Commerce.com, Inc.

Evaluation of Disclosure Controls and Procedures

Our management, under the supervision and with the participation of our Chief Executive Officer (principal executive officer) and Chief Financial and Chief Operating Officer (principal financial officer), has evaluated our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act as of the end of the period covered by this report. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on the evaluation of our disclosure controls and procedures as of December 31, 2025, the end of the period covered by this report, our Chief Executive Officer and Chief Financial and Chief Operating Officer concluded that, as of such date, our disclosure controls and procedures were effective at the reasonable assurance level.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) or Rule 15(d)-15(f) under the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Our management, under the supervision and with the participation of our principal executive officer and our principal financial officer, assessed the effectiveness of our internal control over financial reporting as of December 31, 2025. In making this assessment, management used the criteria established in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). Based on our assessment, management concluded that, as of December 31, 2025, the Company’s internal control over financial reporting was effective.

Our independent registered public accounting firm, Ernst & Young LLP, has issued an attestation report on the effectiveness of our internal control over financial reporting as of December 31, 2025, which is included in Item 8 of this Annual Report on Form 10-K.

Remediation of Previously Reported Material Weakness

As previously reported in the Company’s Annual Report on Form 10-K for the fiscal year ended December 31, 2024, we identified a material weakness in internal control over financial reporting. The material weakness related to information technology general controls that support our financial reporting process. Specifically, management determined that we had not maintained effective controls over (i) user access to ensure appropriate segregation of duties and adequately restrict user and privileged access to financial applications, programs and data to the appropriate personnel, and (ii) program change management for financial applications to ensure that information technology (“IT”) program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately. As a result, our related IT dependent manual and application controls that rely upon the affected ITGC’s, or information coming from IT systems with affected ITGC’s were also deemed ineffective. This material weakness did not result in any material misstatement of our financial statements. While this material weakness did not result in a material misstatement of our financial statements, there was a reasonable possibility that it could have resulted in a material misstatement in the Company's annual or interim consolidated financial statements that would not be detected. Accordingly, we determined that it constituted a material weakness.

With respect to the material weakness described above, the Company, under the oversight of the Audit Committee, completed a risk assessment over our financial reporting processes, revised existing IT entity level policies, and completed the re-design and implementation of IT general controls. During the fiscal year ended December 31, 2025, we completed our testing of the operating effectiveness of internal controls impacted by these remediation efforts and determined the material weakness has been remediated as of December 31, 2025.

Changes in Internal Control Over Financial Reporting

Other than the material weakness remediation activities described above, there has been no change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the most recent fiscal year that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.