2 owns · 2 partial of 5 — a pattern, not a score
AI adoption: moderateGitLab's Duo Agent Platform, generally available since January 2026, finished its first full quarter of consumption at a paid consumption run rate of nearly $20 million, a figure that includes minimum usage commitments made before that launch plus on-demand credits. It attached to four of the quarter's top ten deals and added more net new ARR than Duo Pro and Duo Enterprise combined had in any prior quarter. One disclosed account shows the intensity: a top-ten US bank whose developers averaged 1.5 hours saved per task is in active rollout across hundreds of developers, and the customer's own plan points to an active user base nearly 20 times larger at full deployment. Management assumes no material revenue contribution in fiscal 2027 and frames the year as converting pilots to production. source: s204.q4cdn.com
GitLab owns the delivery workflow and the customer relationship, rents the model, and is barred by its own policy from compounding the one data asset that would otherwise be its moat. It is the system of record for the software lifecycle, agents run inside it, and GitLab Credits meter that agent activity, while the models are entirely third-party and customer tenant data is walled off from training. Evaluation is genuinely first-party but leans on an external tracking platform and an industry benchmark for scoring.
| Customer relationship | owns | GitLab sells "through a direct sales organization, a self-service web purchasing experience, and a global partner ecosystem", with partners "designed to complement direct sales efforts." Free tiers and trials feed the funnel, and the installed base is named: 1,456 customers at $100k+ ARR, up from 1,229, net retention of 118%, and "no individual customers whose revenue represented more than 10% of total revenue" in FY2026, FY2025 or FY2024. Customer counts track each end customer separately even when sold through a channel. The counterweight is intermediation: at January 31, 2026 two channel partners held 17% and 13% of accounts receivable, in a book where over 70% of ARR is public sector and enterprise, and the filing carries a channel-partner risk factor. source: sec.gov |
|---|---|---|
| Proprietary data | partial | GitLab has privileged inference-time access to an unusually complete software-lifecycle corpus, but it is customer tenant data and GitLab has foreclosed compounding it: "GitLab does not train generative AI models" and "For GitLab Duo requests, GitLab has a zero data retention policy with Fireworks AI." Some exhaust is kept: Duo Chat and Duo Agent Platform "retain chat and workflow history", "GitLab retains trace data" under expanded logging, telemetry covers prompt lengths, model, editor and accept/reject counts, and since 18.9.1 an opt-in setting logs "Full prompt and response text" and "Tool calls and their results" — "not for training AI models." Prompt caching and "limited vendor-side data retention" apply to certain Anthropic and OpenAI models. source: docs.gitlab.com |
| Evals | partial | GitLab runs a public, first-party evaluation harness. The Centralized Evaluation Framework "is a command-line interface (CLI) framework designed to provide a centralized solution for evaluating AI features at GitLab", maintained by its AI Model Validation and Research group and covering "GitLab AI features (such as Duo Chat, Code Suggestions, etc.)". Its outputs are performance metrics and comparison reports letting developers "test and validate prompt engineering changes"; that these set per-feature defaults is an inference, as the docs say only "GitLab might update default models to optimize performance." It stays below owns because "CEF relies on LangSmith for evaluation tracking and experiment management" and agentic scoring uses an external benchmark via "one-click SWE-bench evaluations." source: gitlab.com |
| Workflow | owns | GitLab "is a technology company and its primary offering is 'GitLab', an intelligent orchestration platform for DevSecOps delivered as a single application", and the issue, merge request, pipeline and vulnerability record live in its system of record. The Duo Agent Platform, "Generally available in January 2026", puts agents inside that workflow: "teams orchestrate AI agents that execute tasks autonomously across planning, development, security, and deployment. This eliminates the need for manual handoffs between software lifecycle stages." Monetization meters the same surface: "Usage-based pricing (GitLab Credits) applies specifically to GitLab Duo Agent Platform capabilities." Authoring is the limit — code is written in "third-party code editors and integrated development environments, or IDEs." source: sec.gov |
| Domain-specific model | none | Every model behind GitLab Duo is third-party: Anthropic (Claude Sonnet 4.5, Sonnet 4.6, Sonnet 3, Haiku 3, Haiku 4.5, several via Google Vertex), Google (Gemini 2.5 Flash Vertex), Mistral Codestral 25.01 and 25.08, and OpenAI — the guidance recommends starting with "Claude Haiku 4.5 or GPT-5.4 Mini." Defaults are Claude Sonnet 4.6 Vertex for code generation and chat, Claude Sonnet 4.5 Vertex for Code Review, and Codestral 25.08 Fireworks for code completion. No GitLab-authored model appears and there is no fine-tuning claim: "GitLab does not train generative AI models." The 10-K books the dependency as a risk — "We rely on third-party vendors for the provision of the AI models which power many of our AI features." GitLab owns routing, per-feature model switching (GA in 18.5) and prompt engineering. source: docs.gitlab.com |