Vendor record · about.gitlab.com
What GitLab promises about your data.
Where GitLab publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
GitLab lists its sub-processors at about.gitlab.com/privacy/subprocessors/#third-party-sub-processors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between September 11, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we haven't found a data processing agreement from GitLab anywhere we've looked.
- Window
- —
- Sub-processors
- 59
- Pages
- 6
- Copies
- 41
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
GitLab DPA
We have not found a data processing agreement published by GitLab anywhere we looked. There is no sub-processor notice window we can quote.
GitLab sub-processors
GitLab publishes a sub-processor list at about.gitlab.com/privacy/subprocessors/#third-party-sub-processors; we last read it on October 15, 2026. It names 59 entries. The first 15, as the list prints them: Adaptavist; Adfinis; Amazon Web Services Inc.; Anthropic, PBC; Ascend Integrated Technology Solutions, Inc.; Black Diamond Development, LLC; cc cloud GmbH; ClickHouse, Inc.; Cloud Ace, Inc.; Cloudflare Inc.; Corewire GmbH; CPrime; CyberChange; Datamato Technologies Private Limited; Decagon AI, Inc.; and 44 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
59 named · full table
Every public change we have recorded · Where vendors publish their lists
How long GitLab keeps your data
We hold no statement about data retention from GitLab's watched pages. The pages we watch: changelog about.gitlab.com/whats-new; pricing page about.gitlab.com/pricing; privacy policy about.gitlab.com/privacy; sub-processor list about.gitlab.com/privacy/subprocessors/#third-party-sub-processors; terms of service about.gitlab.com/terms; trust and security page about.gitlab.com/security. On training with customer data, GitLab's privacy policy (about.gitlab.com/privacy, in the copy read October 8, 2026) says: “However, we will not use your AI-inputs to train any language models without your instruction or prior consent.”
Training on customer data
“In addition, we may record and transcribe sales calls hosted on various videoconferencing technologies to enable our sales and support teams to share conversational insights, create training and presentations, and improve their internal processes. Other Content You Submit: We may also collect other content that you submit to our Services.”
about.gitlab.com/privacy · read 2026-10-08
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 59 · 3 name an AI provider we list
Adaptavist
Professional Services
United States, European Economic Area, Canada, Malaysia, and Australia
Adfinis
Professional Services
European Economic Area, North Africa, Middle East, and Australia
Amazon Web Services Inc.
Cloud Hosting and [AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/)
United States* **For GitLab Dedicated Customers the hosting location is your ch…
Anthropic, PBCAI · Anthropic
[AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/) and Customer Support
United States
Ascend Integrated Technology Solutions, Inc.
Professional Services
United States and Canada
Black Diamond Development, LLC
Professional Services
United States
cc cloud GmbH
Professional Services
Germany
ClickHouse, Inc.
Database Hosting
United States
Cloud Ace, Inc.
Professional Services
Japan
Cloudflare Inc.
Content Delivery Network
United States and European Union
Corewire GmbH
Professional Services
Germany
CPrime
Professional Services
United States
CyberChange
Middle East, Turkey, and Africa
Datamato Technologies Private Limited
Professional Services
India and United Arab Emirates
Decagon AI, Inc.
First-Line Customer Support Agent
United States
demicon GmbH
Professional Services
Germany, Austria, and Switzerland
DevOps Enabler & Co.
Professional Services
India
Devoteam SAS
Professional Services
France
DF Tech FZ-LLC
Professional Services
United Arab Emirates and Saudi Arabia
Eficode
Professional Services
United States, United Kingdom, and European Economic Area
Elasticsearch Inc.
Search Functionality and Application Logging and Debugging
United States
Fireworks.ai, Inc.AI · Fireworks AI
[AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/)
United States and European Union
Fivetran, Inc.
ELT Pipeline for Customer Support Ticketing
United States
GitLab BV
Support Services
Netherlands
GitLab Canada Corp.
Support Services
Canada
GitLab France SAS
Support Services
France
GitLab GK
Support Services
Japan
GitLab Iberia, S.L.
Support Services
Spain
GitLab India Pvt Ltd
Support Services
India
GitLab Ireland Ltd
Support Services
Ireland
GitLab IT BV
Support Services
Netherlands
GitLab Singapore Holding PTE Ltd
Support Services
Singapore
GitLab South Korea
Support Services
South Korea
GitLab UK Ltd
Support Services
United Kingdom
GitSimple, LLC
Professional Services
United States
Glean Technologies, Inc.
AI-Powered Knowledge Base for Support Services
United States
Google LLC
Cloud Hosting, Customer Support, and [AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/)
United States
HCS Company B.V.
European Economic Area
HiddenLayer, Inc.
Prompt Injection Security for [AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/)
United States
IntouchCX Disrupt Inc.
Outsourced Customer Support Business Processes
India
JSaunders Solutions, LLC d/b/a NextLink Labs
Professional Services
United States and Canada
Mailgun Technologies, Inc.
Transactional Email APIs
United States and European Union
N22 Technologies LLC
Middle East, Turkey, and Africa
Norwin Technologies LLC
Professional Services
United States, European Economic Area, Asia Pacific, India, and Mexico
OpenAI, LLCAI · OpenAI
[AI-Powered Product Features](https://docs.gitlab.com/user/gitlab_duo/)
United States
OTTRA Ltd
Professional Services
United Kingdom and European Economic Area
Par-Tec S.p.A
European Economic Area
ReleaseTEAM
Professional Services
United States and Canada
Sfeir S.A.
Professional Services
France, Belgium, and Luxembourg
Sirius Federal
Professional Services
United States
Snowflake Inc.
Data Warehouse and Analytics Services for Customer Support Ticketing
United States
SPK and Associates, LLC
Professional Services
United States
Successive Technologies
Professional Services
United States, Canada, Middle East, and Japan
ThunderSnow Industries Corporation
Professional Services
United States
Trend Solutions Co., Ltd.
Professional Services
Japan
VivaOps LLC
North America
X-RD Pty Ltd
Professional Services
Australia
Zendesk Inc.
Support Services Portal
United States
ZYYX Inc.
Professional Services
Japan
Certifications the trust page names · ISO 27001 · ISO 27017 · ISO 27018 · SOC 2 Type II
Laws the trust page names · GDPR
The pages' own stamps: Last updated 2026-04-23
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What GitLab does not publish where we can read it
Of the 6 public pages we watch for GitLab, these give us nothing right now.
Data processing agreement
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. GitLab may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates GitLab. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at GitLab? With an email at about.gitlab.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is GitLab in your product? Hear the morning we read a change.
You get the lines that moved, in GitLab’s own words, and the date any window closes. No card. Nothing to cancel.