GitLab
GitLab Inc. (Nasdaq: GTLB) ·about.gitlab.com· As of: 2026-07-30
Our verdict
Source control creates no edge; it is the precondition for anything built to belong to a company rather than to individual machines. For the guiding question of this collection, GitLab is the case where the axis between buying and building shows cleanly: the core sits under a free licence, so moving from the managed service to running it yourself is not a migration to another maker but an assumption of operational responsibility. That is not an argument for self-hosting straight away. It is an argument that you could, and that alone caps the damage a change of vendor, or a takeover of the vendor, can do.
Who it fits
Solo
suitable
The free plan carries private projects with 400 build minutes a month. Anyone needing more supplies their own runner, and that works on a small server for a few euros a month.
Mid-market
suitable
Twenty-nine US dollars per user per month billed annually sits well above the competitor. What that buys includes an entitlement to 10,000 minutes and the option to move to self-hosting at any time without leaving the maker.
Enterprise
suitable
The managed single-tenant variant allows a choice among eight EU regions, plus separately selectable regions for failover and backups, with ISO/IEC 27001:2022 and SOC 2 Type 2 in scope. The catch is twofold: the variant requires the top tier, whose price is not public, and the region choice is final once provisioned.
Buy, switch or build
Off-the-shelf
The market leader as incumbent
The obvious choice is the larger forge: more ready-made building blocks for check pipelines, more extensions, and almost every candidate knows the workflows. That is paid for in ownership. The server software is not open source, the self-hostable edition is a licensed product from the same house, and the owner is a group whose strategy sets the product's direction. EU storage exists there only as a separate environment on the most expensive plan, without public repositories. Anyone treating the forge purely as a tool does well with it. Anyone treating it as the place where their own work sits should know the difference.
AI-native
No AI-native replacement, but a relocation of the model
There is no AI-native forge replacing this category, because the job is versioning and rule sets. The difference that actually counts here is not a new vendor but where the model runs. The vendor offers an edition in which the assistive features work against a model inside your own house rather than against an outside service. With that, the input never leaves the building, and the questions of training use and third-country transfer fall away for that part. The price is operating the model: hardware, updates and judging the quality of its answers.
Build it yourself
Running the Community Edition yourself
Here, building it yourself is not a reimplementation but the same product under a free licence. No licence fee, no user limit, full access to the source. That is why this category belongs in the buy-or-build axis at all: the exit is not a migration but a handover. It is paid for in operations, with backup, availability, upgrades, directory integration, your own runners and being on call. And the paid-tier features are missing, above all audit event streaming and part of the security scanning. This route works under hard sovereignty requirements and in organisations that run servers anyway. For a single person it does not.
Our advice
- Solo: Free plan. Self-hosting does not pay off for one person.
- Mid-market: Buy. Only cost out self-hosting once someone takes on being permanently on call.
- Enterprise: Buy the single-tenant variant in an EU region, or self-host as a deliberate decision.
Who is behind it
Staying power: Established
A listed company with published figures, growing revenue, clearly positive operating cash flow and a net loss that persists. The real uncertainty for this collection lies not in the business but in the ownership: since 2024 the company has repeatedly been named as a takeover candidate, with no deal concluded. Anyone relying on it should know that the open-source edition softens that scenario without removing it.
- Ownership: listed on Nasdaq as GTLB; per a Reuters report of 17 July 2024, Alphabet held 22.2 percent of the voting rights · Source · As of 2026-07-30
- Financials: Fiscal year 2026: 955.2 million US dollars in revenue, up 26 percent year over year, a net loss of 56.0 million US dollars, operating cash flow of 232.9 million US dollars, and a first share repurchase programme of 400 million US dollars authorised · Source · As of 2026-07-30
- Takeover interest: Reuters reported a sale process with interest from Datadog on 17 July 2024; in October 2025 further reports described a renewed bid above 60 US dollars per share, in both cases without a deal and without confirmation by the parties · Source · As of 2026-07-30
- Certification: ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and SOC 2 Type 2, each covering GitLab.com and the single-tenant variant · Source · As of 2026-07-30
- Open-source core: the Community Edition is published under the MIT licence and can be self-hosted with no user limit; the paid features sit under a separate, non-free licence · Source · As of 2026-07-30
Cost of leaving: Low
Two routes are open, and the second is the real difference from the competitor. First, Git is distributed, every clone holds the full history, and issues, merge requests and settings can be taken out through a project and group export archive. Second, the core of the system sits as the Community Edition under the MIT licence and can be run yourself without the vendor's consent. Leaving the managed service therefore does not force a change of maker, it means taking on operational responsibility. The price of that route sits in the same sentence: what the Community Edition lacks are the features of the paid tiers. Anyone who has anchored audit event streaming, security scanning or approval chains from those tiers into their workflow loses them on the way out.
Regulation and data
| Data processing agreement | In place; the privacy statement names the subscription agreement as the governing frame, and a separate customer document is kept in the public handbookThe separate document was not directly retrievable in this review because the handbook redirected to a sign-in. What is substantiated is its existence and the reference to it, not its wording. Anyone who needs breach notice periods, deletion periods and the objection window for new subprocessors has to request and read the document before signing.Source · As of 2026-07-30 |
|---|---|
| Storage location | The shared service sits in a single US region; EU storage only through the managed single-tenant variant, with a choice among eight EU regionsFor the shared service the privacy statement states plainly that the services are operated in the United States. For the single-tenant variant, Frankfurt, Ireland, London, Milan, Paris, Spain, Stockholm and Zurich can be chosen, plus separately selectable regions for failover and backups. The choice is final once provisioned. That is more freedom of choice than at the competitor, but it costs the top tier.Source · As of 2026-07-30 |
| Subprocessors | Public list naming 14 third parties, each with purpose and country; notification through a sign-up formThe third parties include several model vendors, among them Google, Amazon Web Services, Anthropic and OpenAI, all based in the United States. The page carries no last-changed date. Anyone wanting to hear about changes has to sign up actively rather than receive them.Source · As of 2026-07-30 |
| Third-country transfer | Transfer to the United States, based on the EU-US data privacy framework including the UK extension and the Swiss version, supplemented by standard contractual clausesThe privacy statement names both bases explicitly, and for Japan adds adequacy decisions and intra-group agreements. That is documented far more clearly than at the competitor. It remains the case that a US parent company is subject to access under US law; anyone who has to exclude that ends up with the single-tenant variant in an EU region, or with self-hosting.Source · As of 2026-07-30 |
| Training on customer data | Ruled out without the customer's instruction or prior consentThe privacy statement commits to not using AI inputs to train language models without instruction or prior consent. On this point that is the stronger commitment compared with the competitor, which includes its personal plans by default from April 2026. What the model vendors it draws on do remains open; the vendor describes contractual restrictions for that, which belong on the table before signing.Source · As of 2026-07-30 |
| Retention and deletion | For as long as the account is active and beyond that as necessary; a concrete figure is given only for chat transcripts, namely 12 monthsBeyond that the privacy statement names only the principle of necessity. For audit events the documentation notes expressly that no retention policy can be configured. Anyone who needs a deletion period has to obtain it by contract or run the system themselves.Source · As of 2026-07-30 |
| Certifications | ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and SOC 2 Type 2 for security, confidentiality and availability, each covering GitLab.com and the single-tenant variantStandard, version and scope are public, which considerably shortens the work on a security questionnaire. The page names neither FedRAMP nor TISAX. None of these attestations apply to a self-hosted installation, because there the operator is you.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearWith its AI features the system contains an AI system in the sense of the regulation, so the transparency duties under Article 50 apply from August 2026. The vendor maintains its own page disclosing its AI features and the models behind them. We found no explicit statement about the regulation and Article 50 on the security, privacy or documentation pages reviewed.no source given · As of 2026-07-30 |
| Audit logging | Audit events on both paid tiers, streaming to your own systems only on the top tier; no configurable retention periodThe line falls in the same place as at the competitor: viewing yes, exporting only on the most expensive tier. In a self-hosted installation the database is yours, which turns the retention period into an operational question of your own rather than a plan question.Source · As of 2026-07-30 |
What it really costs
Entry price
Free with 400 build minutes a month. The middle tier costs 29 US dollars per user per month billed annually and includes 10,000 minutes; the top tier is quoted on request only and includes 50,000 minutes. Self-hosting the Community Edition carries no licence fee and no user limit.
Source · As of2026-07-30
What gets expensive
At the jump from 29 US dollars to a price that is not published. Everything a larger organisation needs hangs off the top tier: audit event streaming, part of the security scanning, and above all the managed single-tenant variant, the only edition that lets you choose an EU region. Taking that route means leaving the public price list and negotiating. On top comes consumption: beyond the included minutes you are billed, unless you supply your own runners. And self-hosting is not free, it merely moves the cost off the invoice and into your own time, with backup, upgrades and being on call as permanent line items.
What it displaces
- Central version server with a locking model
- Separate tools for issues, review and delivery
- A self-run build server next to the version server
- Bought-in security scanning as a standalone tool
Interfaces
- REST and GraphQL API
- Webhooks on every project event
- Build and deployment runs with your own runners
- Sign-in via SAML and OIDC, provisioning via SCIM
- Project and group export as an archive for migration
At Convios: Not used by us
Not substantiated as our own operation for this review. The assessment rests entirely on publicly available vendor pages, documentation and the fiscal year release, not on our own experience.
Alternatives
Evidence
- 1.Tiers, per-user price billed annually and included build minutes · As of 2026-07-30
- 2.Eight selectable EU regions, separate regions for failover and backups, and the finality of the choice · As of 2026-07-30
- 3.Top tier as a prerequisite for the single-tenant variant, operation on one cloud platform only, and the sign-in methods that are unavailable · As of 2026-07-30
- 4.Services operated in the United States, EU-US data privacy framework and standard contractual clauses, the commitment on training use, and twelve months for chat transcripts · As of 2026-07-30
- 5.14 named third parties with purpose and country, notification through a sign-up form · As of 2026-07-30
- 6.ISO/IEC 27001:2022, 27017:2015, 27018:2019 and SOC 2 Type 2 with a named scope · As of 2026-07-30
- 7.Revenue, growth, net loss, operating cash flow and the share repurchase programme in fiscal year 2026 · As of 2026-07-30
- 8.Sale process with interest from Datadog, Alphabet's voting stake, and the market value at the time of reporting · As of 2026-07-30
- 9.MIT licence for the Community Edition · As of 2026-07-30
- 10.Audit events on the paid tiers, streaming only on the top tier · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.