Gitlab Inc

Evaluation of Disclosure Controls and Procedures

In connection with the preparation of this Quarterly Report on Form 10-Q, as of October 31, 2024, an evaluation was performed under the supervision and with the participation of our management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act). Based on that evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, as of October 31, 2024, our disclosure controls and procedures were, in design and operation, not effective at a reasonable assurance level as a result of the material weakness described below.

Material Weakness

As disclosed in our Annual Report on Form 10-K for the fiscal year ended January 31, 2024, we previously identified a material weakness in our internal control over financial reporting. Our management determined that a material weakness exists due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the Company.

As a result, the following material weakness exists as of October 31, 2024:

•We did not design and maintain effective controls over certain information technology, or IT, general controls for information systems used in the financial reporting processes related to revenue. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.

Notwithstanding such material weakness in internal control over financial reporting, our Chief Executive Officer and Chief Financial Officer have concluded that our unaudited condensed consolidated financial statements included in this Quarterly Report on Form 10-Q present fairly, in all material respects, our financial position, results of operations and cash flows for the periods presented in conformity with U.S. GAAP. The aforementioned material weakness also did not result in a material misstatement in any previously issued consolidated financial statements.

Remediation Efforts and Status

We have implemented remediation actions in the third quarter of fiscal year 2025, that we believe will address the underlying causes of the material weakness, including:

•Strengthening IT governance and designing IT general controls related to certain revenue systems, including program change management, restricting user access to our internal systems used for financial reporting and enhancing the retention of contemporaneous documentation of reviews over IT general controls, and

•Developing and deploying training programs regarding the operation and importance of internal controls.

We believe the actions described above, once fully tested, will be sufficient to remediate the identified material weakness and strengthen our internal controls. However, our efforts to remediate this material weakness may not be effective or prevent any future material weakness or significant deficiency in our internal control over financial reporting. This material weakness will not be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Other than the material weakness and remediation efforts described above, there were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended October 31, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the company have been detected.