GitLab Inc. (GTLB)

How it makes money

Almost all of the money is recurring subscription revenue: customers pay per licensed seat, per year, for the Premium or Ultimate tier, whether they run the software themselves or use GitLab's cloud. In fiscal 2026 subscription revenue (self-managed plus SaaS) was $864.7 million of the $955.2 million total, growing 28%, with the remaining $90.5 million coming from license and other revenue, which includes professional services. On top of seats, GitLab has added usage-based pricing through prepaid credits, used mainly for AI agent capabilities. Growth therefore comes from three places at once — new customers, more seats inside existing customers, and upgrades to higher tiers or add-ons. The company reported a dollar-based net retention rate of 118% for the fourth quarter of fiscal 2026, meaning the same cohort of customers spent about a fifth more than a year earlier, and 1,456 customers with more than $100,000 of annual recurring revenue, up 18% year over year. Annual recurring revenue passed $1 billion during the year.

Once a company's source code, review history, build pipelines and security policies live inside GitLab, moving elsewhere means migrating years of history and rewriting the automation that every engineer touches daily — costly and disruptive enough that most teams do not do it lightly. The all-in-one design deepens this: the more of the toolchain a customer consolidates on GitLab, the more there is to unpick. The advantage is narrow rather than wide because the underlying Git technology is open and portable, a free tier of GitLab itself competes with the paid tiers, and the largest rival (GitHub, owned by Microsoft) can bundle a comparable platform with cloud and productivity contracts the customer is already signing. The company's own 10-K names intense competition and customers staying on the free tier as risks.

Demand follows software-engineering headcount and IT budgets, because GitLab is billed per seat. That gives it a solid floor — the platform is where the code lives, so it is rarely switched off, and multi-year subscriptions delay any shock by a renewal cycle. But it is not defensive either: when companies freeze developer hiring or cut engineering teams, seat counts stop expanding and renewals come back smaller, and GitLab's own filing points to customer downgrades and free-tier retention as the pressure valves. Longer-term demand is pushed along by structural forces that do not track the economic cycle: more software being written everywhere, security and compliance requirements pulling scanning into the development pipeline, and now AI coding assistants, which raise both the volume of code produced and the need for tooling to review and secure it.

Key risks

• Intense competition — GitLab's 10-K states that it faces intense competition and could lose market share to competitors, which would adversely affect its business, operating results and financial condition. The fiscal 2026 filing reworked this area to address free alternatives, pricing pressure and competing developer-environment integrations.
• Free users may never become paying customers — The filing discloses the risk that customers choose to stay on the free self-managed or SaaS offering instead of converting into paying customers. The free tier is the top of GitLab's funnel, so a low conversion rate turns a large user base into a cost rather than a source of revenue.
• Security and privacy breaches — GitLab lists security and privacy breaches among its principal risks. The consequence is unusually direct for this company: the product holds customers' source code and build credentials, so a breach touches the most sensitive asset a software organisation has. The fiscal 2026 filing added specific risks around security-breach litigation and PCI-DSS compliance.
• Dependence on open source and community-contributed code — The filing states that GitLab faces a heightened risk of security breaches because it uses third-party open source technologies and incorporates a substantial amount of open source and community-contributed code in its products — code whose quality and provenance it does not fully control.
• Artificial intelligence features — The company discloses that implementing AI and machine learning technologies in its services may result in reputational harm, liability, increased expenditures or other adverse consequences. The fiscal 2026 filing broadened this to regulation, copyright, personal-data compliance and litigation connected with GitLab Duo.
• History of losses and uncertain profitability — GitLab discloses that it has a history of losses and may not achieve or sustain profitability. The company reported a GAAP net loss of $56.0 million in fiscal 2026 even as revenue grew 26% and adjusted free cash flow reached $219.6 million.
• Managing rapid growth — The filing warns that the business has grown rapidly and that failing to manage future growth, or to improve its systems, processes and controls, would adversely affect results. Related risks named include hiring and retaining key personnel, preserving the company's all-remote culture, and the complexity of its team-engagement model using professional employer organisations and contractors.
• Pricing and packaging changes — GitLab discloses risk from its pricing and packaging strategy, including how it structures tiers and usage-based billing. The fiscal 2026 filing highlights customer downgrades as a specific concern — customers can move down a tier or reduce seats at renewal rather than leave outright.

The filing does not disclose a revenue share for the largest customers. What it does state is that there were no individual customers whose balance represented more than 10% of accounts receivable as of January 31, 2026 and January 31, 2025. The customer base is broad by the company's own metrics — 1,456 customers each generating more than $100,000 of annual recurring revenue, spread across customers in more than 159 countries — so no single account appears to carry the business. GitLab does sell a meaningful part of its volume through channel partners and resellers rather than direct, which concentrates the route to market even where the end customers are diverse; the filing does not quantify that share.