CS Disco Inc

Previous wording

Our actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation

Current wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we rely) actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation (including class claims), fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customer sales, or otherwise harm our business.

Previous wording

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information, client information, and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party data. As a result, we are, or may become, subject to numerous federal, state, local and foreign laws and regulations, guidance, industry standards and other obligations regarding privacy, data protection, information security and processing and protection of personal information and other content, the scope of which is changing, subject to differing interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our privacy policies and obligations to third parties (including contractual) related to privacy, data protection and information security. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy and data protection worldwide is unclear and evolving, and is likely to remain uncertain, for the foreseeable future. We expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. There is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to data privacy or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our product offerings. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Current wording

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information, client information, and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party data. As a result, we are, or may become, subject to numerous federal, state, local and foreign laws and regulations, guidance, industry standards and other obligations regarding privacy, data protection, information security and processing and protection of personal information and other content, the scope of which is changing, subject to differing interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our internal and externally facing privacy policies and obligations to third parties (including contractual) related to privacy, data protection and information security. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy and data protection worldwide is unclear and evolving rapidly, and is likely to remain uncertain, for the foreseeable future. We expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. There is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to data privacy or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our product offerings. We may face challenges in addressing these requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Previous wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR, permits data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. Furthermore, several jurisdictions have enacted measures related to the use of artificial intelligence and machine learning in products and services. For example, the proposed EU Artificial Intelligence Act (EUAIA) could impose onerous obligations related to the use of AI related systems if passed into law. Such regulations, and others that may be passed in other jurisdictions, may require us to change our business practices, or else be subject to regulatory action and/or fines.

Current wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR, permits data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Previous wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, absent appropriate safeguards, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States of America that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Current wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security, including data breach notification laws, personal information privacy laws, and consumer protection laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for data breaches that may increase data breach litigation. Twelve other states have also passed comprehensive privacy laws some of which go into effect in 2024 and the coming years. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties upon who we rely.

Current wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security laws, including data breach notification laws, personal information privacy laws, consumer protection laws and other similar laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents rights to access and require deletion of their personal information, opt out of certain personal information sharing and data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. The CCPA provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for data breaches that may increase data breach litigation. At least eighteen other states have also passed comprehensive privacy laws and similar laws are being considered in several other states, as well as at the federal and local levels. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties with whom we work.

Previous wording

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy, data protection and information security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or vendors do not comply with our published policies, certifications, and documentation. Any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties we rely upon, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Current wording

GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or third parties with whom we work do not comply with our published policies, certifications, and documentation. Regulators in the United States are increasingly scrutinizing these statements, and any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Previous wording

Any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of our customers’ data, or regarding the manner in which the express or implied consent of customers for the collection, use, retention or disclosure of such content is obtained, could increase our costs and require us to modify our product offerings, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process customer data or develop new applications and features. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.

Current wording

Any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of our customers’ data, or regarding the manner in which the express or implied consent of customers for the collection, use, retention or disclosure of such content is obtained, could increase our costs and require us to modify our product offerings, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process customer data or develop new applications and features. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf.

Previous wording

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal data for targeted advertising purposes. For example, in 2021, Apple began allowing users to more easily opt-out of activity tracking across devices. In February 2022, Google announced similar plans to adopt additional privacy controls on its Android devices to allow users to limit sharing of their data with third parties and reduce cross-device tracking for advertising purposes.

Current wording

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal information for targeted advertising purposes. For example, in 2021, Apple began allowing users to more easily opt-out of activity tracking across devices. In February 2022, Google announced similar plans to adopt additional privacy controls on its Android devices to allow users to limit sharing of their data with third parties and reduce cross-device tracking for advertising purposes.

Previous wording

Additionally, Google has announced that it intends to phase out third-party cookies in its Chrome browser, which could make it more difficult for us to target advertisements. Other browsers, such as Firefox and Safari, have already adopted similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control.

Current wording

Additionally, Google has announced that it intends to phase out third-party cookies in its Chrome browser, which could make it more difficult for us to target advertisements. Other browsers, such as Firefox and Safari, have already adopted similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal information for targeted advertising purposes as well as a company’s disclosure of personal information in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser opt-out signals from the Global Privacy Control.

Previous wording

Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal data to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes. As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Current wording

Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal information to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser opt-out signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes. As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Previous wording

If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences.

Current wording

If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties with whom we work, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences.

Previous wording

In the ordinary course of business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, processing) potentially highly sensitive and confidential electronic documentation for use by our law firm and non-law firm customers in various legal matters, including litigation and governmental investigations and as a result. we and the third parties upon which we rely face a variety of evolving threats. Due to the nature of our services, and the legal and regulatory context in which our services are utilized by customers, our ability to protect the confidentiality, availability and integrity of our customers’ information is critical to our ability to attract and retain customers, generate revenue and the overall success of our business, and our failure or perceived failure to maintain adequate protections could materially affect our business.

Current wording

In the ordinary course of business, we and the third parties with whom we work, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, process) potentially highly sensitive and confidential electronic documentation for use by our law firm and non-law firm customers in various legal matters, including litigation and governmental investigations and, as a result, we and the third parties with whom we work face a variety of evolving threats. Due to the nature of our services, and the legal and regulatory context in which our services are utilized by customers, our ability to protect the confidentiality, availability and integrity of our customers’ information is critical to our ability to attract and retain customers, generate revenue and the overall success of our business, and our failure or perceived failure to maintain adequate protections could materially affect our business.

Previous wording

Our information technology systems and those of third parties upon whom we rely are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware, denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations.

Current wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and other devices outs…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of these threats and issues may lead to a security incident and significant adverse consequences, including compromise of our system infrastructure or the loss, destruction, alteration, denial of access to, disclosure or dissemination of, or damage or unauthorized access to, our information technology systems, data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal information) or data that is processed or maintained on our behalf, or other assets.

Current wording

Any of these threats and issues could lead to a security incident and significant adverse consequences, including compromise of our system infrastructure or the loss, destruction, alteration, denial of access to, disclosure or dissemination of, or damage or unauthorized access to, our information technology systems, data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal information) or data that is processed or maintained on our behalf, or other assets. For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future.

Previous wording

We rely on third-party service providers and technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Current wording

We rely on third-parties and third-party technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We work with third-parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third-parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third-party with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Previous wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data.

Current wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures to protect our information technology systems and sensitive data.

Previous wording

We take steps designed to detect, mitigate and remediate security vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect and remediate them all on a timely basis. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities, bugs, errors and vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident. These vulnerabilities, bugs, errors or defects alone, or a combination of them, could pose material risks to our business. Further, the cost to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of customer trust, diminished use of our product offerings as well as other harms to our business and our competitive position. These adverse consequences could force us to spend money, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation.

Current wording

We take steps designed to detect, mitigate and remediate security vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate them all on a timely basis. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities, bugs, and errors. Even if we have issued or otherwise made patches or information for vulnerabilities available in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident. These vulnerabilities, bugs, errors or defects alone, or a combination of them, could pose material risks to our business. Further, the cost to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of customer trust, diminished use of our product offerings as well as other harms to our business and our competitive position. These adverse consequences could force us to spend money, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation.

Previous wording

If we, or a third party upon whom we rely, experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrict our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches.

Current wording

If we, or the third parties with whom we work, experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrict our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and material attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches. We cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Previous wording

Notifications and follow-up actions related to a security incident could impact our reputation, result in a loss of customers and prospects, and cause us to incur significant costs, including legal expenses and remediation costs. We may have contractual and legal obligations under applicable data privacy and security laws to notify relevant stakeholders of security breaches. Such disclosures are costly, could lead to negative publicity, may cause our customers or prospective customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach.

Current wording

Notifications and follow-up actions related to a security incident could impact our reputation, result in a loss of customers and prospects, and cause us to incur significant costs, including legal expenses and remediation costs. We may have contractual and legal obligations under applicable data privacy and security laws to notify relevant stakeholders of security breaches, or we may voluntarily choose to notify relevant stakeholders including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identify theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences including negative publicity, which may cause our customers or prospective customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach.

Previous wording

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive data about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal information) that we input into a third-party generative AI / machine learning, or ML, platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal information and makes inferences using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Previous wording

Our employees and personnel use generative artificial intelligence (AI) technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We use AI and machine learning (ML), to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous wording

We use AI, including generative AI, and ML technologies in our products and services (collectively, AI/ML technologies). The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

The development and use of AI/ML presents various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. For example, our revenue was $138.1 million and $135.2 million for the years ended December 31, 2023 and 2022, respectively. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues increased from 2022 to 2023, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Current wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. For example, our revenue was $144.8 million and $138.1 million for the years ended December 31, 2024 and 2023, respectively. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Previous wording

•recruit, hire, train and manage additional qualified developers, professionals and sales and marketing personnel; and

Current wording

•recruit, hire, train, manage, and retain sufficient qualified developers, professionals and sales and marketing personnel; and

Previous wording

•sales and marketing, including the future expansion of our sales organization to engage existing and prospective customers, increase brand awareness and drive adoption of our product offerings;

Current wording

•sales and marketing, including any future expansion of our sales organization to engage existing and prospective customers, increase brand awareness and drive adoption of our product offerings;

Previous wording

Our limited operating history and our history of operating losses makes it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

Current wording

Our limited operating history at our current scale and our history of operating losses make it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

Previous wording

We launched our business in 2013 and have experienced net losses in each fiscal year since inception. We incurred net losses of $42.2 million and $70.8 million for the years ended December 31, 2023 and 2022, respectively. As of December 31, 2023, we had an accumulated deficit of $240.4 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable. Even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant costs to support further growth and development of our product offerings, including expanding the functionality of our platform, technology infrastructure and business systems, expanding our partner ecosystem, increasing our marketing activities and growing our international operations. We will also face increased compliance costs associated with growth and expansion of our customer base. These increased expenditures will make it harder for us to achieve or sustain profitability. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our common stock could decline and our business may be harmed.

Current wording

We launched our business in 2013 and have experienced net losses in each fiscal year since inception. We incurred net losses of $55.8 million and $42.2 million for the years ended December 31, 2024 and 2023, respectively. As of December 31, 2024, we had an accumulated deficit of $297.4 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable. Even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant costs to support further growth and development of our product offerings, including expanding the functionality of our platform, technology infrastructure and business systems, expanding our partner ecosystem, increasing our marketing activities and growing our international operations. We will also face increased compliance costs associated with the growth and expansion of our customer base. These increased expenditures will make it harder for us to achieve or sustain profitability. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our common stock could decline and our business may be harmed.

Previous wording

We have limited historical financial data and operate in a rapidly evolving and cyclical market that is prone to significant periodic fluctuations. As a result, it is difficult to evaluate our current business and our future prospects, including our ability to plan for and model future growth, and any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable market. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in constantly evolving industries, including the risks described herein. If we do not address these risks successfully, our business may be harmed.

Current wording

We have limited historical financial data at our current scale and operate in a rapidly evolving and cyclical market that is prone to significant periodic fluctuations. As a result, it is difficult to evaluate our current business and our future prospects, including our ability to plan for and model future growth, and any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable market. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in constantly evolving industries, including the risks described herein. If we do not address these risks successfully, our business may be harmed.

Previous wording

We have funded our operations since inception primarily through payments received from our customers, sales of equity securities, including our IPO in July 2021, and borrowings under our former credit facility. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. We evaluate financing opportunities from time to time and our ability to obtain financing will depend, among other things, on our development efforts, business plans, operating performance and condition of the capital markets at the time we seek financing. Additional financing may not be available on favorable terms, if at all. Weakness and volatility in the capital markets and the economy in general could limit our access to capital markets and increase our costs of borrowing. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Current wording

We have funded our operations since inception primarily through payments received from our customers, sales of equity securities, and borrowings under our former credit facility. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. We evaluate financing opportunities from time to time and our ability to obtain financing will depend, among other things, on our development efforts, business plans, and operating performance and the condition of the capital markets at the time we seek financing. Additional financing may not be available on favorable terms, if at all. Weakness and volatility in the capital markets and the economy in general could limit our access to capital markets and increase our costs of borrowing. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Previous wording

Our future success also depends in part on our ability to expand our existing customer relationships by increasing usage and developing and selling additional offerings to our existing customers. The rate at which our customers purchase our product offerings from us depends on a number of factors, including our ability to develop additional features for our platform and the quality of such features, general economic conditions and pricing and services offered by our competitors. For example, we developed a new ediscovery chatbot, Cecilia, which we released publicly in the fourth quarter of 2023 in the United States, and intend to offer our customers access to sources of primary law, which we acquired through our Fastcase license and intend to launch in 2024. If our efforts to increase usage and develop and sell additional offerings to our customers are not successful, or the development of additional features is delayed, our business may be harmed.

Current wording

Our future success also depends in part on our ability to expand our existing customer relationships by increasing usage and developing and selling additional offerings to our existing customers. The rate at which our customers purchase our product offerings from us depends on a number of factors, including our ability to develop additional features for our platform and the quality of such features, our ability to effectively develop and expand our marketing and sales capabilities, general economic conditions and pricing and services offered by our competitors. If our efforts to increase usage and develop and sell additional offerings to our customers are not successful, or the development of additional features is delayed, our business may be harmed.

Previous wording

We regularly train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize its potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Current wording

We train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize its potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Previous wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Current wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers and maintain or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Previous wording

We currently host our platform and support most of our operations using AWS, a provider of cloud infrastructure services. We do not control the operations of AWS’s facilities. AWS’s facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events or could be subject to break-ins, computer viruses, sabotage, intentional acts of vandalism and other misconduct. The occurrence of any of these events, a decision to close the facilities or cease or limit providing services to us without adequate notice or other unanticipated problems could result in interruptions to our product offerings, which may be lengthy. Our product offerings’s continuing and uninterrupted performance is critical to our success and employers and job seekers may become dissatisfied by service interruption. Sustained or repeated system failures could reduce the attractiveness of our product offerings to customers, cause our customers to decrease their use of or stop using our product offerings and otherwise adversely affect our business. Moreover, negative publicity from disruptions could damage our reputation.

Current wording

We currently host our platform and support most of our operations using AWS, a provider of cloud infrastructure services. We do not control the operations of AWS’s facilities. AWS’s facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events or could be subject to break-ins, computer viruses, sabotage, intentional acts of vandalism and other misconduct. The occurrence of any of these events, a decision to close the facilities or cease or limit providing services to us without adequate notice or other unanticipated problems could result in interruptions to our product offerings, which may be lengthy. Our product offerings’ continuous and uninterrupted performance is critical to our success and employers and job seekers may become dissatisfied by service interruption. Sustained or repeated system failures could reduce the attractiveness of our product offerings to customers, cause our customers to decrease their use of or stop using our product offerings and otherwise adversely affect our business. Moreover, negative publicity from disruptions could damage our reputation.

Previous wording

Any one or more of the factors above may result in significant fluctuations in our results of operations. In addition, because we were founded in 2013 and have experienced rapid expansion of our business and revenues since such time, we do not have a long history upon which to base forecasts of future revenue and operating results. Accordingly, we may be unable to accurately forecast our revenues. As a result, our past results may not be indicative of our future performance, and the variability and unpredictability of our results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our common stock could decline substantially and we could face lawsuits that are costly and may divert management’s attention, including securities class action suits.

Current wording

Any one or more of the factors above may result in significant fluctuations in our results of operations. In addition, because we were founded in 2013 and have experienced both rapid expansion and slowed growth of our business and revenues since such time, we have experienced significant volatility and do not have a long history upon which to base forecasts of future revenue and operating results. Accordingly, we may be unable to accurately forecast our revenues. As a result, our past results may not be indicative of our future performance, and the variability and unpredictability of our results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our common stock could decline substantially and we could face lawsuits that are costly and may divert management’s attention, including securities class action suits.

Previous wording

Because our substantial growth since inception has resulted in the rapid expansion of our business and revenues, we do not have a long history upon which to base forecasts of future revenue and operating results. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Current wording

Because our substantial growth since inception has resulted in the rapid expansion of our business and revenues, we do not have a long history at our current scale upon which to base forecasts of future revenue and operating results. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Previous wording

The success of our business will depend, in part, on our ability to adapt and develop enhancements for our product offerings that respond effectively to these changes on a timely basis and in a user-friendly manner. For example, our ediscovery chatbot, Cecilia, was publicly released in the fourth quarter of 2023 in the U.S., and we intend to offer customer access to sources of primary law, which we acquired through our Fastcase license, in 2024. If we are unable to evolve our cloud platform to satisfy our customers’ needs and provide enhancements or add new and innovative features and capabilities to our product offerings that keep pace with rapid technological and industry change, or if the release of new features and capabilities are delayed, our revenue and operating results could be adversely affected. If new technologies emerge that enable our competitors to deliver competitive products, services and applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete. If our product offerings do not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our product offerings and new customers will be less likely to adopt our product offerings.

Current wording

The success of our business will depend, in part, on our ability to adapt and develop or acquire enhancements for our product offerings that respond effectively to these changes on a timely basis and in a user-friendly manner. Any such enhancements may not result in any synergies or other benefits we had expected to achieve, which could result in impairment charges that could be substantial. For example, during the year ended December 31, 2024, we recorded an impairment charge of $15.2 million related to the acquisition of our primary law intangible asset in 2023 and the related capitalized development costs. If we are unable to evolve our cloud platform to satisfy our customers’ needs and provide enhancements or add new and innovative features and capabilities to our product offerings that keep pace with rapid technological and industry change, including developments in the area of AI, or if the release of new features and capabilities are delayed, our revenue and operating results could be adversely affected. If new technologies emerge that enable our competitors to deliver competitive products, services and applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete. If our product offerings do not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our product offerings and new customers will be less likely to adopt our product offerings.

Previous wording

We derive a substantial portion of our revenue from sales to our top 10% customers. As a result, our revenue could fluctuate materially and could be and has in the past been materially and disproportionately impacted by purchasing decisions of these customers or any other significant future customer. Because a significant majority of our revenue is directly correlated with our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues. Any of our significant customers may decide to purchase less than they have in the past, may alter their purchasing patterns at any time with limited notice, may cease usage of our product offerings following the conclusion of a matter, or may decide not to continue to use our product offerings at all, any of which could cause our revenue to decline and adversely affect our financial condition and results of operations. If we do not further diversify our customer base, we will continue to be susceptible to risks associated with customer concentration.

Current wording

We derive a substantial portion of our revenue from sales to our top 10% of customers. As a result, our revenue could fluctuate materially and could be and has in the past been materially and disproportionately impacted by purchasing decisions of these customers or any other significant future customer. Because a significant majority of our revenue is directly correlated with our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues. Any of our significant customers may decide to purchase less than they have in the past, may alter their purchasing patterns at any time with limited notice, may cease usage of our product offerings following the conclusion of a matter, or may decide not to continue to use our product offerings at all, any of which could cause our revenue to decline and adversely affect our financial condition and results of operations. If we do not further diversify our customer base, we will continue to be susceptible to risks associated with customer concentration.

Previous wording

The market for technology solutions for law firms, private enterprises and government and other organizations is highly fragmented, competitive and constantly evolving. With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. Almost all potential customers have existing solutions for ediscovery and legal document review in place, which typically consists of a mix of cloud-based solutions, on-premise point solutions and human professional service providers to deliver these solutions. Our competitors include (i) legal services providers, including large dedicated legal services providers such as Consilio LLC, Epiq Systems, Inc. and KLDiscovery Inc., the legal services divisions of large professional firms such as Deloitte & Touche LLP, Ernst and Young LLP, KPMG LLP and PricewaterhouseCoopers LLP, as well as a large number of smaller regional and local services companies and certain law firms providing in-house ediscovery and document review solutions; (ii) legacy on-premise software providers, such as Nuix Limited, Open Text Corporation and Relativity ODA LLC, or Relativity, RELX PLC and Thomson Reuters Corporation; and (iii) cloud software providers, such as Everlaw, Inc., Relativity through its RelativityOne offering, and Reveal Data Corporation (recently acquired Logik Systems, Inc. - d.b.a. Logikcull). In addition, we expect to expand our product offerings to address additional areas of the legal function and we likely face further competition from existing companies in such areas.

Current wording

The market for technology solutions for law firms, private enterprises and government and other organizations is highly fragmented, competitive and constantly evolving. With the introduction of new technologies, particularly in the area of AI, and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. Almost all potential customers have existing solutions for ediscovery and legal document review in place, which typically consists of a mix of cloud-based solutions, on-premise point solutions and human professional service providers to deliver these solutions. Our competitors include (i) legal services providers, including large dedicated legal services providers such as Consilio LLC, Epiq Systems, Inc. and KLDiscovery Inc., the legal services divisions of large professional firms such as Deloitte & Touche LLP, Ernst and Young LLP, KPMG LLP and PricewaterhouseCoopers LLP, as well as a large number of smaller regional and local services companies and certain law firms providing in-house ediscovery and document review solutions; (ii) legacy on-premise software providers, such as Nuix Limited, Open Text Corporation and Relativity ODA LLC, or Relativity, RELX PLC and Thomson Reuters Corporation; and (iii) cloud software providers, such as Everlaw, Inc., Relativity through its RelativityOne offering, and Reveal Data Corporation (recently acquired Logik Systems, Inc. - d.b.a. Logikcull). In addition, we expect to expand our product offerings to address additional areas of the legal function and we likely face further competition from existing companies in such areas.

Previous wording

Furthermore, any negative publicity relating to our employees, customers or others associated with these parties may also tarnish our own reputation and may reduce the value of our brand. For example, we recently experienced negative publicity following the departure of our former chief executive officer, which negative publicity may affect perception of our brand. Damage to our brand and reputation may result in reduced demand for our product offerings and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Current wording

Furthermore, any negative publicity relating to our employees, customers or others associated with these parties may also tarnish our own reputation and may reduce the value of our brand. Damage to our brand and reputation may result in reduced demand for our product offerings and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Previous wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. In addition, we have limited experience with respect to determining the optimal pricing for our product offerings and, as a result, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.

Current wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. In addition, we have limited experience with respect to determining the optimal pricing for our product offerings and, as a result, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. This risk may be further exacerbated as we focus on attracting and retaining customers with significant annual ediscovery spend, large practice teams, and practices in legal areas with significant ediscovery needs. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.