Evidence interpretation
Understand what the archive provides, what requires independent validation, and how to read dates and scope.
Not every assurance record proves the same thing.
This independent index presents copies of submitted assurance materials alongside public references relating to GitLab.com. The archive copies retain their original markings and have not been authenticated by the issuing organization. The index is not operated by GitLab or a certification body.
Official public assurance
Published statements from GitLab on its own security pages support specific claims about ISO and SOC assurance categories, but do not by themselves authenticate an archive copy or every expiry date printed on it.
Framework and control mapping
PCI governance documents, NIST CSF mappings and IRAP templates can establish how controls are organized or assessed. They do not automatically establish a current third-party credential, accredited assessor or complete operational result.
Archive records with limited provenance
Where the record lacks a separately verifiable issuer, certificate register entry or scope statement, that limitation should remain explicit. The date in the record is informational until validated with its original source.
Dates are not interchangeable
Certificates may show expiry dates. SOC 2 reports describe examination periods. NIST-based control reviews and IRAP assessments may show next-review or reassessment dates. These different date types must not be treated as one universal certificate expiry field.
Documents and downloads
The documents linked from this website are publicly downloadable archive files. Downloading a record does not establish authenticity, processing authorization in another system or permission to reuse its statements for a different scope.