Help Page could be more helpful

mentioned in issue gitlab-com/marketing#1137

I find the Docs at https://docs.gitlab.com/ee/README.html much more usable than those at https://gitlab.com/help or on the user's own instances, so I link to our Docs site whenever possible.

The search function on the landing page is really useful too:

https://docs.gitlab.com

Thanks for the links @markglenfletcher, this is really helpful!

closed

reopened

changed the description

assigned to @sarrahvesselov

mentioned in issue gitlab-foss#29483 (moved)

Here are some questions I had from a lead - some about .com and some EE. I think there is also room for improvement with our FAQ pages. We have FAQ at the bottom of each product page, which makes sense to me, but also have this: https://about.gitlab.com/license-faq/.

These questions will be cross posted, but thought it would be worth sharing here.

  What sort of assurance can you give us that our data will be safe? What security measures do you have in place?

GitLab follows industry best practices regarding security. Regular external network and application audits are performed. Azure and Digital Ocean both maintain SOC2 and ISO27001 certifications.

  How many companies are using your SaaS solution, gitlab.com?

We don't currently publish an official number for this, but there are over 100,000 groups on GitLab.com which could be companies, open-source initiatives, educational institutes or personal groups.

  Are you going to be able to integrate with Azure AD?

On-premises GitLab solutions (CE/EE/EEP) allow for Microsoft Azure AD integration. Currently, GitLab.com cannot due to SSO limitations when using multiple providers. This is something we are actively working on to include, and I suggest commenting on the open issue (milestone is set for next 2-3 months).

  How do you delete our data if we cancel our account or you replace your hardware?

For GitLab EE, 14 days after the end of your subscription, your key will no longer work and GitLab Enterprise Edition will not be functional anymore. You will be able to downgrade to GitLab Community Edition, which is free to use.

  Do you have any certifications and adhere to best practices such as NIST?

We do adhere to best practices and are in the process of attaining CSA STAR certification, but it will be some time. We do not utilize NIST standards such as 800-53, 800-115, 800-27, etc. directly but they do influence our security controls and assessments.

  Have you ever had a breach and are you obligated to tell us if you've been breached?

We have not. Our breach notification policy is in draft form and publicly available here: https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/5737

It should be finalized and published soon.

  Will any partners or 3rd parties you work with have access to our data?

Third parties are sometimes hired to assist in improving the performance or security of GitLab.com. They may have access to user data during the course of their work. All third parties are required to sign non-disclosure agreements to protect sensitive data, including that belonging to users.

  Do you pen test your systems and do you allow customers to pen test? What are the results?

Yes, we regularly conduct penetration tests and other security assessments. Anyone is allowed to conduct security assessments against the GitLab software via our HackerOne bug bounty program. Assessments conducted against GitLab.com or associated infrastructure must be approved and have a signed contract and NDA.

  Do you have scheduled maintenance periods which may be disruptive? If so, how will we be notified?

Our goal is to avoid downtime whenever possible and we do not have scheduled downtime weekly or monthly. If downtime is necessary users are notified via the GitLab status Twitter account and via a banner on GitLab.com, typically several days in advance.

Check out this documentation on High Availability and see more information on Premium Support, which offers live upgrade assistance and support for HA.

Do you offer API access and can you verify that all are authenticated and encrypted? (which protocols are in use?)

API access is a core feature of GitLab. All API calls require authentication and encryption via HTTPS.

Do we own our data or do you? Metadata? This is available in our GitLab.com Terms.

"We do not claim any ownership rights to the information that you submit to the GitLab application itself, your code is yours."

Will our data be backed up off site or at a facility not operated by you? Will it be encrypted?

The GitLab.com database is encrypted and backed up to Amazon S3. Repository backups are performed with mirrored disk images in Azure and are not kept off-site. There is a plan in place to keep another repository backup on a second cloud service provider using GitLab Geo which we hope to have in place soon.

Is your data encrypted at rest, motion, and in use?

Data is encrypted in motion via SSH and HTTPS. Data is not encrypted at the application or filesystem level.

Is the Enterprise version supported on Windows?

GitLab EE is hosted by you and is developed for Unix operating systems. Though it does not run on Windows, it can be run on virtual machines/containers, AWS, etc.

Thanks @mollybeth!

mentioned in issue gitlab-foss#17658 (closed)

marked this issue as related to gitlab-foss#18739 (moved)

moved from gitlab-foss#34005 (moved)

Help Page could be more helpful

Problem:

Solution:

Related Issues:

Designs

Child items ...

Activity

Admin message

Admin message

Help Page could be more helpful

Problem:

Solution:

Related Issues:

Relates to

Activity