Data residency & sovereignty
Repositories, CI logs, artifacts, and container images stored in the Azure region you choose, under your own encryption keys and retention rules.
Solutions · Engineering Platforms
Self-Hosted GitLab Platform
Your source code is your business, yet it sits in a shared service outside your network and region — and running your own instance properly looks like a full-time job nobody has time for. Symetriz builds your own GitLab in your Azure subscription and runs it for you.
The problem
Whose servers is your code on?
Code outside your control
Source code, CI logs, and artifacts sit in a shared service outside your region and network, which auditors and customers increasingly question.
How we fix it: Your own instance, in your subscription and region, private by default.
Self-hosting sounds like a full-time job
Monthly upgrades, security patches, backups, and scaling need an owner you don't have.
How we fix it: Upgrades, patches, monitoring, and restore drills run as a managed service.
Pipelines holding cloud keys
CI variables full of long-lived cloud credentials are a breach waiting to happen.
How we fix it: Secretless deploys to Azure with federated identity.
The solution
Your own GitLab, in your subscription, run for you
- Your subscription, your region, your network — no shared SaaS tenancy
- Autoscaling runners that deploy to Azure without stored secrets
- Upgraded, patched, backed up, and restore-tested every month as a managed service
Why run GitLab in your own subscription
GitLab.com suits many teams. When source code is the business, regulated, or bound to a region, owning the instance is the simpler answer.
Private by default
No public endpoint unless you want one: access through your VNet, private endpoints, and VPN or ExpressRoute, with the same network controls as the rest of your estate.
Cost you can see and control
Compute and storage billed on your own Azure invoice, runners that scale to zero out of hours, and capacity sized to real usage rather than a seat bundle.
End-to-end setup
From an empty subscription to your teams pushing code, without a platform team of your own.
Sizing to GitLab's reference architecture
User count and workload mapped to GitLab's published reference architectures, from a single VM for small teams to a highly available deployment for thousands of users.
VMs or Kubernetes, chosen deliberately
The Linux package on VMs, or GitLab's cloud-native deployment on AKS with Git storage kept on dedicated VMs — whichever fits your scale and operating model.
Managed data services
PostgreSQL, Redis, and Blob Storage for artifacts, LFS, packages, and the container registry, provisioned as managed Azure services and validated against GitLab's supported versions.
Entra ID single sign-on
Sign-in through Entra ID with group sync to GitLab groups and roles, so joiners and leavers are handled where the rest of your access already lives.
Backups & disaster recovery
Scheduled backups of repositories and database, restores rehearsed rather than assumed, and a recovery plan with agreed recovery time and recovery point targets.
Migration from where you are today
Repositories, merge requests, issues, and pipelines moved in from GitLab.com, GitHub, Bitbucket, or Azure DevOps, team by team, with a rollback plan for each wave.
CI/CD and security built in
An instance with no runners and no guardrails is just a Git server. The delivery platform around it is the point.
Autoscaling runners
Runners on AKS or VM scale sets that scale with the queue and back to zero, with separate pools for trusted production deploys and untrusted merge-request builds.
Secretless deploys to Azure
Pipelines authenticate to Azure with OIDC federated credentials and managed identities, so no cloud keys sit in CI variables waiting to leak.
Security scanning in every pipeline
Static analysis, dependency, secret, and container image scanning wired into shared pipeline templates, using GitLab's scanners or open-source equivalents where your tier doesn't include them.
Shared pipeline templates
Reusable build, test, and deploy templates your teams include rather than copy, so a fix to the pipeline lands everywhere at once.
Registry & artifacts in your estate
Container images, packages, and build artifacts kept in the instance's own registry or promoted to Azure Container Registry, never pulled from a public cache in production.
Protected branches & approvals
Branch protection, merge request approval rules, and protected environments, so what reaches production has been reviewed by the right people.
Run as a managed service
GitLab ships a new release every month and security patches between them. Self-hosted only works if someone keeps up.
Monthly upgrades & security patches
Each release tested on a staging instance and rolled out in an agreed window, following GitLab's supported upgrade paths, with critical security patches applied between releases.
Monitoring & capacity
Instance health, Gitaly latency, runner queue times, and storage growth watched continuously in Azure Monitor, with capacity added before developers feel it.
Restore drills & support
Scheduled restore tests to prove the backups work, plus a support channel for your developers and administrators that knows how your instance is built.
Ready when you are
Want GitLab inside your own subscription?
Tell us how many developers you have, where your code lives today, and any residency rules you work under, and we will size an instance and a migration plan.