Veritone Inc

Previous wording

In the ordinary course of business, we process proprietary, confidential, and sensitive data, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, financial information, and biometric data (collectively, sensitive information). Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. In particular, the data processed and stored in our platform, networks, and computer systems by customers in the government market may contain highly sensitive data that is subject to protection under government regulations, and we are obligated to comply with stringent requirements related to the security of such data, such as FedRAMP and Criminal Justice Information Services (“CJIS”) security requirements.

Current wording

In the ordinary course of business, we process proprietary, confidential, and sensitive data, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, financial information, and biometric data (collectively, sensitive information). Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures designed to protect our information technology systems and sensitive information. In particular, the data processed and stored in our platform, networks, and computer systems by customers in the government market may contain highly sensitive data protected under government regulations, and we are obligated to comply with stringent requirements related to the security of such data, such as FedRAMP and Criminal Justice Information Services (“CJIS”) security requirements.

Previous wording

Individuals or entities may attempt to penetrate our network, computer system or platform security, or that of our third-party hosting and storage providers and other third parties upon which we rely, and could gain access to our sensitive information, including customer data. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation, nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. For example, we have operations and third parties upon which we rely to support our business located in unstable regions and regions experiencing (or expected to experience) geopolitical or other conflicts, including in the Middle East, where businesses have experienced an increase in cyberattacks in relation to the Israel/Hamas conflict.

Current wording

Individuals or entities have in the past and may in the future attempt to penetrate our network, computer system or platform security, or that of our third-party hosting and storage providers and other third parties upon which we rely, and could gain access to our sensitive information, including customer data. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation, nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. For example, we have operations and third parties upon which we rely to support our business located in unstable regions and regions experiencing (or expected to experience) geopolitical or other conflicts, including in the Middle East, where businesses have experienced an increase in cyberattacks in relation to the Israel/Hamas conflict.

Previous wording

In addition, our network, computer system or platform may be subject to a variety of evolving threats, including but not limited to computer malware (including as a result of advanced persistent threat intrusions), viruses, worms and computer hacking, fraudulent use attempts, phishing and other social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, adware, attacks enhanced or facilitated by AI, and other similar threats, all of which have become more prevalent in our industry. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Our data and information systems may also fail for reasons other than malicious activity, including but not limited to software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, telecommunications failures, earthquakes, fires, and floods.

Current wording

In addition, our network, computer system or platform are subject to a variety of evolving threats, including but not limited to computer malware (including as a result of advanced persistent threat intrusions), viruses, worms and computer hacking, fraudulent use attempts, phishing and other social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks and disruptions, adware, attacks enhanced or facilitated by AI, and other similar threats, all of which have become more prevalent in our industry. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Our data and information systems or those of third party service providers on which we rely may also fail for reasons other than malicious activity, including but not limited to software bugs, server malfunctions, software or hardware failures, service outages, loss of data or other information technology assets, telecommunications failures, earthquakes, fires, and floods.

Previous wording

These and other threats, attacks, disruptions, or accidents could result in the unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure, access or misappropriation of our proprietary or confidential information, including of our customers and their employees or third parties, and/or damage to our or our third party service providers’ platform, network, or computer systems. For instance, we were recently made aware of an article posted by a security researcher which identified a temporary vulnerability related to two Azure environments related to a limited number of government customers. This vulnerability was not present in our commercial environment, which operates on a different system. The vulnerability was remediated in March 2024, but we have notified our potentially affected customers and are currently investigating the matter.

Current wording

These and other threats, attacks, disruptions, outages, or accidents involving us or our third party service providers could result in the unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure, access, unavailability or misappropriation of our proprietary or confidential information, including of our customers and their employees or third parties, and/or damage to our or our third party service providers’ platform, network, or computer systems. For instance, in the second quarter of 2024, we were made aware of an article posted by a security researcher which identified a temporary vulnerability related to two Azure environments related to a limited number of government customers. The vulnerability was remediated as of June 30, 2024, and we notified our potentially affected customers. Our investigation into and response to the matter and this issue has concluded and has not resulted in the loss of any of our customers.

Previous wording

Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. An actual or perceived security breach of our platform, network or computer systems, or those of our technology service providers or third party vendors, could result in adverse consequences such as the loss of business, financial losses, reputational damage, negative publicity, government enforcement actions (for example, regulatory investigations, orders, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, litigation (including class claims), indemnity obligations, damages for contract breach, civil and criminal penalties (including for violation of applicable laws, regulations or contractual obligations), restrictions on processing sensitive data (including personal data), diversion of management attention, interruptions in our operations (including availability of data), significant costs, fees and other monetary payments for remediation, and other similar harms.

Current wording

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents or vulnerabilities, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions are costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. An actual or perceived security breach of our platform, network or computer systems, or those of our technology service providers or third party vendors, could result in adverse consequences such as the loss of business, financial losses, reputational damage, negative publicity, government enforcement actions (for example, regulatory investigations, orders, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, litigation (including class claims), indemnity obligations, damages for contract breach, civil and criminal penalties (including for violation of applicable laws, regulations or contractual obligations), restrictions on processing sensitive data (including personal data), diversion of management attention, interruptions in our operations (including availability of data), significant costs, fees and other monetary payments for remediation, and other similar harms.

Previous wording

The reliability and continuous availability of our platform and services is critical to our success. However, software such as ours can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our product are released. Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such fix may be difficult to push out to our customers or otherwise be delayed. Furthermore, our business depends upon the appropriate and successful implementation of our platform and services by our customers. If our customers fail to use our platform or services according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, and could result in reputational harm. In addition to security breaches, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information or sensitive information of our customers could be leaked, disclosed, or revealed as a result of or in connection with the use of generative AI technologies by our employees, personnel, or vendors.

Current wording

The reliability and continuous availability of our platform and services is critical to our success. However, software such as ours can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our product are released. Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such fix may be difficult to push out to our customers or otherwise be delayed. Furthermore, our business depends upon the appropriate and successful implementation of our platform and services by our customers. If our customers fail to use our platform or services according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, and could result in reputational harm. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information or sensitive information of our customers could be leaked, disclosed, or revealed as a result of or in connection with the use of generative AI technologies by our employees, personnel, or vendors.

Previous wording

During the three months ended March 31, 2024, we issued 206,957 shares of Common Stock to certain Warrant Holders upon the exercise of 349,657 warrants held by them. Each warrant was cashless exercised at a strike price of $2.5760. The shares of Common Stock issued upon exercise of these warrants were issued in reliance on an exemption from registration provided by Section 3(a)(9) of the Securities Act. Each of the Warrant Holders represented that they were acquiring the warrants and, upon any exercise thereof, will acquire shares of Common Stock issuable upon such exercise, for its own account and not with a view to distribution or resale in violation of the Securities Act or any applicable state securities law.

Current wording

During the three and six months ended June 30, 2024, we issued 91,153 and 298,110 shares of our common stock (“Common Stock”) to certain Warrant Holders upon the exercise of 150,200 and 499,857 warrants held by them, respectively. Each warrant was cashless exercised at a strike price of $2.5760. The shares of Common Stock issued upon exercise of these warrants were issued in reliance on an exemption from registration provided by Section 3(a)(9) of the Securities Act. Each of the Warrant Holders represented that they were acquiring the warrants and, upon any exercise thereof, will acquire shares of Common Stock issuable upon such exercise, for such Warrant Holder’s own account and not with a view to distribution or resale in violation of the Securities Act or any applicable state securities law.