Gitlab Inc.

Previous wording

We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 9,893 as of January 31, 2025 from 8,602 as of January 31, 2024. The growth and expansion of our business places a continuous significant strain on our management and operational and financial resources. Inaddition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and investment decisions by our customers.

Current wording

We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 10,682 as of January 31, 2026 from 9,893 as of January 31, 2025. The growth and expansion of our business places a continuous strain on our management and operational and financial resources. Inaddition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and investment decisions by our customers.

Previous wording

Our total revenue for the years ended January 31, 2025 and 2024 was $759.2 million and $579.9 million, respectively, representing a growth rate of 31%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth. Our historical revenue growth should not be considered indicative of our future performance.

Current wording

Our total revenue for the years ended January 31, 2026 and 2025 was $955.2 million and $759.2 million, respectively, representing a growth rate of 26%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth, and our usage (or consumption) billing model. Our historical revenue growth should not be considered indicative of our future performance.

Previous wording

Further, in future periods, our revenue could decline or our revenue growth rate could slow. Many factors may contribute to this decline, including changes to technology, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our Class A common stock could be adversely affected.

Current wording

Further, in future periods, our revenue could decline or our revenue growth rate could slow. Many factors may contribute to this decline, including changes to technology, such as increased AI adoption, our usage billing models, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our Class A common stock could be adversely affected.

Previous wording

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth. We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business would be harmed. Moreover, if the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, or we are unable to maintain consistent revenue or revenue growth, our share price could be volatile, and it may be difficult to achieve and maintain profitability.

Current wording

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth and our usage billing models. We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business would be harmed. Moreover, if the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, or we are unable to maintain consistent revenue or revenue growth, our share price could be volatile, and it may be difficult to achieve and maintain profitability.

Previous wording

We have incurred losses in each year since our inception, including net losses of approximately $173.4 million, $425.7 million and $6.3 million in fiscal year 2023, 2024 and 2025, respectively. As of January 31, 2025, we had an accumulated deficit of approximately $1.2 billion. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to continue to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Current wording

We have incurred losses in each year since our inception, including net losses of approximately $425.7 million, $6.3 million and $56.0 million in fiscal year 2024, 2025 and 2026, respectively. As of January 31, 2026, we had an accumulated deficit of approximately $1.2 billion. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including implementing usage billing, expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to continue to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, usage billing, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Previous wording

Security incidents of ours or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result from AI related sensitive data exposure such as insufficient data anonymization during the training process, system misconfiguration, or from cyber attacks, including, but not limited to, denial-of-service attacks, reverse-engineering of AI algorithms, web scraping, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. Any security breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential information of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Current wording

Security incidents of our or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result in sensitive data exposure. Cyber attacks may also occur, including, but not limited to, denial-of-service attacks, ransomware attacks, application security attacks, software-supply chain attacks, compromised credentials, business email compromises, computer malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. AI has shifted previously defined security boundaries for GitLab and our providers, including new and novel language-based attack vectors. AI incorporated into our and our third-party service provider’s products may introduce security risks including, but not limited to, AI-enabled social engineering, automated vulnerability exploitation, inadvertent data exposure due to model training, inappropriate data access using AI-enabled features, and AI supply-chain attacks. On the other hand, we could increase our vulnerability to cybersecurity incidents or other technology related failures due to, or as a result of, the timing of our evaluation, updating, or integration of new technology or AI enabled systems used in our business. Any security breach, disruption or other technology related failure could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential data of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Previous wording

Techniques used to obtain unauthorized access or to sabotage systems change frequently. As a result, we may be unable to fully anticipate these techniques or to implement adequate preventative measures. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers. If we are, or are perceived to be, not in compliance with data protection, consumer privacy, or other legal or regulatory requirements or operational norms bearing on the collection, processing, storage, or other treatment of data records, including personal data, our reputation and operating performance may suffer. Further, we need to continually monitor and remain compliant with all applicable changes in local, state, national, or international legal or regulatory requirements. Any significant violations of data privacy could result in the loss of business, litigation, and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition.

Current wording

Techniques used to obtain unauthorized access or to sabotage systems change frequently, including novel AI-specific attack vectors and vulnerabilities. The use of agentic AI is changing the fundamental ways that we secure and defend our platform and operations as both threat actors and security teams are using AI to industrialize their attacks. Traditional perimeter controls and static security rules are no longer the most effective security mechanisms and we, in alignment with our industry, are reinforcing our defensive capabilities in areas such as, but not limited to, behavioral analysis, automated detection response, and zero-trust. However, we may be unable to fully anticipate these techniques or implement adequate preventative measures. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers. If we are, or are perceived to be, not in compliance with data protection, consumer privacy, or other legal or regulatory requirements or operational norms bearing on the collection, processing, storage, or other treatment of data records, including personal data, our reputation and operating performance may suffer. Further, we need to continually monitor and remain compliant with all applicable changes in local, state, national, or international legal or regulatory requirements. Any significant violations of data privacy could result in the loss of business, litigation, and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition.

Previous wording

We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products.

Current wording

We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source and community contributed code in our products.

Previous wording

The DevSecOps platform is built using open-source technology. Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber attacks as a result of our use of open source code, it may substantially damage our reputation and adversely affect our business, financial condition, and operating results.

Current wording

The DevSecOps platform is built using open-source technology and GitLab accepted community code contributions. Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber attacks as a result of our use of open source code, it may substantially damage our reputation and adversely affect our business, financial condition, and operating results.

Previous wording

We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which has us competing with many providers with offerings across all stages. We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.

Current wording

We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which means we compete with many providers with offerings across all stages. We compete with well-established providers such as Microsoft and

Previous wording

•our ability to price our products competitively, including our ability to transition users of our free product offering to a paid version of The DevSecOps platform;

Current wording

•our ability to price our products competitively, including our usage billing model and our ability to transition users of our free product offering to a paid version of The DevSecOps platform;

Previous wording

In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels, our operating results would be negatively affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

Current wording

In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels or successfully implement usage billing, our operating results would be negatively affected. Pricing pressures, usage billing, and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

Previous wording

Because of the nature and importance of the data that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including: customers’ inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events. If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.

Current wording

Because of the nature and importance of the data that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including: customers’ inability to access the internet, customers’ inappropriate use of our software, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events. If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.

Previous wording

The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Current wording

The market for our services is rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Previous wording

Because the market for our services is relatively new and rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services. Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide. Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be able to compete effectively or achieve market acceptance of our products. If we or other software and SaaS providers experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected. If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.

Current wording

Because the market for our services is rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services. Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide. Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be able to compete effectively or achieve market acceptance of our products. If we or other software and SaaS providers experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected. If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.

Previous wording

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

Current wording

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, usage billing, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

Previous wording

It could also become increasingly difficult to predict revenue and timing of collections as our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings. Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.

Current wording

It could also become increasingly difficult to predict revenue and timing of collections given our usage billing model and our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings. Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.

Previous wording

Our future success also depends in part on our ability to sell more subscriptions and additional services to our current customers. Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease the number of seats in their subscription. If our customers do not purchase additional subscriptions and services from us, our revenue may decline and our operating results may be harmed. Paying customers may decline or fluctuate as a result of a number of factors, including their satisfaction with our services and our end-customer support, the frequency and severity of product outages, our product uptime or latency, their satisfaction with the speed of delivering new features, the pricing of our, or competing, services, and the impact of macroeconomic conditions on our customers and their corporate spending. We have limited historical data with respect to rates of paying customers buying more seats, uptiering, downtiering and churning, so we may not accurately predict future customer trends.

Current wording

Our future success also depends in part on our ability to increase usage or consumption, sell more subscriptions and additional services to our current customers. Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease the number of seats or usage in their subscription. If our customers do not purchase additional subscriptions and services from us, our revenue may decline and our operating results may be harmed. Paying customers may decline or fluctuate as a result of a number of factors, including their satisfaction with our services and our end-customer support, the frequency and severity of product outages, our product uptime or latency, their satisfaction with the speed of delivering new features, the pricing of our, or competing, services, and the impact of macroeconomic conditions on our customers and their corporate spending. We have limited historical data with respect to rates of paying customers buying more seats, uptiering, downtiering and churning, so we may not accurately predict future customer trends.

Previous wording

(including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.

Current wording

Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and down-tiers may increase, or fluctuate, as a result of a number of factors, including: quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices (including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.

Previous wording

•the timing of recognition of revenues;

Current wording

•the timing of recognition of revenues and impact of usage billing;

Previous wording

•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;

Current wording

•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;

Previous wording

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our last two fiscal quarters as compared to the first two fiscal quarters due to the annual budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation and volatile interest rates.

Current wording

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our last two fiscal quarters as compared to the first two fiscal quarters due to the annual budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, and volatile interest rates.

Previous wording

As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

Current wording

As our product offerings mature and expand, our pricing and packaging for new and existing products may result in customers purchasing products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

Previous wording

As our product offerings and the markets for our services mature, or as new competitors introduce new products or services that are similar to or compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, some customers may demand greater price concessions or additional functionality at the same price levels. As a result, in the future we may be required to reduce our prices or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.

Current wording

As our product offerings and the markets for our services mature, or as new competitors introduce new products or services that are similar to or compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, some customers may demand greater price concessions or additional functionality at the same price levels, and some customers may choose to adjust their usage rates due to our usage billing. As a result, in the future we may be required to reduce our prices or adjust existing products or packaging, or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.

Previous wording

We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features. The technologies underpinning these features are in the early stages of commercial use and exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Current wording

We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features. The technologies underpinning these features exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Previous wording

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies, such as the E.U. Artificial Intelligence Act, which came into effect on August 1, 2024. These regulations may impose onerous obligations related to our, and our vendors’, development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Current wording

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies. These regulations impose prescriptive obligations related to the development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Previous wording

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area. Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Current wording

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area.

Previous wording

Furthermore, many of our generative AI features involve the processing of personal data and may be subject to laws, policies, legal obligations, and codes of conduct related to privacy and data protection. While there is current uncertainty about the extent to which privacy and data protection laws apply to AI technologies, any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Current wording

Furthermore, many of our AI features involve the processing of personal data and any processing of personal data is subject to comprehensive privacy and data protection laws, including the E.U. General Data Protection Regulation, or the GDPR, and the California Consumer Privacy Act, or the CCPA. Specific obligations under these regulations, such as requirements for lawful basis, data minimization, automated decision-making, and storage limitation, apply equally to personal data processed by the GitLab Duo suite of AI features. Any difficulties in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Previous wording

Our generative AI features may also generate output that is misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.

Current wording

Our AI features may also generate output or perform actions, as applicable, that are misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.

Previous wording

We rely on third-party vendors for the provision of the AI models which power many of our AI features. In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected.

Current wording

We rely on third-party vendors for the provision of the AI models which power many of our AI features. In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, are subject to regulatory or other national security actions by governmental authorities, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected. Any such events could also impact our customers’ ability to use GitLab features powered by specific third-party vendors’ AI models in certain deployment contexts.

Previous wording

The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

Current wording

The publicly available GitLab Handbook, or Handbook, may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

Previous wording

Any failure to offer high-quality technical support services, including success plan services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Current wording

Any failure to offer high-quality technical support services, including success tiers, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Previous wording

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success plan services that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.

Current wording

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success tiers that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.

Previous wording

We are and could continue to be subject to securities class action litigation and shareholder derivative suits.

Current wording

We have been and could in the future be subject to securities class action litigation and shareholder derivative suits.

Previous wording

Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following periods of volatility in the market price of a company’s securities. See Part I, Item 3 of this Form 10-K for additional information regarding our pending legal proceedings. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. These types of litigation could result in substantial costs, adverse publicity, and a diversion of management’s attention and resources, which could adversely affect our business operating results, or financial condition. Additionally, the cost of directors’ and officers’ liability insurance may increase, which may cause us to opt for lower overall policy limits or to forgo insurance that we may otherwise rely on to cover significant defense costs, settlements, and damages awarded to plaintiffs.

Current wording

Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following periods of volatility in the market price of a company’s securities. See Part II, Item 1 of this Form 10-K for additional information regarding our legal proceedings. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. These types of litigation could result in substantial costs, adverse publicity, and a diversion of management’s attention and resources, which could adversely affect our business operating results, or financial condition. Additionally, the cost of directors’ and officers’ liability insurance may increase, which may cause us to opt for lower overall policy limits or to forgo insurance that we may otherwise rely on to cover significant defense costs, settlements, and damages awarded to plaintiffs.

Previous wording

The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, business combinations, and impairment of goodwill. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

Current wording

The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, impairment of goodwill and long-lived assets. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

Previous wording

All web direct customers purchase our solution using online payment solutions such as credit cards, which represent the majority of the payment transactions we receive, and our business depends upon our ability to offer such payment options. The termination of our ability to process payments on any material payment option would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing. If we fail to maintain our compliance with the data protection and documentation standards adopted by our payment processors and applicable to us, these processors could terminate their agreements with us, and we could lose our ability to offer our customers a credit card or other payment option. If these processors increase their payment processing fees because we experience excessive chargebacks or refunds or for other reasons, it could adversely affect our business and operating results. Increases in payment processing fees would increase our operating expense and adversely affect our operating results.

Current wording

All web direct customers purchase our solution using online payment solutions such as credit cards, which represent the majority of the payment transactions we receive, and our business depends upon our ability to offer such payment options. The termination of our ability to process payments on any material payment solution would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing. If we fail to maintain our compliance with the data protection and documentation standards adopted by our payment processors and applicable to us, these processors could terminate their agreements with us, and we could lose our ability to offer our customers a credit card or other payment option. If these processors increase their payment processing fees because we experience excessive chargebacks or refunds or for other reasons, it could adversely affect our business and operating results. Increases in payment processing fees would increase our expense and adversely affect our operating results.

Previous wording

With respect to E.U. and U.K. team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the E.U. General Data Protection Regulation, or the GDPR, and applicable national implementing legislation of the GDPR, and the U.K. General Data Protection Regulation and U.K. Data Protection Act 2018, or the U.K. GDPR, respectively. We are a controller with respect to this data.

Current wording

With respect to E.U. and U.K. team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the GDPR and applicable national implementing legislation of the GDPR, and the U.K. General Data Protection Regulation and U.K. Data Protection Act 2018, or the U.K. GDPR, respectively. We are a controller with respect to this data.

Previous wording

The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Legal developments in the E.U. have resulted in complexity and uncertainty regarding such transfers. For example, the European Court of Justice, or the CJEU, has previously advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism) are not alone sufficient to protect data transferred to the United States or other countries not deemed adequate and the current E.U.-U.S. Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A. and the U.K, has been subject to proposed legal challenges before the CJEU. Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board has also issued a decision imposing higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers and the CJEU has stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, supervisory authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. personal data to the United States. We will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business. In additio…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Legal developments in the E.U. have resulted in complexity and uncertainty regarding such transfers. For example, the European Court of Justice, or the CJEU, has previously advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism) are not alone sufficient to protect data transferred to the United States or other countries not deemed adequate and the current E.U.-U.S. Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A. and the U.K, has previously been subject to proposed legal challenges before the CJEU. Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board has also issued a decision imposing higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers and the CJEU has stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, supervisory authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. personal data to the United States. We will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business.

Previous wording

Additionally, we are subject to the California Consumer Privacy Act, or the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA, among other things, requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Compliance with privacy legislation adds complexity and has required and may in the future require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Current wording

Additionally, we are subject to the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Compliance with privacy legislation adds complexity and has required and may in the future require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.