SaaS Ranking
Menu

GitLab

gitlab.com · Developer collaboration and CI · checked 2026-09-03

17/100FBand F

Rank 16 of 22 in Developer collaboration and CI, where the median is 28.

We measured 12 of 12 criteria for GitLab on 2026-09-03. We found 3 with a source and did not find 9 at the addresses we checked. That is a transparency score of 17 out of 100, band F.

Overview

Transparency labelsaas-ranking.com

GitLab

gitlab.com · Developer collaboration and CI

  1. A
  2. B
  3. C
  4. D
  5. E
  6. F
F 17of 100 Rank 16 of 22

Published commitments1 of 9 found

Measured behaviour2 of 3 found

Checked 2026-09-03. Every line links the page we found it on. A cross means we found nothing at the addresses we checked, not that the vendor has no such document. A transparency score, not a product rating.

We do not issue badges: a badge is the first step towards a paid placement, and there is none here. The SVG is a document with the date in it, for your own files.

The label is the whole measurement in one object: every criterion with its weight, the band, and the date. Public transparency score, not a product or security rating.

Every line in it links the page we found the result on, or lists the addresses we checked. A cross means we found nothing there, not that GitLab has no such document.

Gaps, heaviest first

✗

Data processing agreement

weight 3 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 8 addresses we checked
  1. https://gitlab.com/legal/dpa – found, but behind a sign-in
  2. https://gitlab.com/dpa – reached, no match (HTTP 200)
  3. https://gitlab.com/legal/data-processing-agreement – found, but behind a sign-in
  4. https://gitlab.com/data-processing-agreement – found, but behind a sign-in
  5. https://gitlab.com/legal/data-processing-addendum – found, but behind a sign-in
  6. https://gitlab.com/legal/gdpr – found, but behind a sign-in
  7. https://gitlab.com/trust/dpa – found, but behind a sign-in
  8. https://gitlab.com/privacy/dpa – found, but behind a sign-in

Is this wrong? Send us the URL

✗

Subprocessor list

weight 3 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 7 addresses we checked
  1. https://gitlab.com/legal/subprocessors – found, but behind a sign-in
  2. https://gitlab.com/subprocessors – found, but behind a sign-in
  3. https://gitlab.com/sub-processors – found, but behind a sign-in
  4. https://gitlab.com/legal/sub-processors – found, but behind a sign-in
  5. https://gitlab.com/trust/subprocessors – found, but behind a sign-in
  6. https://gitlab.com/privacy/subprocessors – found, but behind a sign-in
  7. https://gitlab.com/legal/subprocessor-list – found, but behind a sign-in

Is this wrong? Send us the URL

✗

Data location stated

weight 3 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 7 addresses we checked
  1. https://gitlab.com/security – reached, no match (HTTP 200)
  2. https://gitlab.com/trust – reached, no match (HTTP 200)
  3. https://gitlab.com/legal/privacy – found, but behind a sign-in
  4. https://gitlab.com/privacy – reached, no match (HTTP 200)
  5. https://gitlab.com/privacy-policy – reached, no match (HTTP 200)
  6. https://gitlab.com/compliance – found, but behind a sign-in
  7. https://gitlab.com/legal/privacy-policy – found, but behind a sign-in

Is this wrong? Send us the URL

✗

Status page with history

weight 2 of 3

No public status page found.

Checked 3 addresses on 2026-09-03.

Show the 3 addresses we checked
  1. https://status.gitlab.com/ – reached, no match (HTTP 200)
  2. https://gitlab.com/status – reached, no match (HTTP 200)
  3. https://gitlab.com.statuspage.io/ – Could not be fetched: fetch failed.

Is this wrong? Send us the URL

✗

Public pricing

weight 2 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 5 addresses we checked
  1. https://gitlab.com/pricing – found, but behind a sign-in
  2. https://gitlab.com/pricing/ – found, but behind a sign-in
  3. https://gitlab.com/plans – found, but behind a sign-in
  4. https://gitlab.com/en/pricing – found, but behind a sign-in
  5. https://gitlab.com/pricing-plans – found, but behind a sign-in

Is this wrong? Send us the URL

✗

No third-party tracking before consent

weight 2 of 3

No consent-free first load found.

Checked 1 address on 2026-09-03.

Show the 1 address we checked
  1. https://gitlab.com/ – third-party requests before any interaction: cdn.cookielaw.org, geolocation.onetrust.com, res.cloudinary.com, www.googletagmanager.com

Is this wrong? Send us the URL

✗

Notice before subprocessors change

weight 2 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 8 addresses we checked
  1. https://gitlab.com/legal/subprocessors – found, but behind a sign-in
  2. https://gitlab.com/subprocessors – found, but behind a sign-in
  3. https://gitlab.com/sub-processors – found, but behind a sign-in
  4. https://gitlab.com/legal/dpa – found, but behind a sign-in
  5. https://gitlab.com/dpa – reached, no match (HTTP 200)
  6. https://gitlab.com/legal/data-processing-agreement – found, but behind a sign-in
  7. https://gitlab.com/trust/subprocessors – found, but behind a sign-in
  8. https://gitlab.com/legal/sub-processors – found, but behind a sign-in

Is this wrong? Send us the URL

✗

Uptime SLA with a figure

weight 1 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 6 addresses we checked
  1. https://gitlab.com/legal/sla – found, but behind a sign-in
  2. https://gitlab.com/sla – found, but behind a sign-in
  3. https://gitlab.com/legal/service-level-agreement – found, but behind a sign-in
  4. https://gitlab.com/trust/sla – found, but behind a sign-in
  5. https://gitlab.com/uptime – found, but behind a sign-in
  6. https://gitlab.com/legal/uptime-sla – found, but behind a sign-in

Is this wrong? Send us the URL

✗

Named privacy contact

weight 1 of 3

We found this behind a sign-in, so it is not published openly.

Seen at https://gitlab.com/users/sign_in · checked 2026-09-03

Show the 7 addresses we checked
  1. https://gitlab.com/legal/privacy – found, but behind a sign-in
  2. https://gitlab.com/privacy – reached, no match (HTTP 200)
  3. https://gitlab.com/privacy-policy – reached, no match (HTTP 200)
  4. https://gitlab.com/legal/privacy-policy – found, but behind a sign-in
  5. https://gitlab.com/legal/privacy-notice – found, but behind a sign-in
  6. https://gitlab.com/trust/privacy – found, but behind a sign-in
  7. https://gitlab.com/datenschutz – found, but behind a sign-in

Is this wrong? Send us the URL

Evidence

The full source lists sit behind these two groups, so that the answer above stays readable.

Published, with a source 3
✓

HTTPS enforced with HSTS

weight 2 of 3

HTTP redirects to HTTPS and the HSTS header is set.

Source: https://gitlab.com/ · checked 2026-09-03

✓

Certifications named

weight 1 of 3

SOC 2 or ISO 27001 named on a public page.

Source: https://trust.gitlab.com/ · checked 2026-09-03

✓

security.txt (RFC 9116)

weight 1 of 3

Served at /.well-known/security.txt.

Source: https://gitlab.com/.well-known/security.txt · checked 2026-09-03

History

Not enough completed runs yet to draw a line. The next runs fill this in.

Compare