Gitlab Inc.

Previous wording

We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 8,602 as of January 31, 2024 from 7,002 as of January 31, 2023. The growth and expansion of our business places a continuous significant strain on our management and operational and financial resources. In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, and investment decisions by our customers.

Current wording

We have experienced rapid growth, both in terms of employee headcount and customer growth, as well as increased demand for our products. We anticipate that we will continue to expand our operations and responsibly grow our headcount in the near term, and our success will depend in part on our ability to manage that growth effectively, although there is no assurance that our rate of growth will continue at its current pace. Our total number of Base Customers has grown to 9,893 as of January 31, 2025 from 8,602 as of January 31, 2024. The growth and expansion of our business places a continuous significant strain on our management and operational and financial resources. Inaddition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties. Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and investment decisions by our customers.

Previous wording

Our total revenue for the years ended January 31, 2024 and 2023 was $579.9 million and $424.3 million, respectively, representing a growth rate of 37%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth. Our historical revenue growth should not be considered indicative of our future performance.

Current wording

Our total revenue for the years ended January 31, 2025 and 2024 was $759.2 million and $579.9 million, respectively, representing a growth rate of 31%. You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance. As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth. Our historical revenue growth should not be considered indicative of our future performance.

Previous wording

•product development, including investments in our product development team and the development of new features and functionality for The DevSecOps Platform;

Current wording

•product development, including investments in our product development team and the development of new features and functionality for The DevSecOps platform, including those related to artificial intelligence, or AI;

Previous wording

We have incurred losses in each year since our inception, including net losses of approximately $155.1 million, $172.3 million and $424.2 million in fiscal 2022, fiscal 2023 and fiscal 2024, respectively. As of January 31, 2024, we had an accumulated deficit of approximately $1,149.8 million. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including expanding our research and development function to drive further development of The DevSecOps Platform, expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, including, for example, through our workforce reduction in February 2023, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps Platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Current wording

We have incurred losses in each year since our inception, including net losses of approximately $173.4 million, $425.7 million and $6.3 million in fiscal year 2023, 2024 and 2025, respectively. As of January 31, 2025, we had an accumulated deficit of approximately $1.2 billion. While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability. We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities. In addition to the anticipated costs to continue to grow our business, we also expect to continue to incur significant legal, accounting, and other expenses as a public company. These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, or any inability on our part to capitalize on growth opportunities. Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins. Any failure to increase our revenue or to manage our costs as we continue to grow and invest in our business would prevent us from achieving or maintaining profitability or achieving or maintaining positive operating cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Previous wording

Security incidents compromising the confidentiality, integrity, and availability of our confidential or personal data and our third-party service providers’ information technology systems could result from artificial intelligence, or AI, related sensitive data exposure such as insufficient data anonymization during the training process, system misconfiguration, or from cyber-attacks, including denial-of-service attacks, reverse-engineering of AI algorithms, web scraping, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. Any security breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to the GitLab application or data, including personal and/or confidential information of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Current wording

Security incidents of ours or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result from AI related sensitive data exposure such as insufficient data anonymization during the training process, system misconfiguration, or from cyber attacks, including, but not limited to, denial-of-service attacks, reverse-engineering of AI algorithms, web scraping, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries. Any security breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities. If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential information of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Previous wording

We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify affected individuals, regulatory authorities, and relevant others of security breaches involving certain types of data, including personal data. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach. In addition, in July 2023, the Securities and Exchange Commission, or the SEC, also adopted a new cybersecurity rule requiring companies subject to SEC reporting requirements to formally report material cyber security incidents, where failure to report may result in the SEC imposing injunctions, fines and other penalties.

Current wording

We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify affected individuals, regulatory authorities, and relevant others of security breaches involving certain types of data, including personal data. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and may require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach.

Previous wording

The DevSecOps Platform is built using open-source technology. Using or incorporating any third-party technology can become a vector for supply-chain cyber-attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber-attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber-attacks as a result of our use of open source code, it may substantially damage our reputation and adversely impact our results of operations and financial condition.

Current wording

The DevSecOps platform is built using open-source technology. Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks. Such attacks are prevalent in our industry and our customers’ industries, and our use of open-source technology may, or may be perceived to, leave us vulnerable to security attacks. We have previously been, and may in the future become, the target of cyber attacks by third parties seeking unauthorized access to our or our customers’ data or to disrupt our operations or ability to provide our services. If we are the target of cyber attacks as a result of our use of open source code, it may substantially damage our reputation and adversely affect our business, financial condition, and operating results.

Previous wording

We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which has us competing with many providers with offerings across all stages. We compete with well-established providers such as Atlassian and Microsoft as well as other companies with offerings in fewer stages including with respect to both code hosting and code collaboration services, as well as file storage and distribution services and artificial intelligence, or AI. Many of our competitors are significantly larger than we are and have more capital to invest in their businesses.

Current wording

We face competition in several areas due to the nature of our product. Our product offering is broad across all stages of the software development lifecycle which has us competing with many providers with offerings across all stages. We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.

Previous wording

Many of our current and potential competitors have greater financial, technical, marketing and other resources and larger customer bases than we do. Furthermore, our current or potential competitors may be acquired by third parties with greater available resources and the ability to initiate or withstand substantial price competition. In addition, many of our competitors have established sales and marketing relationships and have access to larger customer bases. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their product offerings or resources. These factors may allow our competitors to respond more quickly than we can to new or emerging technologies and changes in customer preferences. These competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may undercut our pricing policies and allow them to build a larger user base or to monetize that user base more effectively than us. If our competitors’ products, platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected. In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free. If we are unable to achieve our target pricing levels, our operating results would be negatively affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

Current wording

Many of our current and potential competitors have greater financial, technical, marketing and other resources and larger customer bases than we do. Furthermore, our current or potential competitors may be acquired by third parties with greater available resources and the ability to initiate or withstand substantial price competition. In addition, many of our competitors have established sales and marketing relationships and have access to larger customer bases. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their product offerings or resources. These factors may allow our competitors to respond more quickly than we can to new or emerging technologies and changes in customer preferences. These competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may undercut our pricing policies and allow them to build a larger user base or to monetize that user base more effectively than us. If our competitors’ products, platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected.

Previous wording

Many of our users extend the functionality of The DevSecOps Platform using third-party code editors and integrated development environments (IDEs), including editors and IDEs developed by our competitors. Our development and distribution of integrations with such tools is subject to the integration policies and technical specifications imposed by the developer of the tool. A change to the policies and specifications pertaining to any of these third-party tools (including those developed by Microsoft), could cause GitLab to lose market share to competitors whose products and services continue to support integrations with such tools.

Current wording

Many of our users extend the functionality of The DevSecOps platform using third-party code editors and integrated development environments, or IDEs, including editors and IDEs developed by our competitors. Our development and distribution of integrations with such tools is subject to the integration policies and technical specifications imposed by the developer of the tool. A change to the policies and specifications pertaining to any of these third-party tools (including those developed by Microsoft), could cause us to lose market share to competitors whose products and services continue to support integrations with such tools.

Previous wording

We may also encounter service interruptions due to issues interfacing with our customers’ IT systems, including stack misconfigurations or improper environment scaling, or due to cyber security attacks on ours or our customers’ IT systems. Any such service interruption may have an adverse impact on our reputation and future operating results.

Current wording

We may also encounter service interruptions, outage, or disruption due to issues interfacing with our customers’ IT systems, including stack misconfigurations or improper environment scaling, defective updates or upgrades, or due to cybersecurity attacks on ours or our customers’ IT systems. Any such service interruption may have an adverse impact on our reputation and future operating results.

Previous wording

Because of the (nature and importance of the data) that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including customers’ inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain of these events. For example, our customers access our products through their internet service providers. If a service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.

Current wording

Because of the nature and importance of the data that our customers collect and manage by means of our services, it is possible that failures or errors in our systems could result in data loss or corruption, and/or cause the information that we or our customers collect to be incomplete or contain inaccuracies that our customers regard as material. Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including: customers’ inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events. If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues. In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers. Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time. Further, while we have in place a data recovery plan, our data backup systems might fail and our data recovery plans may be insufficient to fully recover all of ours or our customers’ data hosted on our system.

Previous wording

The market for our services is relatively new and unproven and may not grow, which would adversely affect our future results and the trading price of our Class A common stock.

Current wording

The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Previous wording

Our business model depends on generating and maintaining a large user base that is satisfied with The DevSecOps Platform. We rely on satisfied customers to expand their footprint by buying new products and services and onboarding additional users. While we have implemented user limits on our free SaaS product (and plan to implement in the future storage and transfer limitations on our free SaaS product), we have limited historical data with respect to the number of current and previous free users and the rates in which customers convert to paying customers, so we may not accurately predict future customer purchasing trends. In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

Current wording

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities. We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

Previous wording

Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and downtiers may increase, or fluctuate, as a result of a number of factors, including: quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices (including price increases for our Premium tier that were generally implemented in the first quarter of fiscal year 2024), the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.

Current wording

(including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount). If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer. In addition, an increase in the use of online and social media for product promotion and marketing may increase the burden on us to monitor compliance of such materials and increase the risk that such materials could contain problematic product or marketing claims in violation of applicable regulations.

Previous wording

Further, we have previously discontinued certain lower priced product offerings, requiring users of these products to switch to another paid offering, switch to our free product or discontinue using our products. Additionally, we have implemented user limits on our free SaaS product, and plan to implement in the future storage and transfer limitations on our free SaaS product offering. We also announced in the first quarter of fiscal year 2023 storage and transfer limitations on our paid product offerings, the extent and implementation of which varies depending on the tier. To the extent we discontinue or add additional limits on our free or lower-priced product offerings, we cannot assure you that our customers will purchase our products, and if our end customers do not purchase our products, our revenues may grow more slowly than expected or decline.

Current wording

Further, we have previously discontinued certain lower priced product offerings, requiring users of these products to switch to another paid offering, switch to our free product or discontinue using our products. Additionally, we have implemented user limits on our free SaaS product. To the extent we discontinue or add additional limits on our free or lower-priced product offerings, we cannot assure you that our customers will purchase our products, and if our end customers do not purchase our products, our revenues may grow more slowly than expected or decline.

Previous wording

•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including ongoing armed conflicts in different regions of the world;

Current wording

•general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S. presidential election and ongoing armed conflicts in different regions of the world;

Previous wording

As our product offerings mature and expand our pricing and packaging for new products may result in existing customers purchasing new products on less favorable terms to us to replace the existing products they purchase or subscribe for from us.

Current wording

As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

Previous wording

In addition, our customers have no obligation to renew their subscriptions for our services after the expiration of the initial subscription period. A majority of our subscriptions are on a one-year period. Our customers may renew for fewer or other elements of our services or negotiate for different pricing terms. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization. Changes in product packaging, pricing strategy, or product offerings, or the implementation or execution of the foregoing, may not be seen favorably by our customers and may have an adverse effect on our ability to retain our current customers and acquire new ones. For example, we have previously discontinued certain lower priced product offerings, and during fiscal year 2024 we implemented a price increase in our Premium tier product offering, which may cause customers who previously used these tiers to opt for our free version or to cease using our products completely. We may also decide to raise the prices of our product offerings in the future. If our customers do not renew their subscriptions on similar pricing terms, our revenues may decline, and our business could suffer. In addition, over time the average term of our contracts could change based on renewal rates or for other reasons.

Current wording

In addition, our customers have no obligation to renew their subscriptions for our services after the expiration of the initial subscription period. A majority of our subscriptions are on a one-year period. Our customers may renew for fewer or other elements of our services or negotiate for different pricing terms. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization. Changes in product packaging, pricing strategy, or product offerings, or the implementation or execution of the foregoing, may not be seen favorably by our customers and may have an adverse effect on our ability to retain our current customers and acquire new ones. For example, we have previously discontinued certain lower priced product offerings, and we have in the past implemented price increases, which may cause customers who previously used these tiers to opt for our free version or to cease using our products completely. We may also decide to raise the prices of our product offerings in the future. If our customers do not renew their subscriptions on similar pricing terms, our revenues may decline, and our business could suffer. In addition, over time the average term of our contracts could change based on renewal rates or for other reasons.

Previous wording

We are implementing AI features, including generative AI features, throughout our services. The technologies underpinning these features are in the early stages of commercial use and exist in a nascent regulatory environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Current wording

We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features. The technologies underpinning these features are in the early stages of commercial use and exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Previous wording

Many states, regions, and supranational bodies, including the European Union, have proposed new regulations related to the use of AI and machine learning technologies. The final form of these may impose onerous obligations related to our, and our vendors’, development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Current wording

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies, such as the E.U. Artificial Intelligence Act, which came into effect on August 1, 2024. These regulations may impose onerous obligations related to our, and our vendors’, development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Previous wording

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations. Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Current wording

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area. Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Previous wording

Our future success depends, in part, on our ability to convert users of our free self-managed or SaaS product offerings into paying customers by selling additional products, and by upselling additional subscription services. The total number of users of our free SaaS product may decline as a result of, or due to, our enforcement of user limits and our plan to implement in the future storage and transfer limits for our free SaaS product offering. As a result of our investment in new capabilities and improvements to our free product offering, users of our free product may decline to purchase additional products or subscription services if they perceive the free product to be more attractive as compared to our paid offerings. Converting users of our free product offering may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our end-customers purchase additional products and services depends on a number of factors, including the perceived need for additional products and services, the limitations on the number of users and limitations on storage and transfers applicable to the free product offering as well as general economic conditions. If our efforts to sell additional products and services to our end-customers are not successful, our business may suffer.

Current wording

Our future success depends, in part, on our ability to convert users of our free self-managed or SaaS product offerings into paying customers by selling additional products, and by upselling additional subscription services. The total number of users of our free SaaS product may decline as a result of, or due to, our enforcement of user limits. As a result of our investment in new capabilities and improvements to our free product offering, users of our free product may decline to purchase additional products or subscription services if they perceive the free product to be more attractive as compared to our paid offerings. Converting users of our free product offering may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our end-customers purchase additional products and services depends on a number of factors, including the perceived need for additional products and services, the limitations on the number of users and limitations on storage and transfers applicable to the free product offering as well as general economic conditions. If our efforts to sell additional products and services to our end-customers are not successful, our business may suffer.

Previous wording

Any failure to offer high-quality technical support services, including lifecycle services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Current wording

Any failure to offer high-quality technical support services, including success plan services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Previous wording

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the lifecycle services that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.

Current wording

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success plan services that we offer. We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our services and business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, operating results and financial position.

Previous wording

Our current and future customers may demand more customized configuration and integration services, which increase our up-front investment in sales and deployment efforts, with no guarantee that these customers will increase the scope of their subscription. As a result of these factors, we may need to devote a significant amount of sales, support, and professional services resources to individual customers, increasing the cost and time required to complete sales. If prospective customers require customized features or functions that we do not offer, and which would be difficult for them to deploy themselves, then the market for our applications will be more limited and our business could suffer.

Current wording

Our current and future customers may demand more customized configuration and integration services, which increase our up-front investment in sales and deployment efforts, with no guarantee that these customers will increase the scope of their subscription. As a result of these factors, we may need to devote a significant amount of sales, operations, engineering, support, and professional services resources to individual customers, increasing the cost and time required to complete sales. If prospective customers require customized features or functions that we do not offer, and which would be difficult for them to deploy themselves, then the market for our applications will be more limited and our business could suffer.

Previous wording

Further, from time to time, we may receive letters from third parties alleging that we are infringing upon their intellectual property rights or inviting us to license their intellectual property rights. Our technologies and other intellectual property may be found to infringe upon such third-party rights, and such successful claims against us could result in significant monetary liability, prevent us from selling some of our products and services, or require us to change our branding. In addition, resolution of claims may require us to redesign our products, license rights from third parties at a significant expense, or cease using those rights altogether. We may in the future bring claims against third parties for infringing our intellectual property rights. Costs of supporting such litigation and disputes may be considerable, and there can be no assurances that a favorable outcome will be obtained. Patent infringement, trademark infringement, trade secret misappropriation, and other intellectual property claims and proceedings brought against us or brought by us, whether successful or not, could require significant attention of our management and resources and have in the past and could further result in substantial costs, harm to our brand, and have an adverse effect on our business.

Current wording

Further, from time to time, we may receive letters from third parties alleging that we are infringing upon their intellectual property rights or inviting us to license their intellectual property rights. Our technologies and other intellectual property may be found to infringe upon such third-party rights, and such successful claims against us could result in significant monetary liability, prevent us from selling some of our products and services, or require us to change our branding. In addition, resolution of claims may require us to redesign our products, license rights from third parties at a significant expense, or cease using those rights altogether. And we may in the future bring claims against third parties for infringing our intellectual property rights. Costs of supporting such litigation and disputes may be considerable, and there can be no assurances that a favorable outcome will be obtained. Patent infringement, trademark infringement, trade secret misappropriation, and other intellectual property claims and proceedings brought against us or brought by us, whether successful or not, could require significant attention of our management and resources and have in the past and could further result in substantial costs, harm to our brand, and have an adverse effect on our business.

Previous wording

We have from time to time been, and are likely to in the future become, defendants in actual or threatened lawsuits brought by or on behalf of our current and former team members, competitors, vendors, governmental or regulatory bodies, or third parties who use The DevSecOps Platform. In addition, our agreements sometimes include indemnification provisions which can subject us to costs and damages in the event of a claim against an indemnified third party. In either case, the various claims in such lawsuits may include, among other things, negligence or misconduct in the operation of our business and provision of services, intellectual property infringement, unfair competition, or violation of employment or privacy laws or regulations. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate. However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits. In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions. An unfavorable outcome with respect to these lawsuits and any future lawsuits could, individually or in the aggregate, cause us to incur substantial liabilities that may have a material adverse effect upon our business, financial condition or results of operations. In addition, an unfavorable outcome in one or more of these cases could cause us to change our compensation plans for our team members, which could have a material adverse effect upon our business. Further, while we maintain insurance that may provide coverage for these types of lawsuits and other claims, such coverage may not be adequate to cover the related costs and other liabilities.

Current wording

We have from time to time been, and are likely to in the future become, defendants in actual or threatened lawsuits brought by or on behalf of our current and former team members, competitors, vendors, shareholders, governmental or regulatory bodies, or third parties who use The DevSecOps platform. In addition, our agreements sometimes include indemnification provisions which can subject us to costs and damages in the event of a claim against an indemnified third party. In either case, the various claims in such lawsuits may include, among other things, negligence or misconduct in the operation of our business and provision of services, intellectual property infringement, unfair competition, or violation of employment or privacy laws or regulations. Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees. Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate. However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits. In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions. An unfavorable outcome with respect to these lawsuits and any future lawsuits could, individually or in the aggregate, cause us to incur substantial liabilities that may have a material adverse effect upon our business, financial condition or results of operations. In addition, an unfavorable outcome in one or more of these cases could cause us to change our compensation plans for our team members, which could have a material adverse effect upon our business. Further, while we maintain insurance that may provide coverage for these types of lawsuits and other claims, such coverage may not be adequate to cover the related costs and other liabilities.

Previous wording

The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, deferred contract acquisition costs, income taxes, business combination, stock-based compensation and common stock valuations. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

Current wording

The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, business combinations, and impairment of goodwill. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

Previous wording

The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Recent legal developments in the E.U. have created complexity and uncertainty regarding such transfers. For example, on July 16, 2020, the European Court of Justice, or the CJEU, invalidated the E.U.-U.S. Privacy Shield framework, or the Privacy Shield. Further, the CJEU also advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential alternative to the Privacy Shield) were not alone sufficient to protect data transferred to the United States or other countries not deemed adequate. On July 10, 2023, the European Commission entered into force the E.U.-U.S. Data Privacy Framework, or the DPF, as a successor framework to the Privacy Shield. Under the DPF, certified U.S.-based organizations may receive transfers of personal data from the E.E.A. and the U.K. However, there are uncertainties regarding the long-term viability of the DPF due to proposed legal challenges to the framework before the CJEU. Thus, the Standard Contractual Clauses will remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board issued additional guidance regarding the CJEU’s decision in November 2020, which imposes higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers. The CJEU also stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, Supervisory Authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated in January 2022 that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. persona…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The GDPR and U.K. GDPR requires, among other things, that personal data only be transferred outside of the European Economic Area, or the E.E.A., or the U.K., respectively, to jurisdictions that have not been deemed adequate by the European Commission or by the U.K. data protection regulator, respectively, including the United States, if certain safeguards are taken to legitimize those data transfers. Legal developments in the E.U. have resulted in complexity and uncertainty regarding such transfers. For example, the European Court of Justice, or the CJEU, has previously advised that the Standard Contractual Clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism) are not alone sufficient to protect data transferred to the United States or other countries not deemed adequate and the current E.U.-U.S. Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A. and the U.K, has been subject to proposed legal challenges before the CJEU. Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A. and the U.K., but the use of Standard Contractual Clauses must still be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place. The European Data Protection Board has also issued a decision imposing higher burdens on the use of data transfer mechanisms, such as the Standard Contractual Clauses, for cross-border data transfers and the CJEU has stated that if a competent supervisory authority believes that the Standard Contractual Clauses cannot be complied with in the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Since the decision by the CJEU, supervisory authorities, including the CNIL and the Austrian Data Protection Authority, are now looking at cross-border transfers more closely, and have publicly stated that the transfer of data to the United States using certain analytics tools is illegal. While these decisions related specifically to analytics tools and may be inapplicable to organizations certified under the DPF, it has been suggested that it is far-reaching and applies to any transfer of E.U. personal data to the United States. We will continue to monitor this situation, and evaluate and utilize, where appropriate, all data transfer mechanisms available to us, but this may require the removal of tools from our services and websites where data is transferred from the E.U. to the United States, or impact the manner in which we provide our services, which could adversely affect our business. In additio…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, following the U.K.’s withdrawal from the E.U., the E.U. issued an adequacy decision in June 2021 in favor of the U.K. permitting data transfers from the E.U. to the U.K. However, this adequacy decision is subject to a four-year term, and the E.U. could intervene during the term if it determines that the data protection laws in the U.K. are not sufficient. If the adequacy decision is not renewed after its term, or the E.U. intervenes during the term, data may not be able to flow freely from the E.U. to the U.K. unless additional measures are taken. In which case, we may be required to find alternative solutions for the compliant transfer of personal data into the U.K. from the E.U. As supervisory authorities continue to issue further guidance on personal data (including regarding data export and circumstances in which we cannot use the Standard Contractual Clauses), we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

Current wording

In addition, following the U.K.’s withdrawal from the E.U., the E.U. issued an adequacy decision in June 2021 in favor of the U.K. permitting data transfers from the E.U. to the U.K. However, this adequacy decision is subject to a four-year term set to expire in 2025, and the E.U. could intervene during the term if it determines that the data protection laws in the U.K. are not sufficient. If the adequacy decision is not renewed after its term, or the E.U. intervenes during the term, data may not be able to flow freely from the E.U. to the U.K. unless additional measures are taken. In which case, we may be required to find alternative solutions for the compliant transfer of personal data into the U.K. from the E.U. As supervisory authorities continue to issue further guidance on personal data (including regarding data export and circumstances in which we cannot use the Standard Contractual Clauses), we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

Previous wording

We are also subject to evolving E.U. and U.K. privacy laws on cookies and e-marketing. In the E.U. and the U.K., regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive are highly likely to be replaced by an E.U. regulation known as the ePrivacy Regulation which will significantly increase fines for non-compliance. In the E.U. and the U.K., informed consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing. The U.K. GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. While the text of the ePrivacy Regulation is still under development, a recent European court decision and regulators’ recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

Current wording

We are also subject to evolving E.U. and U.K. privacy laws on cookies and e-marketing. In the E.U. and the U.K., regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may increase fines for non-compliance. In the E.U. and the U.K., informed consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing. The U.K. GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Further, a recent European court decision and regulators’ recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

Previous wording

Additionally, we are subject to the California Consumer Privacy Act, or the CCPA, which came into effect in 2020 and increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation. Additionally, in November 2020, California passed the California Privacy Rights Act, or the CPRA, which expands the CCPA significantly, including by expanding consumers’ rights with respect to certain personal data and creating a new state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Many of the CPRA’s provisions became effective on January 1, 2023. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Current wording

Additionally, we are subject to the California Consumer Privacy Act, or the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data. The CCPA, among other things, requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Compliance with privacy legislation adds complexity and has required and may in the future require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. Changing definitions of personal data and information may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Also, some jurisdictions require that certain types of data be retained on servers within these jurisdictions. Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Previous wording

In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC, and collectively, Trade Controls. As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. For example, the recent Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries and have sanctioned various entities and individuals located there. Those Trade Controls, which are unprecedented and expansive, continue to evolve and further restrict our ability to do business in that region. Processing payments from those customers, even when legally permissible, has become very difficult, in part because most U.S. and E.U. banks are unwilling to facilitate those transactions. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

Current wording

In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC, and collectively, Trade Controls. As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. For example, Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries, and have sanctioned various entities and individuals located there, while recent sanctions restrict the provision of certain cloud services to Russia. Those Trade Controls are unprecedented and expansive, and may continue to evolve. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

Previous wording

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010 and possibly other anti-bribery and anti-money laundering laws in countries outside of the United States in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their team members, and their third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

Current wording

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010 and other anti-bribery and anti-money laundering laws in countries outside of the United States in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their team members, and their third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

Previous wording

Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive, and time-consuming, often requiring significant up-front time and expense without any assurance that these efforts will generate a sale. Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained the revised certification. Government demand and payment for our products may be affected by public sector budgetary cycles, funding authorizations, government shutdowns, and general political priorities, with funding reductions or delays adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products.

Current wording

Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive, and time-consuming, often requiring significant up-front time and expense without any assurance that these efforts will generate a sale. Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained the revised certification. Government demand and payment for our products may be affected by public sector budgetary cycles, funding authorizations, government shutdowns, and general political priorities and initiatives, with funding delays, or reductions or eliminations, adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products. The U.S. federal government and other government entities are in the process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

Previous wording

Government entities may have statutory, contractual, or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.

Current wording

Government entities may have statutory, contractual, or other legal rights to terminate contracts with us for convenience, including in connection with political priorities or initiatives, or due to a default, and any such termination may adversely affect our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.

Previous wording

Historically, we have experienced seasonality in new customer contracts, as we typically enter into a higher percentage of subscription agreements with new customers and renewals with existing customers in the last two fiscal quarters of each year. We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. We expect that this seasonality, which can itself at times be unpredictable, will continue to affect our bookings, deferred revenue, and our results of operations in the future and might become more pronounced as we continue to target larger enterprise customers.

Current wording

Historically, we have experienced seasonality in new customer contracts, as we typically enter into a higher percentage of subscription agreements with new customers and renewals with existing customers in the last two fiscal quarters of each year. We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. We expect that this seasonality, which can itself at times be unpredictable, will continue to affect our bookings, deferred revenue, and our results of operations in the future and might become more pronounced as we continue to target larger enterprise customers.

Previous wording

Our results of operations may fluctuate, in part, because of the length and variability of the sales cycle of our subscriptions and the difficulty in making short-term adjustments to our operating expenses. The length of our sales cycle, from initial contact from a prospective customer to contractually committing to our paid subscriptions can vary substantially from customer to customer based on deal complexity as well as whether a sale is made directly by us. It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers, the timing of our customers’ decisions to make a purchase, greater deal scrutiny by our customers, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. Our results of operations depend in part on sales to new large customers and increasing sales to existing customers. As a result, in particular, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. Because a substantial proportion of our expenses are relatively fixed in the short term, our results of operations will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our Class A common stock to decline.

Current wording

Our results of operations may fluctuate, in part, because of the length and variability of the sales cycle of our subscriptions and the difficulty in making short-term adjustments to our operating expenses. The length of our sales cycle, from initial contact from a prospective customer to contractually committing to our paid subscriptions can vary substantially from customer to customer based on deal complexity as well as whether a sale is made directly by us. It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers, the timing of our customers’ decisions to make a purchase, greater deal scrutiny by our customers, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector. Our results of operations depend in part on sales to new large customers and increasing sales to existing customers. As a result, in particular, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. Because a substantial proportion of our expenses are relatively fixed in the short term, our results of operations will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our Class A common stock to decline.

Previous wording

Our future success is dependent, in part, on our ability to hire, integrate, train, retain and motivate the members of our management team and other key team members throughout our organization. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, finance, support, product development, human resources, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business. In particular, we are highly dependent on the services of Sytse Sijbrandij, our co-founder, Chair of the board of directors and Chief Executive Officer, who is critical to the development of our technology, services, future vision and strategic direction.

Current wording

Our future success is dependent, in part, on our ability to hire, integrate, train, retain and motivate the members of our management team and other key team members throughout our organization. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, finance, support, product development, human resources, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.