Primary sources
Public links for cross-checking the subject domain, certifications, framework mappings and published security documents.
GitLab Trust Center ↗
GitLab statement of ISO 27001 certification, ISO 27017 / 27018 compliance and SOC 2 Type 2 reports.
https://about.gitlab.com/security/PRIMARY / PUBLIC REFERENCECertifications and attestations ↗
Security Compliance handbook directing customers to the current assurance inventory.
https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/certifications/PRIMARY / PUBLIC REFERENCEGitLab PCI Charter ↗
PCI DSS governance and service-provider scope; not an uploaded attestation.
https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/pci-charter/PRIMARY / PUBLIC REFERENCEGitLab Control Framework ↗
Security compliance control program, assessment cadence and scope.
https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/sec-controls/PRIMARY / PUBLIC REFERENCEBuilding the control framework ↗
Public account of aligning GitLab controls to multiple standards including NIST CSF.
https://about.gitlab.com/blog/how-gitlab-built-a-security-control-framework-from-scratch/PRIMARY / PUBLIC REFERENCEFramework templates ↗
Technical templates for CIS, IRAP, NIST CSF, PCI and other control mappings.
https://about.gitlab.com/blog/quick-compliance-with-compliance-framework-templates/PRIMARY / PUBLIC REFERENCEGitLab privacy information ↗
Public privacy policies, data handling and legal notices.
https://about.gitlab.com/privacy/PRIMARY / PUBLIC REFERENCEGitLab.com ↗
Primary subject domain and product homepage.
https://gitlab.com/Archive versus primary reference
A record downloaded from this site is a separate archive copy. The record's expiry, holder or issuer should not be inferred from the existence of an official page mentioning the same standard. The primary source, named service scope and issuing authority should be checked before making an assurance decision.
How evidence is interpreted →