Gitlab Inc.

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") ("certifying officers") have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of January 31, 2025. Our certifying officers concluded that our disclosure controls and procedures were effective as of January 31, 2025.

Management's Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). The Company's management, with participation of the CEO and CFO, under the oversight of our board of directors, evaluated the effectiveness of the Company's internal control over financial reporting as of January 31, 2025 using the framework in Internal Control - Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on that evaluation, management concluded that the Company's internal control over financial reporting was effective as of January 31, 2025.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an unqualified opinion on the effectiveness of the Company's internal control over financial reporting. KPMG LLP's report appears in Item 8 of this Annual Report on Form 10-K.

Remediation of Previously Disclosed Material Weakness

As disclosed in our previously issued Annual Report on Form 10-K for the year ended January 31, 2024, we identified a material weakness in our internal control over financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. During fiscal year 2024, we determined that a material weakness existed due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the Company. In particular:

•We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems used in the financial reporting processes related to revenue. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.

We implemented remediation actions during fiscal year 2025 to address this material weakness and enhance our control environment. Our remediation actions included:

•Strengthening IT governance and designing IT general controls related to certain revenue systems, including program change management, restricting user access to our internal systems used for financial reporting and enhancing the retention of contemporaneous documentation of reviews over IT general controls, and

•Developing and deploying training programs regarding the operation and importance of internal controls.

We have tested and evaluated the implementation of these new and revised processes and internal controls to determine whether they are designed and operating effectively to provide reasonable assurance that they will prevent or detect a material error in our consolidated financial statements. Based on our assessment, we have concluded that this material weakness has been remediated as of January 31, 2025.

Changes in Internal Control over Financial Reporting

Other than the remediation efforts described above, there were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the Company have been detected.