DOCUSIGN INC

Previous wording

Our products and solutions address a market that is evolving and highly competitive. We have customers in a wide variety of industries, including real estate, financial services, insurance, manufacturing, and healthcare and life sciences. We intend to continue to expand our sales efforts internationally, where many countries may have less familiarity with and acceptance of e-signature products. It is difficult to predict customer demand for our products and solutions, customer retention and expansion rates, the size and growth rate of the market for agreement automation, the entry of competitive products or the success of existing competitive products. We expect that we will continue to need intensive sales efforts to educate prospective customers, particularly enterprise and commercial customers and international customers, about the uses and benefits of our products and solutions. Additionally, we face competition from different companies depending on the product or solution. For example, our primary global e-signature competitor is currently Adobe Sign. We also face competition from a select number of vendors that focus on specific industries, geographies or product areas such as contract lifecycle management and advanced contract analytics. As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to the solutions that their organizations have used in the past.

Current wording

Our products and solutions address a market that is evolving and highly competitive. We have customers in a wide variety of industries, including real estate, financial services, insurance, manufacturing, and healthcare and life sciences. We intend to continue to expand our sales efforts internationally, where many countries may have less familiarity with and acceptance of e-signature products. It is difficult to predict customer demand for our products and solutions, customer retention and expansion rates, the size and growth rate of the market for agreement automation, the entry of competitive products or the success of existing competitive products. We expect that we will continue to need intensive sales efforts to educate prospective customers, particularly enterprise and commercial customers and international customers, about the uses and benefits of our products and solutions. Additionally, we face competition from different companies depending on the product or solution. For example, our primary global e-signature competitor is currently Adobe Sign. We also face competition from a select number of vendors that focus on specific industries, geographies or product areas such as contract lifecycle management and advanced contract analytics. As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to other solutions available to their organizations.

Previous wording

While we have security measures in place designed to protect our production and development environment and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we have faced security incidents in the past that did not have a material impact on our operations. In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies, when appropriate. These efforts may not completely eliminate potential risks from such incidents. Furthermore, there can be no assurance that there will be no impact to our operations from these or similar incidents in the future. Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers, damage to our reputation and could impair our sales and harm our business.

Current wording

While we have security measures in place designed to protect our production and development environment and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we are a frequent target of cyberattacks and have faced security incidents in the past that did not have a material impact on our operations. In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies, when appropriate. While we have taken steps to address cyber incidents, these efforts may not be successful, and there can be no assurance that there will be no impact to our operations from these or similar incidents in the future. Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers, damage to our reputation and could impair our sales and harm our business.

Previous wording

Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using a wide variety of tactics. The frequency and sophistication of such threats continues to increase and often becomes further heightened in connection with geopolitical tensions. In addition, we face increased risk to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers. Advances in technology and the increasing sophistication of attackers have led to more frequent and effective cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments and identity theft. If bad actors gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom.

Current wording

Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using widely varying and frequently changing tactics, including phishing and fraud campaigns targeting our personnel via email, text, instant messaging and voice calls. The frequency and sophistication of such threats continues to increase and often becomes further heightened in connection with geopolitical tensions. In addition, we face increased risk to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers. Advances in technology and the increasing sophistication of attackers have led to more frequent and effective cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or phishing tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments and identity theft. If “bad actors” gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom. Additionally, “bad actors” have misused our platform and/or our brand name to attempt to deceive or defraud others, and may continue to do so. If our efforts to prevent these activities, or limit their impact, are unsuccessful, our reputation and brand could be harmed, we could lose customers, and our business and financial condition could be adversely affected.

Previous wording

For example, in fiscal 2023, we launched a new enterprise resource planning (“ERP”) system, which is designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team. ERP system implementations are complex projects that require significant investment of capital and human resources, the reengineering of many business processes and the attention of many employees who would otherwise be focused on other aspects of our business. Our failure to improve our systems and processes or their failure to operate in the intended manner, could harm our business, financial condition, and operating results. Additionally, if the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be adversely affected.

Current wording

For example, in fiscal 2023, we launched an enterprise resource planning (“ERP”) system, which is designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team. If certain existing information technology systems, like our ERP system, do not operate as intended, the effectiveness of our internal control over financial reporting could also be adversely affected.

Previous wording

▪the time and costs related to litigation, including securities litigation and litigation and claims involving our former CEO;

Current wording

▪the time and costs related to litigation, including securities litigation;

Previous wording

You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. Future growth rates are also subject to a number of assumptions and uncertainties, including the effectiveness of our sales and growth strategy and general macro-economic conditions. For example, it has been, and may continue to be, difficult for us to forecast our operating results due to recent macro-economic events, including interest rate hikes and rising rates of inflation and concerns about a potential economic downturn. Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated revenue that we do not receive as a result of delays arising from these factors. If we do not address these risks successfully, our operating results could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

Current wording

You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. Future growth rates are also subject to a number of assumptions and uncertainties, including the effectiveness of our sales and growth strategy and general macro-economic conditions. For example, it has been, and may continue to be, difficult for us to forecast our operating results due to recent macro-economic events, including interest rate volatility and inflation and concerns about a potential economic downturn. Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated revenue that we do not receive as a result of delays arising from these factors. If we do not address these risks successfully, our operating results could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

Previous wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally. In each of the years ended January 31, 2024, 2023 and 2022 total revenue generated from customers outside the U.S. was 26%, 25% and 23% of our total revenue. As of July 31, 2024, we have offices in 12 countries and approximately 35% of our full-time employees were located outside of the U.S. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. We expect that our international activities will continue to grow as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources.

Current wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally. In each of the years ended January 31, 2024, 2023 and 2022 total revenue generated from customers outside the U.S. was 26%, 25% and 23% of our total revenue. As of October 31, 2024, we have offices in 12 countries and approximately 36% of our full-time employees were located outside of the U.S. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. We expect that our international activities will continue to grow as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources.

Previous wording

Internationally, many countries have established their own data privacy and security legal framework with which we, our customers and partners may need to comply. For example, in Europe, the General Data Protection Regulation (the “GDPR”) has been enacted as national legislation for respective member states and contains robust obligations on data controllers and processors and fulsome documentation requirements for data protection compliance programs by companies. As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the GDPR, UK GDPR, the UK Data Protection Act 2018, and other similar regional European data protection regulations, all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner. We are also certified as a Privacy Rights Processor under the Asia-Pacific Economic Cooperation. A breach of the GDPR, UK GDPR or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit). Such penalties, which may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects. We may also face civil claims including representative actions and other class action-type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

Current wording

“GDPR”) has been enacted as national legislation for respective member states and contains robust obligations on data controllers and processors and fulsome documentation requirements for data protection compliance programs by companies. As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the GDPR, UK GDPR, the UK Data Protection Act 2018, and other similar regional European data protection regulations, all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner. We are also certified as a Privacy Rights Processor under the Asia-Pacific Economic Cooperation. A breach of the GDPR, UK GDPR or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit). Such penalties, which may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects. We may also face civil claims including representative actions and other class action-type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

Previous wording

Existing laws and regulations may be interpreted, or new laws and regulations regarding AI may be adopted and interpreted, in ways which could negatively affect the way we use AI in our products. For example, the European Parliament, the European Commission and Council reached a political agreement on December 8, 2023, regarding the EU Artificial Intelligence Act that, once finalized and entered into force, would prohibit certain AI applications and systems with unacceptable risk and impose additional requirements on the use of other high-risk or limited-risk AI applications or systems. Intellectual property ownership issues, licensing and privacy rights surrounding AI technologies are evolving and have not been fully addressed by U.S. federal or state courts or foreign jurisdictions, which may expose us to claims of intellectual property infringement or misappropriation or privacy rights violations, or result in inquiries by government bodies or agencies. For example, the U.S. Federal Trade Commission initiated multiple AI-related inquiries in 2023 and 2024 and sent requests to technology companies, including Docusign, seeking additional information about their AI usage and policies. The rapid evolution of AI technologies will require significant resources in research and development in order to develop, test and maintain our platform and products to minimize any potential harmful impact on our business, financial condition, and results of operations.

Current wording

Existing laws and regulations may be interpreted, or new laws and regulations regarding AI may be adopted and interpreted, in ways which could negatively affect the way we use AI in our products. For example, the EU Artificial Intelligence Act, which was officially published on July 12, 2024 and came into effect on August 1, 2024, prohibits certain AI applications and systems with unacceptable risk and imposes additional requirements on the use of other high-risk or limited-risk AI applications or systems, which may require the implementation of additional quality assurance controls and measures to be reviewed and approved by regulatory submissions of our products. Intellectual property ownership issues, licensing and privacy rights surrounding AI technologies are evolving and have not been fully addressed by U.S. federal or state courts or foreign jurisdictions, which may expose us to claims of intellectual property infringement or misappropriation or privacy rights violations, or result in inquiries by government bodies or agencies. For example, the U.S. Federal Trade Commission initiated multiple AI-related inquiries in 2023 and 2024 and sent requests to technology companies, including Docusign, seeking additional information about their AI usage and policies. The rapid evolution of AI technologies will require significant resources in research and development in order to develop, test and maintain our platform and products to minimize any potential harmful impact on our business, financial condition, and results of operations.

Previous wording

These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally, subject to certain exceptions, prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder. Any delay or prevention of a change of control transaction or changes in our management could cause the market price of our common stock to decline.

Current wording

are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally, subject to certain exceptions, prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder. Any delay or prevention of a change of control transaction or changes in our management could cause the market price of our common stock to decline.