With GitLab Self-Managed, your organization secures the hosts and installs updates to GitLab and its operating system. With GitLab.com, GitLab operates and patches the SaaS platform, but your team still secures the parts it controls: accounts, permissions, projects, secrets, pipelines, runners, and connected systems. The difference is who operates the platform—not whether your organization has security work to do.
Who patches what?
| Security area | GitLab Self-Managed | GitLab.com |
|---|---|---|
| GitLab application | Your administrators plan and install upgrades, following GitLab’s maintenance policy and upgrade paths. GitLab maintenance policy | GitLab operates the SaaS platform. Customers do not patch GitLab.com itself. GitLab security |
| Operating system and host | Your organization patches and hardens the hosts, operating system, and related software. Secure GitLab | GitLab and its infrastructure subprocessors operate the underlying SaaS infrastructure. GitLab identifies Google Cloud Platform (GCP) IaaS in its SaaS security FAQ. GitLab security |
| Accounts, projects, and configuration | Your team manages authentication, permissions, visibility, tokens, and security settings. | Your team still manages accounts, project visibility, permissions, secrets, pipelines, and relevant security settings. GitLab hardening guidance |
| Runners and connected systems | You secure and maintain infrastructure your organization operates, including self-managed runners and connected services. Runner security | GitLab.com does not make customer-operated runners or connected infrastructure GitLab’s responsibility. Runner security guidance applies across offerings. Runner security |
| Security fixes | GitLab publishes releases; your administrators decide when and how to install them, and remain responsible for keeping the installation current. GitLab maintenance policy | GitLab maintains the SaaS platform. Your team remains responsible for your configuration and customer-managed integrations. GitLab security |
How to keep a Self-Managed installation patched
GitLab’s documentation explicitly makes Self-Managed customers and administrators responsible for host security and keeping GitLab up to date. That work includes the GitLab application, operating system, related software, and host hardening; updating only GitLab is not a complete patching plan. Secure GitLab
- Track security announcements and releases. Compare the version you run with the maintained versions and current guidance in GitLab’s maintenance policy. Supported versions change, so check the live policy rather than relying on a version list copied into an old checklist.
- Plan the upgrade path. Use GitLab’s documented upgrade paths, particularly if you are skipping releases or crossing major versions. A patch release being available does not install it on your instance.
- Update the full host stack. Patch the operating system and related software, and harden hosts according to vendor guidance. Secure GitLab
- Review runners and integrations separately. Maintain and isolate infrastructure your organization operates rather than treating an application upgrade as a fix for runner or connected-system risks. Runner security
- Include security updates in incident response. GitLab’s incident-response guidance tells Self-Managed administrators to keep installations current and update after security patch releases. Incident management
What GitLab’s maintenance cadence means
GitLab’s maintenance policy describes monthly scheduled releases and patch releases twice monthly around the monthly release. It says security fixes are backported to the current stable release and the previous two monthly releases, subject to exceptions and circumstances where no backport is made; high and critical security issues are always addressed with a patch release. These are policy details, not a promise that GitLab will apply updates to a customer’s Self-Managed instance. Check the current policy and upgrade-path guidance when planning a specific update. GitLab maintenance policy
What your team still secures on GitLab.com
Moving to GitLab.com transfers operation of the SaaS platform to GitLab; it does not transfer control of your organization’s security decisions. GitLab’s hardening guidance covers both SaaS and Self-Managed deployments and says settings should reflect the use case, risk assessment, and environment. GitLab hardening guidance
#1 Best Overall
- Identity and access: Set up authentication and grant users only the access they need.
- Projects and repositories: Choose appropriate visibility and manage permissions and protected branches for your work.
- Secrets and pipelines: Control access to CI/CD secrets and review pipeline settings and practices.
- Runners and integrations: Secure customer-operated runners and any connected services or infrastructure.
- Response and administration: Monitor your configuration and handle security issues affecting your projects, users, or integrations.
GitLab’s security page lists SOC 2 Type 2 for GitLab.com and ISO/IEC 27001:2022 certification for SaaS subscriptions. These are assurance evidence about the service; they do not establish that your users, projects, permissions, or pipelines are configured securely. GitLab security
Why runners deserve separate attention
CI jobs run repository-defined code. A runner is therefore more than a convenience: it supplies compute and may have access to networks, credentials, or other resources. GitLab warns that shared, non-ephemeral runners can create cross-project risk. If your organization operates runners, review their isolation, maintenance, and access as part of your own security boundary—even when the GitLab instance is GitLab.com. Runner security
Rank #2
Which responsibility model fits your operation?
The practical choice is about operational ownership, control, and capability—not a blanket claim that one offering is inherently more secure. Self-Managed gives your organization responsibility for the application and host patching as well as control over that infrastructure. GitLab.com removes that platform-patching task from your team, while leaving customer-controlled configuration and connected infrastructure in your hands.
Quick Recap
Rank #4
- Choose Self-Managed only if you can assign people and processes to track releases, plan upgrades, patch hosts, harden infrastructure, and maintain runners.
- Choose GitLab.com if you want GitLab to operate the SaaS platform, while recognizing that your team must still manage identities, project settings, secrets, pipelines, and integrations.
- For either option, assess assurance evidence alongside your own configuration, operational competence, connected systems, and threat model.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
