GitLab Security & Compliance

Enterprise-grade security with ISO 27001 and TISAX certifications

Your source code, data, and intellectual property are always protected with the highest standards of information security. Our GitLab hosting infrastructure is ISO 27001:2022 and TISAX certified, with a dedicated security team ensuring protection measures are always up to date.

Security Certifications#

ISO 27001:2022#

ISO 27001 is the international standard for information security management systems (ISMS). Our certification demonstrates a systematic approach to managing and protecting sensitive information.

What ISO 27001 covers:

TISAX Certification#

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's information security standard. Our Level 2 (Advanced Protection) certification is mandatory for suppliers to major automotive manufacturers.

TISAX Assessment Objectives:

Industries requiring TISAX:

• Automotive OEMs (VW, BMW, Mercedes, Stellantis)
• Tier 1 suppliers (Bosch, Continental, ZF, Magna)
• Engineering service providers
• Software development for automotive

Infrastructure Security#

Network Architecture#

1
┌─────────────────────────────────────────────────────────────┐
2
│                      Internet                                │
3
└─────────────────────────┬───────────────────────────────────┘
4
                          │
5
                    ┌─────▼─────┐
6
                    │  DDoS     │
7
                    │ Protection│
8
                    └─────┬─────┘
9
                          │
10
                    ┌─────▼─────┐
11
                    │  WAF /    │
12
                    │ Firewall  │
13
                    └─────┬─────┘
14
                          │
15
              ┌───────────┼───────────┐
16
              │           │           │
17
        ┌─────▼─────┐ ┌───▼───┐ ┌─────▼─────┐
18
        │  GitLab   │ │GitLab │ │  GitLab   │
19
        │ Instance A│ │Inst. B│ │ Instance C│
20
        └───────────┘ └───────┘ └───────────┘
21
              │           │           │
22
              └───────────┼───────────┘
23
                          │
24
                    ┌─────▼─────┐
25
                    │  Backup   │
26
                    │  Storage  │
27
                    │(Encrypted)│
28
                    └───────────┘

Network Security Controls#

Encryption Standards#

Access Control#

Authentication Options#

We support enterprise authentication methods:

Role-Based Access Control#

GitLabHost Control Panel supports granular permissions:

Security Monitoring#

24/7 Monitoring#

Our security team provides continuous monitoring:

• Infrastructure Monitoring: Server health, resource utilization, availability
• Security Monitoring: Log analysis, threat detection, anomaly detection
• Application Monitoring: GitLab performance, error rates, response times
• Compliance Monitoring: Configuration drift, policy violations

Incident Response#

Security Logging#

All security-relevant events are logged and retained:

• Authentication attempts (success/failure)
• Authorization decisions
• Administrative actions
• API access
• File access and modifications
• Network connections

Log retention: 90 days online, 1 year archived

Vulnerability Management#

Patch Management#

Security Testing#

Backup Security#

Backup Architecture#

Disaster Recovery#

Physical Security#

Data Center Standards#

All hosting locations meet or exceed:

• Tier III+ data center certification
• ISO 27001 certified facilities
• SOC 2 Type II audited

Physical Controls#

Compliance Support#

Documentation Available#

Audit Support#

We support customer audits:

• Questionnaire completion
• Evidence provision
• Virtual audit sessions
• On-site audits (by arrangement)

Getting Started#

Related Resources#

• Managed GitLab Overview
• European Hosting
• Security Audit Services
• Compliance Services