CS Disco, Inc.

Previous wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we rely) actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation (including class claims), fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customer sales, or otherwise harm our business.

Current wording

•We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties upon whom we rely) actual or perceived failure to comply with privacy, data protection and information security laws, regulations and other non-regulatory obligations related to data privacy and security could lead to regulatory investigations or actions, litigation (including class claims), fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customer sales, or otherwise harm our business.

Previous wording

If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties with whom we work, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences.

Current wording

•If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties with whom we work, are or were compromised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences.

Previous wording

•Our business depends on customers increasing their use of our product offerings and any loss of customers or decline in their use of our product offerings could harm our business.

Current wording

•Our business depends on customers increasing their usage of our product offerings and any loss of customers or decline in their use of our product offerings could harm our business.

Previous wording

•We employ a pricing model that subjects us to various challenges, and given our limited history with our pricing model, we may not be able to accurately predict the optimal pricing necessary to attract new customers and retain existing customers.

Current wording

•We employ a pricing model that subjects us to various challenges and we may not be able to accurately predict the optimal pricing necessary to attract new customers and retain existing customers.

Previous wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR, permits data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Current wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR and UK GDPR, permit data protection authorities to impose large penalties for violations of the regulation, including potential fines of up to €20 million under the EU GDPR, £17.5 million under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provide individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Previous wording

Some European regulators have prevented companies from transferring personal information out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Regulators in the United States such as the Department of Justice are also increasingly scrutinizing certain personal information transfers and have proposed and may enact certain data localization requirements. One example of this is the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

Current wording

Some European regulators have prevented companies from transferring personal information out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Previous wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security laws, including data breach notification laws, personal information privacy laws, consumer protection laws and other similar laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents rights to access and require deletion of their personal information, opt out of certain personal information sharing and data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. The CCPA provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for data breaches that may increase data breach litigation. At least eighteen other states have also passed comprehensive privacy laws and similar laws are being considered in several other states, as well as at the federal and local levels. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties with whom we work.

Current wording

In the United States, federal, state, and local governments have enacted numerous privacy, data protection and information security laws, including data breach notification laws, personal information privacy laws, consumer protection laws and other similar laws. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA gives California residents certain rights, such as the right to access and require deletion of their personal information, opt out of certain personal information sharing and data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches. Many states have also passed comprehensive privacy laws and similar laws are being considered in several other states, as well as at the federal and local levels. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties with whom we work.

Previous wording

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy, data protection and information security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or third parties with whom we work do not comply with our published policies, certifications, and documentation. Regulators in the United States are increasingly scrutinizing these statements, and any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Current wording

GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or third parties with whom we work do not comply with our published policies, certifications, and documentation. Regulators in the United States are increasingly scrutinizing these statements, and any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.

Previous wording

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal information for targeted advertising purposes. For example, in 2021, Apple began allowing users to more easily opt-out of activity tracking across devices. In February 2022, Google announced similar plans to adopt additional privacy controls on its Android devices to allow users to limit sharing of their data with third parties and reduce cross-device tracking for advertising purposes.

Current wording

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal information for targeted advertising purposes.

Previous wording

Additionally, Firefox and Safari have phased out third-party cookies, which makes it more difficult for us to target advertisements. While Google has announced a temporary halt of its prior plan to similarly phase out third-party cookies in its Chrome browser, there is no guarantee that Google will not resume its plan and that other browsers will not adopt similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal information for targeted advertising purposes as well as a company’s disclosure of personal information in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser opt-out signals from the Global Privacy Control.

Current wording

For example, Firefox and Safari have disabled third-party cookies by default, which makes it more difficult for us to target advertisements. While Google has announced a temporary halt of its prior plan to similarly disable third-party cookies by default in its Chrome browser, there is no guarantee that Google will not resume its plan and that other browsers will not adopt similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal information for targeted advertising purposes as well as a company’s disclosure of personal information in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser opt-out signals from the Global Privacy Control.

Previous wording

•If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were compromised, we could experience adverse consequences, including, but not limited, to additional costs, loss of revenue, significant liabilities, harm to our brand, or material disruption of our operations and other adverse consequences.

Current wording

If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties with whom we work, are or were compromised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences.

Previous wording

In the ordinary course of business, we and the third parties with whom we work, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, process) potentially highly sensitive and confidential electronic documentation for use by our law firm and non-law firm customers in various legal matters, including litigation and governmental investigations and, as a result, we and the third parties with whom we work face a variety of evolving threats. Due to the nature of our services, and the legal and regulatory context in which our services are utilized by customers, our ability to protect the confidentiality, availability and integrity of our customers’ information is critical to our ability to attract and retain customers, generate revenue and the overall success of our business, and our failure or perceived failure to maintain adequate protections could materially affect our business.

Current wording

In the ordinary course of business, we and the third parties with whom we work process potentially highly sensitive and confidential electronic documentation, including for use by our law firm and non-law firm customers in various legal matters, including litigation and governmental investigations and, as a result, we and the third parties with whom we work face a variety of evolving threats. Due to the nature of our services, and the legal and regulatory context in which our services are utilized by customers, our ability to protect the confidentiality, availability and integrity of our customers’ information is critical to our ability to attract and retain customers, generate revenue and the overall success of our business, and our failure or perceived failure to maintain adequate protections could materially affect our business.

Previous wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and other devices outs…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, supply-chain attacks, infrastructure failures, operational errors resulting in breaches of service level agreements, and attacks or vulnerabilities enhanced or enabled by artificial intelligence. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, accidentally providing a customer with access to or copies of another customer’s confidential information, or unauthorized and exfiltration of customer data generally. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For ex…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We rely on third-parties and third-party technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We work with third-parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third-parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third-party with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Current wording

We rely on third parties and third-party technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We work with third parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have

Previous wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures to protect our information technology systems and sensitive data.

Current wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures to protect our information technology systems and sensitive data. For example, we have implemented critical compliance certifications such as International Organization for Standardization 27001 compliant security procedures and virus protection software, intrusion prevention systems, identity and access control, and emergency recovery processes, and we carefully select our third-party providers of information systems, to mitigate risks to the information systems that we rely on and to the technology, data, intellectual property and other sensitive information we seek to protect. However, there is no guarantee that such security procedures and mitigation and protection systems will be effective and that we will be able to continuously maintain or renew such critical compliance certifications, and we may still suffer cybersecurity and other incidents, which could have a material adverse effect on our business or operations.

Previous wording

Notifications and follow-up actions related to a security incident could impact our reputation, result in a loss of customers and prospects, and cause us to incur significant costs, including legal expenses and remediation costs. We may have contractual and legal obligations under applicable data privacy and security laws to notify relevant stakeholders of security breaches, or we may voluntarily choose to notify relevant stakeholders including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identify theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences including negative publicity, which may cause our customers or prospective customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach.

Current wording

Notifications and follow-up actions related to a security incident could impact our reputation, result in a loss of customers and prospects, and cause us to incur significant costs, including legal expenses and remediation costs. We may have contractual and legal obligations under applicable data privacy and security laws to notify relevant stakeholders of security breaches, or we may voluntarily choose to notify relevant stakeholders including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences including negative publicity, which may cause our customers or prospective customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach.

Previous wording

We license certain software from third parties and incorporate or integrate such components into and with our product offerings. Certain third-party software has become central to the operation and delivery of our product offerings. Any inability to license necessary third-party technology in the future, or maintain sufficient rights or reasonable terms under existing third-party technology that we rely upon, could have an adverse effect on our business or operating results and adversely affect our ability to compete.

Current wording

We license certain software from third parties and incorporate or integrate such components into and with our product offerings. Certain third-party software has become central to the operation and delivery of our product offerings. Any inability to maintain sufficient rights or reasonable terms under existing third-party technology arrangements that we rely upon, or license necessary third-party technology in the future, could have an adverse effect on our business or operating results and adversely affect our ability to compete.

Previous wording

If certain of our third-party licensors were to change product offerings, cease actively supporting the technologies, fail to update and enhance the technologies to keep pace with changing industry standards, encounter technical difficulties in the continuing development of these technologies, significantly increase prices, terminate our licenses, cease operations, suffer significant capacity or supply chain constraints or suffer significant disruptions, we would need to seek alternative suppliers and incur additional internal or external development costs to ensure continued performance of our product offerings. Such alternatives may not be available on attractive terms or may not be as widely accepted or as effective as the current licenses provided by our existing suppliers. Furthermore, certain customers may require that we use or ensure that our product offerings are compatible with certain enterprise software offerings, such as Microsoft Office 365. If we fail to obtain licenses to use such third-party offerings or otherwise integrate our product offerings with such offerings, our business may be harmed. If the cost of licensing or maintaining the third-party intellectual property significantly increases, our operating earnings could significantly decrease. In addition, interruption in functionality of our product offerings as a result of changes in or with third-party licensors could adversely affect our commitments to customers, future sales of our product offerings and harm our business.

Current wording

If certain of our third-party licensors were to change product offerings, cease actively supporting the technologies, fail to update and enhance the technologies to keep pace with changing industry standards, encounter technical difficulties in the continuing development of these technologies, significantly increase prices, terminate our licenses, cease operations, suffer significant capacity or supply chain constraints or suffer significant disruptions, we would need to seek alternative suppliers and incur additional internal or external development costs to ensure continued performance of our product offerings. Such alternatives may not be available on attractive terms or may not be as widely accepted or as effective as the current licenses provided by our existing suppliers. We also license software from certain of our competitors that is incorporated into our product offerings. If these licensors removed or otherwise limited the availability of their software for use in our product offerings, we may be unable to find alternative suppliers and the functionality of our product offerings and our business may be harmed.

Previous wording

Our product offerings incorporate software licensed under open source licenses and we expect to continue to incorporate software licensed under open source licenses in the future. Such open source licenses sometimes require that source code subject to the license be made available to the public and that any modifications or derivative works to open source software continue to be licensed under open source licenses. Few courts have interpreted open source licenses and the manner in which these licenses may be interpreted and enforced is therefore subject to some uncertainty. We rely on multiple software programmers to design our proprietary technologies and we do not exercise complete control over the development efforts of our programmers and we cannot be certain that our programmers have not incorporated open source software into our proprietary product offerings and technologies or that they will not do so in the future. There is a risk that open source licenses could be construed in a manner that imposes unanticipated conditions, restrictions or costs on our ability to provide or distribute our product offerings. To that end, while we try to mitigate the likelihood of such risks, we may from time to time face claims from third parties alleging ownership of, or demanding release or general availability of, the open source software or derivative works that we developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation, which could be costly for us to defend and could adversely affect our core functionality and services. If we face such problems and attempt or are required to re-engineer our product offerings to mitigate them, it could require significant additional research and development resources and we may not be able to complete it successfully or in a timely manner. In addition to risks related to license requirements, usage of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of software. Many of these risks could be difficult to eliminate or manage and could reduce or eliminate the value of our product offerings and technologies and materially and adversely affect our ability to sustain and grow our business.

Current wording

Our product offerings incorporate software licensed under open source licenses and we expect to continue to incorporate software licensed under open source licenses in the future. Such open source licenses sometimes require that source code subject to the license be made available to the public and that any modifications or derivative works to open source software continue to be licensed under open source licenses. Few courts have interpreted open source licenses and the manner in which these licenses may be interpreted and enforced is therefore subject to some uncertainty. We rely on multiple software programmers to design our proprietary technologies and we do not exercise complete control over the development efforts of our programmers. We cannot be certain that our programmers have not incorporated open source software into our proprietary product offerings and technologies or that they will not do so in the future. There is a risk that open source licenses could be construed in a manner that imposes unanticipated conditions, restrictions or costs on our ability to provide or distribute our product offerings. To that end, while we try to mitigate the likelihood of such risks, we may from time to time face claims from third parties alleging ownership of, or demanding release or general availability of, the open source software or derivative works that we developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation, which could be costly for us to defend and could adversely affect our core functionality and services. If we face such problems and attempt or are required to re-engineer our product offerings to mitigate them, it could require significant additional research and development resources and we may not be able to complete this process successfully or in a timely manner. In addition to risks related to license requirements, usage of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of software. Many of these risks could be difficult to eliminate or manage and could reduce or eliminate the value of our product offerings and technologies and materially and adversely affect our ability to sustain and grow our business.

Previous wording

We have incorporated artificial intelligence, or AI, including generative artificial intelligence, or generative AI, features into our product and services as well as our internal operations. The incorporation of generative AI has the potential to result in adverse effects to our financial condition, results or reputation. The use of generative AI technology and processes at scale is relatively new and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. Generative AI features may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development and maintenance of the technology used, and our customers’ reluctance or failure to adopt or implement our new products and features as intended.

Current wording

We have incorporated artificial intelligence, or AI, including generative artificial intelligence features into our product and services as well as our internal operations. The incorporation of AI technologies has the potential to result in adverse effects to our financial condition, results or reputation. The use of AI technologies and processes at scale is relatively new and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. AI features may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development and maintenance of the technology used, and our customers’ reluctance or failure to adopt or implement our new products and features as intended.

Previous wording

Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal information) that we input into a third-party generative AI / machine learning, or ML, platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal information and makes inferences using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal information) that we input into a third-party AI platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI model. Additionally, where an AI model ingests personal information and makes inferences using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI with bad inputs or logic), or if the logic of the AI is flawed (a so-called “hallucination”). We may use AI outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. AI also presents novel cybersecurity challenges, as it may enhance or enable cyberattacks and/or vulnerabilities that are more sophisticated, harder to detect, or capable of proliferating more rapidly.

Previous wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Current wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

Previous wording

The development and use of AI/ML presents various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

The development and use of AI technologies presents various privacy and security risks that may impact our business. AI technologies are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. For example, the autonomous nature of agentic AI may present challenges in aligning with current AI governance, including testing protocols, and increase risk that agents may learn to circumvent guardrails. Further, countries and states are applying their data and consumer protection laws to AI technologies, and particularly generative AI and interactive chatbots. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI technologies, such as the EU’s AI Act, the Colorado Artificial Intelligence Act, California Bot Disclosure Law, the Utah Artificial Intelligence Policy Act, and the CCPA regulations on automated decision-making technology. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI technologies. These obligations may make it harder for us to conduct our business using AI technologies, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI technologies, or prevent or limit our use of AI technologies. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI technologies where they allege the company has violated privacy and consumer protection laws. If we cannot use AI technologies or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

We make numerous statements online and in our marketing materials describing our use and integration of generative AI in our products and services. Although we endeavor to be accurate with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Our statements regarding our AI-supported features and use of generative AI can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Should any of these statements prove to be untrue or be perceived as untrue, even though circumstances beyond our reasonable control, we may face litigation, disputes, claims, investigations, inquiries or other proceedings which could adversely affect our business, reputation, results of operations and financial condition.

Current wording

We make numerous statements online and in our marketing materials describing our use and integration of AI technologies in our products and services. Although we endeavor to be accurate with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Our statements regarding our AI-supported features and use of AI technologies can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Should any of these statements prove to be untrue or be perceived as untrue, even though circumstances beyond our reasonable control, we may face litigation, disputes, claims, investigations, inquiries or other proceedings which could adversely affect our business, reputation, results of operations and financial condition.

Previous wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Current wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues have increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Previous wording

•continue to develop new functionality within our product offerings and successfully further optimize our product offerings, including continued innovation of our artificial intelligence system for legal documents;

Current wording

•expand the functionality within our product offerings and successfully further optimize our product offerings, including continued innovation of our AI system for legal documents;

Previous wording

•product development, including investments in our development team and the development of new functionality for our product offerings and in the protection of our intellectual property rights related to our product development;

Current wording

•product development, including investments in our development team and the development of new product offerings and functionality for our existing product offerings and in the protection of our intellectual property rights related to our product development;

Previous wording

These investments may not be successful on the timeline we anticipate or at all and may not result in increased revenue growth. If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability over the long term. Additionally, we have encountered, and may in the future encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as unforeseen operating expenses, difficulties, complications, delays and other known or unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, our business, financial position and results of operations may be harmed, and we may not achieve or maintain profitability in the future.

Current wording

These investments may not be successful on the timeline we anticipate or at all and may not result in increased revenue growth. Additionally, we have encountered, and may in the future encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as unforeseen operating expenses, difficulties, complications, delays and other known or unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, particularly relative to expected increases in our operating expenses, our business, financial position and results of operations may be harmed, and we may not achieve or maintain profitability in the future.

Previous wording

Our business depends on customers increasing their use of our product offerings and any loss of customers or decline in their use of our product offerings could harm our business.

Current wording

Our business depends on customers increasing their usage of our product offerings and any loss of customers or decline in their use of our product offerings could harm our business.

Previous wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. Customers are charged in part based on their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, most of our customers may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters experienced, including as a result of reduced levels of enforcement by certain federal agencies under President Trump, delays in the advancement of ongoing litigation in the Federal courts as a result of the current or future shutdowns of the U.S. government, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Current wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters experienced, including as a result of reduced levels of enforcement by certain federal agencies under President Trump, delays in the advancement of ongoing litigation in the federal courts as a result of the recent or future shutdowns of the U.S. government, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Previous wording

Customers under usage-based contracts can cancel their contracts or reduce their usage at any time. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. Because a significant majority of our revenue is directly correlated with our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception, respectively, of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues.

Current wording

Because we derive substantially all of our revenue from our customers’ usage of our product offerings, which in turn is dependent on the timing of and activity driven by litigation, investigations and other legal matters for which our product offerings are used, our operating results have fluctuated significantly in the past in connection with the inception and conclusion of large legal matters, and we expect such fluctuations to continue for the foreseeable future. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception, respectively, of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues.

Previous wording

We must attract new customers and retain existing customers to continue to grow our business. Our success will depend to a substantial extent on the widespread adoption of our product offerings as an alternative to existing offerings, including as an alternative to traditional systems relying on manual tasks and processes. Our customers include law firms and other legal services providers, legal departments of corporate enterprises and organizations and governmental entities. We must convince potential customers of the value of our cloud software platform and that our technologies can automate and simplify legal services more accurately, efficiently and securely than lawyers and their staff and the products of our competitors. This may require significant and costly sales efforts that are targeted at law firms and legal departments of corporate enterprises and organizations and the senior management of these potential customers. In addition, our ability to attract new customers depends in part on our partner ecosystem, consisting of law firms and other legal services providers who resell our product offerings. We must develop and maintain strong relations with our partner ecosystem and convince our partners of the value of our product offerings so that they drive adoption of our product offerings by their customers. Additionally, our platform allows our customers to add other legal industry participants as non-paying users of our platform. Our ability to attract new customers depends in part on our ability to convert the non-paying users. Our success also depends in part on our ability to offer compelling product offerings and the effectiveness of our sales organization. Numerous other factors, many of which are out of our control, may now or in the future impact our ability to acquire new customers, including, but not limited to:

Current wording

We must attract new customers and retain existing customers to continue to grow our business. Our success will depend to a substantial extent on the widespread adoption of our product offerings as an alternative to existing offerings, including as an alternative to traditional systems relying on manual tasks and processes. Our customers include law firms and other legal services providers, legal departments of corporate enterprises and organizations and governmental entities. We must convince potential customers of the value of our cloud software platform and that our product offerings can automate and simplify legal services more accurately, efficiently and securely than lawyers and their staff and the products of our competitors. This may require significant and costly sales efforts that are targeted at law firms and legal departments of corporate enterprises and organizations and the senior management of these potential customers. In addition, our ability to attract new customers depends in part on our partner ecosystem, consisting of law firms and other legal services providers who resell our product offerings. We must develop and maintain strong relations with our partner ecosystem and convince our partners of the value of our product offerings so that they drive adoption of our product offerings by their customers. Additionally, our platform allows our customers to add other legal industry participants as non-paying users of our platform. Our ability to attract new customers depends in part on our ability to convert these non-paying users. Our success also depends in part on our ability to provide compelling product offerings and the effectiveness of our sales organization. Numerous other factors, many of which are out of our control, may now or in the future impact our ability to acquire new customers, including, but not limited to:

Previous wording

•sensitivity to current or future prices offered by us or our competitors;

Current wording

•competitive offerings, including sensitivity to current or future prices offered by us or our competitors;

Previous wording

•our customers’ development of their own proprietary solutions; and

Current wording

•our customers’ development of their own proprietary solutions;

Previous wording

We train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize its potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Current wording

We train our customers in the proper use of and the variety of benefits that can be derived from our product offerings to maximize their potential. Our failure to train customers on how to efficiently and effectively deploy and use our product offerings, or our failure to provide effective support or professional services to our customers, whether actual or perceived, may result in negative publicity or legal actions against us. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services.

Previous wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers and maintain or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Current wording

Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. We outsource substantially all of the infrastructure relating to our cloud-based platform to third-party hosting services. In particular, Amazon Web Services, or AWS, provides the cloud computing infrastructure that we use to host our platform and many of the internal tools we use to operate our business. Customers of our cloud-based platform expect to be able to access our product offerings at any time, without interruption or degradation of performance. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers and maintain or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. Due to the fact that we rely on third-party providers of cloud-based infrastructure to host our cloud-based platform, it may become increasingly difficult to maintain and improve their performance, especially during peak usage times and as our cloud capabilities become more complex and our user traffic increases, because we do not control the infrastructure supporting these services. In addition, any incident affecting our third- party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. If our cloud-based platform is unavailable or if our users are unable to access our cloud-based platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our product offerings, delays in payment to us by customers, injury to our reputation and brand, legal claims against us and the diversion of our resources. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Previous wording

AWS does not have an obligation to renew its agreements with us on commercially reasonable terms, or at all. If we cannot renew our agreement or are unable to renew on commercially reasonable terms, we may experience costs or downtime in connection with the transfer to, or the addition of, new cloud infrastructure or other data centers. If these providers charge high costs for or increase the cost of their services, we will experience higher costs to operate our business and may have to increase the fees to use our product offerings and our operating results may be adversely impacted.

Current wording

Pursuant to our agreement with AWS, AWS has no obligation to renew such agreement with us on commercially reasonable terms, or at all. If we cannot renew our agreement or are unable to renew on commercially reasonable terms, we may not be able to replace the services provided to us in a timely manner or on terms and conditions, including service levels and cost, that are favorable to us. Furthermore, we may experience costs or downtime in connection with the transfer to, or the addition of, new cloud infrastructure or other data centers, resulting in operational delays and inefficiencies until the transition is complete. The transition to another provider or providers would also be technically difficult, expensive and time consuming. If these providers charge high costs for or increase the cost of their services, we will experience higher costs to operate our business and may have to increase the fees to use our product offerings and our operating results may be adversely impacted.

Previous wording

•We expect fluctuations in our financial results which may cause quarterly comparisons not to be meaningful.

Current wording

We expect fluctuations in our financial results, which may cause period-to-period comparisons not to be meaningful.

Previous wording

•the timing and amount of our investments to expand the capacity of our third-party cloud infrastructure providers;

Current wording

•the timing and amount of our investments to expand the capacity of our third-party cloud infrastructure;

Previous wording

Because our substantial growth since inception has resulted in the rapid expansion of our business and revenues, we do not have a long history at our current scale upon which to base forecasts of future revenue and operating results. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Current wording

Given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors, we cannot accurately predict our customers’ usage of our products and services. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.