Third Party Index

GitLab

gitlab.com

Transparency

Exemplary

Breakdown
Subprocessor list30 / 30
Processing locations8 / 8
Purposes7 / 7
Data processing addendum12 / 12
Trust center8 / 8
Privacy policy6 / 6
security.txt6 / 6
Security page5 / 5
Status page5 / 5
Vulnerability disclosurenot found0 / 5
Pages still reachable8 / 8
Total95 / 100

Only documents we can retrieve count: a page behind a login or a broken link scores nothing.

Badge

GitLab transparency rating

For GitLab's own site; it updates with the rating.

<a href="https://thirdpartyindex.com/vendors/gitlab"><img src="https://thirdpartyindex.com/badge/gitlab.svg" alt="GitLab transparency rating on Third Party Index" height="20"></a>
[![GitLab transparency rating on Third Party Index](https://thirdpartyindex.com/badge/gitlab.svg)](https://thirdpartyindex.com/vendors/gitlab)

Documents

DocumentVerifiedChangedEvidence
Trust center snapshot
Subprocessor list snapshot
Data processing addendum snapshot
Privacy policy snapshot
Terms snapshot
Security page snapshot
security.txt snapshot
Status page snapshot

Subprocessors

48 third parties, 12 affiliates. CSV · Atom

NamePurposeLocationListed since
Adaptavist Professional ServicesUnited States, European Economic Area, Canada, Malaysia, and Australia
Adfinis Professional ServicesEuropean Economic Area, North Africa, Middle East, and Australia
Amazon Web Services Inc. Cloud Hosting and AI-Powered Product FeaturesUnited States*
Anthropic, PBC AI-Powered Product Features and Customer SupportUnited States
Ascend Integrated Technology Solutions, Inc. Professional ServicesUnited States and Canada
Black Diamond Development, LLC Professional ServicesUnited States
cc cloud GmbH Professional ServicesGermany
ClickHouse, Inc. Database HostingUnited States
Cloud Ace, Inc. Professional ServicesJapan
Cloudflare Inc. Content Delivery NetworkUnited States and European Union
Corewire GmbH Professional ServicesGermany
CPrime Professional ServicesUnited States
CyberChange Professional ServicesMiddle East, Turkey, and Africa
Datamato Technologies Private Limited Professional ServicesIndia and United Arab Emirates
Decagon AI, Inc. First-Line Customer Support AgentUnited States
demicon GmbH Professional ServicesGermany, Austria, and Switzerland
DevOps Enabler & Co. Professional ServicesIndia
Devoteam SAS Professional ServicesFrance
DF Tech FZ-LLC Professional ServicesUnited Arab Emirates and Saudi Arabia
Eficode Professional ServicesUnited States, United Kingdom, and European Economic Area
Elasticsearch Inc. Search Functionality and Application Logging and DebuggingUnited States
Fireworks.ai, Inc. AI-Powered Product FeaturesUnited States and European Union
Fivetran, Inc. ELT Pipeline for Customer Support TicketingUnited States
GitSimple, LLC Professional ServicesUnited States
Glean Technologies, Inc. AI-Powered Knowledge Base for Support ServicesUnited States
Google LLC Cloud Hosting, Customer Support, and AI-Powered Product FeaturesUnited States
HCS Company B.V. Professional ServicesEuropean Economic Area
HiddenLayer, Inc. Prompt Injection Security for AI-Powered Product FeaturesUnited States
IntouchCX Disrupt Inc. Outsourced Customer Support Business ProcessesIndia
JSaunders Solutions, LLC d/b/a NextLink Labs Professional ServicesUnited States and Canada
Mailgun Technologies, Inc. Transactional Email APIsUnited States and European Union
N22 Technologies LLC Professional ServicesMiddle East, Turkey, and Africa
Norwin Technologies LLC Professional ServicesUnited States, European Economic Area, Asia Pacific, India, and Mexico
OpenAI, LLC AI-Powered Product FeaturesUnited States
OTTRA Ltd Professional ServicesUnited Kingdom and European Economic Area
Par-Tec S.p.A Professional ServicesEuropean Economic Area
ReleaseTEAM Professional ServicesUnited States and Canada
Sfeir S.A. Professional ServicesFrance, Belgium, and Luxembourg
Sirius Federal Professional ServicesUnited States
Snowflake Inc. Data Warehouse and Analytics Services for Customer Support TicketingUnited States
SPK and Associates, LLC Professional ServicesUnited States
Successive Technologies Professional ServicesUnited States, Canada, Middle East, and Japan
ThunderSnow Industries Corporation Professional ServicesUnited States
Trend Solutions Co., Ltd. Professional ServicesJapan
VivaOps LLC Professional ServicesNorth America
X-RD Pty Ltd Professional ServicesAustralia
Zendesk Inc. Support Services PortalUnited States
ZYYX Inc. Professional ServicesJapan
GitLab affiliates (12)
NamePurposeLocationListed since
GitLab BV Support ServicesAustralia; Germany; Netherlands
GitLab Canada Corp. Support ServicesCanada
GitLab France SAS Support ServicesFrance
GitLab GK Support ServicesJapan
GitLab Iberia, S.L. Support ServicesSpain
GitLab India Pvt Ltd Support ServicesIndia
GitLab Ireland Ltd Support ServicesIreland
GitLab IT BV Support ServicesNetherlands
GitLab Singapore PTE Ltd Support ServicesSingapore
GitLab Singapore Holding PTE Ltd Support ServicesSingapore
GitLab South Korea Support ServicesSouth Korea
GitLab UK Ltd Support ServicesUnited Kingdom

Listed as a subprocessor by (4)

Purposes as each company states them.

Security record

What public security catalogs list for GitLab, in their words.

Known exploited vulnerabilities

5 vulnerabilities in GitLab's software that CISA lists as exploited in the wild.

CVEProductVulnerabilityListed
CVE-2026-85706Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability evidence
CVE-2021-22175GitLabGitLab Server-Side Request Forgery (SSRF) Vulnerability evidence
CVE-2021-39935Community and Enterprise EditionsGitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability evidence
CVE-2023-7028GitLab CE/EEGitLab Community and Enterprise Editions Improper Access Control Vulnerability evidence
CVE-2021-22205Community and Enterprise EditionsGitLab Community and Enterprise Editions Remote Code Execution Vulnerability used by ransomware evidence

Source: CISA Known Exploited Vulnerabilities catalog.

Changes

None since tracking began.