[{"data":1,"prerenderedAt":1037},["ShallowReactive",2],{"/blog/benefits-of-transparency-in-compliance":3,"navigation-en-us":253,"banner-en-us":680,"footer-en-us":690,"blog-post-authors-en-us-Steve Truong":935,"blog-related-posts-en-us-benefits-of-transparency-in-compliance":949,"blog-promotions-en-us":974,"next-steps-en-us":1027},{"id":4,"title":5,"authors":6,"body":8,"category":233,"date":234,"description":235,"extension":236,"externalUrl":237,"faq":237,"featured":238,"heroImage":239,"meta":240,"navigation":241,"path":242,"seo":243,"slug":247,"stem":248,"tags":249,"template":251,"updatedDate":237,"__hash__":252},"blogPosts/en-us/blog/benefits-of-transparency-in-compliance.md","The benefits of transparency in a compliance audit",[7],"Steve Truong",{"type":9,"value":10,"toc":224},"minimark",[11,25,39,44,47,50,54,63,77,80,83,92,96,105,108,114,136,139,155,159,162,165,172,176,179,188,210],[12,13,14,18,19],"p",{},[15,16,17],"em",{},"Be open about as many things as possible. By making information public we can reduce the barriers to contribution and make collaboration easier. Use public issue trackers, projects, and repositories when possible."," – The GitLab ",[20,21,24],"a",{"href":22,"rel":23},"https://handbook.gitlab.com/handbook/",[],"Handbook",[12,26,27,32,33,38],{},[20,28,31],{"href":29,"rel":30},"https://handbook.gitlab.com/handbook/values/#transparency",[],"Transparency"," is one of our core values and a fundamental part of what makes GitLab unique. But openness and ",[20,34,37],{"href":35,"rel":36},"https://en.wikipedia.org/wiki/System_and_Organization_Controls",[],"System and Organization Controls 2 (SOC 2)"," audits often don't go hand in hand.",[40,41,43],"h2",{"id":42},"a-quick-history-of-the-traditional-audit","A quick history of the traditional audit",[12,45,46],{},"At traditional organizations, seeing a high level of transparency with documented procedures and processes publicly available, is not typical. And when the time comes for these organizations to undergo an audit, the process is time-consuming and can be burdensome for many employees who have to balance audit requests on top of their day-to-day work responsibilities.",[12,48,49],{},"For these same employees, a lot of time is spent digging through process documentation, policy documents, and even workflow documents, which is only the starting point for an audit. Eventually, this trickles down to the auditors having to meet with these employees to understand how the processes, policies, and workflows are executed, which means more time is sacrificed bringing an auditor up to speed on internal processes and procedures.",[40,51,53],{"id":52},"what-does-our-approach-to-compliance-look-like","What does our approach to compliance look like?",[12,55,56,57,62],{},"At GitLab, we value transparency so much so that everything we do as a company is ",[20,58,61],{"href":59,"rel":60},"https://handbook.gitlab.com/handbook/values/#public-by-default",[],"public by default",". If the need arises for information to be kept private, we have a policy in place which requires GitLab team members to provide justification within our (public) handbook as to why specific information can not be made public.",[12,64,65,66,71,72,76],{},"Specific to compliance, ",[20,67,70],{"href":68,"rel":69},"https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/sec-controls/#list-of-controls-by-family",[],"handbook pages"," detail the implemented controls that exist in our environment, including the scope that each control covers, the groups and/or process owners for each control, and even how we’ve mapped these controls to various industry standard compliance frameworks (e.g. ISO, PCI, SOC 2, etc.). Our handbook is the central repository for how we run the company. The change history for any update made to the handbook is available publicly. This means that the wider GitLab community is able to hold us accountable for what we say we do, and how we do it. Our handbook is geared for ",[73,74,75],"strong",{},"self-serve"," consumption: readers gain visibility into and understanding of how processes are executed and any nuances that should be considered.",[12,78,79],{},"This same self-serve approach applies to compliance and undergoing an audit, where we aim to enable an auditor to self-serve as much information about our processes and procedures as possible. In this case, we save the time control and process owners would have spent walking an auditor through how these processes are executed internally.",[12,81,82],{},"Beyond decreasing the audit workload of control and process owners, transparency earns more frequent feedback and contributions from people outside the company.",[12,84,85,86,91],{},"This enables us to collaborate with our valued customers and partners and deepens the industry and community understanding of our business, culture and ",[20,87,90],{"href":88,"rel":89},"https://handbook.gitlab.com/handbook/values/#why-have-values",[],"values",". Furthermore, we experience the added benefit of recruiting people who share our values.",[40,93,95],{"id":94},"how-did-our-transparent-culture-impact-our-first-soc-2-type-1-audit","How did our transparent culture impact our first SOC 2 Type 1 audit?",[12,97,98,99,104],{},"Almost all information about GitLab and the work that we perform day-to-day is available publicly (with the exception of any data that is considered ",[20,100,103],{"href":101,"rel":102},"https://handbook.gitlab.com/handbook/communication/confidentiality-levels/#not-public",[],"not public by default","). This opens a door that allows external auditors to do more digging and potentially ask questions that we might not be prepared for.",[12,106,107],{},"Knowing this helped us know where and when to push back on our auditor to understand how their questions related back to a specific audit requirement.",[12,109,110,111],{},"We’re happy to say our transparent culture had an overall positive impact on our very first SOC 2 audit. As someone who has operated in an external audit capacity, I would have loved to have been able to perform an external audit over a company that had as much publicly facing documentation as GitLab! ",[73,112,113],{},"Being transparent about everything we do as a company provided a lot of value during our SOC 2 audit in multiple ways:",[115,116,117,124,130],"ul",{},[118,119,120,123],"li",{},[73,121,122],{},"Time savings:"," In a traditional audit, an auditor schedules meetings with various process owners to walk through how internal processes relevant for an audit (such as change management) are executed. Here at GitLab, these procedures are documented publicly, so our auditor was able to read about these processes and provide more specific follow-up questions which ultimately resulted in team members being able to spend more time performing their day-to-day responsibilities instead of spending time interacting with our auditor.",[118,125,126,129],{},[73,127,128],{},"Understanding documentation gaps:"," Based on the deeper follow-up questions asked by our auditor, we were able to identify gaps in our documentation around processes being executed, but without sufficient documentation in the handbook. This gave us an opportunity to improve our documentation and potentially gain time savings in future audit cycles.",[118,131,132,135],{},[73,133,134],{},"Reduced scope creep:"," Given the amount of information that is available in our handbook, this may seem counterintuitive. However, because the GitLab architecture is published in our handbook, it helped to clearly define the scope of our SOC 2 audit and helped take the guesswork out of which technology should be subject to audit procedures.",[12,137,138],{},"While there were many valuable takeaways stemming from our transparency, we also quickly learned that the documentation in our handbook could lead an auditor to preliminary conclusions because processes weren’t fully documented. We didn’t see this as a negative impact, but more as an area for improvement and iteration to further refine our handbook documentation. So, again, the outcome of a deeper understanding of the documentation gaps that existed in our handbook is truly valuable and one we’re already working to address. Here are some merge requests that have been opened as a result of our first SOC 2 Type 1 audit:",[115,140,141,148],{},[118,142,143],{},[20,144,147],{"href":145,"rel":146},"https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/44763/diffs#c5b510796a694dd7bee07591c5baed6b97c18ce4",[],"Revising our Data Classification Policies for more clarity",[118,149,150],{},[20,151,154],{"href":152,"rel":153},"https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/44987",[],"GitLab Control Framework (“GCF”) revisions to align controls to SOC 2 Criteria and clean-up control language for clarity",[40,156,158],{"id":157},"how-do-you-find-the-middle-ground-between-transparency-and-compliance","How do you find the middle ground between transparency and compliance?",[12,160,161],{},"To put it plainly, there is no middle ground.",[12,163,164],{},"Compliance is a key function of all organizations. These efforts ensure that the organization and its personnel are adhering to various regulatory obligations by working cross-functionally to implement policies and procedures to meet these requirements. Transparency is actually a powerful compliance driver because it means the wider GitLab community can hold the company accountable for the processes that we put into place and how we carry them out.",[12,166,167,168,171],{},"Being transparent ",[15,169,170],{},"inherently"," helps minimize the scope of an audit because it allows us to be specific and detailed about how we operate as a company. We have moved away from a traditional audit model where process owners sit in a meeting with an auditor and spend hours talking. Instead, through our handbook,  the documentation exists in a state that allows someone to pick it up and understand how to execute specific processes and procedures so that there is no guesswork involved. Processes and procedures aren’t left open to interpretation because that would reduce the ability for GitLab team members to \"self-serve\" information. We believe these same benefits extend to deeper understanding and clearer scope definition on the part of an audit team.",[40,173,175],{"id":174},"whats-next","What’s next?",[12,177,178],{},"As a result of our first audit cycle, we have identified areas where we can iterate on our documentation to make it clearer and more concise. We’ll be working to get our handbook up to snuff while continuing to ready ourselves for an SOC 2 Type 2 audit. We are excited to continue exercising our value of transparency to further improve audit efficiency from audit to audit!",[12,180,181,182,187],{},"Between revising our documentation to be more clear and concise and preparing for our SOC 2 Type 2 audit, we have also performed a Cloud Security Alliance (CSA) CAIQ v3.1 self-assessment. We chose to perform this self-assessment partly for transparency and partly to provide the broader GitLab community with additional assurance over the maturation of the Security Compliance Program at GitLab. The self-assessment is ",[20,183,186],{"href":184,"rel":185},"https://cloudsecurityalliance.org/star/registry/gitlab/",[],"available directly on the CSA website",".",[115,189,190,199],{},[118,191,192,193,198],{},"Interested in learning more about GitLab's Security Certifications and Attestations? Visit our ",[20,194,197],{"href":195,"rel":196},"https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/certifications/",[],"Security Certifications and Attestations handbook page"," to learn more.",[118,200,201,204,205,187],{},[73,202,203],{},"Do you require a copy of GitLab’s SOC 2 report?"," See how ",[20,206,209],{"href":207,"rel":208},"https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/certifications/#requesting-a-copy-of-the-gitlab-soc2-type-2-report",[],"potential and existing customers can request this report",[12,211,212,213,218,219],{},"Cover image by ",[20,214,217],{"href":215,"rel":216},"https://unsplash.com/@mvdheuvel?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText",[],"Maarten van den Heuvel"," on ",[20,220,223],{"href":221,"rel":222},"https://unsplash.com/",[],"Unsplash",{"title":225,"searchDepth":226,"depth":226,"links":227},"",2,[228,229,230,231,232],{"id":42,"depth":226,"text":43},{"id":52,"depth":226,"text":53},{"id":94,"depth":226,"text":95},{"id":157,"depth":226,"text":158},{"id":174,"depth":226,"text":175},"security","2020-04-28","We’re transparent by default, and just completed our first SOC 2 Type 1 audit! How does our public-first stance affect our compliance efforts and impact an audit?","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749681258/Blog/Hero%20Images/mvdheuvel-unsplash.jpg",{},true,"/en-us/blog/benefits-of-transparency-in-compliance",{"title":5,"description":235,"ogTitle":5,"ogDescription":235,"noIndex":238,"ogImage":239,"ogUrl":244,"ogSiteName":245,"ogType":246,"canonicalUrls":244},"https://about.gitlab.com/blog/benefits-of-transparency-in-compliance","https://about.gitlab.com","article","benefits-of-transparency-in-compliance","en-us/blog/benefits-of-transparency-in-compliance",[250,233],"inside GitLab","BlogPost","vDOrIL9ZvHG0DR6k7BfyYn1sF-W2YdR0OZqqADu6tMU",{"logo":254,"freeTrial":259,"sales":264,"login":269,"items":274,"search":600,"minimal":631,"duo":650,"switchNav":659,"pricingDeployment":670},{"config":255},{"href":256,"dataGaName":257,"dataGaLocation":258},"/","gitlab logo","header",{"text":260,"config":261},"Get free trial",{"href":262,"dataGaName":263,"dataGaLocation":258},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":265,"config":266},"Request a demo",{"href":267,"dataGaName":268,"dataGaLocation":258},"/sales/?contact-topic=request-demo","sales",{"text":270,"config":271},"Sign in",{"href":272,"dataGaName":273,"dataGaLocation":258},"https://gitlab.com/users/sign_in/","sign in",[275,304,404,409,523,578],{"text":276,"config":277,"menu":279},"Platform",{"dataNavLevelOne":278},"platform",{"type":280,"columns":281},"cards",[282,288,296],{"title":276,"description":283,"link":284},"The intelligent orchestration platform for DevSecOps",{"text":285,"config":286},"Explore our Platform",{"href":287,"dataGaName":278,"dataGaLocation":258},"/platform/",{"title":289,"description":290,"link":291},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":292,"config":293},"Meet GitLab Duo",{"href":294,"dataGaName":295,"dataGaLocation":258},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":297,"description":298,"link":299},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":300,"config":301},"Learn more",{"href":302,"dataGaName":303,"dataGaLocation":258},"/why-gitlab/","why gitlab",{"text":305,"left":241,"config":306,"menu":308},"Product",{"dataNavLevelOne":307},"solutions",{"type":309,"link":310,"columns":314,"feature":383},"lists",{"text":311,"config":312},"View all Solutions",{"href":313,"dataGaName":307,"dataGaLocation":258},"/solutions/",[315,339,362],{"title":316,"description":317,"link":318,"items":323},"Automation","CI/CD and automation to accelerate deployment",{"config":319},{"icon":320,"href":321,"dataGaName":322,"dataGaLocation":258},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[324,328,331,335],{"text":325,"config":326},"CI/CD",{"href":327,"dataGaLocation":258,"dataGaName":325},"/solutions/continuous-integration/",{"text":289,"config":329},{"href":294,"dataGaLocation":258,"dataGaName":330},"gitlab duo agent platform - product menu",{"text":332,"config":333},"Source Code Management",{"href":334,"dataGaLocation":258,"dataGaName":332},"/solutions/source-code-management/",{"text":336,"config":337},"Automated Software Delivery",{"href":321,"dataGaLocation":258,"dataGaName":338},"Automated software delivery",{"title":340,"description":341,"link":342,"items":347},"Security","Deliver code faster without compromising security",{"config":343},{"href":344,"dataGaName":345,"dataGaLocation":258,"icon":346},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[348,352,357],{"text":349,"config":350},"Application Security Testing",{"href":344,"dataGaName":351,"dataGaLocation":258},"Application security testing",{"text":353,"config":354},"Software Supply Chain Security",{"href":355,"dataGaLocation":258,"dataGaName":356},"/solutions/supply-chain/","Software supply chain security",{"text":358,"config":359},"Software Compliance",{"href":360,"dataGaName":361,"dataGaLocation":258},"/solutions/software-compliance/","software compliance",{"title":363,"link":364,"items":369},"Measurement",{"config":365},{"icon":366,"href":367,"dataGaName":368,"dataGaLocation":258},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[370,374,378],{"text":371,"config":372},"Visibility & Measurement",{"href":367,"dataGaLocation":258,"dataGaName":373},"Visibility and Measurement",{"text":375,"config":376},"Value Stream Management",{"href":377,"dataGaLocation":258,"dataGaName":375},"/solutions/value-stream-management/",{"text":379,"config":380},"Analytics & Insights",{"href":381,"dataGaLocation":258,"dataGaName":382},"/solutions/analytics-and-insights/","Analytics and insights",{"title":384,"type":309,"items":385},"GitLab for",[386,392,398],{"text":387,"config":388},"Enterprise",{"icon":389,"href":390,"dataGaLocation":258,"dataGaName":391},"Building","/enterprise/","enterprise",{"text":393,"config":394},"Small Business",{"icon":395,"href":396,"dataGaLocation":258,"dataGaName":397},"Work","/small-business/","small business",{"text":399,"config":400},"Public Sector",{"icon":401,"href":402,"dataGaLocation":258,"dataGaName":403},"Organization","/solutions/public-sector/","public sector",{"text":405,"config":406},"Pricing",{"href":407,"dataGaName":408,"dataGaLocation":258,"dataNavLevelOne":408},"/pricing/","pricing",{"text":410,"config":411,"menu":413},"Resources",{"dataNavLevelOne":412},"resources",{"type":309,"link":414,"columns":418,"feature":512},{"text":415,"config":416},"View all resources",{"href":417,"dataGaName":412,"dataGaLocation":258},"/resources/",[419,452,479],{"title":420,"items":421},"Getting started",[422,427,432,437,442,447],{"text":423,"config":424},"Install",{"href":425,"dataGaName":426,"dataGaLocation":258},"/install/","install",{"text":428,"config":429},"Quick start guides",{"href":430,"dataGaName":431,"dataGaLocation":258},"/get-started/","quick setup checklists",{"text":433,"config":434},"Learn",{"href":435,"dataGaLocation":258,"dataGaName":436},"https://university.gitlab.com/","learn",{"text":438,"config":439},"Product documentation",{"href":440,"dataGaName":441,"dataGaLocation":258},"https://docs.gitlab.com/","product documentation",{"text":443,"config":444},"Best practice videos",{"href":445,"dataGaName":446,"dataGaLocation":258},"/getting-started-videos/","best practice videos",{"text":448,"config":449},"Integrations",{"href":450,"dataGaName":451,"dataGaLocation":258},"/integrations/","integrations",{"title":453,"items":454},"Discover",[455,460,465,470,474],{"text":456,"config":457},"Customer success stories",{"href":458,"dataGaName":459,"dataGaLocation":258},"/customers/","customer success stories",{"text":461,"config":462},"Blog",{"href":463,"dataGaName":464,"dataGaLocation":258},"/blog/","blog",{"text":466,"config":467},"Demo Hub",{"href":468,"dataGaName":469,"dataGaLocation":258},"/demo-hub/","demo hub",{"text":471,"config":472},"The Source",{"href":473,"dataGaName":464,"dataGaLocation":258},"/the-source/",{"text":475,"config":476},"Remote",{"href":477,"dataGaName":478,"dataGaLocation":258},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":480,"items":481},"Connect",[482,487,492,497,502,507],{"text":483,"config":484},"GitLab Services",{"href":485,"dataGaName":486,"dataGaLocation":258},"/services/","services",{"text":488,"config":489},"Contribute",{"href":490,"dataGaName":491,"dataGaLocation":258},"https://contributors.gitlab.com","contribute",{"text":493,"config":494},"Community",{"href":495,"dataGaName":496,"dataGaLocation":258},"/community/","community",{"text":498,"config":499},"Forum",{"href":500,"dataGaName":501,"dataGaLocation":258},"https://forum.gitlab.com/","forum",{"text":503,"config":504},"Events",{"href":505,"dataGaName":506,"dataGaLocation":258},"/events/","events",{"text":508,"config":509},"Partners",{"href":510,"dataGaName":511,"dataGaLocation":258},"/partners/","partners",{"config":513,"title":516,"text":517,"link":518},{"background":514,"textColor":515},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":519,"config":520},"Read the latest",{"href":521,"dataGaName":522,"dataGaLocation":258},"/whats-new/","whats new",{"text":524,"config":525,"menu":527},"Company",{"dataNavLevelOne":526},"company",{"type":309,"columns":528},[529],{"items":530},[531,536,542,544,549,553,558,563,568,573],{"text":532,"config":533},"About",{"href":534,"dataGaName":535,"dataGaLocation":258},"/company/","about",{"text":537,"config":538,"footerGa":541},"Jobs",{"href":539,"dataGaName":540,"dataGaLocation":258},"/jobs/","jobs",{"dataGaName":540},{"text":503,"config":543},{"href":505,"dataGaName":506,"dataGaLocation":258},{"text":545,"config":546},"Leadership",{"href":547,"dataGaName":548,"dataGaLocation":258},"/company/team/e-group/","leadership",{"text":24,"config":550},{"href":551,"dataGaName":552,"dataGaLocation":258},"https://handbook.gitlab.com/","handbook",{"text":554,"config":555},"Investor relations",{"href":556,"dataGaName":557,"dataGaLocation":258},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":559,"config":560},"Trust Center",{"href":561,"dataGaName":562,"dataGaLocation":258},"/security/","trust center",{"text":564,"config":565},"AI Transparency Center",{"href":566,"dataGaName":567,"dataGaLocation":258},"/ai-transparency-center/","ai transparency center",{"text":569,"config":570},"Newsletter",{"href":571,"dataGaName":572,"dataGaLocation":258},"/company/contact/#contact-forms","newsletter",{"text":574,"config":575},"Press",{"href":576,"dataGaName":577,"dataGaLocation":258},"/press/","press",{"text":579,"config":580,"menu":581},"Contact us",{"dataNavLevelOne":526},{"type":309,"columns":582},[583],{"items":584},[585,590,595],{"text":586,"config":587},"Talk to sales",{"href":588,"dataGaName":589,"dataGaLocation":258},"/sales/","talk to sales",{"text":591,"config":592},"Support portal",{"href":593,"dataGaName":594,"dataGaLocation":258},"https://support.gitlab.com/hc/en-us","support portal",{"text":596,"config":597},"Customer portal",{"href":598,"dataGaName":599,"dataGaLocation":258},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":601,"login":602,"suggestions":609},"Close",{"text":603,"link":604},"To search repositories and projects, login to",{"text":605,"config":606},"gitlab.com",{"href":272,"dataGaName":607,"dataGaLocation":608},"search login","search",{"text":610,"default":611},"Suggestions",[612,614,618,620,624,628],{"text":289,"config":613},{"href":294,"dataGaName":289,"dataGaLocation":608},{"text":615,"config":616},"Code Suggestions (AI)",{"href":617,"dataGaName":615,"dataGaLocation":608},"/solutions/code-suggestions/",{"text":325,"config":619},{"href":327,"dataGaName":325,"dataGaLocation":608},{"text":621,"config":622},"GitLab on AWS",{"href":623,"dataGaName":621,"dataGaLocation":608},"/partners/technology-partners/aws/",{"text":625,"config":626},"GitLab on Google Cloud",{"href":627,"dataGaName":625,"dataGaLocation":608},"/partners/technology-partners/google-cloud-platform/",{"text":629,"config":630},"Why GitLab?",{"href":302,"dataGaName":629,"dataGaLocation":608},{"freeTrial":632,"mobileIcon":637,"desktopIcon":642,"secondaryButton":645},{"text":633,"config":634},"Start free trial",{"href":635,"dataGaName":263,"dataGaLocation":636},"https://gitlab.com/-/trials/new/","nav",{"altText":638,"config":639},"Gitlab Icon",{"src":640,"dataGaName":641,"dataGaLocation":636},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":638,"config":643},{"src":644,"dataGaName":641,"dataGaLocation":636},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":646,"config":647},"Get Started",{"href":648,"dataGaName":649,"dataGaLocation":636},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":651,"mobileIcon":655,"desktopIcon":657},{"text":652,"config":653},"Learn more about GitLab Duo",{"href":294,"dataGaName":654,"dataGaLocation":636},"gitlab duo",{"altText":638,"config":656},{"src":640,"dataGaName":641,"dataGaLocation":636},{"altText":638,"config":658},{"src":644,"dataGaName":641,"dataGaLocation":636},{"button":660,"mobileIcon":665,"desktopIcon":667},{"text":661,"config":662},"/switch",{"href":663,"dataGaName":664,"dataGaLocation":636},"#contact","switch",{"altText":638,"config":666},{"src":640,"dataGaName":641,"dataGaLocation":636},{"altText":638,"config":668},{"src":669,"dataGaName":641,"dataGaLocation":636},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":671,"mobileIcon":676,"desktopIcon":678},{"text":672,"config":673},"Back to pricing",{"href":407,"dataGaName":674,"dataGaLocation":636,"icon":675},"back to pricing","GoBack",{"altText":638,"config":677},{"src":640,"dataGaName":641,"dataGaLocation":636},{"altText":638,"config":679},{"src":644,"dataGaName":641,"dataGaLocation":636},{"title":681,"titleMobile":682,"button":683,"config":688},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":300,"config":684},{"href":685,"dataGaName":686,"dataGaLocation":687},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":689,"disabled":238},"release",{"data":691},{"text":692,"source":693,"edit":699,"contribute":704,"config":709,"items":714,"minimal":924},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":694,"config":695},"View page source",{"href":696,"dataGaName":697,"dataGaLocation":698},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":700,"config":701},"Edit this page",{"href":702,"dataGaName":703,"dataGaLocation":698},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":705,"config":706},"Please contribute",{"href":707,"dataGaName":708,"dataGaLocation":698},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":710,"facebook":711,"youtube":712,"linkedin":713},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[715,762,816,860,892],{"title":405,"links":716,"subMenu":731},[717,721,726],{"text":718,"config":719},"View plans",{"href":407,"dataGaName":720,"dataGaLocation":698},"view plans",{"text":722,"config":723},"Why Premium?",{"href":724,"dataGaName":725,"dataGaLocation":698},"/pricing/premium/","why premium",{"text":727,"config":728},"Why Ultimate?",{"href":729,"dataGaName":730,"dataGaLocation":698},"/pricing/ultimate/","why ultimate",[732],{"title":733,"links":734},"Contact Us",[735,738,740,742,747,752,757],{"text":736,"config":737},"Contact sales",{"href":588,"dataGaName":268,"dataGaLocation":698},{"text":591,"config":739},{"href":593,"dataGaName":594,"dataGaLocation":698},{"text":596,"config":741},{"href":598,"dataGaName":599,"dataGaLocation":698},{"text":743,"config":744},"Status",{"href":745,"dataGaName":746,"dataGaLocation":698},"https://status.gitlab.com/","status",{"text":748,"config":749},"Terms of use",{"href":750,"dataGaName":751,"dataGaLocation":698},"/terms/","terms of use",{"text":753,"config":754},"Privacy statement",{"href":755,"dataGaName":756,"dataGaLocation":698},"/privacy/","privacy statement",{"text":758,"config":759},"Cookie preferences",{"dataGaName":760,"dataGaLocation":698,"id":761,"isOneTrustButton":241},"cookie preferences","ot-sdk-btn",{"title":305,"links":763,"subMenu":772},[764,768],{"text":765,"config":766},"DevSecOps platform",{"href":287,"dataGaName":767,"dataGaLocation":698},"devsecops platform",{"text":769,"config":770},"AI-Assisted Development",{"href":294,"dataGaName":771,"dataGaLocation":698},"ai-assisted development",[773],{"title":774,"links":775},"Topics",[776,781,786,791,796,801,806,811],{"text":777,"config":778},"CICD",{"href":779,"dataGaName":780,"dataGaLocation":698},"/topics/ci-cd/","cicd",{"text":782,"config":783},"GitOps",{"href":784,"dataGaName":785,"dataGaLocation":698},"/topics/gitops/","gitops",{"text":787,"config":788},"DevOps",{"href":789,"dataGaName":790,"dataGaLocation":698},"/topics/devops/","devops",{"text":792,"config":793},"Version Control",{"href":794,"dataGaName":795,"dataGaLocation":698},"/topics/version-control/","version control",{"text":797,"config":798},"DevSecOps",{"href":799,"dataGaName":800,"dataGaLocation":698},"/topics/devsecops/","devsecops",{"text":802,"config":803},"Cloud Native",{"href":804,"dataGaName":805,"dataGaLocation":698},"/topics/cloud-native/","cloud native",{"text":807,"config":808},"AI for Coding",{"href":809,"dataGaName":810,"dataGaLocation":698},"/topics/devops/ai-for-coding/","ai for coding",{"text":812,"config":813},"Agentic AI",{"href":814,"dataGaName":815,"dataGaLocation":698},"/topics/agentic-ai/","agentic ai",{"title":817,"links":818},"Solutions",[819,821,823,828,832,835,839,842,844,847,850,855],{"text":349,"config":820},{"href":344,"dataGaName":349,"dataGaLocation":698},{"text":338,"config":822},{"href":321,"dataGaName":322,"dataGaLocation":698},{"text":824,"config":825},"Agile development",{"href":826,"dataGaName":827,"dataGaLocation":698},"/solutions/agile-delivery/","agile delivery",{"text":829,"config":830},"SCM",{"href":334,"dataGaName":831,"dataGaLocation":698},"source code management",{"text":777,"config":833},{"href":327,"dataGaName":834,"dataGaLocation":698},"continuous integration & delivery",{"text":836,"config":837},"Value stream management",{"href":377,"dataGaName":838,"dataGaLocation":698},"value stream management",{"text":782,"config":840},{"href":841,"dataGaName":785,"dataGaLocation":698},"/solutions/gitops/",{"text":387,"config":843},{"href":390,"dataGaName":391,"dataGaLocation":698},{"text":845,"config":846},"Small business",{"href":396,"dataGaName":397,"dataGaLocation":698},{"text":848,"config":849},"Public sector",{"href":402,"dataGaName":403,"dataGaLocation":698},{"text":851,"config":852},"Education",{"href":853,"dataGaName":854,"dataGaLocation":698},"/solutions/education/","education",{"text":856,"config":857},"Financial services",{"href":858,"dataGaName":859,"dataGaLocation":698},"/solutions/finance/","financial services",{"title":410,"links":861},[862,864,866,868,871,873,876,878,880,882,884,886,888,890],{"text":423,"config":863},{"href":425,"dataGaName":426,"dataGaLocation":698},{"text":428,"config":865},{"href":430,"dataGaName":431,"dataGaLocation":698},{"text":433,"config":867},{"href":435,"dataGaName":436,"dataGaLocation":698},{"text":438,"config":869},{"href":440,"dataGaName":870,"dataGaLocation":698},"docs",{"text":461,"config":872},{"href":463,"dataGaName":464,"dataGaLocation":698},{"text":874,"config":875},"What's new",{"href":521,"dataGaName":522,"dataGaLocation":698},{"text":456,"config":877},{"href":458,"dataGaName":459,"dataGaLocation":698},{"text":475,"config":879},{"href":477,"dataGaName":478,"dataGaLocation":698},{"text":483,"config":881},{"href":485,"dataGaName":486,"dataGaLocation":698},{"text":488,"config":883},{"href":490,"dataGaName":491,"dataGaLocation":698},{"text":493,"config":885},{"href":495,"dataGaName":496,"dataGaLocation":698},{"text":498,"config":887},{"href":500,"dataGaName":501,"dataGaLocation":698},{"text":503,"config":889},{"href":505,"dataGaName":506,"dataGaLocation":698},{"text":508,"config":891},{"href":510,"dataGaName":511,"dataGaLocation":698},{"title":524,"links":893},[894,896,898,900,902,904,908,913,915,917,919],{"text":532,"config":895},{"href":534,"dataGaName":526,"dataGaLocation":698},{"text":537,"config":897},{"href":539,"dataGaName":540,"dataGaLocation":698},{"text":545,"config":899},{"href":547,"dataGaName":548,"dataGaLocation":698},{"text":24,"config":901},{"href":551,"dataGaName":552,"dataGaLocation":698},{"text":554,"config":903},{"href":556,"dataGaName":557,"dataGaLocation":698},{"text":905,"config":906},"Sustainability",{"href":907,"dataGaName":905,"dataGaLocation":698},"/sustainability/",{"text":909,"config":910},"Diversity, inclusion and belonging (DIB)",{"href":911,"dataGaName":912,"dataGaLocation":698},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":559,"config":914},{"href":561,"dataGaName":562,"dataGaLocation":698},{"text":569,"config":916},{"href":571,"dataGaName":572,"dataGaLocation":698},{"text":574,"config":918},{"href":576,"dataGaName":577,"dataGaLocation":698},{"text":920,"config":921},"Modern Slavery Transparency Statement",{"href":922,"dataGaName":923,"dataGaLocation":698},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":925},[926,929,932],{"text":927,"config":928},"Terms",{"href":750,"dataGaName":751,"dataGaLocation":698},{"text":930,"config":931},"Cookies",{"dataGaName":760,"dataGaLocation":698,"id":761,"isOneTrustButton":241},{"text":933,"config":934},"Privacy",{"href":755,"dataGaName":756,"dataGaLocation":698},[936],{"id":937,"title":7,"body":237,"config":938,"content":940,"description":237,"extension":943,"meta":944,"navigation":241,"path":945,"seo":946,"stem":947,"__hash__":948},"blogAuthors/en-us/blog/authors/steve-truong.yml",{"template":939},"BlogAuthor",{"name":7,"config":941},{"headshot":225,"ctfId":942},"sttruong","yml",{},"/en-us/blog/authors/steve-truong",{},"en-us/blog/authors/steve-truong","7M7aL0DLe_NgoyK3djDfe82_s2qav16iD78VOZc_F50",[950,958,966],{"title":951,"description":952,"heroImage":953,"category":233,"date":954,"authors":955,"slug":957,"externalUrl":237},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[956],"Julian Thome","improved-scope-offset-fingerprinting",{"title":959,"description":960,"heroImage":953,"category":233,"date":961,"authors":962,"slug":965,"externalUrl":237},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[963,964],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":967,"description":968,"heroImage":969,"category":233,"date":970,"authors":971,"slug":973,"externalUrl":237},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[972],"Alisa Ho","claude-security-and-gitlab",{"promotions":975},[976,990,1002,1013],{"id":977,"categories":978,"header":980,"text":981,"button":982,"image":987},"ai-modernization",[979],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":983,"config":984},"Get your AI maturity score",{"href":985,"dataGaName":986,"dataGaLocation":464},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":988},{"src":989},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":991,"categories":992,"header":994,"text":981,"button":995,"image":999},"devops-modernization",[993,800],"product","Are you just managing tools or shipping innovation?",{"text":996,"config":997},"Get your DevOps maturity score",{"href":998,"dataGaName":986,"dataGaLocation":464},"/assessments/devops-modernization-assessment/",{"config":1000},{"src":1001},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1003,"categories":1004,"header":1005,"text":981,"button":1006,"image":1010},"security-modernization",[233],"Are you trading speed for security?",{"text":1007,"config":1008},"Get your security maturity score",{"href":1009,"dataGaName":986,"dataGaLocation":464},"/assessments/security-modernization-assessment/",{"config":1011},{"src":1012},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1014,"paths":1015,"header":1018,"text":1019,"button":1020,"image":1025},"github-azure-migration",[1016,1017],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1021,"config":1022},"See how GitLab compares to GitHub",{"href":1023,"dataGaName":1024,"dataGaLocation":464},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1026},{"src":1001},{"header":1028,"blurb":1029,"button":1030,"secondaryButton":1035},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1031,"config":1032},"Get your free trial",{"href":1033,"dataGaName":263,"dataGaLocation":1034},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":736,"config":1036},{"href":588,"dataGaName":268,"dataGaLocation":1034},1786803747759]