DOMO, INC.

Previous wording

We incurred net losses of $105.6 million, $75.6 million and $81.9 million for the years ended January 31, 2023, 2024 and 2025, respectively, and had an accumulated deficit of $1,487.5 million at January 31, 2025. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Current wording

We incurred net losses of $75.6 million, $81.9 million and $59.3 million for the years ended January 31, 2024, 2025 and 2026, respectively, and had an accumulated deficit of $1,546.9 million at January 31, 2026. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Previous wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,487.5 million as of January 31, 2025. We have also experienced negative or close to breakeven cash flows from operating activities, including cash provided by operating activities of $2.6 million and cash used in operating activities of $9.1 million for the years ended January 31, 2024 and 2025, respectively. As of January 31, 2025, we had $45.3 million of cash and cash equivalents, which were held for working capital purposes. Additionally, no amounts were available to draw under our credit facility.

Current wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,546.9 million as of January 31, 2026. We have also experienced negative or close to breakeven cash flows from operating activities, including cash used by operating activities of $9.1 million and cash provided by operating activities of $7.9 million for the years ended January 31, 2025 and 2026, respectively. As of January 31, 2026, we had $43.0 million of cash and cash equivalents, which were held for working capital purposes. Additionally, no amounts were available to draw under our credit facility.

Previous wording

•general economic and political conditions, both domestically and internationally, including the impacts of pandemics or other catastrophic events, military conflicts (including the Russian invasion of Ukraine, and hostilities between Israel and Hamas), inflation, and adverse impacts to the financial services industry, as well as economic conditions specifically affecting industries in which our customers operate.

Current wording

•general economic and political conditions, both domestically and internationally, including the impacts of pandemics or other catastrophic events, military conflicts (including the Russian invasion of Ukraine, and hostilities in the Middle East, inflation, and adverse impacts to the financial services industry, as well as economic conditions specifically affecting industries in which our customers operate.

Previous wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.

Current wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures annually and instead required taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases. The One Big Beautiful Bill Act (or OBBBA), enacted on July 4, 2025, made a number of changes to U.S. federal income tax law, including allowing taxpayers to deduct certain U.S. research and development expenditures (while continuing to require taxpayers to capitalize and amortize foreign research and development expenditures), changing the calculation and deductibility of global intangible low-taxed income (renamed Net CFC Tested Income) and foreign derived intangibles income (renamed Foreign-Derived Deduction Eligible Income) for taxable years beginning after December 31, 2025, reinstating 100% deductibility of bonus depreciation for property placed in service after January 19, 2025, and changing the calculation of deductible business interest expense to include depreciation and amortization, among other changes. While we do not anticipate any material impact to our financial statements, primarily due to the full valuation allowance on net deferred tax assets, and no material permanent tax differences are expected, we are continuing to analyze the potential impact of the OBBBA and other legislation on our operations, business and financial performance.

Previous wording

Further, many countries and the Organization for Economic Cooperation and Development have proposed to reallocate some portion of profits of large multinational companies to markets where sales arise, known as “Pillar One,” as well as enact a global minimum tax rate of at least 15% for multinationals with global revenue exceeding certain thresholds, known as “Pillar Two,” and many countries have adopted or intend to adopt these proposals. Changes to these and other areas in relation to international tax reform, including future actions taken by foreign governments, could increase uncertainty and may adversely affect our tax rate and operating results in future years.

Current wording

Further, many countries and the Organization for Economic Cooperation and Development have proposed to reallocate some portion of profits of large multinational companies to markets where sales arise, known as “Pillar One,” as well as enact a global minimum tax rate of at least 15% for multinationals with global revenue exceeding certain thresholds, known as “Pillar Two,” and many countries have adopted or intend to adopt these proposals. The OECD and participating jurisdictions have agreed to a “side-by-side” elective safe harbor that exempts electing U.S.-parented multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. Changes to these and other areas in relation to international tax reform, including future actions taken by foreign governments could increase uncertainty and may adversely affect our tax rate and operating results in future years.

Previous wording

As of January 31, 2025, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,183.2 million and $1,364.4 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Current wording

As of January 31, 2026, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,289.3 million and $1,414.7 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Previous wording

Even if we do attract customers, the cost of new customer acquisition may prove so high as to prevent us from achieving or sustaining profitability. We recognize subscription revenue ratably over the term of the subscription period. In general, customer acquisition costs and other upfront costs associated with new customers are much higher in the first year than the aggregate revenue we recognize from those new customers in the first year. As a result, the profitability of a customer to our business in any particular period depends in part upon how long a customer has been a subscriber and the degree to which it has expanded its usage of our platform. Additionally, we intend to continue to hire additional sales personnel to grow our domestic and international operations. If our sales and marketing efforts do not result in substantial increases in revenue, our business, results of operations, and financial condition may be adversely affected.

Current wording

Even if we do attract customers, the cost of new customer acquisition may prove so high as to prevent us from achieving or sustaining profitability. We recognize subscription revenue ratably over the term of the contract period. In general, customer acquisition costs and other upfront costs associated with new customers are much higher in the first year than the aggregate revenue we recognize from those new customers in the first year. As a result, the profitability of a customer to our business in any particular period depends in part upon how long a customer has been a subscriber and the degree to which it has expanded its usage of our platform. Additionally, we intend to continue to hire additional sales personnel to grow our domestic and international operations. If our sales and marketing efforts do not result in substantial increases in revenue, our business, results of operations, and financial condition may be adversely affected.

Previous wording

The initial terms of our customer contracts typically vary in length between one and three years, and our customers have no obligation to renew their subscriptions after the expiration of their initial subscription periods. In some cases, the contracts automatically renew (with each party having the option to elect not to renew), but in circumstances where that is not the case, our customers may unilaterally elect not to renew, may seek to renew for lower subscription amounts or for shorter contract lengths, or may choose to renew for the same or fewer applications over time. A majority of our annual recurring revenue is up for renewal during the fiscal year ending January 31, 2026. Our renewal rates may decline or fluctuate as a result of a number of factors, including leadership changes within our customers resulting in loss of sponsorship, limited customer resources, pricing changes by us or competitors, customer satisfaction with our platform and related applications, the acquisition of customers by other companies, procurement or budgetary decisions, and deteriorating general economic conditions, including as a result of public health epidemics or pandemics. To the extent our customer base continues to grow, renewals and additional subscriptions by renewing customers will become an increasingly important part of our results. If our customers do not renew their subscriptions, or decrease the amount they spend with us, revenue will decline and our business will be harmed.

Current wording

The initial terms of our customer contracts typically vary in length between one and five years, and our customers have no obligation to renew their subscriptions after the expiration of their initial subscription periods. In some cases, the contracts automatically renew (with each party having the option to elect not to renew), but in circumstances where that is not the case, our customers may unilaterally elect not to renew, may seek to renew for lower subscription amounts or for shorter contract lengths, or may choose to renew for the same or fewer applications over time. Our renewal rates may decline or fluctuate as a result of a number of factors, including leadership changes within our customers resulting in loss of sponsorship, limited customer resources, pricing changes by us or competitors, customer satisfaction with our platform and related applications, the acquisition of customers by other companies, procurement or budgetary decisions, and deteriorating general economic conditions, including as a result of public health epidemics or pandemics. To the extent our customer base continues to grow, renewals and additional subscriptions by renewing customers will become an increasingly important part of our results. If our customers do not renew their subscriptions, or decrease the amount they spend with us, revenue will decline and our business will be harmed.

Previous wording

We do not control, or in some cases have limited control over, the operation of the data center facilities we use, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions of new capabilities, technology errors, infrastructure changes, distributed denial of service attacks, or other security related incidents. For instance, in December 2017, researchers identified significant CPU architecture vulnerabilities commonly known as “Spectre” and “Meltdown” that have required software updates and patches, including for providers of public cloud services, to mitigate such vulnerabilities and such updates and patches have required servers to be offline and potentially slow their performance. We may not be able to rapidly switch to new data centers or move customers from one data center to another in the event of any adverse event. Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in lengthy interruptions in our service and the loss or corruption of, or unauthorized access to or acquisition of, customer data.

Current wording

We do not control, or in some cases have limited control over, the operation of the data center facilities we use, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions of new capabilities, technology errors, infrastructure changes, distributed denial of service attacks, or other security related incidents. We may not be able to rapidly switch to new data centers or move customers from one data center to another in the event of any adverse event. Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in lengthy interruptions in our service and the loss or corruption of, or unauthorized access to or acquisition of, customer data.

Previous wording

Risks Related to Our Products and Solutions

Current wording

Risks Related to Our Products, Solutions and Industry

Previous wording

•large software companies, including suppliers of traditional business intelligence products that provide one or more capabilities that are competitive with our products, such as Microsoft Corporation, Oracle Corporation, SAP AG and IBM;

Current wording

•large enterprise software and cloud platform vendors, including suppliers of traditional business intelligence and cloud services that provide one or more capabilities competitive with our products, such as Microsoft Corporation, Amazon Web Services, Inc., Oracle Corporation, SAP AG, Salesforce, Inc., and IBM.

Previous wording

•business analytics software companies, such as Tableau Software, Inc. (acquired by salesforce.com, inc.), Qlik Technologies, Looker Data Sciences, Inc. (acquired by Alphabet, Inc.), MicroStrategy, ThoughtSpot, Alteryx, Informatica, Sisense, Inc., and Tibco Software, Inc.; and

Current wording

•specialized business analytics software companies, such as Tableau Software, Inc. (acquired by Salesforce, Inc.), Qlik Technologies, Looker (acquired by Alphabet, Inc.), Strategy Inc. (formerly MicroStrategy), ThoughtSpot, Alteryx, Informatica, Sisense, and Tibco Software, Inc.

Previous wording

•SaaS-based products or cloud-based analytics providers such as Amazon Web Services, Sigma Computing, Fivetran, Matillion, salesforce.com, inc. and Infor, Inc.

Current wording

•cloud-native data integration and analytics providers, such as Sigma Computing, FiveTran, Matillion, Databricks, and Infor, Inc.

Previous wording

We expect competition to increase as other established and emerging companies enter the markets in which we compete, as customer requirements evolve and as new products and technologies are introduced. For example, salesforce.com, inc. acquired Tableau Software, Inc. in August 2019 and Alphabet Inc. acquired Looker Data Sciences, Inc. in February 2020.

Current wording

We expect competition to increase as other established and emerging companies enter the markets in which we compete, as customer requirements evolve and as new products and technologies are introduced. For example, Salesforce acquired Tableau Software in August 2019 and Alphabet acquired Looker Data Sciences in February 2020.

Previous wording

Our pricing and subscription models have evolved over time and will continue to evolve in the future. While more than 68% our annual recurring revenue is now utilizing the platform as a consumption-based service, it is relatively new to our business and therefore contains inherent risks. Revenue recognized for certain customers may be negatively impacted due to our new consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. Additionally, we believe our partner ecosystem will become increasingly important to our business as we continue its expansion. If our partners decide to internally adopt tools that we provide or find other ways that will reduce their need for our platform, that could result in lower volume of usage, which could adversely impact our financial performance. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to capture upside from over-usage of volume in future contracts, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies and drive adoption of our platform, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose us to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Current wording

Our pricing and subscription models have evolved over time and will continue to evolve in the future. While 84% of our annual recurring revenue is now utilizing the platform as a consumption-based service, it is relatively new to our business and therefore contains inherent risks. Revenue recognized for certain customers may be negatively impacted due to our consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. Additionally, as we implement artificial intelligence tools on our platform, we may not be able to accurately predict customer demand of these tools, and if certain customers use these tools more than we anticipate, we may incur increased operational costs that may not be recovered in an appropriate timeframe. We believe our partner ecosystem will become increasingly important to our business as we continue its expansion. If our partners decide to internally adopt tools that we provide or find other ways that will reduce their need for our platform, such as by adopting artificial intelligence tools offered by our competitors in lieu of purchasing our services, that could result in lower volume of usage, which could adversely impact our financial performance. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to capture upside from over-usage of volume in future contracts, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies and drive adoption of our platform, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose us to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Previous wording

Artificial intelligence technologies also are subject to evolving legal and regulatory landscapes. Laws and regulations applicable to artificial intelligence continue to develop and may be inconsistent from jurisdiction to jurisdiction. For example, the Artificial Intelligence Act (EU AI Act), an E.U. regulation which came into effect on August 1, 2024, prohibits certain artificial intelligence applications and systems and imposes disclosure, transparency, and other requirements on the use of certain applications or systems. The EU AI Act could require us to alter or restrict our use of AI both in features or products available to our users and in our systems that interact with our users, depending on respective levels of risk-categorization, types of systems and manner of use. The EU AI Act also may require us to comply with monitoring and reporting requirements. We may need to devote substantial time and resources to evaluate our obligations under the EU AI Act and to develop and execute planned measures designed to comply with it. There have been numerous other laws and bills proposed at the U.S. federal and state level, as well as internationally, aimed at regulating the deployment or provision of AI systems and services or otherwise addressing aspects of the development or use of artificial intelligence. This includes the Utah Artificial Intelligence Policy Act, which, among other things, imposes disclosure requirements on entities using generative artificial intelligence with customers, and other similar regulatory schemes enacted by other states in the United States.

Current wording

Artificial intelligence technologies also are subject to evolving legal and regulatory landscapes. Laws and regulations applicable to artificial intelligence continue to develop and may be inconsistent from jurisdiction to jurisdiction. For example, the Artificial Intelligence Act (EU AI Act), an E.U. regulation which came into effect on August 1, 2024, prohibits certain artificial intelligence applications and systems and imposes disclosure, transparency, and other requirements on the use of certain applications or systems. The EU AI Act could require us to alter or restrict our use of AI both in features or products available to our users and in our systems that interact with our users, depending on respective levels of risk-categorization, types of systems and manner of use. The EU AI Act also may require us to comply with monitoring and reporting requirements. We may need to devote substantial time and resources to evaluate our obligations under the EU AI Act and to develop and execute planned measures designed to comply with it. There have been numerous other laws and bills proposed at the U.S. federal and state level, as well as internationally, aimed at regulating the deployment or provision of AI systems and services or otherwise addressing aspects of the development or use of artificial intelligence. This includes the Utah

Previous wording

Our platform also provides real-time write-back capabilities to customer environments, including to IoT products and services. The development of the internet of things (IoT) presents security, privacy and execution risks. Many IoT devices have limited interfaces and ability to be updated or patched. IoT solutions may collect large amounts of data, and our handling of IoT data may not satisfy customers or regulatory requirements. IoT scenarios may increasingly affect personal health and safety. If IoT solutions that include our technologies do not work as intended, violate the law, or harm individuals or businesses, we may be subject to legal claims or enforcement actions. These risks, if realized, may increase our costs, damage our reputation or brand, or negatively impact our business and operating results.

Current wording

Our platform also provides real-time write-back capabilities to customer environments, including to the internet of things (IoT) products and services. The development of IoT presents security, privacy and execution risks. Many IoT devices have limited interfaces and ability to be updated or patched. IoT solutions may collect large amounts of data, and our handling of IoT data may not satisfy customers or regulatory requirements. IoT scenarios may increasingly affect personal health and safety. If IoT solutions that include our technologies do not work as intended, violate the law, or harm individuals or businesses, we may be subject to legal claims or enforcement actions. These risks, if realized, may increase our costs, damage our reputation or brand, or negatively impact our business and operating results.

Previous wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risk of future disruptive technologies. If new technologies, such as those relating to artificial intelligence, emerge or improve such that they are able to deliver business intelligence solutions or otherwise perform similar functions as our platform at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.

Current wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risks and opportunities presented by future disruptive technologies. If new technologies, such as those relating to artificial intelligence, emerge or improve such that they are, or are perceived to be, able to deliver business intelligence solutions or otherwise perform similar functions as our platform at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete. Market and consumer perceptions of the future competitiveness of the SaaS industry are uncertain, which could negatively impact the market price or volatility of our stock and impair our ability to raise capital.

Previous wording

If we fail to effectively align, develop and expand our sales and marketing capabilities with our new pricing structure and increase sales efficiency, our ability to increase our customer base and increase acceptance of our platform could be harmed.

Current wording

If we fail to effectively align, develop and expand our sales and marketing capabilities with our pricing structure and increase sales efficiency, our ability to increase our customer base and increase acceptance of our platform could be harmed.

Previous wording

To increase the number of customers and increase the market acceptance of our platform, we will need to align and expand our sales and marketing operations, including our domestic and international sales force, with our new pricing structure and increase sales efficiency. We are aligning our cost structure to better reflect significant product and business model innovation with the expectation that go-to-market operations in our new consumption-based business model will be more efficient and require less investment. We will continue to dedicate significant resources to sales and marketing programs. We believe that there is significant competition for direct sales personnel with the sales skills and technical knowledge that we require. Our ability to achieve significant revenue growth in the future will depend, in large part, on our success in recruiting, training and retaining a sufficient number of direct sales personnel and sales leadership. New hires require significant training and time before they achieve full productivity, particularly in new sales territories. Recent hires and planned hires may not become as productive as quickly as we would like, changes in sales leadership could adversely affect our existing sales personnel, and we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the markets where we do business. The effectiveness of our sales and marketing has also varied over time and, together with the effectiveness of any partners or resellers we may engage, may vary in the future. Our business and operating results may be harmed if our efforts do not generate a correspondingly significant increase in revenue. We may not achieve revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective. In particular, we may in the future need to further adjust our go-to-market cost structure and target metrics, particularly as they relate to how we structure, effect, and compensate our direct sales personnel to become more efficient and effective at selling under a consumption-based business model. Any adjustments in compensation structure could negatively affect the productivity of our direct sales personnel, and there is no assurance that we will be able to successfully implement the adjustments in a timely or cost-effective manner, or that we will be able to realize all or any of the expected benefits from such adjustments.

Current wording

To increase the number of customers and increase the market acceptance of our platform, we will need to align and expand our sales and marketing operations, including our domestic and international sales force, with our pricing structure and increase sales efficiency. We are aligning our cost structure to better reflect significant product and business model innovation with the expectation that go-to-market operations in our consumption-based business model will be more efficient and require less investment. We will continue to dedicate significant resources to sales and marketing programs. We believe that there is significant competition for direct sales personnel with the sales skills and technical knowledge that we require. Our ability to achieve significant revenue growth in the future will depend, in large part, on our success in recruiting, training and retaining a sufficient number of direct sales personnel and sales leadership. New hires require significant training and time before they achieve full productivity, particularly in new sales territories. Recent hires and planned hires may not become as productive as quickly as we would like, changes in sales leadership could adversely affect our existing sales personnel, and we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the markets where we do business. The effectiveness of our sales and marketing has also varied over time and, together with the effectiveness of any partners or resellers we may engage, may vary in the future. Our business and operating results may be harmed if our efforts do not generate a correspondingly significant increase in revenue. We may not achieve revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective. In particular, we may in the future need to further adjust our go-to-market cost structure and target metrics, particularly as they relate to how we structure, effect, and compensate our direct sales personnel to become more efficient and effective at selling under a consumption-based business model. Any adjustments in compensation structure could negatively affect the productivity of our direct sales personnel, and there is no assurance that we will be able to successfully implement the adjustments in a timely or cost-effective manner, or that we will be able to realize all or any of the expected benefits from such adjustments.

Previous wording

We have experienced changes to our management and board, which creates uncertainties and could harm our business.

Current wording

We have experienced and may continue to experience changes to our management and board, which may create uncertainties and could harm our business.

Previous wording

We have experienced changes to our management and board in recent years. Changes to strategic or operating goals, which can often times occur with the appointment of new executives and directors, can create uncertainty, may negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as the new executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board changes may inherently causes some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Current wording

We have experienced changes to our management and board in recent years. Changes to strategic or operating goals, which can often occur with the appointment of executives and directors can create uncertainty, can negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as such executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board changes may inherently cause some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Previous wording

Volatility or lack of positive performance in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their vested options have significantly appreciated in value relative to the original purchase prices of the shares or the exercise prices of the options, or, conversely, if the exercise prices of the options that they hold are significantly above the market price of our common stock. If we are unable to appropriately incentivize and retain our employees through equity compensation, or if we need to increase our compensation expenses in order to appropriately incentivize and retain our employees, our business, operating results, financial condition and cash flows would be adversely affected and the ownership of existing shareholders would be diluted.

Current wording

Volatility or lack of positive performance in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their equity awards have significantly appreciated or depreciated in value. In addition, the authorized shares remaining under our 2018 Equity Incentive Plan may be insufficient to continue to provide equity incentives at levels that would be meaningful. If we are unable to appropriately incentivize and retain our employees through equity compensation, or if we seek to increase the authorized shares under our equity incentive plan or increase our compensation expenses in order to appropriately incentivize and retain our employees, our business, operating results, financial condition and cash flows would be adversely affected and the ownership of existing shareholders would be diluted.

Previous wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 79%, and 80% of our total revenue for the years ended January 31, 2024 and 2025, respectively, was derived from sales within the United States. We continue to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Current wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 80%, and 80% of our total revenue for the years ended January 31, 2025 and 2026, respectively, was derived from sales within the United States. We continue to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Previous wording

•unexpected changes in regulatory requirements, taxes or trade laws;

Current wording

•unexpected changes in regulatory requirements or taxes;

Previous wording

•political instability, terrorist activities or military conflicts (including Russia’s invasion of Ukraine and hostilities between Israel and Hamas);

Current wording

•political instability, terrorist activities or military conflicts (including Russia’s invasion of Ukraine and hostilities in the Middle East);

Previous wording

We are subject to general business regulations and laws, as well as regulations and laws specifically governing the internet and software, in the United States as well as the international markets in which we do business. These regulations and laws may cover employment, taxation, privacy, cybersecurity, data protection, pricing, content, copyrights and other intellectual property, mobile communications, electronic contracts and other communications, consumer protection, unencumbered internet access to our services, the design and operation of websites, artificial intelligence, and the characteristics and quality of software and services. It is possible changes to these regulations and laws, as well as compliance challenges related to the complexity of multiple, conflicting and changing sets of applicable regulations and laws, may impact our sales, operations, and future growth.

Current wording

We are subject to general business regulations and laws, as well as regulations and laws specifically governing the internet and software, in the United States as well as the international markets in which we do business. These regulations and laws may cover employment, taxation, tariffs, privacy, cybersecurity, data protection, pricing, content, copyrights and other intellectual property, mobile communications, electronic contracts and other communications, consumer protection, unencumbered internet access to our services, the design and operation of websites, artificial intelligence, and the characteristics and quality of software and services. It is possible changes to these regulations and laws, as well as compliance challenges related to the complexity of multiple, conflicting and changing sets of applicable regulations and laws, may impact our sales, operations, and future growth.

Previous wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that has become effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Current wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that became effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that has become effective in 2026. Broad federal privacy legislation has also been proposed. In 2025, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places restrictions on data transactions involving sensitive personal data and certain “Countries of Concern” and “Covered Persons” (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions). Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. The U.S. Department of Justice also has issued rules restricting, and imposing requirements in connection with, certain bulk transfers of sensitive personal information. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We canno…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Current wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, access, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental authorities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Previous wording

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed after four years, however, and may be modified or revoked in the interim. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

Current wording

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term. The United Kingdom made targeted amendments to its data protection regime in the UK Data (Use and Access) Act 2025, causing the United Kingdom’s data protection regime to differ more significantly from the GDPR. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which generally permitted personal data flows from the European Economic Area to the United Kingdom. This adequacy determination was renewed in December 2025 to extend through December 2031, but it may be modified or revoked in the interim. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

Previous wording

Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of China (PRC) was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Current wording

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and cybersecurity, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of China (PRC) was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Previous wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.

Current wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in harm to our business, operating results, and financial condition.

Previous wording

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Current wording

We enter into business associate agreements with our customers who require them in order to comply with the U.S. Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Previous wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and cybersecurity proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Current wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, cybersecurity, marketing, and consumer communications proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Previous wording

In addition to the privacy and data protection regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as AICPA’s SOC 1 and SOC 2; International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF; and Texas Department of Information Resources’ TX-RAMP certification. Annually, we also perform an internal/self-analysis of our adherence to the requirements stated in Australian Cyber Security Center (ASCS)’s IRAP framework and the United Kingdom’s National Cyber Security Centre’s Cyber Essentials. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and cybersecurity may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition.

Current wording

In addition to the privacy and data protection regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as SOC 1 and SOC 2 (with HIPAA validation); International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF (with HIPAA validation); and Texas Department of Information Resources’ TX-RAMP certification. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and cybersecurity may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition.

Previous wording

As a provider of cloud services, our operations involve the storage and transmission of our customers’ sensitive and proprietary information, and we also collect, store, transmit, and otherwise process large amounts of sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally in both frequency and sophistication (including the use of emerging artificial intelligence technologies), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, artificial intelligence-assisted deepfake attacks and disinformation campaigns, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, as well as other types of security incidents which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, modify, or access without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to company data as well as customer personal information and/or customer data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third party cloud hosting services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals.

Current wording

As a provider of cloud-based platform services, our operations involve the storage, transmission, and other processing of large amounts of our customers’ confidential and proprietary information, and we also collect, store, transmit, and otherwise process sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, personally identifiable information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally in both frequency and sophistication (including the use of emerging artificial intelligence technologies), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, artificial intelligence-assisted deepfake attacks and disinformation campaigns, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, as well as other types of security incidents which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, or modify, access, or disclose without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to our customers’ data as well as customer personal information and/or company data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third-party cloud hosting services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information.

Previous wording

We engage third-party service providers to store and otherwise process some of our and our customers’ data, including personal, confidential, sensitive, and other information relating to individuals. Our service providers may also be the targets of cyberattacks and other malicious activity, or may experience security incidents caused by other factors. While we have established a formal third party security risk assessment process to address security risks for our company relating to our key third party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties or insider threats may be able to circumvent those security measures or our own security measures, resulting in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. We also use and rely on several open source libraries and packages, and certain libraries and packages while developing our product and if such libraries or packages are vulnerable and are exploited, our ability to address such vulnerabilities in a timely manner may be limited and may result in disruptions to our platform or operations and in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. Occasionally, we also deploy code generated by artificial intelligence (AI) tools and improper or inadequate vetting of AI-generated code for any security related vulnerabilities may result in exploitation of such vulnerabilities leading to disruption, unauthorized access to our infrastructure, our confidential data or our customers' data.

Current wording

We engage third-party hosting and other service providers to store and otherwise process some of our and our customers’ data, including confidential, sensitive, and personal information relating. Our service providers may also be the targets of cyberattacks and other malicious activity, or may experience security incidents caused by other factors. While we have established a formal third-party security risk assessment process to address security risks for our company relating to our key third-party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties or insider threats may be able to circumvent those security measures or our own security measures, resulting in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We also use and rely on several open source libraries and packages while developing our product and if such libraries or packages are vulnerable and are exploited, our ability to address such vulnerabilities in a timely manner may be limited and may result in disruptions to our platform or operations and in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We also deploy code generated by artificial intelligence (AI) tools, and improper or inadequate vetting of AI-generated code for any security related vulnerabilities may result in exploitation of such vulnerabilities leading to disruption, unauthorized access to our infrastructure, our confidential data or our customers' data.

Previous wording

Additionally, there have been and may continue to be significant supply chain cyber-attacks generally, and our third-party service providers (and business partners) may be targeted or impacted by such attacks. We cannot guarantee that our systems and networks or those of our vendors or service providers have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach or compromise of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Malicious actors may be able to circumvent those security measures, resulting in unavailability of, unauthorized access to, misuse, disclosure, loss, unavailability, destruction, or other processing of our and our customers’ data, including sensitive and personal information. We and our service providers may also face difficulties or delays in identifying, remediating, and otherwise responding to cyberattacks and other security breaches and incidents. Because the techniques used and vulnerabilities exploited to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or vulnerabilities or implement adequate preventative measures. We may also experience security breaches and incidents that remain undetected for an extended period.

Current wording

Additionally, there have been and may continue to be significant supply chain cyber-attacks generally, and our third-party service providers and business partners may be targeted or impacted by such attacks. We cannot guarantee that our systems and networks or those of our vendors, service providers, or business partners have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach or compromise of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Malicious actors may be able to circumvent security measures, resulting in unavailability of, unauthorized access to, misuse, disclosure, loss, unavailability, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We and our service providers may also face difficulties or delays in identifying, remediating, and otherwise responding to cyberattacks and other security breaches and incidents. Because the techniques used and vulnerabilities exploited to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, we and our third-party service providers may be unable to anticipate these techniques or vulnerabilities or implement adequate preventative measures. We and our third-party service providers may also experience security breaches and incidents that remain undetected for an extended period.

Previous wording

Enterprise use of generative artificial intelligence (GenAI) technologies may result in access to and processing of sensitive information, intellectual property, source code, trade secrets, and other data, through direct user input or the API, including customer or private information and confidential information. Sending confidential and private data outside of our own servers could trigger legal and compliance exposure, as well as risks of information exposure, including unauthorized acquisition, use, or other processing. Such exposure can result from contractual (for example, with customers) or regulatory obligations (such as CCPA, GDPR, HIPAA). Furthermore, if the GenAI platform’s own systems and infrastructure are not secure, data breaches or incidents may occur and lead to the exposure of sensitive information such as customer data, financial information, and proprietary business information, or it may be believed or asserted that one or more of these has occurred. Any of these circumstances may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. Threat actors could also use GenAI and other forms of artificial intelligence for malicious purposes, increasing the frequency or intensity of attacks and the complexity level some are currently capable of, e.g. phishing attacks, fraud, social engineering, and other possible malicious use, such as with writing malware. Code generated by GenAI could potentially be used and deployed without a proper security audit or code review to find vulnerable or malicious components. This could cause widespread deployment of vulnerable code within the organization systems.

Current wording

Use of generative artificial intelligence (GenAI) technologies may result in GenAI providers having access to and processing sensitive information, intellectual property, source code, trade secrets, and other data, through direct user input or the API, including customer confidential information. Such exposure can result from contractual (for example, with customers) or regulatory obligations (such as CCPA, GDPR, HIPAA). Furthermore, if the GenAI platform’s own systems and infrastructure are not secure, security breaches or incidents may occur and lead to the unauthorized exposure of confidential information such as customer data, financial information, and proprietary business information, or it may be believed or asserted that one or more of these has occurred. Any of these circumstances may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. Threat actors could also use GenAI and other forms of artificial intelligence for malicious purposes, increasing the frequency or intensity of attacks and the complexity level some are currently capable of, e.g. phishing attacks, fraud, social engineering, and other possible malicious use, such as with writing malware. Code generated by GenAI could potentially be used and deployed without a proper security audit or code review to find vulnerable or malicious components. This could cause widespread deployment of vulnerable code within our systems.

Previous wording

In addition, insider threats pose significant risks to our business, potentially compromising the confidentiality, integrity, and availability of customer data and the overall reputation of the organization. As employees or trusted individuals have authorized access to sensitive systems and customer information, malicious insiders may intentionally abuse their privileges, leading to actual or perceived data breaches or incidents, intellectual property theft or misappropriation, or unauthorized access to, or use of, systems or data. Additionally, insiders may inadvertently access, use, expose, or otherwise process confidential, personal, or otherwise critical information, or engage in unauthorized access to or use of company devices, networks, systems, or other resources, due to error, negligence, lack of awareness, or otherwise. We have suffered certain of these incidents in the past and expect that they will occur in the future.

Current wording

In addition, insider threats pose significant risks to our business, potentially compromising the confidentiality, integrity, and availability of customer data, our business information and the overall reputation of the organization. As employees or trusted individuals have authorized access to our systems and customer data, malicious insiders may intentionally abuse their privileges, leading to actual or perceived security breaches or incidents, intellectual property theft or misappropriation, or unauthorized access to, or use of, systems or data. Additionally, insiders may inadvertently access, use, expose, or otherwise process without authorization customer data or confidential, sensitive, or personal information, or engage in unauthorized access to or use of company devices, networks, systems, or other resources, due to error, negligence, lack of awareness, or otherwise. We have suffered certain of these incidents in the past and expect that they will occur in the future.