BOX INC

Previous wording

If we do not compete effectively, our customers do not renew their subscriptions or expand their use of our services, we are unable to attract new customers at rates that are consistent with our expectations, or if the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected.

Current wording

If we do not compete effectively, our customers do not renew their subscriptions or expand their use of our services, or if we are unable to attract new customers to our higher-tiered Suites plan or at rates that are consistent with our expectations, or if the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected.

Previous wording

Issues relating to the use of artificial intelligence and machine learning could adversely affect our business and operating results.

Current wording

Issues relating to the use of artificial intelligence and machine learning in Box solutions could adversely affect our business and operating results.

Previous wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the enterprise content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, artificial intelligence, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future and our primary competitors may change. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Current wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the enterprise content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, artificial intelligence, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future and our primary competitors may change. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our intelligent content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Previous wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 102% as of October 31, 2024 and 2023.

Current wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 102 and 101% as of April 30, 2025 and 2024, respectively.

Previous wording

Our net retention rate may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, the effectiveness of our customer support services, the performance of our partners and resellers, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, our ability to successfully integrate new or acquired technology into our products, our ability to execute on our product roadmap, our customers’ budgets and spending levels, and the effects of global economic conditions, especially if challenging macroeconomic conditions continue. If our customers do not renew their subscriptions, renew them on less favorable terms, purchase fewer seats, or fail to purchase new product offerings, our revenue may decline, and we may not realize improved operating results from our customer base.

Current wording

Our net retention rate may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, the effectiveness of our customer support services, the performance of our partners and resellers, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, our ability to successfully integrate new or acquired technology into our products, our ability to execute on our product roadmap, our customers’ budgets and spending levels, and the effects of global economic conditions, especially if challenging macroeconomic conditions continue. If our customers do not renew their subscriptions, renew them on less favorable terms, purchase fewer seats, or fail to purchase new product offerings, our revenue may decline, and we may not realize improved operating results from our customer base. Our future success depends on our customers’ adoption of our intelligent content management platform and purchase of our higher-tiered Suites plan, including our recently-announced Enterprise Advanced plan.

Previous wording

In addition, our business growth depends in part on our customers expanding their use of our services. The use of our cloud content management platform often expands within an organization as new users are added or as additional services are purchased by or for other departments within an organization. Further, as we have introduced new services throughout our operating history, our existing customers have constituted a significant portion of the users of such services, including our recent Box AI offerings. If our customers do not expand their use of our services, our operating results may be adversely affected.

Current wording

In addition, our business growth depends in part on our customers expanding their use of our services. The use of our cloud content management platform often expands within an organization as new users are added or as additional services are purchased by or for other departments within an organization. Further, as we have introduced new services throughout our operating history, our existing customers have constituted a significant portion of the users of such services. If our customers do not expand their use of our services, our operating results may be adversely affected.

Previous wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The United States and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, potential United States (U.S.) sovereign default, bank failures and financial instability, supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the Russia-Ukraine conflict and the conflict in the Middle East, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. We continue to face challenges from customers scrutinizing deals more closely due to the economic environment. In addition, there can be no assurance that enterprise content management and collaboration spending levels will increase following any recovery.

Current wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The U.S. and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, tariffs, potential U.S. sovereign default, bank failures and financial instability, supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the ongoing Russia-Ukraine conflict and the conflict in the Middle East, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. We continue to face challenges from customers scrutinizing deals more closely due to the economic environment. In addition, there can be no assurance that enterprise content management and collaboration spending levels will increase following any recovery.

Previous wording

Our industry is marked by rapid technological developments and new and enhanced applications and services. If we are unable to enhance our existing services or offer new services that achieve market acceptance or keep pace with rapid technological developments, our business could be adversely affected. The success of any new services or enhancements to our existing services, such as Box AI and Box Hubs, depends on several factors, including their timely completion, introduction and market acceptance. We also may experience business or economic disruptions that could adversely affect the productivity of our employees and result in delays in our product development process. We maintain a hybrid workforce (with a mix of employees working from offices and others working remotely), which may lead to disruptions and decreased productivity that could result in delays in our product development process. Failure in this regard may significantly impair our revenue growth and our future financial results. Our product development efforts could also be impacted by our workforce location strategy as we hire an increasing number of our employees in countries such as Poland and the Netherlands. In addition, because our services are designed to operate on a variety of systems, we must continuously modify and enhance our services to keep pace with changes in internet-related hardware, mobile operating systems, and other software, communication, browser and database technologies. We may not be successful in developing these modifications and enhancements or bringing them to market in a timely fashion, which may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers. Furthermore, modifications to existing platforms or technologies will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and adversely affect our business.

Current wording

Our industry is marked by rapid technological developments and new and enhanced applications and services. If we are unable to enhance our existing services or offer new services that achieve market acceptance or keep pace with rapid technological developments, our business could be adversely affected. The success of any new services or enhancements to our existing services, such as Box AI, Box Hubs, Box Doc Gen and Box Forms, depends on several factors, including their timely completion, introduction and market acceptance. We also may experience business or economic disruptions that could adversely affect the productivity of our employees and result in delays in our product development process. We maintain a hybrid workforce (with a mix of employees working from offices and others working remotely), which may lead to disruptions and decreased productivity that could result in delays in our product development process. Failure in this regard may significantly impair our revenue growth and our future financial results. Our product development efforts could also be impacted by our workforce location strategy as we hire an increasing number of our employees in international locations, such as Poland. In addition, because our services are designed to operate on a variety of systems, we must continuously modify and enhance our services to keep pace with changes in internet-related hardware, mobile operating systems, and other software, communication, browser and database technologies. We may not be successful in developing these modifications and enhancements or bringing them to market in a timely fashion, which may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers. Furthermore, modifications to existing platforms or technologies will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and adversely affect our business.

Previous wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. For example, in March 2024, the European Parliament adopted the EU AI Act, which imposes significant obligations related to the use of AI systems and is anticipated to be augmented by secondary legislation in the European Union. Additionally, in October 2023, President Biden issued an Executive Order on AI (“EO 14110”) with the goal of promoting safe, secure, and trustworthy development and use of AI. EO 14110 may ultimately create certain de facto standards and practices given the size and influence of the U.S. government as a customer to major tech companies, like Box. Furthermore, in the U.S. Senate, committees of jurisdiction passed several AI bills that establish additional industry standards and further impose significant obligations in relation to the use of AI systems. At the state level, California and Colorado have enacted several AI-specific bills covering the deployment and regulation of AI technology, which may impact Box. Developing, testing, and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Current wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. For example, in May 2024, the European Council formally adopted the AI Act (the “EU AI Act”), which imposes significant obligations related to the use of AI systems and is anticipated to impact the entire AI ecosystem in the European Union. Additionally, as the EU AI Act is implemented, subsequent guidance, standards and regulations, as well as regulatory bodies within respective member states are expected, which may present unforeseen risks and related challenges. In January 2025, President Trump issued an Executive Order on AI that rescinded former President Biden’s Executive order on AI, and announced efforts to invest in AI infrastructure and innovation. With this shift in AI policy at the federal level, it is unclear the extent to which this may present opportunities or risks to Box in the adoption of AI, including integrating with AI systems developed outside the U.S. that may be, for example, more cost effective. Conversely, at the state level, California and Colorado have enacted several AI-specific bills covering the deployment and regulation of AI technology, which may impact Box. Developing, testing, and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Previous wording

We sell to government customers, which can be highly competitive, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government certification requirements may change, or we may lose one or more government certifications, and in doing so restrict our ability to sell into the government sector or maintain existing government customers until we attain revised certifications. Government demand and payment for our products and services are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Moreover, an extended federal government shutdown resulting from budgetary decisions, a prolonged continuing resolution, breach of the federal debt ceiling, or potential U.S. sovereign default may limit or delay federal government spending on our solutions and adversely affect our revenue. Government entities may also have statutory, contractual or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future operating results.

Current wording

We sell to government customers, which can be highly competitive, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government certification requirements may change, or we may lose one or more government certifications, and in doing so restrict our ability to sell into the government sector or maintain existing government customers until we attain revised certifications. Government demand and payment for our products and services are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Moreover, recent efforts to reduce U.S. federal spending, make the federal government operate more efficiently, an extended federal government shutdown resulting from budgetary decisions, a prolonged continuing resolution, breach of the federal debt ceiling, or potential U.S. sovereign default may limit or delay federal government spending on our solutions and adversely affect our revenue. Government entities may also have statutory, contractual or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future operating results.

Previous wording

A key element of our growth strategy is to expand our international operations and develop a worldwide customer base. In addition, we have opened, and may continue to open, international offices and hire employees to work at these offices in order to gain access to additional talent. For example, in 2020, we established an office in Warsaw, Poland and, in 2021, we acquired SignRequest B.V., a company located in the Netherlands. We have continued to increase our headcount in these countries as we migrate a larger portion of our development to lower cost regions. We are currently committed to our presence in these countries and have entered into a long-term operating lease in Poland to support our growth. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, geographic, social, and political risks that differ from those in the United States. Because of our limited experience with international operations and significant differences between international and U.S. markets, we may not succeed in creating demand for our services outside of the United States or in effectively selling our services in all of the international markets we enter. In addition, we will face challenges in doing business internationally that could adversely affect our business, including:

Current wording

A key element of our growth strategy is to expand our international operations and develop a worldwide customer base. In addition, we have opened, and may continue to open, international offices and hire employees to work at these offices in order to gain access to additional talent. We have continued to migrate a larger portion of our development to lower cost regions, and have entered into a long-term operating lease in Poland to support our growth. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, geographic, social, and political risks that differ from those in the United States. Because of significant differences between international and U.S. markets, we may not succeed in creating demand for our services outside of the United States or in effectively selling our services in all of the international markets we enter. In addition, we will face challenges in doing business internationally that could adversely affect our business, including:

Previous wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen has experienced a decline in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2024 and the nine months ended October 31, 2024 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we have begun implementing hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Current wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen has experienced a decline in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2025 and the three months ended April 30, 2025 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we began implementing hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Previous wording

general economic, industry and market conditions, including those caused by the Russia-Ukraine conflict and the conflict in the Middle East, and as a result of inflation, rising interest rates, or bank failures and financial instability;

Current wording

general economic, industry and market conditions, including those caused by the Russia-Ukraine conflict and the conflict in the Middle East, and as a result of inflation, rising interest rates, tariffs, or bank failures and financial instability;

Previous wording

The services we offer involve the storage of large amounts of our and our customers’ sensitive and proprietary information, some of which may be considered personally identifiable. Cyberattacks and other malicious internet-based activity, including ransomware, malware and viruses, continue to increase in frequency and magnitude and we face security threats from malicious third parties that could obtain unauthorized access to, or disrupt, our systems, infrastructure and networks. These threats may come from a variety of sources including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, sophisticated organizations, hacking groups and individuals and insider threats. These sources can also implement social engineering techniques, such as “phishing,” “smishing” or “vishing” attacks, to induce our partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ data. Hackers that acquire user account information at other companies can attempt to use that information to compromise the accounts of our personnel, or our users’ accounts if an account shares the same sensitive information such as passwords. As we increase our customer base, our brand becomes more widely known and recognized, and our service is used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences, and financial services, we have become more of a target for these malicious third parties.

Current wording

The services we offer involve the storage of large amounts of our and our customers’ sensitive and proprietary information, some of which may be considered personal information, personal data, or other forms of regulated information. Cyberattacks and other malicious internet-based activity, including ransomware, malware and viruses, continue to increase in frequency and magnitude and we face security threats from malicious third parties that could obtain unauthorized access to, or disrupt, our systems, infrastructure and networks. These threats may come from a variety of sources including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, sophisticated organizations, hacking groups and individuals and insider threats. These sources can also implement social engineering techniques, such as “phishing,” “smishing” or “vishing” attacks, to induce our partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ data. Hackers that acquire user account information at other companies can attempt to use that information to compromise the accounts of our personnel, or our users’ accounts if an account shares the same sensitive information such as passwords. As we increase our customer base, our brand becomes more widely known and recognized, and our service is used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences, and financial services, we have become more of a target for these malicious third parties.

Previous wording

These laws and regulations, which may be enforceable by private parties and/or governmental entities, are constantly evolving and can be subject to significant change. A number of new laws coming into effect and/or proposals pending before federal, state and foreign legislative and regulatory bodies could affect our business. For example, the European Union’s General Data Protection Regulation (GDPR) imposes significant obligations on companies regarding the handling of personal data and provides for penalties for noncompliance of up to the greater of 20 million Euros or four percent of a company’s global revenue. Further, local data protection authorities in Europe may adopt regulations and/or guidance more stringent than the GDPR, which may impose additional compliance costs or other burdens that impact our business. Additionally, developments relating to cross-border data transfer may result in the European Commission (EC), European Data Protection Board and/or other regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from the European Economic Area (EEA), Switzerland, or the United Kingdom (U.K.) to the U.S. For example, revised standard contractual clauses were published by regulators in EEA, Switzerland and the U.K., which we adopted in our data processing addenda. However, we cannot guarantee that the policies and related measures that we have implemented will ensure compliance due to possible fluctuations in these laws. Moreover, European governments and the U.S. government have cooperated to adopt the EU-U.S. Data Privacy Framework, U.K.-U.S. Data Bridge and Swiss-U.S. Data Privacy Framework (together, the “Data Privacy Framework”) replacing the EU-U.S. Privacy Shield Framework. While the Data Privacy Framework could benefit the industry as a whole, and we presently maintain self-certification under the Data Privacy Framework, maintaining compliance with the Data Privacy Framework could result in additional costs. The EU-U.S. Data Privacy Framework also already has faced legal challenges, and more generally, the Data Privacy Framework may be subject to future reviews, and subject to suspension, amendment, repeal, or limitations.

Current wording

These laws and regulations, which may be enforceable by private parties and/or governmental entities, are constantly evolving and can be subject to significant change. A number of existing data protection and privacy laws, as well as new laws coming into effect and/or proposals pending before federal, state and foreign legislative and regulatory bodies could affect our business. For example, the European Union’s General Data Protection Regulation (GDPR) imposes significant obligations on companies regarding the handling of personal data and provides for penalties for noncompliance of up to the greater of 20 million Euros or four percent of a company’s global revenue. Further, local data protection authorities in Europe may adopt regulations and/or guidance more stringent than the GDPR, which may impose additional compliance costs or other burdens that impact our business. Additionally, developments relating to cross-border data transfer may result in the European Commission (EC), European Data Protection Board and/or other regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from the European Economic Area (EEA), Switzerland, or the U.K. to the U.S. For example, revised standard contractual clauses were published by regulators in EEA, Switzerland and the U.K., which we adopted in our data processing addenda. However, we cannot guarantee that our relevant policies and measures will ensure compliance due to possible fluctuations in these laws and related frameworks and their interpretation and enforcement. Moreover, European governments and the U.S. government have cooperated to adopt the EU-U.S. Data Privacy Framework, U.K.-U.S. Data Bridge and Swiss-U.S. Data Privacy Framework (together, the “Data Privacy Framework”), replacing the EU-U.S. Privacy Shield Framework. While the Data Privacy Framework could benefit the industry as a whole, and we presently maintain self-certification under the Data Privacy Framework, maintaining compliance with the Data Privacy Framework could result in additional costs. The EU-U.S. Data Privacy Framework has also already faced legal challenges, and more generally, the Data Privacy Framework may be subject to future reviews, and subject to suspension, amendment, repeal, or limitations.

Previous wording

Brexit has created uncertainty around data protection issues and could lead to further legislative and regulatory changes. For example, the U.K. Data Protection Act of 2018 substantially mirrors the EU GDPR in the U.K. and was the subject of statutory amendments that further aligned it with the GDPR in 2019. In June 2021, the EC announced a decision that the U.K. is an “adequate country” to which personal data could be exported from the EEA, but this decision must be renewed and may face challenges in the future, creating uncertainty regarding transfers of personal data to the U.K. from the EEA. It remains unclear how U.K. data protection laws or regulations will develop, and how data transfers to and from the U.K. will be regulated, over time. Additional or modified guidance regarding, or changes to, U.K. cross border data transfers and/or overall U.K. data protection laws and/or guidance could occur, which may require us to change our policies, practices and engage in additional contractual negotiations. Such legislative and regulatory changes may result in increased costs of compliance and limitations on our customers and us.

Current wording

Furthermore, additional or modified guidance regarding, or changes to, U.K. cross border data transfers and/or overall U.K. data protection laws and/or guidance could occur, which may require us to change our policies, practices and engage in additional contractual negotiations. Such legislative and regulatory changes may result in increased costs of compliance and limitations on our customers and us.

Previous wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with an enforcement date of March 29, 2024. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, laws enacted in Virginia, Colorado, Utah, Texas, Montana and Oregon are currently effective and laws enacted in Delaware, Tennessee, Iowa, Indiana, Maryland, Nebraska, New Hampshire, New Jersey, Kentucky, Minnesota, and Rhode Island will become effective between 2025 and 2026. Other U.S. states, including Pennsylvania, Massachusetts, and North Carolina, are anticipated to follow suit. Other states have also enacted privacy laws relating to particular subject matter, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. Efforts to comply with these laws and related fluctuations in laws relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and other proposed federal and state laws relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Current wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with an enforcement date of March 29, 2024. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, laws enacted in Colorado, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia are currently effective, and laws enacted in Maryland, Minnesota, and Tennessee are set to go into effect before the end of 2025. Additionally, laws enacted in Indiana, Kentucky and Rhode Island will become effective in 2026. Other U.S. states are anticipated to follow suit. Other states have also enacted privacy laws relating to particular subject matter, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. Efforts to comply with these laws and related fluctuations in laws relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and other proposed federal and state laws relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Previous wording

We also expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the European Union. Specifically, it expands on the 2016 NIS Directive and broadens its scope to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 EU member states to have issued implementing legislation by October 2024; however, several EU member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resiliency Act (DORA) will become effective in January 2025, and will aim to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers, such as Box. The specific impact and effects of new and evolving laws and regulations will continue to change over time as they are implemented. As a result, we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of, existing laws and regulations, industry standards, or other obligations may have on us or our business. Moreover, these existing and proposed laws, regulations, standards, and other actual or asserted obligations can be difficult and costly to comply with, delay or impede the development or adoption of our products and services, reduce the overall demand for our products and services, increase our operating costs, require modifications to our policies, practices, or products or services, require significant management time and attention, and slow the pace at which we close (or prevent us from closing) sales transactions. Additionally, any actual or alleged noncompliance with these laws, regulations, standards, or other actual or asserted obligations could result in negative publicity and subject us to investigations and other proceedings by regulatory authorities, claims, demands, and litigation by private entities, or other requested remedies or demands, including demands that we modify or cease existing business practices, and expose us to significant fines, penalties and other damages and liabilities. In addition to the possibility of fines, proceedings, demands, claims, and litigation, we may find it necessary or appropriate to fundamentally change our business activities and practices, including the establishment of in-region data storage or other data processing operations, or modify or cease offering certain products or services, any of which could have an adverse effect on our business. We may be unable to…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We also expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the European Union. It expands on the 2016 NIS Directive and broadens its scope to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 EU member states to have issued implementing legislation by October 2024; however, some EU member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resilience Act (DORA), which became effective in January 2025, establishes a universal framework for managing and mitigating information and communication technology risk that applies to entities in the financial sector and their third-party cloud service providers, such as Box. Under DORA, third-party cloud service providers can face significant penalties for non-compliance, including fines of up to $5 million euros for violations. However, the specific impact and effects of these new and evolving laws and regulations are uncertain and subject to change over time as they are implemented. As a result, we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of, existing laws and regulations, industry standards, or other obligations may have on us or our business. Moreover, these existing and proposed laws, regulations, standards, and other actual or asserted obligations can be difficult and costly to comply with, delay or impede the development or adoption of our products and services, reduce the overall demand for our products and services, increase our operating costs, require modifications to our policies, practices, or products or services, require significant management time and attention, and slow the pace at which we close (or prevent us from closing) sales transactions. Additionally, any actual or alleged noncompliance with these laws, regulations, standards, or other actual or asserted obligations could result in negative publicity and subject us to investigations and other proceedings by regulatory authorities, claims, demands, and litigation by private entities, or other requested remedies or demands, including demands that we modify or cease existing business practices, and expose us to significant fines, penalties and other damages and liabilities. In addition to the possibility of fines, proceedings, demands, claims, and litigation, we may find it necessary or appropriate to fundamentally change our business activities and practices, including the establishment of in-region data storage or other data process…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, it could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules.

Current wording

There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, the HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, it could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules.

Previous wording

In order to grow our business, we anticipate that we will continue to depend on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Carahsoft, Cisco, Cloudflare, Guidewire, Google, IBM, Macnica, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-Netsuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM, Zoom and Zscaler to market, resell, or integrate with our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources.

Current wording

To grow our business and to expand our reach in the market, we expect to be more dependent on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Carahsoft, Cisco, Cloudflare, Google, Guidewire, IBM, Macnica, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-Netsuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM, Zoom and Zscaler to market, resell, or integrate with our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources.

Previous wording

Our success is also dependent upon contributions from our executive officers and other key employees and, in particular, Aaron Levie, our co-founder and Chief Executive Officer. In addition, occasionally, there may be changes in our senior management team that could disrupt our business. For example, in November 2023, Olivia Nottebohm joined us as our Chief Operating Officer. The loss of one or more of our executive officers or key employees, or the failure of our senior management team to work together effectively and execute our plans and strategies, could harm our business.

Current wording

Our success is also dependent upon contributions from our executive officers and other key employees and, in particular, Aaron Levie, our co-founder and Chief Executive Officer. In addition, occasionally, there may be changes in our senior management team that could disrupt our business. The loss of one or more of our executive officers or key employees, or the failure of our senior management team to work together effectively and execute our plans and strategies, could harm our business.

Previous wording

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties, which may differ from or be more significant than the risks our business faces; and

Current wording

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders, tax authorities or other third parties, which may differ from or be more significant than the risks our business faces; and

Previous wording

As of January 31, 2024, we had U.S. federal net operating loss carryforwards of approximately $400.9 million, state net operating loss carryforwards of approximately $520.7 million, and foreign net operating loss carryforwards of approximately $298.1 million. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an “ownership change” occurs if there is a cumulative change in our ownership by “5% shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. If we experience ownership changes as a result of future transactions in our stock, then we may be further limited in our ability to use our net operating loss carryforwards and other tax assets to reduce taxes owed on the net taxable income that we earn. Any such limitations on the ability to use our net operating loss carryforwards and other tax assets could adversely impact our business, financial condition and operating results.

Current wording

As of January 31, 2025, we had U.S. federal net operating loss carryforwards of approximately $233.7 million, state net operating loss carryforwards of approximately $487.3 million, and foreign net operating loss carryforwards of approximately $268.5 million. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an “ownership change” occurs if there is a cumulative change in our ownership by “5% shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. If we experience ownership changes as a result of future transactions in our stock, then we may be further limited in our ability to use our net operating loss carryforwards and other tax assets to reduce taxes owed on the net taxable income that we earn. Any such limitations on the ability to use our net operating loss carryforwards and other tax assets could adversely impact our business, financial condition and operating results.

Previous wording

Changes in tariffs, sanctions, international treaties, export/import laws and other trade restrictions or trade disputes may delay the introduction and sale of our services in international markets, prevent our customers with international operations from deploying our services or, in some cases, prevent the export or import of our services to certain countries, governments, persons or entities altogether. Any change in export or import regulations, economic sanctions or related laws, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our services, or in our decreased ability to export or sell our services to existing or potential customers with international operations. Any decrease in the use of our services or limitation on our ability to export or sell our services would likely adversely affect our business, financial condition and operating results.

Current wording

Changes in tariffs, sanctions, international treaties, export/import laws and other trade restrictions or trade disputes may delay the introduction and sale of our services in international markets, prevent our customers with international operations from deploying our services or, in some cases, prevent the export or import of our services to certain countries, governments, persons or entities altogether. Any change in export or import regulations, economic sanctions or related laws, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our services, or in our decreased ability to export or sell our services to existing or potential customers with international operations. Any decrease in the use of our services, limitations on our ability to export or sell our services, or increased costs resulting from changes in tariffs or other trade restrictions, would likely adversely affect our business, financial condition and operating results.

Previous wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million and during fiscal year 2023, we repurchased 10.2 million shares for a total amount of $266.7 million. For the nine months ended October 31, 2024, we repurchased 6.3 million shares for a total amount of $169.0 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Current wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2025, we repurchased 7.6 million shares for a total amount of $211.5 million and during fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million. For the three months ended April 30, 2025, we repurchased 1.6 million shares for a total amount of $49.6 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases or that we will have adequate cash flow to fund any repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Previous wording

As of October 31, 2024, we had outstanding debt, including an aggregate principal amount of (i) $460.0 million issued under the 2029 Convertible Notes and (ii) $205.0 million issued under the 2026 Convertible Notes. During specified periods, the Convertible Notes are convertible at the option of the holders under certain conditions or upon occurrence of certain events as described in Note 6, Part I, Item 1 of this Form 10-Q and Note 9, Part II, Item 8 of our Annual Report on Form 10-K for the year ended January 31, 2024. If one or more holders of the Convertible Notes elect to convert their notes, we are required to settle the principal of the Convertible Notes in cash upon any conversion of such notes, which could adversely affect our liquidity. In addition, even if holders of the Convertible Notes do not elect to convert their Convertible Notes, we may be required under applicable accounting standards to reclassify the carrying value of the Convertible Notes as current, rather than long-term, if any of the conditions to the convertibility of the Convertible Notes are satisfied. This reclassification could materially reduce our reported working capital.

Current wording

As of April 30, 2025, we had outstanding debt, including an aggregate principal amount of (i) $460.0 million issued under the 2029 Convertible Notes and (ii) $205.0 million issued under the 2026 Convertible Notes. During specified periods, the Convertible Notes are convertible at the option of the holders under certain conditions or upon occurrence of certain events as described in Note 9, Part II, Item 8 of our Annual Report on Form 10-K for the year ended January 31, 2025. If one or more holders of the Convertible Notes elect to convert their notes, we are required to settle the principal of the Convertible Notes in cash upon any conversion of such notes, which could adversely affect our liquidity. In addition, even if holders of the Convertible Notes do not elect to convert their Convertible Notes, we may be required under applicable accounting standards to reclassify the carrying value of the Convertible Notes as current, rather than long-term, if any of the conditions to the convertibility of the Convertible Notes are satisfied. This reclassification could materially reduce our reported working capital.

Previous wording

Holders of the Convertible Notes also have the right to require us to repurchase all or a portion of their Convertible Notes upon the occurrence of a fundamental change (as defined in the indenture governing the Convertible Notes) at a repurchase price equal to 100% of the principal amount of the Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any. If the Convertible Notes have not previously been converted or repurchased, we will be required to repay the outstanding principal amount of the Convertible Notes, plus accrued and unpaid special interest, if any, in cash at maturity. The 2026 Convertible Notes and the 2029 Convertible Notes are scheduled to mature on January 15, 2026 and September 15, 2029, respectively.

Current wording

Holders of the Convertible Notes also have the right to require us to repurchase all or a portion of their Convertible Notes upon the occurrence of a fundamental change (as defined in the indenture governing the applicable Convertible Notes) at a repurchase price equal to 100% of the principal amount of the Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any. If the Convertible Notes have not previously been converted or repurchased, we will be required to repay the outstanding principal amount of the Convertible Notes, plus accrued and unpaid special interest, if any, in cash at maturity. The 2026 Convertible Notes and the 2029 Convertible Notes are scheduled to mature on January 15, 2026 and September 15, 2029, respectively.

Previous wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal year 2024 and 2023, we may incur significant losses in the future. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Current wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal years 2025, 2024 and 2023, we may incur significant losses in the future and may not maintain profitability on a consistent basis. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Previous wording

In addition, our ability to repurchase or pay cash upon conversion or at maturity of the Convertible Notes may be limited by law or regulatory authority. Our ability to service our debt also depends on the operating results of our subsidiaries and upon the ability of such subsidiaries to provide us with cash generated by the subsidiaries. Any dividends, loans or other distributions to us from our subsidiaries may be subject to legal, contractual or other restrictions and are subject to other business and tax considerations. Our failure to repurchase Convertible Notes following a fundamental change or to pay cash upon conversion or at maturity of the Convertible Notes as required by the indenture would constitute a default under such indenture. A default under the indenture or the fundamental change itself could also lead to a default under our senior credit facility, our other outstanding indebtedness, or agreements governing our future indebtedness and could have a material adverse effect on our business, results of operations, and financial condition. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Convertible Notes or to pay cash upon conversion or at maturity of the Convertible Notes.

Current wording

In addition, our ability to repurchase or pay cash upon conversion or at maturity of the Convertible Notes may be limited by law or regulatory authority. Our ability to service our debt also depends on the operating results of our subsidiaries and upon the ability of such subsidiaries to provide us with cash generated by the subsidiaries. Any dividends, loans or other distributions to us from our subsidiaries may be subject to legal, contractual or other restrictions and are subject to other business and tax considerations. Our failure to repurchase Convertible Notes following a fundamental change or to pay cash upon conversion or at maturity of the Convertible Notes as required by the applicable indenture would constitute a default under such indenture. A default under the indentures or the fundamental change itself could also lead to a default under our senior credit facility, our other outstanding indebtedness, or agreements governing our future indebtedness and could have a material adverse effect on our business, results of operations, and financial condition. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Convertible Notes or to pay cash upon conversion or at maturity of the Convertible Notes.

Previous wording

In connection with the issuance of the Convertible Notes, we entered into capped call transactions with various counterparties (the “Capped Calls”). The Capped Calls cover, subject to customary adjustments, the number of shares of our Class A common stock initially underlying the Convertible Notes. The Capped Calls are expected generally to reduce or offset the potential dilution to our Class A common stock upon any conversion of the Convertible Notes with such reduction or offset, as the case may be, subject to a cap based on the cap price.

Current wording

In connection with the issuance of each series of the Convertible Notes, we entered into capped call transactions with various counterparties (the “Capped Calls”). The Capped Calls cover, subject to customary adjustments, the number of shares of our Class A common stock initially underlying the applicable series of Convertible Notes. The Capped Calls are expected generally to reduce or offset the potential dilution to our Class A common stock upon any conversion of the applicable series of Convertible Notes with such reduction or offset, as the case may be, subject to a cap based on the cap price.

Previous wording

From time to time, the counterparties to the Capped Calls or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the Convertible Notes. This activity could also cause or prevent an increase or a decrease in the market price of our Class A common stock or the Convertible Notes.

Current wording

From time to time, the counterparties to the Capped Calls or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable series of Convertible Notes. This activity could also cause or prevent an increase or a decrease in the market price of our Class A common stock.

Previous wording

In May 2021, we issued 500,000 shares of our Series A Convertible Preferred Stock to a group of investors led by KKR & Co. Inc. (“KKR,” and such group of investors, the “Investors”). The holders of our Series A Convertible Preferred Stock are generally entitled to vote with the holders of our Class A common stock on all matters submitted for a vote of holders of shares of Class A common stock (voting together with the holders of shares of Class A common stock as one class) on an as-converted basis.

Current wording

In May 2021, we issued 500,000 shares of our Series A Convertible Preferred Stock to a group of investors led by KKR. The holders of our Series A Convertible Preferred Stock are generally entitled to vote with the holders of our Class A common stock on all matters submitted for a vote of holders of shares of Class A common stock (voting together with the holders of shares of Class A common stock as one class) on an as-converted basis.

Previous wording

On August 25, 2024, our Board of Directors authorized the repurchase of an additional $100 million shares of our Class A Common Stock. During the three months ended October 31, 2024, we repurchased 1.0 million shares at a weighted average price of $29.78 per share for a total amount of $29.9 million. We have entered into pre-set trading plans adopted in accordance with Rule 10b5-1 under the Exchange Act to effect such repurchases. The authorized repurchase plan will expire on August 25, 2025.

Current wording

On March 4, 2025, we announced that our Board of Directors authorized the repurchase of an additional $150 million shares of our Class A Common Stock. During the three months ended April 30, 2025, we repurchased 1.6 million shares at a weighted average price of $31.28 per share for a total amount of $49.6 million. We periodically enter into pre-set trading plans adopted in accordance with Rule 10b5-1 under the Exchange Act to effect such repurchases. The authorized repurchase plan will expire on March 3, 2026.