CS Disco, Inc.

Previous wording

•If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were compromised, we could experience adverse consequences, including, but not limited, to additional costs, loss of revenue, significant liabilities, harm to our brand, or material disruption of our operations.

Current wording

•If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were compromised, we could experience adverse consequences, including, but not limited, to additional costs, loss of revenue, significant liabilities, harm to our brand, or material disruption of our operations and other adverse consequences.

Previous wording

Our actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation (including class claims), fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customer sales, or otherwise harm our business.

Current wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we rely) actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation (including class claims), fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customer sales, or otherwise harm our business.

Previous wording

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information, client information, and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party data. As a result, we are, or may become, subject to numerous federal, state, local and foreign laws and regulations, guidance, industry standards and other obligations regarding privacy, data protection, information security and processing and protection of personal information and other content, the scope of which is changing, subject to differing interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our privacy policies and obligations to third parties (including contractual) related to privacy, data protection and information security. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy and data protection worldwide is unclear and evolving, and is likely to remain uncertain, for the foreseeable future. We expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. There is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to data privacy or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our product offerings. We may face challenges in addressing these requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Current wording

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information, client information, and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party data. As a result, we are, or may become, subject to numerous federal, state, local and foreign laws and regulations, guidance, industry standards and other obligations regarding privacy, data protection, information security and processing and protection of personal information and other content, the scope of which is changing, subject to differing interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our internal and externally facing privacy policies and obligations to third parties (including contractual) related to privacy, data protection and information security. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy and data protection worldwide is unclear and evolving rapidly, and is likely to remain uncertain, for the foreseeable future. We expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. There is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to data privacy or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our product offerings. We may face challenges in addressing these requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Previous wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR, permits data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. Furthermore, several jurisdictions have enacted measures related to the use of artificial intelligence and machine learning in products and services. For example, the EU Artificial Intelligence Act (EUAIA) imposes onerous obligations related to the use of AI related systems. Other similar laws may be passed in other jurisdictions and may require us to change our business practices, or else be subject to regulatory action and/or fines.

Current wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR, permits data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Previous wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, absent appropriate safeguards, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States of America that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business.

Current wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous wording

Some European regulators have prevented companies from transferring personal information out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Regulators in the United States are also increasingly scrutinizing certain personal information transfers and may impose data localization requirements, for example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

Current wording

Some European regulators have prevented companies from transferring personal information out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Regulators in the United States such as the Department of Justice are also increasingly scrutinizing certain personal information transfers and have proposed and may enact certain data localization requirements. One example of this is the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

Previous wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security laws, including data breach notification laws, personal information privacy laws, and consumer protection laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for data breaches that may increase data breach litigation. At least eighteen other states have also passed comprehensive privacy laws some of which go into effect in 2024 and the coming years. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties with whom we work.

Current wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security laws, including data breach notification laws, personal information privacy laws, consumer protection laws and other similar laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents rights to access and require deletion of their personal information, opt out of certain personal information sharing and data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. The CCPA provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for data breaches that may increase data breach litigation. At least eighteen other states have also passed comprehensive privacy laws and similar laws are being considered in several other states, as well as at the federal and local levels. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance.

Previous wording

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy, data protection and information security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or vendors do not comply with our published policies, certifications, and documentation. Any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Current wording

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy, data protection and information security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or third parties with whom we work do not comply with our published policies, certifications, and documentation. Regulators in the United States are increasingly scrutinizing these statements, and any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Previous wording

Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal information to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser opt-out signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes. As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Current wording

“do not track” mechanisms (such as browser opt-out signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes. As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Previous wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware, denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations.

Current wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and other devices outs…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of these threats and issues may lead to a security incident and significant adverse consequences, including compromise of our system infrastructure or the loss, destruction, alteration, denial of access to, disclosure or dissemination of, or damage or unauthorized access to, our information technology systems, data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal information) or data that is processed or maintained on our behalf, or other assets.

Current wording

Any of these threats and issues could lead to a security incident and significant adverse consequences, including compromise of our system infrastructure or the loss, destruction, alteration, denial of access to, disclosure or dissemination of, or damage or unauthorized access to, our information technology systems, data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal information) or data that is processed or maintained on our behalf, or other assets. For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future.

Previous wording

We rely on third-party service providers and technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We work with third-parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third-parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Current wording

We rely on third-parties and third-party technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We work with third-parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third-parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third-party with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Previous wording

We take steps designed to detect, mitigate and remediate security vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate them all on a timely basis. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities, bugs, errors and vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities available in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident. These vulnerabilities, bugs, errors or defects alone, or a combination of them, could pose material risks to our business. Further, the cost to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of customer trust, diminished use of our product offerings as well as other harms to our business and our competitive position. These adverse consequences could force us to spend money, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation.

Current wording

We take steps designed to detect, mitigate and remediate security vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate them all on a timely basis. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities, bugs, and errors. Even if we have issued or otherwise made patches or information for vulnerabilities available in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident. These vulnerabilities, bugs, errors or defects alone, or a combination of them, could pose material risks to our business. Further, the cost to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of customer trust, diminished use of our product offerings as well as other harms to our business and our competitive position. These adverse consequences could force us to spend money, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation.

Previous wording

If we, or the third parties with whom we work, experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrict our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches.

Current wording

If we, or the third parties with whom we work, experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrict our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and material attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches. We cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Previous wording

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive data about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal information) that we input into a third party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal information and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal information) that we input into a third-party generative AI / machine learning, or ML, platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal information and makes inferences using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Previous wording

Our employees and personnel use generative artificial intelligence (AI) technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We use AI and machine learning (ML), to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous wording

We use AI, including generative AI, and ML technologies in our products and services (collectively, AI/ML technologies). The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

The development and use of AI/ML presents various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. For example, our revenue was $107.8 million, $102.3 million, $138.1 million and $135.2 million for the nine months ended September 30, 2024 and 2023 and the years ended December 31, 2023 and 2022, respectively. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Current wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Previous wording

•recruit, hire, train and manage additional qualified developers, professionals and sales and marketing personnel; and

Current wording

•recruit, hire, train, manage, and retain sufficient qualified developers, professionals and sales and marketing personnel; and

Previous wording

Our limited operating history and our history of operating losses make it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

Current wording

Our limited operating history at our current scale and our history of operating losses make it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

Previous wording

We launched our business in 2013 and have experienced net losses in each fiscal year since inception. We incurred net losses of $30.6 million and $36.3 million for the nine months ended September 30, 2024 and 2023, respectively. We generated net losses of $42.2 million and $70.8 million for the years ended December 31, 2023 and 2022, respectively. As of September 30, 2024, we had an accumulated deficit of $272.2 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable. Even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant costs to support further growth and development of our product offerings, including expanding the functionality of our platform, technology infrastructure and business systems, expanding our partner ecosystem, increasing our marketing activities and growing our international operations. We will also face increased compliance costs associated with the growth and expansion of our customer base. These increased expenditures will make it harder for us to achieve or sustain profitability. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our common stock could decline and our business may be harmed.

Current wording

We launched our business in 2013 and have experienced net losses in each fiscal year since inception. We incurred net losses of $11.4 million and $10.6 million for the three months ended March 31, 2025 and 2024, respectively. We generated net losses of $55.8 million and $42.2 million for the years ended December 31, 2024 and 2023, respectively. As of March 31, 2025, we had an accumulated deficit of $308.8 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable. Even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant costs to support further growth and development of our product offerings, including expanding the functionality of our platform, technology infrastructure and business systems, expanding our partner ecosystem, increasing our marketing activities and growing our international operations. We will also face increased compliance costs associated with the growth and expansion of our customer base. These increased expenditures will make it harder for us to achieve or sustain profitability. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our common stock could decline and our business may be harmed.

Previous wording

We have limited historical financial data and operate in a rapidly evolving and cyclical market that is prone to significant periodic fluctuations. As a result, it is difficult to evaluate our current business and our future prospects, including our ability to plan for and model future growth, and any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable market. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in constantly evolving industries, including the risks described herein. If we do not address these risks successfully, our business may be harmed.

Current wording

We have limited historical financial data at our current scale and operate in a rapidly evolving and cyclical market that is prone to significant periodic fluctuations. As a result, it is difficult to evaluate our current business and our future prospects, including our ability to plan for and model future growth, and any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable market. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in constantly evolving industries, including the risks described herein. If we do not address these risks successfully, our business may be harmed.

Previous wording

We have funded our operations since inception primarily through payments received from our customers, sales of equity securities, including our IPO in July 2021, and borrowings under our former credit facility. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. We evaluate financing opportunities from time to time and our ability to obtain financing will depend, among other things, on our development efforts, business plans, operating performance and condition of the capital markets at the time we seek financing. Additional financing may not be available on favorable terms, if at all. Weakness and volatility in the capital markets and the economy in general could limit our access to capital markets and increase our costs of borrowing. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Current wording

We have funded our operations since inception primarily through payments received from our customers, sales of equity securities, and borrowings under our former credit facility. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. We evaluate financing opportunities from time to time and our ability to obtain financing will depend, among other things, on our development efforts, business plans, and operating performance and the condition of the capital markets at the time we seek financing. Additional financing may not be available on favorable terms, if at all. Weakness and volatility in the capital markets and the economy in general could limit our access to capital markets and increase our costs of borrowing. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Previous wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. Customers are charged in part based on their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, most of our customers may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters experienced, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Current wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. Customers are charged in part based on their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, most of our customers may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters experienced, including as a result of reduced levels of enforcement by certain federal agencies under President Trump, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Previous wording

Customers under usage-based contracts can cancel their contracts or reduce their usage at any time. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. Because a significant majority of our revenue is directly correlated with our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues.

Current wording

Customers under usage-based contracts can cancel their contracts or reduce their usage at any time. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. Because a significant majority of our revenue is directly correlated with our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception, respectively, of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues.

Previous wording

Our future success also depends in part on our ability to expand our existing customer relationships by increasing usage and developing and selling additional offerings to our existing customers. The rate at which our customers purchase our product offerings from us depends on a number of factors, including our ability to develop additional features for our platform and the quality of such features, general economic conditions and pricing and services offered by our competitors. For example, we developed a new ediscovery chatbot, Cecilia, which we released publicly in the fourth quarter of 2023 in the United States, and intend to offer our customers access to sources of primary law, which we acquired through our Fastcase license and intend to launch in 2025. If our efforts to increase usage and develop and sell additional offerings to our customers are not successful, or the development of additional features is delayed, our business may be harmed.

Current wording

Our future success also depends in part on our ability to expand our existing customer relationships by increasing usage and developing and selling additional offerings to our existing customers. The rate at which our customers purchase our product offerings from us depends on a number of factors, including our ability to develop additional features for our platform and the quality of such features, our ability to effectively develop and expand our marketing and sales capabilities, general economic conditions and pricing and services offered by our competitors. If our efforts to increase usage and develop and sell additional offerings to our customers are not successful, or the development of additional features is delayed, our business may be harmed.

Previous wording

We regularly train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize its potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Current wording

We train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize its potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Previous wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud- based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Current wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers and maintain or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Previous wording

•changes in regulatory or legal environments that may cause us to incur, among other elements, expenses associated with compliance;

Current wording

•changes in regulatory or legal environments that may cause us to incur, among other elements, expenses associated with compliance or impact our customers’ purchasing decisions;

Previous wording

Any one or more of the factors above may result in significant fluctuations in our results of operations. In addition, because we were founded in 2013 and have experienced rapid expansion of our business and revenues since such time, we do not have a long history upon which to base forecasts of future revenue and operating results. Accordingly, we may be unable to accurately forecast our revenues. As a result, our past results may not be indicative of our future performance, and the variability and unpredictability of our results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our common stock could decline substantially and we could face lawsuits that are costly and may divert management’s attention, including securities class action suits.

Current wording

Any one or more of the factors above may result in significant fluctuations in our results of operations. In addition, because we were founded in 2013 and have experienced both rapid expansion and slowed growth of our business and revenues since such time, we have experienced significant volatility and do not have a long history upon which to base forecasts of future revenue and operating results. Accordingly, we may be unable to accurately forecast our revenues. As a result, our past results may not be indicative of our future performance, and the variability and unpredictability of our results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our common stock could decline substantially and we could face lawsuits that are costly and may divert management’s attention, including securities class action suits.

Previous wording

Because our substantial growth since inception has resulted in the rapid expansion of our business and revenues, we do not have a long history upon which to base forecasts of future revenue and operating results. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Current wording

Because our substantial growth since inception has resulted in the rapid expansion of our business and revenues, we do not have a long history at our current scale upon which to base forecasts of future revenue and operating results. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Previous wording

The success of our business will depend, in part, on our ability to adapt and develop enhancements for our product offerings that respond effectively to these changes on a timely basis and in a user-friendly manner. For example, our ediscovery chatbot, Cecilia, was publicly released in the fourth quarter of 2023 in the U.S. and the third quarter of 2024 in Europe. We also intend to offer customer access to sources of primary law, which we acquired through our Fastcase license, in 2025. If we are unable to evolve our cloud platform to satisfy our customers’ needs and provide enhancements or add new and innovative features and capabilities to our product offerings that keep pace with rapid technological and industry change, or if the release of new features and capabilities are delayed, our revenue and operating results could be adversely affected. If new technologies emerge that enable our competitors to deliver competitive products, services and applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete. If our product offerings do not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our product offerings and new customers will be less likely to adopt our product offerings.

Current wording

The success of our business will depend, in part, on our ability to adapt and develop or acquire enhancements for our product offerings that respond effectively to these changes on a timely basis and in a user-friendly manner. Any such enhancements may not result in any synergies or other benefits we had expected to achieve, which could result in impairment charges that could be substantial. For example, during the year ended December 31, 2024, we recorded an impairment charge of $15.2 million related to the acquisition of our primary law intangible asset in 2023 and the related capitalized development costs. If we are unable to evolve our cloud platform to satisfy our customers’ needs and provide enhancements or add new and innovative features and capabilities to our product offerings that keep pace with rapid technological and industry change, including developments in the area of AI, or if the release of new features and capabilities are delayed, our revenue and operating results could be adversely affected. If new technologies emerge that enable our competitors to deliver competitive products, services and applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete. If our product offerings do not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our product offerings and new customers will be less likely to adopt our product offerings.

Previous wording

We seek to grow our partner ecosystem as a way to grow our business. We plan to continue to establish and maintain similar strategic relationships with law firms and other legal services providers and we expect these entities to become an increasingly important aspect of our business. Our future growth in revenue and ability to achieve and sustain profitability depends in part on our ability to identify, establish and retain successful strategic partner relationships in the United States and internationally, which will take significant time and resources and involve significant risk. In order to develop and expand our distribution channel, we must develop and improve our processes for partner introduction and training. If we do not succeed in identifying suitable strategic partners or maintain our relationships with such partners, our business, operating results and financial condition may be adversely affected.

Current wording

We seek to grow our partner ecosystem as a way to grow our business. We plan to continue to establish and maintain similar strategic relationships with law firms and other legal services providers. Our relationship with these entities are an important aspect of our business. Our future growth in revenue and ability to achieve and sustain profitability depends in part on our ability to identify, establish and retain successful strategic partner relationships in the United States and internationally, which will take significant time and resources and involve significant risk. In order to develop and expand our distribution channel, we must develop and improve our processes for partner introduction and training. If we do not succeed in identifying suitable strategic partners or maintain our relationships with such partners, our business, operating results and financial condition may be adversely affected.

Previous wording

Our ability to increase our customer base and achieve broader market acceptance of our product offerings will significantly depend on our ability to expand our marketing and sales operations. We plan to dedicate significant resources to sales, marketing and demand-generation programs, including various online marketing activities as well as targeted account-based advertising. The effectiveness of our targeted account-based advertising has varied over time and may vary in the future. All of these efforts will require us to invest significant financial and other resources and if they fail to attract additional customers, our business will be harmed. If our lead generation methods do not result in broader market acceptance of our product offerings, we will not realize the intended benefits of this strategy and our business will be harmed.

Current wording

Our ability to increase our customer base and achieve broader market acceptance of our product offerings will significantly depend on our ability to expand our marketing and sales operations. We plan to dedicate significant resources to sales, marketing and demand-generation programs, including various online marketing activities as well as targeted account-based advertising. The effectiveness of our targeted account-based advertising has varied over time and may vary in the future.

Previous wording

The market for technology solutions for law firms, private enterprises and government and other organizations is highly fragmented, competitive and constantly evolving. With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. Almost all potential customers have existing solutions for ediscovery and legal document review in place, which typically consists of a mix of cloud-based solutions, on-premise point solutions and human professional service providers to deliver these solutions. Our competitors include (i) legal services providers, including large dedicated legal services providers such as Consilio LLC, Epiq Systems, Inc. and KLDiscovery Inc., the legal services divisions of large professional firms such as Deloitte & Touche LLP, Ernst and Young LLP, KPMG LLP and PricewaterhouseCoopers LLP, as well as a large number of smaller regional and local services companies and certain law firms providing in-house ediscovery and document review solutions; (ii) legacy on-premise software providers, such as Nuix Limited, Open Text Corporation and Relativity ODA LLC, or Relativity, RELX PLC and Thomson Reuters Corporation; and (iii) cloud software providers, such as Everlaw, Inc., Relativity through its RelativityOne offering, and Reveal Data Corporation (recently acquired Logik Systems, Inc. - d.b.a. Logikcull). In addition, we expect to expand our product offerings to address additional areas of the legal function and we likely face further competition from existing companies in such areas.

Current wording

The market for technology solutions for law firms, private enterprises and government and other organizations is highly fragmented, competitive and constantly evolving. With the introduction of new technologies, particularly in the area of AI, and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. Almost all potential customers have existing solutions for ediscovery and legal document review in place, which typically consists of a mix of cloud-based solutions, on-premise point solutions and human professional service providers to deliver these solutions. Our competitors include (i) legal services providers, including large dedicated legal services providers such as Consilio LLC, Epiq Systems, Inc. and KLDiscovery Inc., the legal services divisions of large professional firms such as Deloitte & Touche LLP, Ernst and Young LLP, KPMG LLP and PricewaterhouseCoopers LLP, as well as a large number of smaller regional and local services companies and certain law firms providing in-house ediscovery and document review solutions; (ii) legacy on-premise software providers, such as Nuix Limited, Open Text Corporation and Relativity ODA LLC, or Relativity, RELX PLC and Thomson Reuters Corporation; and (iii) cloud software providers, such as Everlaw, Inc., Relativity through its RelativityOne offering, and Reveal Data Corporation (recently acquired Logik Systems, Inc. - d.b.a. Logikcull). In addition, we expect to expand our product offerings to address additional areas of the legal function and we likely face further competition from existing companies in such areas.

Previous wording

Furthermore, any negative publicity relating to our employees, customers or others associated with these parties may also tarnish our own reputation and may reduce the value of our brand. For example, we have experienced negative publicity following the departure of our former Chief Executive Officer, which negative publicity may affect perception of our brand. Damage to our brand and reputation may result in reduced demand for our product offerings and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Current wording

Furthermore, any negative publicity relating to our employees, customers or others associated with these parties may also tarnish our own reputation and may reduce the value of our brand. Damage to our brand and reputation may result in reduced demand for our product offerings and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Previous wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. In addition, we have limited experience with respect to determining the optimal pricing for our product offerings and, as a result, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.

Current wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. In addition, we have limited experience with respect to determining the optimal pricing for our product offerings and, as a result, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. This risk may be further exacerbated as we focus on attracting and retaining customers with significant annual ediscovery spend, large practice teams, and practices in legal areas with significant ediscovery needs. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.

Previous wording

If we cannot improve and sustain our corporate culture as we grow, our success and our business and competitive position may be harmed.

Current wording

If we cannot continue to build and sustain a productive corporate culture as we grow, our success and our business and competitive position may be harmed.

Previous wording

We are investing to build a strong corporate culture and believe it can be one of our most important and sustainable sources of competitive advantage. In the aftermath of the departure of our former Chief Executive Officer and media reporting on the circumstances of his departure, we determined that certain aspects of our corporate culture need to be reassessed. We have begun executing on an action plan to review and, to the extent necessary, take action to strengthen our culture and make all employees feel that we maintain a positive and constructive work environment. Any failure to improve and preserve our culture could negatively affect our ability to retain and recruit personnel and retain and win new customers, both of which are critical to our growth, and to effectively focus on and pursue our corporate objectives. As we grow and our resources become more globally dispersed, we may find it increasingly difficult to maintain our corporate culture. If we fail to improve and sustain our corporate culture, or if we are unable to retain or hire key personnel, our business and competitive position may be harmed.

Current wording

We are investing to build a strong corporate culture and believe it can be one of our most important and sustainable sources of competitive advantage. In the aftermath of the departure of Kiwi Camara, our former Chief Executive Officer, and media reporting on the circumstances of his departure, we determined that certain aspects of our corporate culture need to be reassessed. We have and will continue to take action to strengthen our culture and make all employees feel that we maintain a positive and constructive work environment. Any failure to improve and preserve our culture could negatively affect our ability to retain and recruit personnel and retain and win new customers, both of which are critical to our growth, and to effectively focus on and pursue our corporate objectives. As we grow and our resources become more globally dispersed, we may find it increasingly difficult to maintain our corporate culture. If we fail to continue building and sustain our corporate culture, or if we are unable to retain or hire key personnel, our business and competitive position may be harmed.

Previous wording

We believe our success has depended, and continues to depend, on the efforts and talents of senior management and key personnel. We also are dependent on the continued service of our existing software engineers because of the complexity of our platform, and our existing salespeople, because of their relationship with our customers. Our senior management and key employees are employed on an at-will basis. In addition, many of our senior management and key employees may be able to receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business.

Current wording

We believe our success has depended, and continues to depend, on the efforts and talents of senior management and key personnel. We also are dependent on the continued service of our existing software engineers because of the complexity of our platform, and our existing salespeople, because of their relationship with our customers. Our senior management and key employees are employed on an at-will basis. In addition, many of our senior management and key employees may be able to receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. Our ability to adequately incentivize and retain the services of our senior management and key employees, including our key salespeople, may depend on our ability to offer satisfactory compensation to such personnel. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business.