline as a result of, or due to, our enforcement of user limits. As a result of our investment in new capabilities and improvements to our free product offering, users of our free product may decline to purchase additional products or subscription services if they perceive the free product to be more attractive as compared to our paid offerings. Converting users of our free product offering may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our end-customers purchase additional products and services depends on a number of factors, including the perceived need for additional products and services, the limitations on the number of users and limitations on storage and transfers applicable to the free product offering as well as general economic conditions. If our efforts to sell additional products and services to our end-customers are not successful, our business may suffer.

Failure to effectively expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our services.

Our ability to increase our customer base and expand with existing customers will depend to a significant extent on our ability to continue to expand our marketing and sales operations. We plan to continue expanding our sales force. We also plan to continue to dedicate resources to sales and marketing programs. We are expanding our marketing and sales capabilities to target additional potential customers, including some larger organizations, but there is no guarantee that we will be successful attracting and maintaining these businesses as customers, and even if we are successful, these efforts may divert our resources away from and negatively impact our ability to attract and maintain our current customer base. All of these efforts will require us to invest financial and other resources. If we are unable to find efficient ways to deploy our marketing spend or to hire, develop, and retain talent required to maintain and support our growth, if our new sales talent are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective, our ability to increase our customer base and achieve broader market acceptance of our services could be harmed.

Table of Contents

Any failure to offer high-quality technical support services, including success tiers, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success tiers that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.

Table of Contents

Customers may demand more customized configuration and integration services, or custom features and functions that we do not offer, which could adversely affect our business and operating results.

Our current and future customers may demand more customized configuration and integration services, which increase our up-front investment in sales and deployment efforts, with no guarantee that these customers will increase the scope of their subscription. As a result of these factors, we may need to devote a significant amount of sales, operations, engineering, support, and professional services resources to individual customers, increasing the cost and time required to complete sales. If prospective customers require customized features or functions that we do not offer, and which would be difficult for them to deploy themselves, then the market for our applications will be more limited and our business could suffer.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, and changing customer needs, requirements, or preferences, our services may become less competitive.

Our industry is subject to rapid technological change, evolving industry standards and practices, and changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including our ability to timely provide enhancements and new features for our existing services or new services that achieve market acceptance or that keep pace with rapid technological developments and the competitive landscape. The success of new services and enhancements depends on several factors, including the timely delivery, introduction, and market acceptance of such services. If we are unable to develop and sell new services that satisfy our customers and provide enhancements and new features for our existing services that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected. Furthermore, we have in the past experienced delays in the planned release dates of new features and upgrades, and have discovered defects in new solutions after their introduction. There can be no assurance that new solutions or upgrades will be released according to schedule, or that when released they will not contain defects. If new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.

Our services must also integrate with a variety of network, hardware, mobile, cloud, and software platforms and technologies, including third-party AI services, and we need to continuously modify and enhance our services to adapt to changes and innovation in these technologies, including changes in internet-related hardware, operating systems, cloud computing infrastructure, and other software, communication, browser and open source technologies. If developers widely adopt new software platforms, we would have to develop new versions of our products to work with those new platforms. This development effort may require significant engineering, marketing, and sales resources, all of which would affect our business and operating results. Any failure of our services to operate effectively with future infrastructure platforms and technologies could reduce the demand for our products and significantly impair our revenue growth. We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, could increase our research and development expenses. If we are unable to respond to these changes in a timely or cost-effective manner, our services may become less marketable and less competitive or obsolete, which may result in customer dissatisfaction, and adversely affect our business.

6358

Table of Contents

development effort may require significant engineering, marketing, and sales resources, all of which would affect our business and operating results. Any failure of our services to operate effectively with future infrastructure platforms and technologies could reduce the demand for our products and significantly impair our revenue growth. We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, could increase our research and development expenses. If we are unable to respond to these changes in a timely or cost-effective manner, our services may become less marketable and less competitive or obsolete, which may result in customer dissatisfaction, and adversely affect our business.

Our channel partners may provide a poor experience to customers putting our brand or company growth at risk. Channel partners may deliver poor services or a poor selling experience delaying customer purchase or hurting the company brand.

In addition to our direct sales force, we use channel partners to sell and support our products. Channel partners may become an increasingly important aspect of our business, particularly with regard to enterprise, governmental, and international sales. Our future growth in revenue and ability to achieve and sustain profitability may depend in part on our ability to identify, establish, and retain successful channel partner relationships in the United States and internationally, which will take significant time and resources and involve significant risk. If we are unable to maintain our relationships with these channel partners, or otherwise develop and expand our indirect distribution channel, our business, operating results, financial condition, or cash flows could be adversely affected.

We cannot be certain that we will be able to identify suitable indirect sales channel partners. To the extent we do identify such partners, we will need to negotiate the terms of a commercial agreement with them under which the partner would distribute The DevSecOps platform. We cannot be certain that we will be able to negotiate commercially-attractive terms with any channel partner, if at all. In addition, all channel partners must be trained to distribute The DevSecOps platform and must allocate appropriately skilled resources to the customers. In order to develop and expand our distribution channel, we must develop and improve our processes for channel partner introduction and training. If we do not succeed in identifying suitable indirect sales channel partners, our business, operating results, and financial condition may be adversely affected.

We also cannot be certain that we will be able to maintain successful relationships with any channel partners and, to the extent that our channel partners are unsuccessful in selling our products, our ability to sell our products and our business, operating results, and financial condition could be adversely affected. Our channel partners may offer customers the products and services of several different companies, including products and services that compete with our products. Because our channel partners generally do not have an exclusive relationship with us, we cannot be certain that they will prioritize or provide adequate resources to sell our products. Moreover, divergence in strategy by any of these channel partners may materially adversely affect our ability to develop, market, sell, or support our products. We cannot assure you that our channel partners will continue to cooperate with us. In addition, actions taken or omitted to be taken by such parties may adversely affect us. In addition, we rely on our channel partners to operate in accordance with the terms of their contractual agreements with us. For example, our agreements with our channel partners limit the terms and conditions pursuant to which they are authorized to resell or distribute our products and offer technical support and related services. We also typically require our channel partners to represent to us the dates and details of products sold through to our customers. If our channel partners do not comply with their contractual obligations to us, our business, operating results, and financial condition may be adversely affected.

We track certain performance metrics with internal tools and data models and do not independently verify such metrics. Certain of our performance metrics are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and negatively affect our business.

Table of Contents

Our internal tools and data models have a number of limitations and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. We calculate and track performance metrics with internal tools, which are not independently verified by any third party. While we believe our metrics are reasonable estimates of our customer base for the applicable period of measurement, the methodologies used to measure these metrics require significant judgment and may be susceptible to algorithmic or other technical errors. For example, the accuracy and consistency of our performance metrics may be impacted by changes to internal assumptions regarding how we account for and track customers, limitations on system implementations, and limitations on the ability of third-party tools to match our database. If the internal tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate. In addition, limitations or errors with respect to how we measure data (or the data that we measure) may affect our understanding of certain details of our business, which could affect our longer-term strategies. If our performance metrics are not accurate representations of our business, user base, or traffic levels; if we discover material inaccuracies in our metrics; or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

We rely to a significant degree on a number of independent open source contributors, to develop and enhance the open source technologies we use to provide our products and services.

In our development process we rely upon numerous open core software programs which are outside of our direct control. Members of corresponding leadership committees and core teams, many of whom are not employed by us, are primarily responsible for the oversight and evolution of the codebases of these open source technologies. If the project committees and contributors fail to adequately further develop and enhance open source technologies, or if the leadership committees fail to oversee and guide the evolution of the open source technologies in the manner that we believe is appropriate to maximize the market potential of our offerings, then we would have to rely on other parties, or we would need to expend additional resources, to develop and enhance our offerings. We also must devote adequate resources to our own internal contributors to support their continued development and enhancement of open source technologies, and if we do not do so, we may have to turn to third parties or experience delays in developing or enhancing open source technologies. We cannot predict whether further developments and enhancements to these technologies will be available from reliable alternative sources. In either event, our development expenses could be increased, and our technology release and upgrade schedules could be delayed. Delays in developing, completing, or delivering new or enhanced offerings could cause our offerings to be less competitive, impair customer acceptance of our offerings and result in delayed or reduced revenue for our offerings.

Our failure or inability to protect our intellectual property rights, or claims by others that we are infringing upon or unlawfully using their intellectual property, could diminish the value of our brand and weaken our competitive position, and adversely affect our business, financial condition, operating results, and prospects.

We currently rely on a combination of copyright, trademark, patent, trade secret, and unfair competition laws, as well as confidentiality agreements and procedures and licensing arrangements, to establish and protect our intellectual property rights. We have devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on patent and trade secret laws and confidentiality agreements with our team members, licensees, independent contractors, commercial partners, and other advisors. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. We cannot be certain that the steps taken by us to protect our intellectual property rights will be adequate to prevent infringement of such rights by others. Additionally, the process of obtaining patent or trademark protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications or apply for all necessary or desirable trademark applications at a reasonable cost or in a timely manner. Moreover, intellectual property protection may be unavailable or limited in some foreign countries where laws or law enforcement practices may not protect our intellectual property rights as fully as in the United States, and it may be more difficult for us to successfully challenge the use of our intellectual property rights by other parties in these countries. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and our failure or inability to obtain or maintain trade secret protection or otherwise protect our proprietary rights could adversely affect our business.

Table of Contents

~~certain~~reasonable ~~that~~cost ~~our~~or ~~products~~in a timely manner. Moreover, intellectual property protection may be unavailable or ~~activities~~limited doin ~~not~~some ~~violate~~foreign ~~the~~countries ~~patents,~~where ~~trademarks,~~laws or ~~other~~law enforcement practices may not protect our intellectual property rights ofas ~~third-party~~fully ~~claimants.~~as ~~Companies~~ in the ~~technology~~United ~~industry~~States, and ~~other~~it ~~patent,~~may ~~copyright,~~be ~~and~~more ~~trademark~~difficult ~~holders~~for ~~seeking~~us to ~~profit~~successfully ~~from~~challenge ~~royalties~~the inuse ~~connection with grants~~ of ~~licenses~~our ~~own~~intellectual ~~large~~property ~~numbers~~rights ofby ~~patents,~~other ~~copyrights,~~parties ~~trademarks,~~in ~~domain~~these ~~names,~~countries. ~~and~~Costly ~~trade secrets~~ and ~~frequently~~time-consuming ~~commence~~ litigation ~~based~~could onbe ~~allegations~~necessary ofto ~~infringement,~~enforce ~~misappropriation,~~and ordetermine ~~other~~the ~~violations~~scope of ~~intellectual~~our ~~property~~proprietary ~~or other~~ rights., Asand weour ~~face~~failure ~~increasing~~or ~~competition~~inability ~~and~~to ~~gain~~obtain anor ~~increasingly~~maintain ~~high~~trade ~~profile,~~secret ~~the~~protection ~~likelihood~~or ofotherwise ~~intellectual~~protect ~~property~~our proprietary rights ~~claims~~could ~~against~~adversely usaffect ~~may~~our ~~grow~~business.

We may in the future be subject to intellectual property infringement claims and lawsuits in various jurisdictions, and although we are diligent in our efforts to protect our intellectual property we cannot be certain that our products or activities do not violate the patents, trademarks, or other intellectual property rights of third-party claimants. Companies in the technology industry and other patent, copyright, and trademark holders seeking to profit from royalties in connection with grants of licenses own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently commence litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. As we face increasing competition and gain an increasingly high profile, the likelihood of intellectual property rights claims against us may grow.

Further, from time to time, we may receive letters from third parties alleging that we are infringing upon their intellectual property rights or inviting us to license their intellectual property rights. Our technologies and other intellectual property may be found to infringe upon such third-party rights, and such successful claims against us could result in significant monetary liability, prevent us from selling some of our products and services, or require us to change our branding. In addition, resolution of claims may require us to redesign our products, license rights from third parties at a significant expense, or cease using those rights altogether. And we may in the future bring claims against third parties for infringing our intellectual property rights. Costs of supporting such litigation and disputes may be considerable, and there can be no assurances that a favorable outcome will be obtained. Patent infringement, trademark infringement, trade secret misappropriation, and other intellectual property claims and proceedings brought against us or brought by us, whether successful or not, could require significant attention of our management and resources and have in the past and could further result in substantial costs, harm to our brand, and have an adverse effect on our business.

Our open source and source code-available business model makes our software vulnerable to authorized and unauthorized distribution and sale.

We license many significant components of our software under permissive open source software licenses which grant licensees broad permissions to use, copy, modify, and distribute the covered software. Under these licenses, third parties are entitled to distribute and sell the covered software without payment to us.

Features available on our paid tiers are source code-available subject to a proprietary software license. This proprietary license prohibits, amongst other things, distribution and sale of the covered software. Notwithstanding these prohibitions, by virtue of the source code’s being publicly available, the covered software is vulnerable to unauthorized distribution and sale by third parties.

We are or may be the defendant in lawsuits or other claims that could cause us to incur substantial liabilities.

We have from time to time been, and are likely to in the future become, defendants in actual or threatened lawsuits brought by or on behalf of our current and former team members, competitors, vendors, shareholders, governmental or regulatory bodies, or third parties who use The DevSecOps platform. In addition, our agreements sometimes include indemnification provisions which can subject us to costs and damages in the event of a claim against an indemnified third party. In either case, the various claims in such lawsuits may include, among other things, negligence or misconduct in the operation of our business and provision of services, intellectual property infringement, unfair competition, or violation of employment or privacy laws or regulations. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate. However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits. In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions. An unfavorable outcome with respect to these lawsuits and any future lawsuits could, individually or in the aggregate, cause us to incur substantial liabilities that may have a material adverse effect upon our business, financial condition or results of operations. In addition, an unfavorable outcome in one or more of these cases could cause us to change our compensation plans

6661

Table of Contents

or violation of employment or privacy laws or regulations. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate. However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits. In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions. An unfavorable outcome with respect to these lawsuits and any future lawsuits could, individually or in the aggregate, cause us to incur substantial liabilities that may have a material adverse effect upon our business, financial condition or results of operations. In addition, an unfavorable outcome in one or more of these cases could cause us to change our compensation plans for our team members, which could have a material adverse effect upon our business. Further, while we maintain insurance that may provide coverage for these types of lawsuits and other claims, such coverage may not be adequate to cover the related costs and other liabilities.

We ~~are~~have been and could ~~continue~~in tothe future be subject to securities class action litigation and shareholder derivative suits.

Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following, among other things, periods of volatility in the market price of a company’s securities. ~~See Part II, Item 1 of this Form 10-Q for additional information regarding our pending legal proceedings.~~ Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. These types of litigation could result in substantial costs, adverse publicity, and a diversion of management’s attention and resources, which could adversely affect our business operating results, or financial condition. Additionally, the cost of directors’ and officers’ liability insurance may increase, which may cause us to opt for lower overall policy limits or to forgo insurance that we may otherwise rely on to cover significant defense costs, settlements, and damages awarded to plaintiffs.

We may engage in merger and acquisition activities and joint ventures, which could require significant management attention, disrupt our business, dilute stockholder value, and adversely affect our operating results.

As part of our business strategy, we have in the past and expect to continue to make investments in and/or acquire other companies, products, or technologies. We may not be able to find suitable acquisition candidates and we may not be able to complete acquisitions on favorable terms, if at all. Even if we complete acquisitions or joint ventures, we may not ultimately strengthen our competitive position or achieve our goals, and any acquisitions or joint ventures we complete could be viewed negatively by users or investors. In addition, if we fail to successfully integrate such acquisitions, or the assets, technologies or talent associated with such acquisitions, into our company, we may have depleted the company’s capital resources without attractive returns, and the revenue and operating results of the combined company could be adversely affected.

We may face additional risks in connection with acquisitions and joint ventures, including:

•diversion of management time and focus from operating our business to addressing acquisition integration challenges;

•coordination of research and development and sales and marketing functions;

•integration of product and service offerings;

•retention of key team members from the acquired company;

•changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

•integration of customers from the acquired company;

Table of Contents

•cultural challenges associated with integrating team members from the acquired company into our organization;

•integration of the acquired company’s accounting, management information, human resources and other administrative systems;

•the need to implement or improve controls, procedures and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

Table of Contents

•additional legal, regulatory or compliance requirements;

•financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we do not adequately address and that cause our reported results to be incorrect;

•liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;

•unanticipated write-offs or charges; and

•litigation or other claims in connection with the acquired company, including claims from terminated team members, customers, former stockholders or other third parties.

Further, we may have to pay cash, incur debt, or issue equity securities to pay for any such acquisition or joint venture, each of which could affect our financial condition or the value of our capital stock and could result in dilution to our stockholders. If we incur more debt it would result in increased fixed obligations and could also subject us to covenants or other restrictions that would impede or may be beyond our ability to manage our operations. Additionally, we may receive indications of interest from other parties interested in acquiring some or all of our business. The time required to evaluate such indications of interest could require significant attention from management, disrupt the ordinary functioning of our business, and adversely affect our operating results.

Our failure to address these risks or other problems encountered in connection with acquisitions activities and joint ventures could cause us to fail to realize the anticipated benefits of these acquisitions, investments or joint ventures, cause us to incur unanticipated liabilities, and harm our business generally.

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.

The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this ~~Annual~~Quarterly Report on Form 10-KQ. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, stock-based compensation, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, ~~business combinations, and~~ impairment of goodwill and long-lived assets. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

Adverse tax laws or regulations could be enacted or existing laws could be applied to us or our customers, which could increase the costs of our services and adversely impact our business.

The application of federal, state, local, and international tax laws to services provided electronically is evolving. New sales, use, value-added tax, digital service or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time (possibly with retroactive effect), and could be applied solely or disproportionately to services provided over the internet. If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows. Moreover, we are subject to the examination of our sales, use, and value-added tax returns by U.S. state and foreign tax authorities. We regularly assess the likelihood of outcomes resulting from these examinations and have reserved for potential adjustments that may result from these 63

Table of Contents

The termination of our relationship with our payment solutions providers could have a severe, negative impact on our ability to collect revenue from customers.

All web direct customers purchase our solution using online payment solutions such as credit cards, which represent the majority of the payment transactions we receive, and our business depends upon our ability to offer such payment options. The termination of our ability to process payments on any material payment ~~option~~solution would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing. If we fail to maintain our compliance with the data protection and documentation standards adopted by our payment processors and applicable to us, these processors could terminate their agreements with us, and we could lose our ability to offer our customers a credit card or other payment option. If these processors increase their payment processing fees because we experience excessive chargebacks or refunds or for other reasons, it could adversely affect our business and operating results. Increases in payment processing fees would increase our ~~operating~~ expense and adversely affect our operating results.

We process, store and use personal data and other data, which subjects us to governmental regulation and other legal obligations, including in the United States, the European Union, or the E.U., the United Kingdom, or the U.K., Canada, and Australia, related to privacy, and our actual or perceived failure to comply with such laws, regulations and contractual obligations could result in significant liability and reputational harm.

We receive, store and process personal data and other customer data. There are numerous federal, state, local and foreign laws regarding privacy and the storing, sharing, access, use, processing, disclosure and protection of personal data and other customer data, the scope of which is changing, subject to differing interpretations, and which may be inconsistent among countries or conflict with other rules.

With respect to E.U. and U.K. team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the GDPR and applicable national implementing legislation of the GDPR, and the U.K. General Data Protection Regulation and U.K. Data Protection Act 2018, or the U.K. GDPR, respectively. We are a controller with respect to this data.

The GDPR and U.K. GDPR impose stringent data protection requirements and, where we are acting as a controller, includes requirements to: provide detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form); demonstrate that an appropriate legal basis is in place or otherwise exists to justify data processing activities; grant rights for data subjects in regard to their personal data including the right to be “forgotten,” the right to data portability, the right to correct personal data, and the right to access personal data; notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; define pseudonymized (key-coded) data; limit the retention of personal data; maintain a record of data processing; and comply with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, trainings and audits. Where we act as a processor and process personal data on behalf of our customers, we are required to execute mandatory data processing clauses with those customers and maintain a record of data processing, among other requirements under the GDPR and U.K. GDPR. The GDPR and U.K. GDPR provide for penalties for noncompliance of up to the greater of €20 million or 4% of worldwide annual revenues (in the case of the GDPR) or £17 million and 4% of worldwide annual revenue (in the case of the U.K. GDPR). As we are required to comply with both the GDPR and the U.K. GDPR, we could be subject to parallel enforcement actions with respect to breaches of the GDPR or U.K. GDPR which affects both E.U. and U.K. data subjects. In addition to the foregoing, a breach of the GDPR or U.K. GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our personal data, enforcement notices, and/or

6964

Table of Contents

with those customers and maintain a record of data processing, among other requirements under the GDPR and U.K. GDPR. The GDPR and U.K. GDPR provide for penalties for noncompliance of up to the greater of €20 million or 4% of worldwide annual revenues (in the case of the GDPR) or £17 million and 4% of worldwide annual revenue (in the case of the U.K. GDPR). As we are required to comply with both the GDPR and the U.K. GDPR, we could be subject to parallel enforcement actions with respect to breaches of the GDPR or U.K. GDPR which affects both E.U. and U.K. data subjects. In addition to the foregoing, a breach of the GDPR or U.K. GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our personal data, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Legal developments in the E.U. have resulted in complexity and uncertainty regarding such transfers. For example, the European Court of Justice, or the CJEU, has previously advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism) are not alone sufficient to protect data transferred to the United States or other countries not deemed adequate and the current E.U.-U.S. Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A. and the U.K, has previously been subject to proposed legal challenges before the CJEU. Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board has also issued a decision imposing higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers and the CJEU has stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, supervisory authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. personal data to the United States. We will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business. ~~In addition, if participation in the DPF is deemed appropriate, then we would be required to update documentation and processes, which may result in further compliance costs.~~

InWe ~~addition,~~are ~~following~~also ~~the~~subject ~~U.K.’s~~to ~~withdrawal~~evolving ~~from the~~ E.U., ~~the~~and E.U.K. ~~issued~~privacy anlaws ~~adequacy~~on ~~decision~~cookies inand ~~June 2021 in favor of the U~~e-marketing.K. ~~permitting~~In ~~data transfers from~~ the E.U. toand the U.K., ~~This~~regulators ~~adequacy~~are ~~decision~~increasingly isfocusing ~~subject~~on tocompliance awith ~~four-year~~requirements ~~term set to expire~~ in ~~December 2025, with~~ the ~~expectation~~online itbehavioral ~~will~~advertising beecosystem, ~~renewed~~and ~~for~~current anational ~~further~~laws ~~period~~that ofimplement ~~six years as indicated by~~ the ~~European~~ePrivacy ~~Commission’s~~Directive ~~draft~~may ~~proposal. However,~~increase ~~the~~fines ~~draft~~for ~~renewal proposal still needs approval by all E~~non-compliance.U. ~~member~~In ~~states and~~ the E.U. ~~could~~and ~~intervene during~~ the ~~current term or any approved renewal term, if it determines that the data protection laws in the~~ U.K., ~~are~~informed ~~not~~consent ~~sufficient. If the adequacy decision~~ is ~~not~~required ~~renewed~~for ~~after its term, or~~ the ~~E.U.~~placement ~~intervenes~~of ~~during~~a ~~the~~cookie ~~term,~~or ~~data~~similar ~~may~~technologies ~~not~~on bea ~~able~~user’s todevice ~~flow~~and ~~freely~~for ~~from~~direct ~~the~~electronic Emarketing.U. toThe ~~the~~ U.K. ~~unless~~GDPR ~~additional~~also ~~measures~~imposes ~~are~~conditions ~~taken.~~on Inobtaining ~~which~~valid ~~case~~consent, wesuch ~~may~~as bea ~~required~~prohibition ~~to find alternative solutions for the compliant transfer of personal data into the U.K. from the E.U. As supervisory authorities continue to issue further guidance~~ on ~~personal~~pre-checked ~~data~~consents ~~(including regarding data export~~ and ~~circumstances~~a inrequirement ~~which~~to weensure ~~cannot~~separate ~~use~~consents ~~the~~are ~~Standard~~sought ~~Contractual~~for ~~Clauses),~~each wetype ~~could~~of ~~suffer~~cookie ~~additional costs, complaints,~~ or ~~regulatory~~similar ~~investigations~~technology. ~~or fines~~Further, ~~and~~a ifrecent weEuropean ~~are~~court ~~otherwise~~decision ~~unable to transfer personal data between~~ and ~~among~~regulators’ ~~countries~~recent ~~and~~guidance ~~regions~~are indriving ~~which~~increased weattention ~~operate,~~to itcookies ~~could~~and ~~affect~~tracking ~~the~~technologies. ~~manner~~If inregulators ~~which~~start weto ~~provide~~enforce ~~our services,~~ the ~~geographical~~strict ~~location~~approach orin ~~segregation~~recent ~~of our relevant systems and operations~~guidance, ~~and~~this could ~~adversely~~lead ~~affect~~to ~~our~~substantial ~~financial results. Loss~~costs, ~~retention~~limit orthe ~~misuse~~effectiveness of ~~certain~~our ~~information~~marketing ~~and alleged violations of laws and regulations relating to privacy and data security~~activities, ~~and any relevant claims, may expose us to potential liability and may require us to~~

7065

Table of Contents

~~expend~~divert ~~significant~~the ~~resources~~attention onof ~~data~~our ~~security~~technology personnel, adversely affect our margins, increase costs and insubject ~~responding~~us to additional liabilities. Regulation of cookies and ~~defending~~similar ~~such~~technologies, ~~allegations~~and any decline of cookies or similar online tracking technologies as a means to identify and ~~claims~~potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

We are also subject to evolving E.U. and U.K. privacy laws on cookies and e-marketing. In the E.U. and the U.K., regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may increase fines for non-compliance. In the E.U. and the U.K., informed consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing. The U.K. GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Further, a recent European court decision and regulators’ recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf or as our sub-processor. To the extent required by applicable law, we attempt to mitigate the associated risks of using third parties by performing security assessments and detailed due diligence, entering into contractual arrangements to ensure that providers only process personal data according to our instructions or equivalent instructions to that of our customer (as applicable), and that they have sufficient technical and organizational security measures in place. Where we transfer personal data outside the E.U. or the U.K. to such third parties, we do so in compliance with the relevant data export requirements, as described above. There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information. Any violation of data or security laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties under the GDPR and the U.K. GDPR outlined above.

Additionally, we are subject to the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA, ~~among other things,~~ requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Compliance with privacy legislation adds complexity and has required and may in the future require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Table of Contents

directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

We are also currently subject to China’s Personal Information Protection Law, or PIPL, which came into effect in November 2021 and which increases the protections of Chinese residents. In particular, the law is intended to protect the rights and interests of individuals, to regulate personal data processing activities, to safeguard the lawful and “orderly flow” of data, and to facilitate reasonable use of personal data. Our failure to comply with the PIPL may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results. Also, the Cyberspace Administration of China has developed measures to govern cross-border transfers of personal data, such as security assessments, certifications, and Standard Contractual Clauses, all of which may impact our ability to transact with customers with operations in China. To reduce the impact of PIPL, we are in the process of transitioning certain users who are resident in China to our JiHu entity.

Table of Contents

Further, we are subject to Payment Card Industry Data Security Standard, or PCI-DSS, a security standard applicable to companies that collect, store or transmit certain data regarding credit and debit cards, holders and transactions. We rely on vendors to handle PCI-DSS matters and to ensure PCI-DSS compliance. Despite our compliance efforts, we may become subject to claims that we have violated the PCI-DSS based on past, present, and future business practices. Our actual or perceived failure to comply with the PCI-DSS can subject us to fines, termination of banking relationships, and increased transaction fees. In addition, there is no guarantee that PCI-DSS compliance will prevent illegal or improper use of our payment systems or the theft, loss or misuse of payment card data or transaction information.

We generally seek to comply with industry standards and are subject to the terms of our privacy policies and privacy-related obligations to third parties. We strive to comply with all applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data protection to the extent possible. However, it is possible that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any failure or perceived failure by us to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to users or other third parties, or any compromise of security that results in the unauthorized release or transfer of personal data or other customer data, may result in governmental enforcement actions, litigation, or public statements against us by consumer advocacy groups or others and could cause our users to lose trust in us, which would have an adverse effect on our reputation and business. It is possible that a regulatory inquiry might result in changes to our policies or business practices. Violation of existing or future regulatory orders or consent decrees could subject us to substantial monetary fines and other penalties that could negatively affect our financial condition and operating results. In addition, it is possible that future orders issued by, or enforcement actions initiated by, regulatory authorities could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.

Any significant change to applicable laws, regulations or industry practices regarding the use or disclosure of our users’ data, or regarding the manner in which the express or implied consent of users for the use and disclosure of such data is obtained – or in how these applicable laws, regulations or industry practices are interpreted and enforced by state, federal and international privacy regulators – could require us to modify our services and features, possibly in a material manner, may subject us to regulatory enforcement actions and fines, and may limit our ability to develop new services and features that make use of the data that our users voluntarily share with us.

In addition to U.S. and foreign privacy laws, we are subject to a variety of new and evolving legal and regulatory requirements related to data, content, content moderation, and safety, such as the EU Digital Services Act, or DSA, which imposes obligations on hosting service providers including requirements related to content moderation, transparency reporting, and user complaint mechanisms. Similar platform regulations have been enacted in other jurisdictions, including the UK. Compliance with the DSA and similar laws could subject us to increased compliance costs and operational requirements, and includes significant penalties for non-compliance of up to 6% of global annual turnover and provides for the ability of civil society organizations and non-governmental organizations to commence class action lawsuits. The interpretation and enforcement of these requirements remain subject to uncertainty, and failure to comply could result in fines, enforcement actions, or limitations on our ability to operate in affected jurisdictions, which could adversely affect our business, financial condition, and results of operations.

We are subject to various governmental export controls, trade sanctions, and import laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls.

In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC, and collectively, Trade Controls. As such, a license may be required to export or re-export our products, or provide related services, to certain

7267

Table of Contents

subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC, and collectively, Trade Controls. As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. For example, Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries, and have sanctioned various entities and individuals located there, while recent sanctions restrict the provision of certain cloud services to Russia. Those Trade Controls are unprecedented and expansive, and may continue to evolve. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

We have procedures in place designed to ensure our compliance with Trade Controls, with which failure to comply could subject us to both civil and criminal penalties, including substantial fines, possible incarceration of responsible individuals for willful violations, possible loss of our export or import privileges, and reputational harm. We are currently working to enhance these procedures. Trade Controls are complex and dynamic regimes, and monitoring and ensuring compliance can be challenging, particularly given that our products are widely distributed throughout the world and are available for download without registration. Prior to implementing certain control procedures, we inadvertently exported our software to entities located in embargoed countries and listed on denied parties lists administered by the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, and OFAC. In September 2019, we disclosed these apparent violations to BIS and OFAC, which resulted in a BIS Warning Letter and an OFAC Cautionary Letter, in January and February 2020, respectively. While BIS and OFAC did not assess any penalties, we understand that BIS and OFAC may consider our regulatory history, including these prior disclosures and warning/cautionary letters, if the company is involved in a future enforcement case for failure to comply with export control laws and regulations. Any future failure by us or our partners to comply with applicable laws and regulations would have negative consequences for us, including reputational harm, government investigations, and penalties.

In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our end-customers’ ability to implement our products in those countries. Changes in our products or changes in export and import regulations in such countries may create delays in the introduction of our products into international markets, prevent our end-customers with international operations from deploying our products globally or, in some cases, prevent or delay the export or import of our products to certain countries, governments, or persons altogether. Any change in export or import laws or regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing export, import or sanctions laws or regulations, or change in the countries, governments, persons, or technologies targeted by such export, import or sanctions laws or regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations. Any decreased use of our products or limitation on our ability to export to or sell our products in international markets could adversely affect our business, financial condition, and results of operations.

Failure to comply with anti-bribery, anti-corruption, anti-money laundering laws, and similar laws, could subject us to penalties and other adverse consequences.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010 and other anti-bribery and anti-money laundering laws in countries outside of the United States in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their team members, and their third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

We sometimes leverage third parties to sell our products and services and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our team members, representatives, contractors, partners, and agents, even if we do not explicitly authorize such

7368

Table of Contents

~~employees of government agencies or state-owned or affiliated entities and may be held liable for the corrupt or other illegal~~ activities ~~of these third-party business partners and intermediaries, our team members, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities~~. We cannot assure you that all of our team members and agents will not take actions in violation of applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.

Any allegations or actual violation of the FCPA or other applicable anti-bribery, anti-corruption laws, and anti-money laundering laws could result in whistleblower complaints, sanctions, settlements, prosecution, enforcement actions, fines, damages, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from U.S. government contracts, all of which may have an adverse effect on our reputation, business, results of operations, and prospects. Responding to any investigation or action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees. In addition, the U.S. government may seek to hold us liable for successor liability for FCPA violations committed by companies in which we invest or that we acquire. As a general matter, investigations, enforcement actions and sanctions could harm our reputation, business, results of operations, and financial condition.

Further, in June 2024, the U.S. Supreme Court reversed its longstanding approach under the Chevron doctrine, which provided for judicial deference to regulatory agencies. As a result of this decision, we cannot be sure whether there will be increased challenges to existing agency regulations or how lower courts will apply the decision in the context of other regulatory schemes without more specific guidance from the U.S. Supreme Court and/or federal appellate courts. For example, the U.S. Supreme Court’s decision could significantly impact consumer protection, advertising, privacy, artificial intelligence, anti-corruption and anti-money laundering practices and other regulatory regimes with which we are required to comply.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive, and time-consuming, often requiring significant up-front time and expense without any assurance that these efforts will generate a sale. Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained the revised certification. Government demand and payment for our products may be affected by public sector budgetary cycles, funding authorizations, government shutdowns, and general political priorities and initiatives, with funding delays, or reductions or eliminations, adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products. The U.S. federal government and other government entities are in the process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

Additionally, we rely on certain partners to provide technical support services to certain of our government entity customers to resolve any issues relating to our products. If our partners do not effectively assist our government entity customers in deploying our products, succeed in helping our government entity customers quickly resolve post-deployment issues, or provide effective ongoing support, our ability to sell additional products to new and existing government entity customers would be adversely affected and our reputation could be damaged.

Government entities may have statutory, contractual, or other legal rights to terminate contracts with us for convenience, including in connection with political priorities or initiatives, or due to a default, and any such termination may adversely affect our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or

7469

Table of Contents

any such termination may adversely affect our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.

One of our competitive advantages is our ability to provide users of our products and services with access to an abundance of useful, efficient, high-quality code which in turn depends on the quality and volume of code contributed by our open source contributors.

We believe that one of our competitive advantages is the quality, quantity and collaborative nature of the code on GitLab, and that access to open source code is an important reason why users visit GitLab. In furtherance of the foregoing competitive advantages and access, we seek to foster a broad and engaged contributor community, and we encourage individuals, companies, governments, and institutions to use our products and services to learn, code and work. If contributors, including influential contributors, do not continue to contribute code, our customer base and contributor engagement may decline. Additionally, if we are not able to address user concerns regarding the safety and security of our products and services or if we are unable to successfully prevent abusive or other hostile behavior on The DevSecOps platform, the size of our customer base and contributor engagement may decline. If there is a decline in the number of contributors, customer or contributor growth rate or engagement, including as a result of the loss of influential contributors and companies who provide innovative code on GitLab, or due to the increased adoption of AI, paying customers of our online services may be deterred from using our products or services or reduce their spending with us or cease doing business with us, which would harm our business and operating results.

Seasonality may cause fluctuations in our sales and results of operations.

Historically, we have experienced seasonality in new customer contracts, as we typically enter into a higher percentage of subscription agreements with new customers and renewals with existing customers in the last two fiscal quarters of each year. We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. We expect that this seasonality, which can itself at times be unpredictable, will continue to affect our bookings, deferred revenue, and our results of operations in the future and might become more pronounced as we continue to target larger enterprise customers.

We recognize a significant portion of revenue from subscriptions over the term of the relevant subscription period, and as a result, downturns or upturns in sales are not immediately reflected in our results of operations. Further, we recognize a significant portion of our subscription revenue over the term of the relevant subscription period. As a result, much of the subscription revenue we report each fiscal quarter is the recognition of deferred revenue from subscription contracts entered into during previous fiscal quarters. Consequently, a decline in new or renewed subscriptions in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter and will negatively affect our revenue in future fiscal quarters. Accordingly, the effect of significant downturns in new or renewed sales of our subscriptions is not fully reflected in our results of operations until future periods.

The length of our sales cycle can be unpredictable, particularly with respect to sales to large customers, and our sales efforts may require considerable time and expense.

Our results of operations may fluctuate, in part, because of the length and variability of the sales cycle of our subscriptions and the difficulty in making short-term adjustments to our operating expenses. The length of our sales cycle, from initial contact from a prospective customer to contractually committing to our paid subscriptions can vary substantially from customer to customer based on deal complexity as well as whether a sale is made directly by us. It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers, the timing of our

7570

Table of Contents

~~as whether a sale is made directly by us. It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing~~ customers~~, the timing of our customers~~’ decisions to make a purchase, greater deal scrutiny by our customers, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. Our results of operations depend in part on sales to new large customers and increasing sales to existing customers. As a result, in particular, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. Because a substantial proportion of our expenses are relatively fixed in the short term, our results of operations will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our Class A common stock to decline.

Risks Related to our People and Culture

We rely on our management team and other key team members and will need additional personnel to grow our business, and the loss of one or more key team members or our inability to hire, integrate, train and retain qualified personnel, could harm our business.

Our future success is dependent, in part, on our ability to hire, integrate, train, retain and motivate the members of our management team and other key team members throughout our organization. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, finance, support, product development, human resources, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

OnCompetition ~~December~~for 5highly skilled personnel in our industry is intense, ~~2024~~and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs. We have, ~~Sytse~~from ~~Sijbrandij~~time to time, ~~our~~experienced, ~~co-founder~~and we may experience in the future, ~~resigned~~difficulty ~~from~~in ~~his~~hiring ~~position~~and asretaining ~~our~~highly ~~Chief~~skilled ~~Executive~~team ~~Officer~~members with appropriate qualifications. In ~~connection~~particular, recruiting and hiring senior product engineering personnel with ~~his~~AI ~~resignation,~~and ~~Mr.~~machine ~~Sijbrandij~~learning ~~was~~backgrounds ~~appointed~~has asbeen, ~~the~~and ~~Executive~~we ~~Chair~~expect ofit ~~our~~to ~~board~~continue ofto ~~directors~~be, challenging. On ~~December~~June 51, ~~2024~~2026, wethe ~~also~~board ~~announced~~of ~~that~~directors ~~William~~of ~~Staples~~the ~~had~~Company ~~been~~approved ~~appointed~~a asrestructuring ~~our~~plan ~~Chief~~(the ~~Executive Officer~~“Plan”). ~~While~~The weCompany ~~conducted~~anticipates ~~this~~approximately ~~transition~~14% inof anits ~~orderly~~global ~~manner~~workforce as of January 31, ~~any~~2026 may ~~change~~be inimpacted by the ~~leadership~~Plan. ofThe Plan is intended to help position the ~~company~~Company isfor along-term ~~significant~~success ~~event~~by ~~and~~realigning ~~may~~its ~~result~~operating instructure ~~additional~~to ~~volatility~~optimize inexecution ~~our~~against ~~stock~~its ~~price~~strategic ~~and~~priorities. Any future reduction in force could ~~disrupt~~be disruptive to our operations and ~~have~~could anyield ~~adverse~~unanticipated ~~effect~~consequences, onsuch as attrition beyond planned staff reductions, or disruptions in our day-to-day operations, or could negatively impact our ability to ~~grow~~attract and retain qualified management, technology software professionals or other personnel who are critical to our business.

Competition for highly skilled personnel in our industry is intense, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs. We have, from time to time, experienced, and we may experience in the future, difficulty in hiring and retaining highly skilled team members with appropriate qualifications. In particular, recruiting and hiring senior product engineering personnel with AI and machine learning backgrounds has been, and we expect it to continue to be, challenging.

Further, many of the companies with which we compete for experienced personnel have greater resources than we have. Our competitors also may be successful in recruiting and hiring members of our management team or other key team members, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all. We have in the past, and may in the future, be subject to allegations that team members we hire have been improperly solicited, or that they have divulged proprietary or other confidential information or that their former employers own such team member’s inventions or other work product, or that they have been hired in violation of non-compete provisions or non-solicitation provisions.

In addition, job candidates and existing team members often consider the value of the benefits and equity awards they receive in connection with their employment. If the perceived value of our benefits, equity, or equity awards declines, it may adversely affect our ability to retain highly skilled team members. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects would be severely harmed.

7671

Table of Contents

Our corporate culture has contributed to our success, and if we cannot maintain this culture ~~as we grow~~, we could lose the innovation, creativity, and teamwork fostered by our culture, and our business may be harmed.

We believe that our corporate culture has been and will continue to be a key contributor to our success. If we do not continue to develop our corporate culture as we ~~grow~~continue ~~and~~to evolve, it could harm our ability to foster the innovation, creativity, and teamwork that we believe is important to support our growth. As our organization grows and we are required to implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.

We engage our team members in various ways, including direct hires, through PEOs and as independent contractors. As a result of these methods of engagement, we face certain challenges and risks that can affect our business, operating results, and financial condition.

In the locations where we directly hire our team members into one of our entities, we must ensure that we are compliant with the applicable local laws governing team members in those jurisdictions, including local employment and tax laws. In the locations where we utilize PEOs, we contract with the PEO for it to serve as “Employer of Record” for those team members engaged through the PEO in each applicable location. Under this model, team members are employed by the PEO but provide services to GitLab. We also engage team members through a PEO self-employed model in certain jurisdictions where we contract with the PEO, which in turn contracts with individual team members as independent contractors. In all locations where we utilize PEOs, we rely on those PEOs to comply with local employment laws and regulations. We also issue equity to a substantial portion of our team members, including team members engaged through PEOs and to independent contractors, and must ensure we remain compliant with securities laws of the applicable jurisdiction where such team members are located.

Additionally, in some cases, we contract directly with team members who are independent contractors. When we engage team members through a PEO or independent contractor model, we may not be utilizing the appropriate hiring model needed to be compliant with local laws or the PEO may not be complying with local regulations. Additionally, the agreements executed between PEOs and our team members or between us and team members engaged under the independent contractor model, may not be enforceable depending on the local laws because of the indirect relationship created through these engagement models. Accordingly, as a result of our engagement of team members through PEOs, and of our relationship with independent contractors, our business, financial condition and results of operations could be materially and adversely affected. Furthermore, litigation related to our model of engaging team members, if instituted against us, could result in substantial costs and divert our management’s attention and resources from our business.

If we do not effectively hire, integrate, and train additional sales personnel, and expand our sales and marketing capabilities, we may be unable to increase our customer base and increase sales to our existing customers.

Our ability to increase our customer base and achieve broader market adoption of The DevSecOps platform will depend to a significant extent on our ability to continue to expand our sales and marketing operations. We plan to dedicate significant resources to sales and marketing programs and to expand our sales and marketing capabilities to target additional potential customers, but there is no guarantee that we will be successful in attracting and maintaining additional customers. If we are unable to find efficient ways to deploy our sales and marketing investments or if our sales and marketing programs are not effective, our business and operating results would be adversely affected.

Furthermore, we plan to continue expanding our sales force and there is significant competition for sales personnel with the skills and technical knowledge that we require. Our ability to achieve revenue growth will depend, in part, on our success in hiring, integrating, training, and retaining sufficient numbers

7772

Table of Contents

of sales personnel to support our growth, particularly in international markets. New hires require significant training and may take significant time before they achieve full productivity. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business, operating results, and financial condition will be adversely affected.

We are a remote-only company, meaning that our team members work remotely which poses a number of risks and challenges that can affect our business, operating results, and financial condition. We are highly dependent on technology in our operations and if our technology fails, our business could be adversely affected.

As a remote-only company, we face a number of unique operational risks. For example, technologies in our team members’ homes may not be robust enough and could cause the networks, information systems, applications, and other tools available to team members and service providers to be limited, unreliable, or unsecure. Additionally, we are highly dependent on technology as a remote-only company and if we experience problems with the operation of our current IT systems or the technology systems of third parties on which we rely, that could adversely affect, or even temporarily disrupt, all or a portion of our operations until resolved. In addition, in a remote-only company, it may be difficult for us to develop and preserve our corporate culture and our team members may have decreased opportunities to collaborate in meaningful ways. Any impediments to preserving our corporate culture and fostering collaboration could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively, and execute on our business strategy.

Unfavorable media coverage could negatively impact our business.

We receive a high degree of media coverage, including due to our commitment to transparency. Unfavorable publicity or consumer perception of our service offerings could adversely affect our reputation, resulting in a negative impact on the size of our user base and the loyalty of our users. It could negatively impact our ability to acquire new customers and could lead to customers choosing to leave GitLab. As a result, our business, financial condition and results of operations could be materially and adversely affected.

Our brand, reputation, and business may be harmed if our customers, partners, team members, contributors or the public at large disagrees with, or finds objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team.

Our customers, partners, team members, contributors or the public at large may, from time to time, disagree with, or find objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team. As a result of these disagreements and any negative publicity associated therewith, we could lose customers or partners, or we may have difficulty attracting or retaining team members or contributors and such disagreements may divert resources and the time and attention of management from our business. Our culture of transparency may also result in customers, partners, team members, contributors or the public at large having greater insight into our policies and practices or organizational decisions. Additionally, with the importance and impact of social media, any negative publicity regarding our policies and practices or organizational decisions or actions by members of our management team, may be magnified and reach a large portion of our customer, partner, team member base or contributors in a very short period of time, which could harm our brand and reputation and adversely affect our business.

7873

Table of Contents

Risks Related to Our International Operations

We plan to continue expanding our international operations which could subject us to additional costs and risks, and our continued expansion internationally may not be successful.

We plan to expand our operations internationally in the future. Outside of the United States, we currently have direct and indirect subsidiaries in Canada, Germany, France, India, Ireland, Israel, the Netherlands, Spain, the United Kingdom, Australia, India, Japan, South Korea, and Singapore, and have team members in over 60 countries. We also have a joint venture in China. There are significant costs and risks inherent in conducting business in international markets, including:

•establishing and maintaining effective controls at foreign locations and the associated increased costs;

•adapting our technologies, products, and services to non-U.S. consumers’ preferences and customs;

•increased competition from local providers;

•compliance with foreign laws and regulations;

•adapting to doing business in other languages and/or cultures;

•compliance with the laws of numerous taxing jurisdictions where we conduct business, potential double taxation of our international earnings, foreign tax withholding on intercompany transactions, and potentially adverse tax consequences due to U.S. and foreign tax laws as they relate to our international operations;

•compliance with anti-bribery laws, such as the FCPA and the U.K. Bribery Act, by us, our team members, our service providers, and our business partners;

•difficulties in staffing and managing global operations and the increased travel, infrastructure, and compliance costs associated with multiple international locations;

•complexity and other risks associated with current and future foreign legal requirements, including legal requirements related to data privacy frameworks, such as the GDPR and U.K. GDPR;

•currency exchange rate fluctuations or limitations and related effects on our operating results;

•economic and political instability in some countries, including the potential effects of health pandemics or epidemics and the ongoing armed conflicts in different regions of the world;

•the uncertainty of protection for intellectual property rights in some countries and practical difficulties of enforcing rights abroad; and

•other costs of doing business internationally.

These factors and other factors could harm our international operations and, consequently, materially impact our business, operating results, and financial condition. Further, we may incur significant operating expenses as a result of our international expansion, which may not be successful. We have limited experience with regulatory environments and market practices internationally, and we may not be able to penetrate or successfully operate in new markets. If we are unable to continue to expand internationally and manage the complexity of our global operations successfully, our financial condition and operating results could be adversely affected.

7974

Table of Contents

We have a limited operating history in China and we face risks with respect to conducting business in connection with our joint venture in China due to certain legal, political, economic and social uncertainties relating to China. Our ability to monetize our joint venture in China may be limited.

In February 2021, we partnered with two Chinese investment partners to form an independent company called GitLab Information Technology (Hubei) Co., Ltd. (极狐, pinyin: JiHu, pronounced Gee Who) which was formed to specifically serve the Chinese market. This company offers a dedicated distribution of The DevSecOps platform available as both a self-managed and SaaS that is only available in mainland China, Hong Kong and Macau. The autonomous company has its own governance structure, management team, and business support functions including Engineering, Sales, Marketing, Finance, Legal, Human Relations and Customer Support.

Our participation in this joint venture in China is subject to general, as well as industry-specific, economic, political, tax, and legal developments and risks in China. The Chinese government exercises significant control over the Chinese economy, including but not limited to controlling capital investments, allocating resources, setting monetary policy, controlling and monitoring foreign exchange rates, implementing and overseeing tax regulations, providing preferential treatment to certain industry segments or companies and issuing necessary licenses to conduct business. In addition, we could face additional risks resulting from changes in China’s data privacy and cybersecurity requirements, including China’s adoption of the Personal Information Protection Law, or PIPL, which went into effect on November 1, 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to citizens of China. Accordingly, any adverse change in the Chinese economy, the Chinese legal system or Chinese governmental, economic or other policies could have a material adverse effect on our business and operations in China and our prospects generally.

We face additional risks in China due to China’s historically limited recognition and enforcement of contractual and intellectual property rights. We may experience difficulty enforcing our intellectual property rights in China. Unauthorized use of our technologies and intellectual property rights by Chinese partners or competitors may dilute or undermine the strength of our brands. If we cannot adequately monitor the use of our technologies and products, or enforce our intellectual property rights in China or contractual restrictions relating to use of our intellectual property by Chinese companies, our revenue from JiHu could be adversely affected.

Our joint venture is subject to laws and regulations applicable to foreign investment in China. There are uncertainties regarding the interpretation and enforcement of laws, rules and policies in China. Because many laws and regulations are relatively new, the interpretations of many laws, regulations and rules are not always uniform. Moreover, the interpretation of statutes and regulations may be subject to government policies reflecting domestic political agendas. Enforcement of existing laws or contracts based on existing law may be uncertain and sporadic. As a result of the foregoing, it may be difficult for us to obtain swift or equitable enforcement of laws ostensibly designed to protect companies like ours, which could have a material adverse effect on our business and results of operations. Our ability to monetize our joint venture in China may also be limited. Although the joint venture entity is an autonomous company, it is the exclusive seller of GitLab in mainland China, Hong Kong and Macau and is therefore the public face of GitLab in those areas. Additionally, under U.S. GAAP, we currently consolidate the joint venture’s financials within our own and rely on the joint venture’s management for accurate and timely delivery of the joint venture’s financials. Therefore, we face reputational and brand risk as a result of any negative publicity faced by the joint venture entity. Any such reputational and brand risk can harm our business and operating results.

8075

Table of Contents

We are exposed to fluctuations in currency exchange rates and interest rates, which could negatively affect our results of operations and our ability to invest and hold our cash.

Revenue generated is primarily billed in U.S. dollars while expenses incurred by our international subsidiaries and activities are often denominated in the currencies of the local countries. As a result, our consolidated U.S. dollar financial statements are subject to fluctuations due to changes in exchange rates as the financial results of our international subsidiaries are translated from local currencies into U.S. dollars. Our financial results are also subject to changes in exchange rates that impact the settlement of transactions in non-local currencies. To date, we have not engaged in currency hedging activities to limit the risk of exchange fluctuations and, as a result, our financial condition and operating results could be adversely affected by such fluctuations.

Our fixed-income investment portfolio is subject to fluctuations in fair value due to change in interest rates, which could adversely affect our results of operations due to any rise in interest rates in the future.

Risks Related to Financial and Accounting Matters

Failure to maintain effective systems of internal controls and disclosure controls could have a material adverse effect on our business, operating results, and financial condition.

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective internal control over financial reporting, or ICFR, and disclosure controls and procedures, or DC&P. In order to maintain and improve the effectiveness of our ICFR and DC&P, we have expended, and anticipate that we will continue to expend, significant resources, including accounting related costs and significant management oversight.

Maintaining effective ICFR and DC&P requires ongoing attention and resources. Our current controls may become inadequate because of changes in conditions in our business, personnel, IT systems and applications, or other factors. WeIf ~~have successfully remediated a previously identified material weakness in our ICFR as of January 31, 2025, and if~~ we identify ~~new~~ material weaknesses or fail to maintain effective controls, it could adversely affect our operating results, cause us to fail to meet our reporting obligations, result in a restatement of our financial statements, or adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports.

As a public company that is a large accelerated filer, our independent registered public accounting firm is required to provide an annual attestation report on the effectiveness of our ICFR, which has required, and will continue to require, increased costs, expenses, and management resources.

We incur significant costs and devote management resources as a result of operating as a public company.

As a public company, we incur significant legal, accounting, compliance and other expenses. Our management and other personnel devote a substantial amount of time and incur significant expense in connection with compliance initiatives. As a public company, we bear all of the internal and external costs of preparing and distributing periodic public reports in compliance with our obligations under the securities laws.

In addition, regulations and standards relating to corporate governance and public disclosure, including the Sarbanes-Oxley Act, and the related rules and regulations implemented by the SEC, have increased legal and financial compliance costs and will make some compliance activities more time consuming. We intend to continue to invest resources to comply with evolving laws, regulations and standards, and this investment will result in increased general and administrative expenses and may divert management’s time and attention from our other business activities. If our efforts to comply with

8176

Table of Contents

~~divert management’s time and attention from our other business activities. If our efforts to comply with~~ new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us, and our business may be harmed. While we believe we currently have sufficient directors’ and officers’ insurance coverage, it may in the future, be more expensive or more difficult for us to obtain director and officer liability insurance. We may also be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors would also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation and leadership development committee, and qualified executive officers.

We may in the future need to raise additional capital to grow our business, and we may not be able to raise capital on terms acceptable to us or at all. In addition, any inability to generate or obtain such capital may adversely affect our operating results and financial condition.

In order to support our growth and respond to business challenges, such as developing new features or enhancements to our services to stay competitive, acquiring new technologies, and improving our infrastructure, we have made significant financial investments in our business and we intend to continue to make such investments. As a result, we may need to engage in additional equity or debt financings to provide the funds required for these investments and other business endeavors. If we need to engage in such additional equity or debt financings, we may not be able to raise needed cash on terms acceptable to us or at all. Financing may be on terms that are dilutive or potentially dilutive to our stockholders, and the prices at which new investors would be willing to purchase our securities may be significantly lower than the current price per share of our Class A common stock. The holders of new debt or equity securities may also have rights, preferences, or privileges that are senior to those of existing holders of our common stock. If new sources of financing are required, but are insufficient or unavailable, we will be required to modify our growth and operating plans based on available funding, if any, which would harm our ability to grow our business.

If we raise additional funds through equity or convertible debt issuances, our existing stockholders may suffer significant dilution and these securities could have rights, preferences, and privileges that are superior to those of holders of our common stock. If we obtain additional funds through debt financing, we may not be able to obtain such financing on terms favorable to us. Such terms may involve restrictive covenants making it difficult to engage in capital raising activities and pursue business opportunities, including potential acquisitions. The trading prices of technology companies have been highly volatile as a result of recent global events, including volatile interest rates, inflation, tariffs and the ongoing armed conflicts in different regions of the world, which may reduce our ability to access capital on favorable terms or at all. In addition, a sustained adverse market event resulting from such global events could adversely affect our business and the value of our Class A common stock. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired and our business may be adversely affected, requiring us to delay, reduce, or eliminate some or all of our operations.

Changes in tax laws or other tax guidance could adversely affect our effective tax rates, financial condition, and results of operations.

We are a U.S.-based multinational company subject to taxes in multiple U.S. and foreign tax jurisdictions. In the United States and other countries where we conduct business and in jurisdictions in which we are subject to taxes, including those covered by governing bodies that enact tax laws applicable to us, we are subject to potential changes in relevant tax, accounting and other laws, regulations, guidance, and interpretations, including changes to tax laws applicable to corporate multinationals such as GitLab. These countries, governmental bodies, and intergovernmental economic organizations such as the Organization for Economic Cooperation and Development, have or could make unprecedented assertions about how taxation is determined in their jurisdictions that are contrary to the way in which we have interpreted and historically applied the rules and regulations described above in such jurisdictions. In the current global tax policy environment, any changes in laws, regulations, guidance and/or

8277

Table of Contents

~~the current global tax policy environment, any changes in laws, regulations, guidance and/or~~ interpretations related to these assertions could adversely affect our effective tax rates, cause us to respond by making changes to our business structure, or result in other costs to us which could adversely affect our operations and financial results.

In July 2025, the U.S. federal government enacted the One Big Beautiful Bill Act, or OBBBA, implementing significant corporate tax reforms. OBBBA provides immediate deductibility for domestic research and experimental expenses for tax years beginning after December 31, 2024, with elections available to accelerate deductions for previously capitalized research and experimental expenses from 2022 through 2024. Corporations may deduct remaining unamortized amounts either fully in their first taxable year beginning after December 31, 2024, or ratably over two years. OBBBA increased the tax rate associated with international operations and reduced the tax benefit associated with certain foreign-derived deduction eligible income of United States-domiciled corporations. OBBBA also increased the Base Erosion and Anti-Abuse Tax rate associated with payments from United States corporations to foreign subsidiaries treated as Controlled Foreign Corporations.

The Treasury Department is expected to issue extensive guidance addressing implementation and transition rules. From time to time, the United States Congress may enact technical corrections to OBBBA. The outcome of such guidance and technical corrections and their impact on us is uncertain at this time.

~~Over~~The ~~the last several years, the~~ Organization for Economic Cooperation and Development, or the OECD, ~~has~~implemented ~~been working on~~ a ~~Base~~model ~~Erosion~~treaty ~~and Profit Shifting project that, if implemented, would change various aspects of the existing~~ framework ~~under~~ which ~~our~~includes ~~tax obligations are determined in many of the countries in which we do business. The OECD has~~ a ~~framework to implement a~~ global minimum corporate tax of 15% for companies with global revenues and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January 1, 2025. While the United States has withdrawn support for Pillar 2, certain countries in which we operate have adopted legislation. As of the filing of this Form 10-Q, over 60 countries have enacted or drafted legislation to adopt a minimum “Top Up” tax which allows international jurisdictions to tax their domestic income if the worldwide tax on such income is less than a minimum threshold. While the OECD has recommended that the worldwide system of taxation implemented by the United States is compliant under its framework, certain OECD member countries may implement laws which nevertheless impose top-up taxes. Similarly, the European Union and several countries have issued proposals that would apply to various aspects of the current tax framework under which we are taxed. These include proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue. For example, several jurisdictions have proposed or enacted taxes applicable to digital services, which include business activities on digital advertising and online marketplaces, and which apply to our business.

Due to the large and expanding scale of our international business activities, many of these types of changes to the taxation of our activities described above could increase our worldwide effective tax rate, increase the amount of non-income taxes imposed on our business, and harm our financial position, results of operations, and cash flows. Such changes may also apply retroactively to our historical operations and result in taxes greater than the amounts estimated and recorded in our financial statements. There can be no assurance that future tax law changes will not increase the rate of the corporate income tax, impose new limitations on deductions, credits or other tax benefits, or make other changes that may adversely affect our business, cash flows or financial performance. Among other considerations, the applicability and impact of these tax provisions, and of other U.S. or international tax law changes could adversely affect our effective income tax rate and cash flows in future years.

We may have exposure to greater than anticipated tax liabilities.

The tax laws applicable to our business, including the laws of the United States and other jurisdictions, are subject to interpretation and certain jurisdictions are aggressively interpreting their laws to expand the tax bases. Our existing corporate structure has been implemented in a manner we believe is in compliance with current tax laws. However, the taxing authorities of the jurisdictions in which we operate may challenge our methodologies, including for valuing developed technology or classifying the nature of intercompany arrangements, which could impact our worldwide effective tax rate and adversely

8378

Table of Contents

~~arrangements, which could impact our worldwide effective tax rate and adversely~~ affect our financial condition and results of operations, possibly with retroactive effect. Moreover, changes to our corporate structure could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations.

Furthermore, U.S. and OECD Transfer Pricing Guidelines require us to analyze the functions performed by our entities, the risks incurred, and the assets owned. This functional analysis is a control to sustain the operating margins of our entities and confirm arm’s length pricing for intercompany transactions. Competent authorities could interpret, change, modify or apply adversely, existing tax laws, statutes, rules, regulations or ordinances to us (possibly with retroactive effect); which could require us to make transfer pricing corrections or to pay fines, penalties or interest for past amounts. If we are unable to make corresponding adjustments with our related entities, we would effectively be liable for additional tax, thereby adversely impacting our operating results and cash flows.

Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. Our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus. The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our business, with some changes possibly affecting our tax obligations in future or past years. We regularly assess the likelihood of outcomes resulting from possible examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result from these examinations. We cannot provide assurance that the final determination of any of these examinations will not have an adverse effect on our financial position and results of operations.

Our cash and cash equivalents could be adversely affected if the financial institutions in which we hold our cash and cash equivalents fail.

We regularly maintain cash balances at third-party financial institutions in excess of the FDIC insurance limit and similar regulatory insurance limits outside the United States. If a depository institution where we maintain deposits fails or is subject to adverse conditions in the financial or credit markets, we may not be able to recover all, if any, of our deposits, which could adversely impact our operating liquidity and financial performance.

Risks Related to Ownership of Our Class A Common Stock

The market price of our Class A common stock may be volatile, and you could lose all or part of your investment.

Technology stocks historically have experienced high levels of volatility. The market price of our Class A common stock depends on a number of factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance. In addition, the limited public float of our Class A common stock may increase the volatility of the trading price of our Class A common stock. These fluctuations could cause you to lose all or part of your investment in our Class A common stock, since you might not be able to sell your shares at or above the price initially paid for the stock. Factors that could cause fluctuations in the market price of our Class A common stock include the following:

•actual or anticipated changes or fluctuations in our operating results;

•the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;

8479

Table of Contents

•announcements by us or our competitors of new products or new or terminated significant contracts, commercial relationships or capital commitments;

•industry or financial analyst or investor reaction to our press releases, other public announcements and filings with the SEC;

•rumors and market speculation involving us or other companies in our industry;

•price and volume fluctuations in the overall stock market from time to time;

•changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;

•failure of industry or financial analysts to maintain coverage of us, changes in financial estimates by any analysts who follow our company, or our failure to meet these estimates or the expectations of investors;

•actual or anticipated developments in our business or our competitors’ businesses or the competitive landscape generally;

•litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;

•developments or disputes concerning our intellectual property rights or our solutions, or third-party proprietary rights;

•announced or completed acquisitions of businesses or technologies by us or our competitors;

•new laws or regulations or new interpretations of existing laws or regulations applicable to our business;

•the impact of interest rate volatility on the overall stock market and the market for technology company stocks;

•any major changes in our management or our board of directors;

•effects of public health crises, pandemics, and epidemics;

•general economic conditions, changes in the capital markets generally, inflation, tariffs, and slow or negative growth of our markets and instability in the global banking sector; and

•other events or factors, including those resulting from political instability, regulatory uncertainty, war, incidents of terrorism or responses to these events, including those related to the ongoing armed conflicts in different regions of the world.

In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect the market price of our Class A common stock, regardless of our actual operating performance. In addition, in the past, following periods of volatility in the overall market and the market prices of a particular company’s securities, companies have been subject to increased stockholder activism or securities class action litigation. Any stockholder activism or securities litigation, if instituted against us, could result in substantial costs and divert our management’s attention and resources from our business. This could have an adverse effect on our business, operating results and financial condition.

8580

Table of Contents

Sales of substantial amounts of our Class A common stock in the public markets, or the perception that they might occur, could cause the market price of our Class A common stock to decline.

Sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and greater than 5% stockholders, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline or make it more difficult for you to sell your Class A common stock at a time and price that you deem appropriate.

Moreover, the holders of a significant portion of shares of our capital stock also have rights, subject to some conditions, to require us to file registration statements for the public resale of such capital stock or to include such shares in registration statements that we may file for us or other stockholders.

We may also issue our shares of our capital stock or securities convertible into shares of our capital stock from time to time in connection with a financing, acquisition, investment, or otherwise.

We cannot guarantee that our stock repurchase program will be fully consummated or that it will preserve or enhance long-term stockholder value.

Although our Board has authorized a stock repurchase program, the program does not require us to repurchase any specific dollar amount or to acquire any specific number of shares of our Class A common stock and may be modified, suspended, or terminated at any time. We cannot guarantee that the program will be fully consummated or that it will preserve or enhance long-term stockholder value. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation, investor confidence in us, or our stock price. The program could also affect the trading price of our Class A common stock, increase volatility, and reduce the market liquidity of our Class A common stock, and any announcement of a termination or change of this program may result in a decrease in the trading price of our Class A common stock. In addition, any repurchases made under this program will reduce the amount of cash we have available to fund working capital, capital expenditures, strategic transactions, and other general corporate requirements.

The dual class structure of our common stock will have the effect of concentrating voting control with those stockholders who hold our Class B capital stock, including our directors, executive officers, and beneficial owners of 5% or greater of our outstanding capital stock who hold in the aggregate a majority of the voting power of our capital stock, which will limit or preclude your ability to influence corporate matters, including the election of directors and the approval of any change of control transaction.

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share. As of ~~October~~April 3130, ~~2025~~2026, the holders of our outstanding Class B common stock hold a substantial majority of the voting power of our outstanding capital stock, with our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, holding a majority of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore will be able to control all matters submitted to our stockholders for approval until the earlier of (i) October 14, 2031, (ii) the death or disability, as defined in our restated certificate of incorporation, of Sytse Sijbrandij, (iii) the date specified by a vote of the holders of two-thirds of the then outstanding shares of Class B common stock and (iv) the first date on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) is less than 5% of the aggregate number of shares of outstanding common stock. This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or ~~discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.~~

Table of Contents

discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

Future transfers by holders of our Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of our Class B common stock who retain their shares in the long term.

The dual class structure of our common stock may adversely affect the trading market for our Class A common stock.

Several stockholder advisory firms and large institutional investors oppose the use of multiple class structures. As a result, the dual class structure of our common stock may cause stockholder advisory firms to publish negative commentary about our corporate governance practices or otherwise seek to cause us to change our capital structure, and may result in large institutional investors not purchasing shares of our Class A common stock. Any actions or publications by stockholder advisory firms or institutional investors critical of our corporate governance practices or capital structure could also adversely affect the value of our Class A common stock.

Table of Contents

institutional investors critical of our corporate governance practices or capital structure could also adversely affect the value of our Class A common stock.

If industry or financial analysts do not continue to publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our Class A common stock, our stock price and trading volume could decline.

The trading market for our Class A common stock will depend in part on the research and reports that industry or financial analysts publish about us or our business. We do not control these analysts or the content and opinions included in their reports. If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price may decline. In addition, if our financial results fail to meet, or exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.

We do not intend to pay dividends in the foreseeable future. As a result, your ability to achieve a return on your investment will depend on appreciation in the price of our Class A common stock.

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must for the foreseeable future rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Provisions in our organizational documents and under Delaware law could make an acquisition of us, which could be beneficial to our stockholders, more difficult and may limit attempts by our stockholders to replace or remove our current management.

Provisions in our restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a merger, acquisition or other change of control of our company that our stockholders may consider favorable. In addition, because our board of directors is responsible for appointing the members of our management team, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors. Among other things, our restated certificate of incorporation and amended and restated bylaws include provisions that:

•provide that our board of directors is classified into three classes of directors with staggered three-year terms;

Table of Contents

•permit our board of directors to establish the number of directors and fill any vacancies and newly created directorships;

•require supermajority voting to amend some provisions in our restated certificate of incorporation and amended and restated bylaws;

•authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;

•provide that only our chief executive officer or a majority of our board of directors will be authorized to call a special meeting of stockholders;

•eliminate the ability of our stockholders to call special meetings of stockholders;

•do not provide for cumulative voting;

Table of Contents

•provide that directors may only be removed “for cause” and only with the approval of two-thirds of our stockholders;

•provide for a dual class common stock structure in which holders of our Class B common stock may have the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our common stock, including the election of directors and other significant corporate transactions, such as a merger or other sale of our company or its assets;

•prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

•provide that our board of directors is expressly authorized to make, alter, or repeal our amended and restated bylaws; and

•establish advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon by stockholders at

Filing Compare · Gitlab Inc.