VEEVA SYSTEMS INC

Previous wording

•Our plans to migrate our customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Current wording

•The migration of our customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Previous wording

•Nearly all of our revenues are generated by sales to customers in the life sciences industry, and factors that adversely affect this industry could also adversely affect us.

Current wording

•Nearly all of our revenues are generated by sales to customers in the life sciences industry, and factors that adversely affect this industry(including regulatory, funding, or policy changes) could also adversely affect us.

Previous wording

•Unique and uncertain macroeconomic and geopolitical factors, including as a result of worldwide inflationary pressures and changes in interest rates, volatility in the financial sector, concerns about a possible domestic or global recession, currency exchange fluctuations, the Russian invasion of Ukraine, and the Israel-Hamas conflict may cause instability and volatility in the global financial markets, and disruptions within the life sciences industry that may negatively impact our business, our financial results, and our stock price.

Current wording

•Uncertain macroeconomic and geopolitical factors, including as a result of worldwide inflationary pressures and changes in interest rates, currency exchange fluctuations, changes in trade policies and practices (including the imposition of tariffs) or other economic policies, geopolitical conflicts (like the Russian invasion of Ukraine and the regional conflict in the Middle East), and concerns about a possible domestic or global recession, may cause instability in the global economy, and disruptions within the life sciences industry that may negatively impact our business, our financial results, and our stock price.

Previous wording

•We rely on third-party providers for computing infrastructure, secure network connectivity, and other technology-related services needed to deliver our cloud solutions, and any disruption in the services provided by them could adversely affect our business and subject us to liability.

Current wording

•We rely on third-party providers for computing infrastructure, secure network connectivity, and other technology-related services needed to deliver our cloud solutions, and any slowdown, failure, or disruption in the services provided by them could adversely affect our business and subject us to liability.

Previous wording

•Changing laws and regulations, including increasingly complex data privacy and information security regulations, in the U.S. and internationally, life sciences industry regulations, and trade policies, may impose additional costs for compliance, reduce demand for our solutions, and subject us to significant liabilities.

Current wording

•Changing laws, regulations, and enforcement priorities, including increasingly complex U.S. and international data privacy and information security regulations and measures specific to the life sciences industry, may impose additional costs for compliance, reduce demand for our solutions, and subject us to significant liabilities.

Previous wording

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyber-attacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate access to or use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyber-attack and other sources of security breaches and incidents may be elevated as a result of Russia’s invasion of Ukraine, the Israel-Hamas conflict, or other geopolitical tensions or conflicts, due to an increase in cyber-attack attempts on us, our customers, our partners, or our technology infrastructure providers.

Current wording

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate access to or use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyberattacks and other sources of security breaches and incidents may be elevated as a result of Russia’s invasion of Ukraine, the regional conflict in the Middle East, or other geopolitical tensions or conflicts, due to an increase in cyberattack attempts on us, our customers, our partners, or our technology infrastructure providers.

Previous wording

While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently and are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target. Moreover, our efforts to detect, prevent, and remediate known or unknown security vulnerabilities, including those arising from third-party hardware or software in our supply chain, may be insufficient to prevent security breaches or incidents resulting from such vulnerabilities, and may result in additional direct or indirect costs and liabilities and time of management and technical personnel. We may be required to expend significant capital and financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches or incidents. Additionally, we and our service providers may face difficulties or delays in identifying, remediating, and otherwise responding to any cybersecurity attack or other security breach or incident.

Current wording

While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently and are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target. For instance, as artificial intelligence (AI) technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, coordinated, and difficult to defend against. Moreover, our efforts to detect, prevent, and remediate known or unknown security vulnerabilities, including those arising from third-party hardware or software in our supply chain, may be insufficient to prevent security breaches or incidents resulting from such vulnerabilities, and may result in additional direct or indirect costs and liabilities and time of management and technical personnel. We may be required to expend significant capital and financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches or incidents. Additionally, we and our service providers may face difficulties or delays in identifying, remediating, and otherwise responding to any cybersecurity attack or other security breach or incident.

Previous wording

Any or all of these circumstances or issues, or the perception that any of them have occurred or are present (including any actual or perceived cyberattacks or other security breaches or incidents), could adversely affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions, result in reputational damage and harm to our market position, or subject us to third-party claims, demands, and lawsuits, regulatory investigations, proceedings, fines, and penalties, mandatory notifications and disclosures, or other action or liability, which could adversely affect our operating results and financial condition. Our insurance may not be adequate to cover losses associated with such events, and such insurance may not cover all of the types of costs, expenses, and losses we could incur to respond to and remediate a security breach or incident.

Current wording

Any or all of these circumstances or issues, or the perception that any of them have occurred or are present (including any actual or perceived cyberattacks or other security breaches or incidents), could adversely affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions, result in reputational damage and harm to our market position, or subject us to third-party claims, demands, and lawsuits, regulatory investigations, proceedings, fines, and penalties, mandatory notifications and disclosures, or other action or liability, which could adversely affect our operating results and financial condition. Our insurance may not be adequate to cover losses associated with such events, and such insurance may not cover all of the types of costs, expenses, and losses we could incur to respond to and remediate a security breach or incident.

Previous wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. The principal such competitor for our Veeva Commercial Cloud applications is IQVIA Holdings Inc., which offers a CRM application built on the Salesforce platform, various data products, and other applications that compete with our products. Salesforce, Inc. has also announced their intention to offer a life science industry-specific CRM solution, which will compete with our offerings. Our Veeva Data Cloud products. as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud applications. Our Veeva Commercial Cloud and Veeva Development Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Inc., Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Current wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. Our CRM solutions primarily compete with Salesforce, Inc., which is developing a life sciences industry-specific CRM application and has entered into a partnership with IQVIA Holdings, which also offers various data products and other applications that compete with our products. Our Veeva Data Cloud products as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud or Veeva Quality Cloud applications. Our Veeva Commercial Cloud, Veeva Development Cloud, and Veeva Quality Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Inc., Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Previous wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business recognition, larger intellectual property portfolios, and agreements with a broader set of system integrators and other partners. We also continue to be subject to litigation from our competitors. For example, as disclosed elsewhere in this report, we are in active litigation with IQVIA. In addition, our competitors may offer price concessions, delayed payment terms, or other more favorable terms and conditions in light of the recent macroeconomic environment.

Current wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business recognition, larger intellectual property portfolios, and agreements with a broader set of system integrators and other partners. In addition, our competitors have offered price concessions, delayed payment terms, or other more favorable terms and conditions in light of the recent macroeconomic environment.

Previous wording

If our competitors’ products, services, or technologies become more accepted than our solutions, if they are successful in bringing their products or services to market earlier than we are, if their products or services are more technologically capable than ours (including as a result of new or better use of evolving artificial intelligence (AI) technologies), or if customers replace our solutions with custom-built software, then our revenues could be adversely affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business. For all of these reasons, we may not be able to compete favorably against our current and future competitors.

Current wording

If our competitors’ products, services, or technologies become more accepted than our solutions, if they are successful in bringing their products or services to market earlier than we are, if their products or services are more technologically capable than ours (including as a result of new or better use of evolving AI technologies), or if customers replace our solutions with custom-built software, then our revenues could be adversely affected. Moreover, if we enter new markets, we will likely face competition and will need to adapt to competitive factors that may be different from those we face today. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business. For all of these reasons, we may not be able to compete favorably against our current and future competitors.

Previous wording

Our continued growth and profitability will depend on our ability to successfully develop and sell new solutions. It is uncertain whether these newer solutions will continue to grow as a percentage of revenues at a pace significant enough to support our expected overall growth. For example, we have limited experience selling certain of our data and analytics offerings and certain of our solutions that enable remote patient interactions for clinical trials. Also, as discussed in more detail below, we intend to migrate our Veeva CRM customers to Vault CRM. We cannot be certain that we will be successful with respect to newer solutions and markets. It may take us significant time, and we may incur significant expense, to effectively market and sell these solutions, develop other new solutions, or make enhancements to our existing solutions. If our newer solutions do not continue to gain traction in the market, or other solutions that we may develop and introduce in the future do not achieve market acceptance in a timely manner, the growth rate of our revenues and operating results will be adversely affected.

Current wording

Our continued growth and profitability will depend on our ability to successfully develop and sell new solutions. It is uncertain whether these newer solutions will continue to grow as a percentage of revenues at a pace significant enough to support our expected overall growth. For example, as discussed in more detail below, we have begun to migrate our Veeva CRM customers to Vault CRM. We cannot be certain that we will be successful with respect to newer solutions and markets. It may take us significant time, and we may incur significant expense, to effectively market and sell these solutions, develop other new solutions, or make enhancements to our existing solutions. If our newer solutions do not continue to gain traction in the market, or other solutions that we may develop and introduce in the future do not achieve market acceptance in a timely manner, the growth rate of our revenues and operating results will be adversely affected.

Previous wording

In our fiscal years ended January 31, 2024, 2023, and 2022, our top 10 customers accounted for 28%, 29%, and 31% of our total revenues, respectively. We rely on our reputation and recommendations from key customers in order to promote our solutions to potential customers, which we call “reference selling.” The loss of any of our key customers, or a failure of one or more of them to renew or expand user subscriptions for some or all our products, could have a significant impact on the growth rate of our revenues, our reputation, and our ability to obtain new customers. In the event of an acquisition of one of our customers or a business combination between two of our customers, we have in the past and may in the future suffer reductions in user subscriptions or non-renewal of certain or all of their subscription orders. We are also likely to face increasing purchasing scrutiny at the renewal of large customer subscription orders, which may result in reductions in user subscriptions or increased pricing pressure. The business impact of any of these negative events could be particularly pronounced with respect to our largest customers.

Current wording

In our fiscal years ended January 31, 2025, 2024, and 2023, our top 10 customers accounted for 28%, 28%, and 29% of our total revenues, respectively. We rely on our reputation and recommendations from key customers in order to promote our solutions to potential customers, which we call “reference selling.” The loss of any of our key customers, or a failure of one or more of them to renew or expand user subscriptions for some or all our products, could have a significant impact on the growth rate of our revenues, our reputation, and our ability to obtain new customers. In the event of an acquisition of one of our customers or a business combination between two of our customers, we have in the past and may in the future suffer reductions in user subscriptions or nonrenewal of certain or all of their subscription orders. We are also likely to face increasing purchasing scrutiny at the renewal of large customer subscription orders, which may result in reductions in user subscriptions or increased pricing pressure. The business impact of any of these negative events could be particularly pronounced with respect to our largest customers.

Previous wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems. These types of problems may be caused by a variety of factors, including human or software errors, viruses, cyber-attacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Current wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems. These types of problems may be caused by a variety of factors, including human or software errors, viruses, cyberattacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Previous wording

Since our customers use our solutions for important aspects of their businesses, any errors, defects, disruptions, service degradations, or other performance problems with our solutions, could hurt our reputation and may damage our customers’ businesses. If that occurs, our customers may delay or withhold payment to us, cancel their agreements with us, elect not to renew, or make service credit claims, warranty claims, or other claims against us, and we could lose future sales. The occurrence of any of these events could result in diminishing demand for our solutions, a reduction of our revenues, an increase in our bad debt expense or in collection cycles for accounts receivable, or could require us to incur the expense of litigation or substantial liability.

Current wording

Since our customers use our solutions for important aspects of their businesses, any errors, defects, disruptions, service degradations, or other performance problems with our solutions, could hurt our reputation and may damage our customers’ businesses. Such issues have in the past, and may in the future, result in increased operational costs, delays in delivering new products, our customers delaying or withholding payment to us, cancelling their agreements with us, electing not to renew, or making service credit claims, warranty claims, or other claims against us, and loss of future sales. The occurrence of any of these events could result in diminishing demand for our solutions, a reduction of our revenues, an increase in our bad debt expense or in collection cycles for accounts receivable, or could require us to incur the expense of litigation or substantial liability.

Previous wording

Our plans to migrate our CRM customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Current wording

The migration of our CRM customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Previous wording

We currently depend on the Salesforce platform to deliver our multichannel CRM applications, but in December 2022 we announced plans to migrate our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. We also announced that we do not intend to renew our agreement with Salesforce, Inc. for use of the Salesforce platform. Vault CRM is currently used by early adopters and we intend to make Vault CRM generally available to all customers in April 2024. Veeva CRM will be supported until September 1, 2030. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful or that the Veeva Vault platform will be ready for migration on our intended timeline or the timeline necessary to support our customers. Further, some existing customers may decide not to migrate to Vault CRM and may decide to use a different CRM solution. Additionally, Vault CRM may encounter difficulties supporting the increased volume of users migrating from Veeva CRM, leading to outages or other performance problems. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, that could subject us to liability or harm our reputation. If we are unsuccessful migrating our Veeva CRM customers to Vault CRM, encounter disruptions or other problems in the migration process, or our customers do not migrate to the Vault CRM in a timely manner, or at all, our business, operating results, and brand could be materially and adversely affected.

Current wording

We currently depend on the Salesforce platform to deliver our Veeva CRM application, but we have begun to migrate our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. We do not intend to renew our agreement with Salesforce, Inc. for use of the Salesforce platform. Veeva CRM will be supported until September 1, 2030. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Further, certain customers have decided, and other customers may in the future decide, not to migrate to Vault CRM and use a different CRM solution, including a CRM solution provided by Salesforce. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, that could subject us to liability or harm our reputation. If we are unsuccessful migrating our Veeva CRM customers to Vault CRM, encounter disruptions or other problems in the migration process, or our customers do not migrate to the Vault CRM in a timely manner, or at all, our business, operating results, and brand could be materially and adversely affected.

Previous wording

The risks we face in doing business internationally that could adversely affect our business include:

Current wording

The risks we face in doing business internationally that have in the past adversely affected, and could in the future adversely affect, our business include:

Previous wording

•difficulties in repatriating funds without adverse tax consequences or restrictions on the transfer of funds more generally, including as a result of sanctions arising from the Russian invasion of Ukraine, which may limit our ability to receive payment from Russian banks;

Current wording

•difficulties in repatriating funds without adverse tax consequences or restrictions on the transfer of funds more generally, including as a result of sanctions, including those arising from the Russian invasion of Ukraine, which may limit our ability to receive payment from Russian banks;

Previous wording

•changes in diplomatic relations and trade policy, including the status of relations between the United States and other countries, including China and Russia, and the implementation of or changes to trade sanctions, tariffs, and embargoes, including if the United States and other countries were to impose more significant general sanctions against Russia in response to the continuing conflict in Ukraine, which could ban the use of our products by companies or users in Russia;

Current wording

•changes in diplomatic relations and trade policy, including the status of relations between the United States and other countries, including China and Russia, and the implementation of or changes to export controls, trade sanctions, tariffs, and embargoes, including if the United States and other countries were to impose more significant general sanctions against Russia in response to the continuing conflict in Ukraine, which could ban the use of our products by companies or users in Russia;

Previous wording

•unstable regional and economic political conditions or armed conflicts in the markets in which we operate, including as a result of the Russian invasion of Ukraine and the Israel-Hamas conflict.

Current wording

•unstable regional and economic political conditions or armed conflicts in the markets in which we operate, including as a result of the Russian invasion of Ukraine and the regional conflict in the Middle East.

Previous wording

We do not currently have locations or employees in Russia and our revenues from sales to Russian entities is limited. However, certain customers have reduced their number of users of our products in Ukraine. Additionally, the European Union recently adopted new sanctions against Russia prohibiting the sale and supply of enterprise software to entities and individuals in Russia. If customers further curtail or discontinue their operations in Ukraine or Russia, or if we are not able to supply or service users in Russia due to existing or new sanctions, we may lose sales and our results of operations could be negatively impacted.

Current wording

We do not currently have locations or employees in Russia and our revenues from sales to Russian entities is limited. However, certain customers have reduced their number of users of our products in Ukraine. Additionally, the European Union adopted sanctions against Russia prohibiting the sale and supply of enterprise software to entities and individuals in Russia. If customers further curtail or discontinue their operations in Ukraine or Russia, or if we are not able to supply or service users in Russia due to existing or new sanctions, we may lose sales and our results of operations could be negatively impacted.

Previous wording

Many of the companies with which we compete for experienced employees have greater resources than we have and may offer compensation packages that are perceived to be better than ours. For example, we offer equity awards to a substantial majority of our job candidates and existing employees as part of their overall compensation package. If the perceived value of our equity awards declines, including as a result of prolonged declines in the market price of our common stock or changes in perception about our future prospects, it may adversely affect our ability to recruit and retain highly skilled employees. Additionally, changes in our compensation structure may be negatively received by employees and result in attrition or cause difficulty in the recruiting process. If we fail to attract new employees or fail to retain and motivate our current employees, our business and future growth prospects could be adversely affected.

Current wording

Many of the companies with which we compete for experienced employees have greater resources than we have and may offer compensation packages and benefits that are perceived to be better than ours. For example, we offer equity awards to a substantial majority of our job candidates and existing employees as part of their overall compensation package. If the perceived value of our equity awards declines, including as a result of prolonged declines in the market price of our common stock or changes in perception about our future prospects, it may adversely affect our ability to recruit and retain highly skilled employees. Additionally, changes in our compensation structure may be negatively received by employees and result in attrition or cause difficulty in the recruiting process. If we fail to attract new employees or fail to retain and motivate our current employees, our business and future growth prospects could be adversely affected.

Previous wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyber-attack, armed conflicts (including the Russian invasion of Ukraine and the Israel-Hamas conflict), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches of data security, loss of key employees, and loss of critical data, all of which could have an adverse effect on our future operating results.

Current wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the Russian invasion of Ukraine and the regional conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches of data security, loss of key employees, and loss of critical data, all of which could have an adverse effect on our future operating results.

Previous wording

We may acquire other companies or technologies, which could divert our management’s attention, result in additional dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

Current wording

Acquisitions could divert our management’s attention, result in additional dilution to our stockholders, and otherwise disrupt our operations.

Previous wording

•Changes in the funding environment and bankruptcies in the life sciences industry—Our business depends on the overall economic health of our existing and prospective customers. The purchase of our solutions may involve a significant commitment of capital and other resources. Since 2022, there has been a reduction in funding for early-stage life sciences companies, which has resulted in reduced sales and adversely affected our financial results and may continue for the foreseeable future. Moreover, life sciences companies, and in particular early-stage companies with pre-commercial treatments in clinical trials, may ultimately be unsuccessful and may subsequently declare bankruptcy. If our customers declare bankruptcy or otherwise dissolve, they may terminate their agreements with us or we may not be able to recoup the full payment of fees owed to us. Certain of our customers or potential customers may also be negatively impacted by high interest rates and recent volatility in the financial sector and may find access to debt and other financing more difficult as a result.

Current wording

•Changes in the funding environment and bankruptcies in the life sciences industry—Our business depends on the overall economic health of our existing and prospective customers. The purchase of our solutions may involve a significant commitment of capital and other resources. A reduction in private funding or the ability to secure funding in public markets for early-stage life sciences companies has resulted in the past, and may result in the future, in reduced sales and adverse effects to our financial results. Moreover, life sciences companies, and in particular early-stage companies with pre-commercial treatments in clinical trials, may ultimately be unsuccessful and may subsequently declare bankruptcy. If our customers declare bankruptcy or otherwise dissolve, they may terminate their agreements with us or we may not be able to recoup the full payment of fees owed to us. Certain of our customers or potential customers may also be negatively impacted by high interest rates and may find access to debt and other financing more difficult as a result.

Previous wording

•Changes in market conditions and practices within the life sciences industry—The expiration of key patents, the implications of precision medicine treatments, changes in the practices of prescribing physicians and patients, changes with respect to payer relationships, the policies and preferences of healthcare professionals and healthcare organizations with respect to the sales and marketing efforts of life sciences companies, and changes in the regulation of the sales and marketing efforts and pricing practices of life sciences companies. Changes in public perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Current wording

•Changes in market conditions and practices within the life sciences industry—The expiration of key patents, the implications of precision medicine treatments, changes in the practices of prescribing physicians and patients, changes with respect to payer relationships, and the policies and preferences of healthcare professionals and healthcare organizations with respect to the sales and marketing efforts of life sciences companies could negatively impact demand for our solutions. Changes in public perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Previous wording

•Changes in geopolitical conditions that impact the life sciences industry, changes in the ability to sell healthcare treatments in certain locations, and the global availability of healthcare treatments provided by the life sciences companies to which we sell—If economic or geopolitical conditions deteriorates, or the ability to market life sciences products or conduct clinical trials in key markets is disrupted, including as a result of the Russian invasion of Ukraine, the Israel-Hamas conflict or resulting sanctions, or if the demand for life sciences products globally deteriorates for other reasons, our customers may delay or reduce their IT spending, particularly within the regions impacted by negative economic or geopolitical conditions. For example, a number of significant life sciences companies have scaled back sales, operations, and investments in Russia, including curtailing sales and marketing and clinical trial activity in Russia.

Current wording

•Changes in geopolitical conditions that impact the life sciences industry, changes in the ability to sell healthcare treatments in certain locations, and the global availability of healthcare treatments provided by the life sciences companies to which we sell—If economic or geopolitical conditions deteriorate, or the ability to market life sciences products or conduct clinical trials in key markets is disrupted, including as a result of the Russian invasion of Ukraine; the regional conflict in the Middle East; changes in export controls; sanctions, tariffs, or other international laws; or if the demand for life sciences products globally deteriorates for other reasons, our customers may delay or reduce their IT spending, particularly within the regions impacted by negative economic or geopolitical conditions. For example, a number of significant life sciences companies have scaled back sales, operations, and investments in Russia, including curtailing sales and marketing and clinical trial activity in Russia.

Previous wording

Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom’s General Data Protection Regulation (UK GDPR), we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on the EU Standard Contractual Clauses and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and may impose significant penalties for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Current wording

Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom’s General Data Protection Regulation (UK GDPR), we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and significant penalties may be imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Previous wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. Certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. As a result, we expect that over the next twelve months, such customers may be required to implement a CRM solution that does not require data to be transferred outside of China. While we offer a CRM solution, called China SFA, that does not require data to be transferred outside of China, certain of our Veeva CRM customers in China may choose to implement a competitor’s CRM solution and our CRM business in China may be negatively impacted. Currently, approximately 3% of our total revenue is attributable to China.

Current wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Previous wording

In the United States, the U.S. Department of Health and Human Services promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws.

Current wording

In the United States, the U.S. Department of Health and Human Services has promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws.

Previous wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information and create new privacy rights for individuals. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data and analytics products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, recently passed the My Health My Data Act, which became effective on March

Current wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect on April 8, 2025, and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to data to business partners located in China or with other specified links to China and other designated countries. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Previous wording

In addition to government regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results.

Current wording

In addition to governmental laws and regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results.

Previous wording

Customers expect that our solutions can be used in compliance with applicable data protection, data privacy and cybersecurity laws and regulations. Compliance with these global laws and regulations, including any new or evolving regulations relating to the use of data in AI and machine learning technologies, such as the proposed EU AI Act, has and will continue to require valuable management and employee time and resources and modification of our products or operations, and may also limit use and adoption of our products. Data protection authorities from around the world will from time to time review our products and services and their compliance with applicable laws and regulations. Any actual or perceived failure to comply with such laws and regulations or other actual or asserted obligations relating to privacy, data protection, or cybersecurity could lead to inspections, audits, regulatory investigations and other proceedings, significant fines, penalties, and other relief imposed by government agencies and regulatory bodies, and claims, demands, and litigation by our customers or third parties, which may reduce demand for our solutions and result in reputational harm, substantial damages and other liabilities.

Current wording

Customers expect that our solutions can be used in compliance with applicable data protection, data privacy and cybersecurity laws and regulations. Compliance with these global laws and regulations, including any new or evolving regulations relating to the use of data in AI and machine learning technologies, such as the EU AI Act, has and will continue to require valuable management and employee time and resources and modification of our products or operations, and may also limit use and adoption of our products. Data protection authorities from around the world will from time to time review our products and services and their compliance with applicable laws and regulations. Any actual or perceived failure to comply with such laws and regulations or other actual or asserted obligations relating to privacy, data protection, or cybersecurity could lead to inspections, audits, regulatory investigations and other proceedings, significant fines, penalties, and other relief imposed by government agencies and regulatory bodies, and claims, demands, and litigation by our customers or third parties, which may reduce demand for our solutions and result in reputational harm, substantial damages and other liabilities.

Previous wording

Our solutions are hosted from and use computing infrastructure provided by third parties. We utilize Amazon Web Services with respect to applications built on the Veeva Vault platform. Our Veeva CRM application (and certain of our multichannel CRM applications) are built on a platform provided by Salesforce, Inc. that utilizes hosting and computing infrastructure provided by Salesforce, Inc. However, as discussed in more detail above, we intend to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. We also utilize other computing infrastructure service providers to a lesser extent.

Current wording

Our solutions are hosted from and use computing infrastructure provided by third parties. We utilize Amazon Web Services with respect to applications built on the Veeva Vault platform. Our Veeva CRM application is built on a platform provided by Salesforce, Inc. that utilizes hosting and computing infrastructure provided by Salesforce, Inc. However, as discussed in more detail above, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. We also utilize other computing infrastructure service providers to a lesser extent.

Previous wording

Problems faced by our computing infrastructure service providers could adversely affect the experience of our customers. For example, Salesforce, Inc. and Amazon Web Services have experienced significant service outages in the past and may do so again in the future. Additionally, our failure to manage or react to an increase in customer demand could have an adverse effect on our business. A rapid expansion of our business or an increase in customer demand could affect our service levels or cause our systems to fail. Our agreements with third-party computing infrastructure service providers may not entitle us to corresponding service level credits to those we offer to our customers. Any changes in third-party service levels at our computing infrastructure service providers or any related disruptions or performance problems with our solutions could result in lengthy interruptions in our services, damage our customers’ stored files, or result in potential losses of customer data, any of which could adversely affect our reputation. Interruptions in our services might reduce our revenues, cause us to issue refunds to customers for prepaid and unused subscriptions, subject us to service level credit claims and potential liability, or adversely affect our renewal rates.

Current wording

Problems faced by our computing infrastructure service providers could adversely affect the experience of our customers. For example, Salesforce, Inc. and Amazon Web Services have experienced significant service outages in the past and may do so again in the future. Additionally, our failure to manage or react to an increase in customer demand could have an adverse effect on our business. A rapid expansion of our business or an increase in customer demand could affect our service levels or cause our systems to fail. Our agreements with third-party computing infrastructure service providers may not entitle us to corresponding service level credits to those we offer to our customers. Any changes in third-party service levels at our computing infrastructure service providers or any related disruptions, slowdowns, failures, or other performance problems with our solutions could result in lengthy interruptions in our services, damage our customers’ stored files, or result in potential losses of customer data, any of which could adversely affect our reputation. Interruptions in our services might reduce our revenues, cause us to issue refunds to customers for prepaid and unused subscriptions, subject us to service level credit claims and potential liability, or adversely affect our renewal rates.

Previous wording

We are currently dependent upon Salesforce, Inc’s. platform for our multichannel CRM applications, and we are bound by the restrictions of our agreement with Salesforce, Inc., which limits the markets to which we may sell our Veeva CRM solution.

Current wording

We are currently dependent upon Salesforce, Inc’s. platform for our Veeva CRM application.

Previous wording

Our Veeva CRM application, and certain portions of the multichannel CRM applications that complement our Veeva CRM application, utilize the Salesforce platform of Salesforce, Inc., and we are currently dependent upon the Salesforce platform to deliver our CRM application.

Current wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM.

Previous wording

However, on December 1, 2022, we announced our intent to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform, and we do not intend to renew our agreement with Salesforce, Inc. when the current term expires on September 1, 2025. Pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Current wording

However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform, and we do not intend to renew our agreement with Salesforce, Inc. when the current term expires on September 1, 2025. Pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Previous wording

On May 1, 2023, as allowed by the terms of our agreement, Salesforce Inc. terminated certain competition restrictions imposed by the agreement. Per the terms of the agreement, termination of those non-competition obligations by Salesforce, Inc. released us from our minimum order commitments in the future. Under the terms of our current agreement, Salesforce, Inc. is no longer prohibited from promoting third parties' products that are competitive to Veeva CRM, treating another third party as a "preferred" vendor of a CRM solution in the pharma and biotech market, or developing or promoting a product that competes with Veeva CRM.

Current wording

Salesforce, Inc. also has the right to terminate the agreement early in certain circumstances, including in the event of a material breach of the agreement by us, or if Salesforce, Inc. is subjected to third-party intellectual property infringement claims based on our solutions (except to the extent based on the Salesforce platform) or our trademarks and we do not remedy such infringement in accordance with the agreement. Also, if we are acquired by specified companies, Salesforce, Inc. may terminate the agreement upon notice of not less than 12 months. On May 1, 2023, as allowed by the terms of our agreement, Salesforce Inc. terminated certain competition restrictions imposed by the agreement. Per the terms of the agreement, termination of those non-competition obligations by Salesforce, Inc. released us from our minimum order commitments in the future. Under the terms of our current agreement, Salesforce, Inc. is no longer prohibited from promoting third-party products that are competitive to Veeva CRM, treating another third party as a "preferred" vendor of a CRM solution in the pharma and biotech market, or developing or promoting a product that competes with Veeva CRM. For example, Salesforce, Inc. is developing a life sciences industry-specific CRM application that will compete with our offerings and has entered into a partnership with IQVIA.