Gitlab Inc.

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") ("certifying officers") have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of January 31, 2026. Our certifying officers concluded that our disclosure controls and procedures were effective as of January 31, 2026.

Management's Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). The Company's management, with participation of the CEO and CFO, under the oversight of our board of directors, evaluated the effectiveness of the Company's internal control over financial reporting as of January 31, 2026 using the framework in Internal Control - Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on that evaluation, management concluded that the Company's internal control over financial reporting was effective as of January 31, 2026.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an unqualified opinion on the effectiveness of the Company's internal control over financial reporting. KPMG LLP's report appears in Item 8 of this Annual Report on Form 10-K.

Changes in Internal Control over Financial Reporting

There were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the fiscal quarter ended January 31, 2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the Company have been detected.