CS Disco, Inc.

Previous wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR and UK GDPR permit data protection authorities to impose large penalties for violations of the regulations, including potential fines of up to €20 million under the EU GDPR, £17.5 million under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provide individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Current wording

The EU GDPR and UK GDPR are wide-ranging in scope and impose numerous requirements, including requiring that consent of individuals to whom the personal information relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal information, creating mandatory data breach notification requirements in certain circumstances and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The EU GDPR and UK GDPR, each permit data protection authorities to impose large penalties for violations of the regulations, including potential fines of up to €20 million under the EU GDPR, £17.5 million under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR and UK GDPR also provide individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confer a private rights of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR and UK GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information.

Previous wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Current wording

Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, the EU GDPR generally restricts the transfer of personal information to countries outside the European Economic Area, or EEA, absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, supply-chain attacks, infrastructure failures, operational errors resulting in breaches of service level agreements, and attacks or vulnerabilities enhanced or enabled by artificial intelligence. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, accidentally providing a customer with access to or copies of another customer’s confidential information, or unauthorized and exfiltration of customer data generally. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For ex…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our information technology systems and those of third parties with whom we work are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Cyberattacks and other malicious internet-based activity continue to increase and are increasingly difficult to detect, respond to and mitigate. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, supply-chain attacks, infrastructure failures, operational errors resulting in breaches of service level agreements, and attacks or vulnerabilities enhanced or enabled by artificial intelligence. In addition to traditional computer “hackers,” threat actors, internal personnel, sophisticated nation-state and nation-state supported actors and organized criminals now engage in attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, accidentally providing a customer with access to or copies of another customer’s confidential information, or unauthorized exfiltration of customer data generally. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For exampl…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible. For example, our customers are responsible for configuring multi-factor authentication on their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships reputation, and revenue in the future may be adversely impacted.

Current wording

We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible. For example, our customers are responsible for configuring multi-factor authentication on their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships reputation, and future revenue may be adversely impacted.

Previous wording

If we, or the third parties with whom we work, experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restriction of our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and material attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches. We cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Current wording

If we, or the third parties with whom we work, experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrictions on our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and material attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We could be required to fundamentally change our business activities and practices or modify our product offerings and/or platform capabilities, which could have an adverse effect on our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches. Although we maintain cybersecurity insurance, we cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Previous wording

We have incorporated artificial intelligence, or AI, including generative artificial intelligence features into our product and services as well as our internal operations. The incorporation of AI technologies has the potential to result in adverse effects to our financial condition, results or reputation. The use of AI technologies and processes at scale is relatively new and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. AI features may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development and maintenance of the technology used, and our customers’ reluctance or failure to adopt or implement our new products and features as intended.

Current wording

We have incorporated artificial intelligence, or AI, including generative artificial intelligence features into our product offerings and services as well as our internal operations. The incorporation of AI technologies has the potential to result in adverse effects to our financial condition, results or reputation. The use of AI technologies and processes at scale is relatively new and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. AI features may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development and maintenance of the technology used, and our customers’ reluctance or failure to adopt or implement our new products and features as intended.

Previous wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

Current wording

In addition to these cybersecurity and operational risks, our use of AI technologies exposes us to privacy and other regulatory risks. Our employees and other personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in connection with these technologies are subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI technologies. Our use of these technologies could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

Previous wording

The development and use of AI technologies presents various privacy and security risks that may impact our business. AI technologies are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. For example, the autonomous nature of agentic AI may present challenges in aligning with current AI governance, including testing protocols, and increase risk that agents may learn to circumvent guardrails. Further, countries and states are applying their data and consumer protection laws to AI technologies, and particularly generative AI and interactive chatbots. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI technologies, such as the EU’s AI Act, the Colorado Artificial Intelligence Act, California Bot Disclosure Law, the Utah Artificial Intelligence Policy Act, and the CCPA regulations on automated decision-making technology. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI technologies. These obligations may make it harder for us to conduct our business using AI technologies, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI technologies, or prevent or limit our use of AI technologies. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI technologies where they allege the company has violated privacy and consumer protection laws. If we cannot use AI technologies or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

The development and use of AI technologies are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny, which may further complicate our management of the privacy and security risks described above. For example, the autonomous nature of agentic AI may present challenges in aligning with current AI governance, including testing protocols, and increase risk that agents may learn to circumvent guardrails. Further, countries and states are applying their data and consumer protection laws to AI technologies, and particularly generative AI and interactive chatbots. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI technologies, such as the EU’s AI Act, the Colorado Artificial Intelligence Act, California Bot Disclosure Law, the Utah Artificial Intelligence Policy Act, and the CCPA regulations on automated decision-making technology. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI technologies. These obligations may make it harder for us to conduct our business using AI technologies, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI technologies, or prevent or limit our use of AI technologies. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI technologies where they allege the company has violated privacy and consumer protection laws. If we cannot use AI technologies or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. You should not rely on the revenue growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues have increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Current wording

We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. You should not rely on the revenue or other business-related growth reflected by any prior quarterly or annual period as an indication of our future performance. Although our revenues have increased year over year, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities. Overall growth of our revenue depends on a number of factors, including our ability to:

Previous wording

The rapid growth we have experienced in our business places significant demands on our operational infrastructure. As usage of our product offerings grows, we will need to devote additional resources to improving and maintaining our infrastructure and integrating with third-party applications, including open source software. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support and professional services, to serve our growing customer base. Any failure of or delay in these efforts could lead to impaired system performance and reduced customer satisfaction, resulting in decreased sales to customers, lower dollar-based net retention rates, the issuance of service credits or requested refunds, which would hurt our revenue growth and our reputation. Even if we are successful in our expansion efforts, they will be expensive and complex, and require the dedication of significant management time and attention. We could also face inefficiencies or service disruptions as a result of our efforts to scale our internal infrastructure. We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition and results of operations.

Current wording

The rapid growth we have experienced in our business places significant demands on our operational infrastructure. As usage of our product offerings grows and our operational needs change, we will need to devote additional resources to improving and maintaining our infrastructure and integrating with third-party applications, including open source software. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support and professional services, to serve our growing customer base. Any failure of or delay in these efforts could lead to impaired system performance and reduced customer satisfaction, resulting in decreased sales to customers, lower dollar-based net retention rates, the issuance of service credits or requested refunds, which would hurt our revenue growth and our reputation. Even if we are successful in our expansion efforts, they will be expensive and complex, and require the dedication of significant management time and attention. We could also face inefficiencies or service disruptions as a result of our efforts to scale our internal infrastructure. We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition and results of operations.

Previous wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters, including as a result of reduced levels of enforcement by certain federal agencies under President Trump, delays in the advancement of ongoing litigation in the federal courts as a result of the recent or future shutdowns of the U.S. government, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Current wording

Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. If our customers do not increase their usage of our product offerings, our revenue may decline and our results of operations may be harmed. Most of our customers do not have long-term contractual financial commitments to us and, therefore, may reduce or cease their use of our product offerings at any time. Customers may terminate or reduce their use of our product offerings for any number of reasons, including the settlement or other resolution of legal matters, reductions in the volume of major legal matters experienced, including as a result of reduced levels of enforcement by certain federal agencies under President Trump, delays in the advancement of ongoing litigation in the federal courts as a result of past or future shutdowns of the U.S. government, customer budget constraints, customer satisfaction or negative perceptions as to the reliability of our product offerings relative to traditional methods of performing legal services, changes in our customers’ underlying businesses and financial conditions, pricing changes, legal industry trends away from litigation toward alternative forms of dispute resolution, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, competitive conditions and general economic conditions. The loss of customers or reductions in their usage of our product offerings may each have a negative impact on our business, results of operations and financial condition. In addition, even if our customers expand their usage of our product offerings, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

Previous wording

The success of our strategy to establish and maintain relationships with law firms and other legal services providers also depends in part on the ability of these partners to generate and maintain business with their own clients. If the clients of our law firm and other legal services provider partners reduce their legal spending or move their business to other firms or legal services providers with whom we do not partner for any reason, usage of our product offerings may decline and our business, operating results and financial condition may be adversely affected. For example, in March 2025, President Trump issued executive orders against certain law firms with whom we partner, which could have the effect of restricting the ability of such firms to practice law in matters involving the federal government or under the jurisdiction of the federal court system. While we have not to date observed any adverse impact to our revenue generated from these law firm partners as a result of the executive orders, the validity of these executive orders continues to be litigated in the federal court system and we cannot be certain that there will be no future adverse impact on our law firm partners’ usage of our product offerings or that our law firm partners’ clients will continue to engage such firms for their legal services.

Current wording

The success of our strategy to establish and maintain relationships with law firms and other legal services providers also depends in part on the ability of these partners to generate and maintain business with their own clients. If the clients of our law firm and other legal services provider partners reduce their legal spending or move their business to other firms or legal services providers with whom we do not partner for any reason, usage of our product offerings may decline and our business, operating results and financial condition may be adversely affected. For example, in March 2025, President Trump issued executive orders against certain law firms with whom we partner, which could have the effect of restricting the ability of such firms to practice law in matters involving the federal government or under the jurisdiction of the federal court system. While we have not to date observed any adverse impact to our revenue generated from these law firm partners as a result of the executive orders, the validity of certain of these executive orders continues to be litigated in the federal court system and we cannot be certain that there will be no future adverse impact on our law firm partners’ usage of our product offerings or that our law firm partners’ clients will continue to engage such firms for their legal services.

Previous wording

New technology such as generic large language models, generative AI and general-purpose agents are evolving rapidly and may significantly alter how technology is developed, distributed and consumed. In the future, we may face increased competition from these offerings evolving to address a broad range of business needs. As we attempt to sell our product offerings to new and existing customers, we may need to demonstrate that our product offerings are superior to other available solutions, including existing and any new competitors.

Current wording

New technology such as generic large language models (“LLMs”), generative AI and general-purpose agents are evolving rapidly and may significantly alter how technology is developed, distributed and consumed. In the future, we may face increased competition from these offerings evolving to address a broad range of business needs. As we attempt to sell our product offerings to new and existing customers, we may need to demonstrate that our product offerings are superior to other available solutions, including existing and any new competitors.

Previous wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward, including in connection with our recently announced evolution to our pricing model, and, if it fails to gain acceptance, our business could be harmed. In addition, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. This risk may be further exacerbated as we focus on attracting and retaining customers with significant annual ediscovery spend, large practice teams, and practices in legal areas with significant ediscovery needs. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.

Current wording

We generally charge our customers for their usage of our product offerings across a variety of dimensions of usage. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward, including in connection with our changes to our pricing model, and, if it fails to gain acceptance, our business could be harmed. In addition, we have changed our pricing model in the past and expect that we may need to change it in the future. As the market for our product offerings matures and technology changes and improves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, frequent or significant users of our product offerings may demand substantial price concessions. This risk may be further exacerbated as we focus on attracting and retaining customers with significant annual ediscovery spend, large practice teams, and practices in legal areas with significant ediscovery needs. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow.

Previous wording

Once our product offerings are deployed, our customers sometimes request consulting and training to assist them in integrating our product offerings into their business and rely on our customer support personnel to resolve issues and realize the full benefits that our product offerings provide. Our ability to provide effective customer support is largely dependent on our ability to attract, train and retain qualified personnel with experience in supporting customers with a cloud platform such as ours and maintaining the same. If we are unable to provide sufficient high-quality consulting, training, integration and maintenance resources, our customers may not effectively integrate our product offerings into their business or realize sufficient business value from our product offerings to justify further usage, which could impact our future financial performance. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for technical support or maintenance assistance. We also may be unable to modify the future, scope and delivery of our maintenance services and technical support to compete with changes in the technical services provided by our competitors. Increased customer demand for support and professional services, without corresponding revenue, could increase costs and negatively affect our operating results. In addition, as we continue to grow our operations and support our global customer base, we need to be able to continue to provide efficient support and effective maintenance that meets our customers’ needs globally at scale. Our ability to attract new customers is highly dependent on our business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality support services, or a market perception that we do not maintain high-quality support services for our customers, would harm our business.

Current wording

Once our product offerings are deployed, our customers sometimes request consulting and training to assist them in integrating our product offerings into their business and rely on our customer support personnel to resolve issues and realize the full benefits that our product offerings provide. Our ability to provide effective customer support is largely dependent on our ability to attract, train and retain qualified personnel with experience in supporting customers with a cloud platform such as ours and maintaining the same. If we are unable to provide sufficient high-quality consulting, training, integration and maintenance resources, our customers may not effectively integrate our product offerings into their business or realize sufficient business value from our product offerings to justify further usage, which could impact our future financial performance. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for technical support or maintenance assistance. We also may be unable to modify the nature, scope and delivery of our maintenance services and technical support to compete with changes in the technical services provided by our competitors. Increased customer demand for support and professional services, without corresponding revenue, could increase costs and negatively affect our operating results. In addition, as we continue to grow our operations and support our global customer base, we need to be able to continue to provide efficient support and effective maintenance that meets our customers’ needs globally at scale. Our ability to attract new customers is highly dependent on our business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality support services, or a market perception that we do not maintain high-quality support services for our customers, would harm our business.

Previous wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally, particularly in India and the United Kingdom, respectively. For the three months ended June 30, 2026, the percentage of revenue generated from customers outside the United States was 12% of our total revenue. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. In connection with such expansion, we may face difficulties, including costs associated with expansion, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycle difficulties in collecting accounts receivable in some countries, increased management, travel, infrastructure and legal compliance costs associated with having operations and developing our business in multiple jurisdictions, different technical standards, existing or future regulatory and certification requirements and required features and functionality, political and economic conditions and uncertainty in each country or region in which we operate and general economic and political conditions and uncertainty around the world, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries and a geographically and culturally diverse workforce and customer base. In addition, our product offerings have been developed with a focus on the practice of law in the United States and the rules and regulations applicable domestically in the United States and we may be required to expend substantial time and resources to update our product offerings or develop new applications to address alternative systems of legal resolution in other jurisdictions. Furthermore, in certain jurisdictions in which we seek to enter, the rules and regulations governing the practice of law and e-discovery may impose additional obligations or restrictions on our operations. Failure to overcome any of these difficulties could harm our business.

Current wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally, particularly in India and the United Kingdom, respectively. For the three and nine months ended September 30, 2026, the percentage of revenue generated from customers outside the United States was 12% of our total revenue. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. In connection with such expansion, we may face difficulties, including costs associated with expansion, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycle difficulties in collecting accounts receivable in some countries, increased management, travel, infrastructure and legal compliance costs associated with having operations and developing our business in multiple jurisdictions, different technical standards, existing or future regulatory and certification requirements and required features and functionality, political and economic conditions and uncertainty in each country or region in which we operate and general economic and political conditions and uncertainty around the world, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries and a geographically and culturally diverse workforce and customer base. In addition, our product offerings have been developed with a focus on the practice of law in the United States and the rules and regulations applicable domestically in the United States and we may be required to expend substantial time and resources to update our product offerings or develop new applications to address alternative systems of legal resolution in other jurisdictions. Furthermore, in certain jurisdictions in which we seek to enter, the rules and regulations governing the practice of law and ediscovery may impose additional obligations or restrictions on our operations. Failure to overcome any of these difficulties could harm our business.

Previous wording

The imposition of substantial new tariffs and other restrictive trade policies by the U.S. government have created a dynamic and unpredictable trade landscape, which may adversely impact our business. Although our current business model is not directly reliant on the import or export of physical goods, trade policies may indirectly adversely impact our business and operations. For example, current and future tariffs on hardware, networking infrastructure or other technology infrastructure used by us or our third-party vendors could raise costs, constrain supply or affect service reliability, which could harm our competitive position, reduce customer demand and damage customer relationships.

Current wording

The imposition of substantial tariffs and other restrictive trade policies by the U.S. government has created a dynamic and unpredictable trade landscape, which may adversely impact our business. Although our current business model is not directly reliant on the import or export of physical goods, trade policies may indirectly adversely impact our business and operations. For example, current and future tariffs on hardware, networking infrastructure or other technology infrastructure used by us or our third-party vendors could raise costs, constrain supply or affect service reliability, which could harm our competitive position, reduce customer demand and damage customer relationships.

Previous wording

As of June 30, 2026, we had 16 granted U.S. patents and 21 pending U.S. patent applications related to our platform and its technology. We cannot assure you that any of our patent applications will result in the issuance of a patent or that the examination process will not require us to narrow our claims. Any patents that issue from any patent applications may not give us the protection that we seek or may be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be valid and enforceable in actions against alleged infringers. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law, or because of technology developed prior to the inventions we have sought to patent or because of defects in our patent prosecution process.

Current wording

As of September 30, 2026, we had 16 granted U.S. patents and 24 pending U.S. patent applications related to our platform and its technology. We cannot assure you that any of our patent applications will result in the issuance of a patent or that the examination process will not require us to narrow our claims. Any patents that issue from any patent applications may not give us the protection that we seek or may be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be valid and enforceable in actions against alleged infringers. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law, or because of technology developed prior to the inventions we have sought to patent or because of defects in our patent prosecution process.

Previous wording

In addition, there were 0.2 million shares of common stock issuable upon the exercise of options and 7.7 million shares of common stock issuable upon the vesting and settlement of restricted stock units and performance-based restricted stock units outstanding as of June 30, 2026. We have registered all of the shares of common stock issuable upon the exercise of outstanding options or other equity incentives we may grant in the future, for public resale under the Securities Act. The shares of common stock will become eligible for sale in the public market to the extent such options are exercised.

Current wording

In addition, there were 0.2 million shares of common stock issuable upon the exercise of options and 7.0 million shares of common stock issuable upon the vesting and settlement of restricted stock units and performance-based restricted stock units outstanding as of September 30, 2026. We have registered all of the shares of common stock issuable upon the exercise of outstanding options or other equity incentives we may grant in the future, for public resale under the Securities Act. The shares of common stock will become eligible for sale in the public market to the extent such options are exercised.

Previous wording

Act, creates concurrent jurisdiction for federal and state courts over all such Securities Act actions. Accordingly, both state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation will further provide that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause or causes of action arising under the Securities Act, including all causes of action asserted against any defendant to such complaint. For the avoidance of doubt, this provision is intended to benefit and may be enforced by us, our officers and directors, the underwriters to any offering giving rise to such complaint and any other professional entity whose profession gives authority to a statement made by that person or entity and who has prepared or certified any part of the documents underlying the offering.

Current wording

The provisions would not apply to suits brought to enforce a duty or liability created by the Securities Exchange Act of 1934, as amended, or the Exchange Act. Furthermore, Section 22 of the Securities Act of 1933, as amended, or the Securities Act, creates concurrent jurisdiction for federal and state courts over all such Securities Act actions. Accordingly, both state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation will further provide that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause or causes of action arising under the Securities Act, including all causes of action asserted against any defendant to such complaint. For the avoidance of doubt, this provision is intended to benefit and may be enforced by us, our officers and directors, the underwriters to any offering giving rise to such complaint and any other professional entity whose profession gives authority to a statement made by that person or entity and who has prepared or certified any part of the documents underlying the offering.