A structured index of GitLab.com security and compliance references, including supporting record copies, documented scopes and important dates.
These categories are referenced by GitLab in its official security materials. Downloaded record copies are indexed separately from the issuer's original documentation.
Information security management system covering risk treatment, access controls, operations, and managed cloud service governance.
Read evidence details →ISOCloud security management responsibilities and implementation of controls for hosted services.
Read evidence details →ISOPrivacy safeguards for public cloud, data handling and processor responsibilities.
Read evidence details →AuditOperational effectiveness of security, confidentiality and availability controls over a defined period.
Read evidence details →Seven PDF records and seven image records are directly linked below. Each record includes the date printed in the supplied document and a route to relevant public context.
Information security management system covering risk treatment, access controls, operations, and managed cloud service governance.
Public statement supports the certification category. The attached record and its printed expiry have not been independently authenticated.
Cloud security management responsibilities and implementation of controls for hosted services.
Compliance statement is public; the submitted record is not a separately authenticated certificate.
Privacy safeguards for public cloud, data handling and processor responsibilities.
A public compliance statement is not verification of the attached document or its validity window.
Operational effectiveness of security, confidentiality and availability controls over a defined period.
The public statement supports report availability; the attached record is not an authenticated audit report.
Cardholder-data security governance, segmentation, authentication, vulnerability management and logging.
A governance charter is not an Attestation of Compliance, and it does not authenticate this particular archive item.
Australian Government ISM control mapping and assessment scope.
No official assessor identity or complete assessment scope has been independently confirmed for the attached archive item.
Privacy information management framework and personal data processing practices.
Do not infer current 27701 certification solely from this document index.
Govern, Identify, Protect, Detect, Respond and Recover control alignment.
NIST CSF is a framework; a mapping or self-assessment should not be described as a NIST-issued certification.
Security inventory, hardening, monitoring and safeguards aligned to CIS Controls v8.1.
A template or control mapping is not evidence of independent certification.
Privacy governance, data subject rights and personal data processing controls.
GDPR is a regulation rather than a certificate. Published privacy policy content does not authenticate this attachment.
Cloud controls framework coverage and cloud service operational safeguards.
The provided image alone does not establish STAR registry status or independent assurance level.
Protection of controlled unclassified information and access accountability.
A control mapping is not proof of a CMMC assessment or certified scope.
Administrative, physical and technical safeguards relevant to protected health information.
HIPAA does not issue a universal compliance certificate for this record.
Business continuity planning, operational resilience and recovery requirements.
This index does not establish an accredited ISO 22301 certificate.
Some standards appear in published GitLab assurance statements; others appear in framework mappings or submitted assessment records. These are different forms of evidence and should not be treated as equivalent.
How we classify evidence →Match the record subject and service boundary to the question under review.
A review date, report period and certificate expiry mean different things.
A submitted copy does not independently establish a valid external attestation.
