DOMO, INC.

Previous wording

We incurred net losses of $64.3 million and $51.4 million for the nine months ended October 31, 2024 and 2025, respectively, and had an accumulated deficit of $1,538.9 million at October 31, 2025. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Current wording

We incurred net losses of $18.1 million and $14.2 million for the three months ended April 30, 2025 and 2026, respectively, and had an accumulated deficit of $1,561.1 million at April 30, 2026. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Previous wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,538.9 million as of October 31, 2025. We have also experienced negative or close to breakeven cash flows from operating activities, including cash used in operating activities of $18.0 million and cash provided by operating activities of $10.7 million for the nine months ended October 31, 2024 and 2025, respectively. As of October 31, 2025, we had $47.9 million of cash and cash equivalents, which were held for working capital purposes. Additionally, no amounts were available to draw under our credit facility.

Current wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,561.1 million as of April 30, 2026. We have also experienced negative or close to breakeven cash flows from operating activities, including cash provided by operating activities of $4.0 million and $5.2 million for the three months ended April 30, 2025 and 2026, respectively. As of April 30, 2026, we had $39.1 million of cash and cash equivalents, which were held for working capital purposes. Additionally, no amounts were available to draw under our credit facility. Our need to raise additional capital or complete a potential transaction is heightened by our noncompliance with a financial covenant under our credit facility as of April 30, 2026 and the resulting substantial doubt about our ability to continue as a going concern, as described above.

Previous wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures annually and instead required taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases. The One Big Beautiful Bill Act (or OBBBA), enacted on July 4, 2025, made a number of changes to U.S. federal income tax law, including allowing taxpayers to deduct certain U.S. research and development expenditures (while continuing to require taxpayers to capitalize and amortize foreign research and development expenditures), changing the calculation and deductibility of global intangible low-taxed income (renamed Net CFC Tested Income) and foreign derived intangibles income (renamed Foreign-Derived Deduction Eligible Income) for taxable years beginning after December 31, 2025, reinstating 100% deductibility of bonus depreciation for property placed in service after January 19, 2025, and changing the calculation of deductible business interest expense to include depreciation and amortization, among other changes. While we do not anticipate any material impact to our financial statements, primarily due to the full valuation allowance on net deferred tax assets, and no material permanent tax differences are expected, we are continuing to analyze the potential impact of the OBBBA on our operations, business and financial performance.

Current wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures annually and instead required taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases. The One Big Beautiful Bill Act (or OBBBA), enacted on July 4, 2025, made a number of changes to U.S. federal income tax law, including allowing taxpayers to deduct certain U.S. research and development expenditures (while continuing to require taxpayers to capitalize and amortize foreign research and development expenditures), changing the calculation and deductibility of global intangible low-taxed income (renamed Net CFC Tested Income) and foreign derived intangibles income (renamed Foreign-Derived Deduction Eligible Income) for taxable years beginning after December 31, 2025, reinstating 100% deductibility of bonus depreciation for property placed in service after January 19, 2025, and changing the calculation of deductible business interest expense to include depreciation and amortization, among other changes. While we do not anticipate any material impact to our financial statements, primarily due to the full valuation allowance on net deferred tax assets, and no material permanent tax differences are expected, we are continuing to analyze the potential impact of the OBBBA and other legislation on our operations, business and financial performance.

Previous wording

Further, many countries and the Organization for Economic Cooperation and Development have proposed to reallocate some portion of profits of large multinational companies to markets where sales arise, known as “Pillar One,” as well as enact a global minimum tax rate of at least 15% for multinationals with global revenue exceeding certain thresholds, known as “Pillar Two,” and many countries have adopted or intend to adopt these proposals. On June 28, 2025, the G7 released a joint Statement on Global Minimum Tax, announcing an understanding regarding a proposed “side-by-side” solution that would exempt U.S. multinational businesses from some of the Pillar Two rules (including the 15% global minimum tax adopted by certain members of the EU and other countries). The OECD released a draft proposal, dated August 13, 2025, to exclude U.S. multinational companies from key minimum tax enforcement measures. We will continue to monitor legislative and regulatory developments to assess potential impacts that Pillar Two and other OECD and non-U.S. rules may have on our business, operating results and financial condition. Changes to these and other areas in relation to international tax reform, including future actions taken by foreign governments could increase uncertainty and may adversely affect our tax rate and operating results in future years.

Current wording

Further, many countries and the Organization for Economic Cooperation and Development (or OECD) have proposed to reallocate some portion of profits of large multinational companies to markets where sales arise, known as “Pillar One,” as well as enact a global minimum tax rate of at least 15% for multinationals with global revenue exceeding certain thresholds, known as “Pillar Two,” and many countries have adopted or intend to adopt these proposals. The OECD and participating jurisdictions have agreed to a “side-by-side” elective safe harbor that exempts electing U.S.-parented multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. Changes to these and other areas in relation to international tax reform, including future actions taken by foreign governments could increase uncertainty and may adversely affect our tax rate and operating results in future years.

Previous wording

As of January 31, 2025, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,183.2 million and $1,364.4 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Current wording

As of January 31, 2026, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,289.3 million and $1,414.7 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Previous wording

Even if we do attract customers, the cost of new customer acquisition may prove so high as to prevent us from achieving or sustaining profitability. We recognize subscription revenue ratably over the term of the subscription period. In general, customer acquisition costs and other upfront costs associated with new customers are much higher in the first year than the aggregate revenue we recognize from those new customers in the first year. As a result, the profitability of a customer to our business in any particular period depends in part upon how long a customer has been a subscriber and the degree to which it has expanded its usage of our platform. Additionally, we intend to continue to hire additional sales personnel to grow our domestic and international operations. If our sales and marketing efforts do not result in substantial increases in revenue, our business, results of operations, and financial condition may be adversely affected.

Current wording

Even if we do attract customers, the cost of new customer acquisition may prove so high as to prevent us from achieving or sustaining profitability. We recognize subscription revenue ratably over the term of the contract period. In general, customer acquisition costs and other upfront costs associated with new customers are much higher in the first year than the aggregate revenue we recognize from those new customers in the first year. As a result, the profitability of a customer to our business in any particular period depends in part upon how long a customer has been a subscriber and the degree to which it has expanded its usage of our platform. Additionally, we intend to continue to hire additional sales personnel to grow our domestic and international operations. If our sales and marketing efforts do not result in substantial increases in revenue, our business, results of operations, and financial condition may be adversely affected.

Previous wording

We do not control, or in some cases have limited control over, the operation of the data center facilities we use, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions of new capabilities, technology errors, infrastructure changes, distributed denial of service attacks, or other security related incidents. We may not be able to rapidly switch to new data centers or move customers from one data center to another in the event of any adverse event. Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in lengthy interruptions in our service and the loss or corruption of, or unauthorized access to or acquisition of, customer data.

Current wording

We do not control, or in some cases have limited control over, the operation of the data center facilities we use, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions of new capabilities, technology errors, infrastructure changes, distributed denial of service attacks, cyberattacks, or other security related incidents. We may not be able to rapidly switch to new data centers or move customers from one data center to another in the event of any adverse event. Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a security incident of any kind, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in lengthy interruptions in our service and the loss or corruption of, or unauthorized access to or acquisition of, customer data.

Previous wording

Risks Related to Our Products and Solutions

Current wording

Risks Related to Our Products, Solutions and Industry

Previous wording

•large software companies, including suppliers of traditional business intelligence products that provide one or more capabilities that are competitive with our products, such as Microsoft Corporation, Oracle Corporation, SAP AG and IBM;

Current wording

•large enterprise software and cloud platform vendors, including suppliers of traditional business intelligence and cloud services that provide one or more capabilities competitive with our products, such as Microsoft Corporation, Amazon Web Services, Inc., Oracle Corporation, SAP SE, Salesforce, Inc. (Salesforce), and International Business Machines Corporation.

Previous wording

•business analytics software companies, such as Tableau Software (acquired by Salesforce), Qlik, Looker Data Sciences (acquired by Alphabet), Strategy, ThoughtSpot, Alteryx, Informatica, Sisense and TIBCO Software; and

Current wording

•specialized business analytics software companies, such as Tableau Software, Inc. (Tableau Software) (acquired by Salesforce, Inc.), Qlik Technologies, Inc., Looker Data Sciences (acquired by Alphabet, Inc. (Alphabet)), Strategy Inc. (formerly MicroStrategy), ThoughtSpot, Inc., Alteryx, Inc., Informatica Inc., Sisense Inc., and Tibco Software, Inc.

Previous wording

Our pricing and subscription models have evolved over time and will continue to evolve in the future. While 80% of our annual recurring revenue is now utilizing the platform as a consumption-based service, it is relatively new to our business and therefore contains inherent risks. Revenue recognized for certain customers may be negatively impacted due to our consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. Additionally, as we implement artificial intelligence tools on our platform, we may not be able to accurately predict customer demand of these tools, and if certain customers use these tools more than we anticipate, we may incur increased operational costs that may not be recovered in an appropriate timeframe. We believe our partner ecosystem will become increasingly important to our business as we continue its expansion. If our partners decide to internally adopt tools that we provide or find other ways that will reduce their need for our platform, such as by adopting artificial intelligence tools offered by our competitors in lieu of purchasing our services, that could result in lower volume of usage, which could adversely impact our financial performance. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to capture upside from over-usage of volume in future contracts, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies and drive adoption of our platform, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose us to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Current wording

Our pricing and subscription models have evolved over time and will continue to evolve in the future. While 89% of our annual recurring revenue is now utilizing the platform as a consumption-based service, it is relatively new to our business and therefore contains inherent risks. Revenue recognized for certain customers may be negatively impacted due to our consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. Additionally, as we implement artificial intelligence tools on our platform, we may not be able to accurately predict customer demand of these tools, and if certain customers use these tools more than we anticipate, we may incur increased operational costs that may not be recovered in an appropriate timeframe. We believe our partner ecosystem will become increasingly important to our business as we continue its expansion. If our partners decide to internally adopt tools that we provide or find other ways that will reduce their need for our platform, such as by adopting artificial intelligence tools offered by our competitors in lieu of purchasing our services, that could result in lower volume of usage, which could adversely impact our financial performance. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to capture upside from over-usage of volume in future contracts, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies and drive adoption of our platform, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose us to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Previous wording

The use of artificial intelligence technologies in our platform and otherwise in our business may result in new or enhanced governmental or regulatory scrutiny, new or modified laws or regulations applicable to our development and use of artificial intelligence, claims, demands, and litigation, confidentiality, privacy, data protection, or security risks, ethical concerns, or other complications that could adversely affect our business, financial condition, results of operations and prospects. Uncertainty around new and emerging artificial intelligence technologies may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections, safeguards, and policies for handling the processing of data with artificial intelligence technologies, which may be costly and could impact our expenses. More generally, as use of artificial intelligence becomes more prevalent, we anticipate that it will continue to present new or unanticipated ethical, reputational, technical, operational, legal, competitive, and regulatory issues, among others. We expect that our incorporation of artificial intelligence within our platform and business will require additional resources, including the incurrence of additional costs, to develop and maintain our platform offerings, services, and features in efforts to minimize potentially harmful or unintended consequences, to comply with applicable and emerging laws and regulations, to maintain or extend our competitive position, and to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues that may arise as a result of any of the foregoing. As a result, the challenges presented with our use of artificial intelligence could adversely affect our business, financial condition and results of operations.

Current wording

The use of artificial intelligence technologies in our platform and otherwise in our business may result in new or enhanced governmental or regulatory scrutiny, new or modified laws or regulations applicable to our development and use of artificial intelligence, claims, demands, and litigation, confidentiality, privacy, data protection, or security risks, security or safety incidents, ethical concerns, or other complications that could adversely affect our business, financial condition, results of operations and prospects. Uncertainty around new and emerging artificial intelligence technologies may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections, safeguards, and policies for handling the processing of data with artificial intelligence technologies, which may be costly and could impact our expenses. More generally, as use of artificial intelligence becomes more prevalent, we anticipate that it will continue to present new or unanticipated ethical, reputational, technical, operational, legal, competitive, and regulatory issues, among others. We expect that our incorporation of artificial intelligence within our platform and business will require additional resources, including the incurrence of additional costs, to develop and maintain our platform offerings, services, and features in efforts to minimize potentially harmful or unintended consequences, to comply with applicable and emerging laws and regulations, to maintain or extend our competitive position, and to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues that may arise as a result of any of the foregoing. As a result, the challenges presented with our use of artificial intelligence could adversely affect our business, financial condition and results of operations.

Previous wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risk of future disruptive technologies. If new technologies, such as those relating to artificial intelligence, emerge or improve such that they are able to deliver business intelligence solutions or otherwise perform similar functions as our platform at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.

Current wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risks and opportunities presented by future disruptive technologies. If new technologies, such as those relating to artificial intelligence, emerge or improve such that they are, or are perceived to be, able to deliver business intelligence solutions or otherwise perform similar functions as our platform at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete. Market and consumer perceptions of the future competitiveness of the SaaS industry are uncertain, which could negatively impact the market price or volatility of our stock and impair our ability to raise capital.

Previous wording

Our platform is deployed in a wide variety of technology environments. Increasingly, our platform has been deployed in large scale, complex technology environments, and we believe our future success will depend on our ability to increase sales of our platform for use in such deployments. We must often assist our customers in achieving successful implementations of our platform, which we do through our professional services organization. The time required to implement our platform can vary. For complex deployments, implementation can take multiple months. If our customers are unable to implement our platform successfully, or unable to do so in a timely manner, customer perceptions of our platform may be harmed, our reputation and brand may suffer, and customers may choose to cease usage of our platform or not expand their use of our platform. Our customers and third-party partners may need training in the proper use of and the variety of benefits that can be derived from our platform to maximize its benefits. If our platform is not effectively implemented or used correctly or as intended, or if we fail to adequately train customers on how to efficiently and effectively use our platform, our customers may not be able to achieve satisfactory outcomes. This could result in negative publicity and legal claims against us, which may cause us to generate fewer sales to new customers and reductions in renewals or expansions of the use of our platform with existing customers, any of which would harm our business and results of operations.

Current wording

Our platform is deployed in a wide variety of technology environments. Increasingly, our platform has been deployed in large scale, complex technology environments, and we believe our future success will depend on our ability to increase sales of our platform for use in such deployments. We must often assist our customers in achieving successful implementations of our platform, which we do through our professional services organization. The time required to implement our platform can vary. For complex deployments, implementation can take multiple months. If our customers are unable to implement our platform successfully, or unable to do so in a timely manner, customer perceptions of our platform may be harmed, our reputation and brand may suffer, and customers may choose to cease usage of our platform or not expand their use of our platform. Our customers and third-party partners may need training in the proper use of and the variety of benefits that can be derived from our platform to maximize its benefits. If our platform is not effectively implemented or used correctly or as intended, or if we fail to adequately train customers on how to efficiently and effectively use our platform, our customers may not be able to achieve satisfactory outcomes or may experience increased risks of security incidents. Such outcomes or incidents, even if caused by customer error, could result in negative publicity and legal claims against us, which may cause us to generate fewer sales to new customers and reductions in renewals or expansions of the use of our platform with existing customers, any of which would harm our business and results of operations.

Previous wording

We may experience changes to our management and board, which may create uncertainties and could harm our business.

Current wording

We have experienced and may continue to experience changes to our management and board, which may create uncertainties and could harm our business.

Previous wording

In December 2025, we announced that Joshua G. James was reducing duties to focus on his health and although he remains the Company’s Chief Executive Officer, that Daren Thayne, our Chief Technology Officer and Executive Vice President of Product, was appointed as Interim Principal Executive Officer. The appointment of executives and directors can create uncertainty, can negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as such executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board changes may inherently cause some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Current wording

We have experienced changes to our management and board in recent years. Changes to strategic or operating goals, which can often occur with the appointment of executives and directors can create uncertainty, can negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as such executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board changes may inherently cause some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Previous wording

Volatility or lack of positive performance in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their vested options have significantly appreciated in value relative to the original purchase prices of the shares or the exercise prices of the options, or, conversely, if the exercise prices of the options that they hold are significantly above the market price of our common stock. If we are unable to appropriately incentivize and retain our employees through equity compensation, or if we need to increase our compensation expenses in order to appropriately incentivize and retain our employees, our business, operating results, financial condition and cash flows would be adversely affected and the ownership of existing shareholders would be diluted.

Current wording

Volatility or lack of positive performance in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their equity awards have significantly appreciated or depreciated in value. In addition, the authorized shares remaining under our 2018 Equity Incentive Plan may be insufficient to continue to provide equity incentives at levels that would be meaningful. If we are unable to appropriately incentivize and retain our employees through equity compensation, or if we seek to increase the authorized shares under our equity incentive plan or increase our compensation expenses in order to appropriately incentivize and retain our employees, our business, operating results, financial condition and cash flows would be adversely affected and the ownership of existing shareholders would be diluted.

Previous wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 80% of our total revenue for each of the nine months ended October 31, 2024 and 2025 was derived from sales within the United States. We continue to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Current wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 80%, and 79% of our total revenue for the three months ended April 30, 2025 and 2026, respectively, was derived from sales within the United States. We continue to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Previous wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that became effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Current wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that became effective in 2025, Indiana, Kentucky, and Rhode Island have adopted such legislation that has become effective in 2026, and Alabama and Oklahoma have adopted such legislation that becomes effective in 2027. Broad federal privacy legislation has also been proposed. In 2025, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places restrictions on data transactions involving sensitive personal data and certain “Countries of Concern” and “Covered Persons” (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions). Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations rela…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Current wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, access, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental authorities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Previous wording

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed, however, and may be modified or revoked in the interim. The United Kingdom has made certain modifications to its data protection regime in the UK Data (Use and Access) Act 2025 (DUAA), which was enacted on June 19, 2025. The European Commission has proposed to renew the UK’s adequacy decision after assessing the DUAA, but additional procedural steps remain, causing some uncertainty to remain regarding the UK’s adequacy determination. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

Current wording

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term. The United Kingdom made targeted amendments to its data protection regime in the UK Data (Use and Access) Act 2025, causing the United Kingdom’s data protection regime to differ more significantly from the GDPR. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which generally permitted personal data flows from the European Economic Area to the United Kingdom. This adequacy determination was renewed in December 2025 to extend through December 2031, but it may be modified or revoked in the interim. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

Previous wording

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe’s highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner subsequently concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), with respect to the European Commission adopted an adequacy decision in July 2023, allowing the DPF to be implemented and available for participating entities to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the United Kingdom Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. Numerous laws and regulations in other jurisdictions also have been enacted or modified in manners imposing data transfer restrictions, and we and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, the United Kingdom, or other countries or regions to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland, the United Kingdom, or other regions to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, the United Kingdom, or other regions to the U.S. We and our customers may face a risk of enforcement actions or other proceedings by regulatory authorities relating to personal data transfers. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical perso…

Excerpt shortened here; the source contains the full paragraph.

Current wording

European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), with respect to the European Commission adopted an adequacy decision in July 2023, allowing the DPF to be implemented and available for participating entities to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the United Kingdom Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. Numerous laws and regulations in other jurisdictions also have been enacted or modified in manners imposing data transfer restrictions, and we and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, the United Kingdom, or other countries or regions to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland, the United Kingdom, or other regions to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, the United Kingdom, or other regions to the U.S. We and our customers may face a risk of enforcement actions or other proceedings by regulatory authorities relating to personal data transfers. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance or refusal of European or multi-national customers to use our solutions and being subject to regulatory action or incurring penalties. Any of these developments may have an adverse effect on our business.

Previous wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.

Current wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in harm to our business, operating results, and financial condition.

Previous wording

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Current wording

We enter into business associate agreements with our customers who require them in order to comply with the U.S. Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Previous wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and cybersecurity proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Current wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, cybersecurity, marketing, and consumer communications proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Previous wording

In addition to the privacy and data protection regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as AICPA’s SOC 1 and SOC 2; International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF; and Texas Department of Information Resources’ TX-RAMP certification. Annually, we also perform an internal/self-analysis of our adherence to the requirements stated in Australian Cyber Security Center (ASCS)’s IRAP framework and the United Kingdom’s National Cyber Security Centre’s Cyber Essentials. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and cybersecurity may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition.

Current wording

In addition to the privacy and data protection regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as SOC 1 and SOC 2 (with HIPAA validation); International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF (with HIPAA validation); and Texas Department of Information Resources’ TX-RAMP certification. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and cybersecurity may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition.

Previous wording

As a provider of cloud services, our operations involve the storage and transmission of our customers’ sensitive and proprietary information, and we also collect, store, transmit, and otherwise process large amounts of sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally in both frequency and sophistication (including the use of emerging artificial intelligence technologies), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, artificial intelligence-assisted deepfake attacks and disinformation campaigns, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, as well as other types of security incidents which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, modify, or access without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to company data as well as customer personal information and/or customer data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third party cloud hosting services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals.

Current wording

As a provider of cloud-based platform services, our operations involve the storage, transmission, and other processing of large amounts of our customers’ confidential and proprietary information, and we also collect, store, transmit, and otherwise process sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, personally identifiable information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally in both frequency and sophistication (including through the use of emerging artificial intelligence technologies which may dramatically increase the number and impact of such activity), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, artificial intelligence-assisted deepfake attacks and disinformation campaigns, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, as well as other types of security incidents which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, or modify, access, or disclose without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to our customers’ data as well as customer personal information and/or company data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third-party cloud hosting services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information.

Previous wording

We engage third-party service providers to store and otherwise process some of our and our customers’ data, including personal, confidential, sensitive, and other information relating to individuals. Our service providers may also be the targets of cyberattacks and other malicious activity, or may experience security incidents caused by other factors. While we have established a formal third party security risk assessment process to address security risks for our company relating to our key third party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties or insider threats may be able to circumvent those security measures or our own security measures, resulting in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. We also use and rely on several open source libraries and packages, and certain libraries and packages while developing our product and if such libraries or packages are vulnerable and are exploited, our ability to address such vulnerabilities in a timely manner may be limited and may result in disruptions to our platform or operations and in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. Occasionally, we also deploy code generated by artificial intelligence (AI) tools and improper or inadequate vetting of AI-generated code for any security related vulnerabilities may result in exploitation of such vulnerabilities leading to disruption, unauthorized access to our infrastructure, our confidential data or our customers’ data.

Current wording

We engage third-party hosting and other service providers to store and otherwise process some of our and our customers’ data, including confidential, sensitive, and personal information relating. Our service providers may also be the targets of cyberattacks and other malicious activity, or may experience security incidents caused by other factors. While we have established a formal third-party security risk assessment process to address security risks for our company relating to our key third-party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties or insider threats may be able to circumvent those security measures or our own security measures, resulting in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We also use and rely on several open source libraries and packages while developing our product and if such libraries or packages are vulnerable and are exploited, our ability to address such vulnerabilities in a timely manner may be limited and may result in disruptions to our platform or operations and in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We also deploy code generated by artificial intelligence (AI) tools, and improper or inadequate vetting of AI-generated code for any security related vulnerabilities may result in exploitation of such vulnerabilities leading to disruption, unauthorized access to our infrastructure, our confidential data or our customers' data.

Previous wording

Additionally, there have been and may continue to be significant supply chain cyber-attacks generally, and our third-party service providers (and business partners) may be targeted or impacted by such attacks. We cannot guarantee that our systems and networks or those of our vendors or service providers have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach or compromise of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Malicious actors may be able to circumvent those security measures, resulting in unavailability of, unauthorized access to, misuse, disclosure, loss, unavailability, destruction, or other processing of our and our customers’ data, including sensitive and personal information. We and our service providers may also face difficulties or delays in identifying, remediating, and otherwise responding to cyberattacks and other security breaches and incidents. Because the techniques used and vulnerabilities exploited to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or vulnerabilities or implement adequate preventative measures. We may also experience security breaches and incidents that remain undetected for an extended period.

Current wording

Additionally, there have been and may continue to be significant supply chain cyber-attacks generally, and our third-party service providers and business partners may be targeted or impacted by such attacks. We cannot guarantee that our systems and networks or those of our vendors, service providers, or business partners have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach or compromise of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Malicious actors may be able to circumvent security measures, resulting in unavailability of, unauthorized access to, misuse, disclosure, loss, unavailability, destruction, or other unauthorized processing of our and our customers’ data, including confidential, sensitive, and personal information. We and our service providers may also face difficulties or delays in identifying, remediating, and otherwise responding to cyberattacks and other security breaches and incidents. Because the techniques used and vulnerabilities exploited to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, we and our third-party service providers may be unable to anticipate these techniques or vulnerabilities or implement adequate preventative measures. We and our third-party service providers may also experience security breaches and incidents that remain undetected for an extended period.

Previous wording

Enterprise use of generative artificial intelligence (GenAI) technologies may result in access to and processing of sensitive information, intellectual property, source code, trade secrets, and other data, through direct user input or the API, including customer or private information and confidential information. Sending confidential and private data outside of our own servers could trigger legal and compliance exposure, as well as risks of information exposure, including unauthorized acquisition, use, or other processing. Such exposure can result from contractual (for example, with customers) or regulatory obligations (such as CCPA, GDPR, HIPAA). Furthermore, if the GenAI platform’s own systems and infrastructure are not secure, data breaches or incidents may occur and lead to the exposure of sensitive information such as customer data, financial information, and proprietary business information, or it may be believed or asserted that one or more of these has occurred. Any of these circumstances may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. Threat actors could also use GenAI and other forms of artificial intelligence for malicious purposes, increasing the frequency or intensity of attacks and the complexity level some are currently capable of, e.g. phishing attacks, fraud, social engineering, and other possible malicious use, such as with writing malware. Code generated by GenAI could potentially be used and deployed without a proper security audit or code review to find vulnerable or malicious components. This could cause widespread deployment of vulnerable code within the organization systems.

Current wording

Use of generative artificial intelligence (GenAI) technologies may result in GenAI providers having access to and processing sensitive information, intellectual property, source code, trade secrets, and other data, through direct user input or the API, including customer confidential information. Such exposure can result from contractual (for example, with customers) or regulatory obligations (such as CCPA, GDPR, HIPAA). Furthermore, if the GenAI platform’s own systems and infrastructure are not secure, or do not function as intended, security breaches or incidents may occur and lead to the unauthorized exposure of confidential information such as customer data, financial information, and proprietary business information, or it may be believed or asserted that one or more of these has occurred. Any of these circumstances may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. Threat actors could also use GenAI and other forms of artificial intelligence for malicious purposes, increasing the frequency or intensity of attacks and the complexity level some are currently capable of, e.g. phishing attacks, fraud, social engineering, and other possible malicious use, such as with identification or exploitation of vulnerabilities or writing malware. Code generated by GenAI could potentially be used and deployed without a proper security audit or code review to find vulnerable or malicious components. This could cause widespread deployment of vulnerable code within our systems.

Previous wording

In addition, insider threats pose significant risks to our business, potentially compromising the confidentiality, integrity, and availability of customer data and the overall reputation of the organization. As employees or trusted individuals have authorized access to sensitive systems and customer information, malicious insiders may intentionally abuse their privileges, leading to actual or perceived data breaches or incidents, intellectual property theft or misappropriation, or unauthorized access to, or use of, systems or data. Additionally, insiders may inadvertently access, use, expose, or otherwise process confidential, personal, or otherwise critical information, or engage in unauthorized access to or use of company devices, networks, systems, or other resources, due to error, negligence, lack of awareness, or otherwise. We have suffered certain of these incidents in the past and expect that they will occur in the future.

Current wording

In addition, insider threats pose significant risks to our business, potentially compromising the confidentiality, integrity, and availability of customer data, our business information and the overall reputation of the organization. As employees or trusted individuals have authorized access to our systems and customer data, malicious insiders may intentionally abuse their privileges, leading to actual or perceived security breaches or incidents, intellectual property theft or misappropriation, or unauthorized access to, or use of, systems or data. Additionally, insiders may inadvertently access, use, expose, or otherwise process without authorization customer data or confidential, sensitive, or personal information, or engage in unauthorized access to or use of company devices, networks, systems, or other resources, due to error, negligence, lack of awareness, or otherwise. We have suffered certain of these incidents in the past and expect that they will occur in the future.

Previous wording

We could be required to expend significant capital and other resources to alleviate problems caused by such actual or perceived security breaches, incidents, or other events and to remediate our systems, we could be exposed to a risk of loss, litigation or regulatory action and possible liability, and our ability to operate our business may be impaired. Additionally, actual, potential, or anticipated attacks, security breaches or incidents, or other events, may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants.

Current wording

We could be required to expend significant capital and other resources to alleviate problems caused by actual or perceived security breaches, incidents, or other events and to remediate our systems, we could be exposed to a risk of loss, litigation or regulatory action and possible liability, and our ability to operate our business may be impaired. Additionally, actual, potential, or anticipated attacks, security breaches or incidents, or other events, may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants.

Previous wording

We update our platform on a frequent basis. Despite efforts to test our updates, errors, failures or bugs may not be found in our platform until after it is deployed to our customers. We have discovered and expect we will continue to discover errors, failures and bugs in our platform and anticipate that certain of these errors, failures and bugs will only be discovered and remediated after deployment to customers. Real or perceived errors, failures or bugs in our platform could result in negative publicity, government inquiries, loss of or delay in market acceptance of our platform, loss of competitive position, or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem.

Current wording

We update our platform on a frequent basis. Despite efforts to test our updates, errors, failures or bugs may not be found in our platform until after the update is deployed to our customers. We have discovered and expect we will continue to discover errors, failures and bugs in our platform and anticipate that certain of these errors, failures and bugs will only be discovered and remediated after deployment to customers. Real or perceived errors, failures or bugs in our platform could result in negative publicity, government inquiries, loss of or delay in market acceptance of our platform, loss of competitive position, or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem.

Previous wording

We implement bug fixes and upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes and upgrades in a timely manner, any history of inaccuracies in the data we collect for our customers, or the loss, damage, unauthorized access to or acquisition of, or inadvertent release or exposure of confidential or other sensitive data could cause our reputation to be harmed and result in claims against us, and customers may elect not to purchase or renew their agreements with us or we may incur increased insurance costs. The costs associated with any material defects or errors in our software or other performance problems may be substantial and could harm our operating results.

Current wording

We implement bug fixes and upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes and upgrades in a timely manner, any history of inaccuracies in the data we process for our customers, or the loss, damage, unauthorized access to or acquisition of, or inadvertent release or exposure of customer data could cause our reputation to be harmed and result in claims against us, and customers may elect not to purchase or renew their agreements with us or we may incur increased insurance costs. The costs associated with any material defects or errors in our software or other performance problems may be substantial and could harm our operating results.

Previous wording

The technology industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual property rights. Companies in the technology industry must often defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. Third parties, including our competitors, may own patents or other intellectual property rights that cover aspects of our technology or business methods and may assert patent or other intellectual property rights against us and others in the industry. In addition, our customers’ development and use of artificial intelligence may result in increased claims of infringement or other claims, including those based on unauthorized use of third-party technology or content. Moreover, in recent years, individuals and groups that are non-practicing entities, commonly referred to as “patent trolls,” have purchased patents and other intellectual property assets for the purpose of making claims of infringement or other violation of intellectual property rights in order to extract settlements. From time to time, we have received and may receive in the future threatening letters, notices or “invitations to license,” or may be the subject of claims that our technology and business operations infringe or otherwise violate the intellectual property rights of others. Responding to such claims, regardless of their merit, can be time consuming, costly to defend in litigation, divert management’s attention and resources, damage our reputation and brand and cause us to incur significant expenses. Claims of intellectual property infringement or other violations of intellectual property rights might require us to stop using technology found to infringe or violate a third party’s rights, redesign our platform, which could require significant effort and expense and cause delays of releases, enter into costly settlement or license agreements or pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our platform. If we cannot or do not license the infringed or otherwise violated technology on commercially reasonable terms or at all, or substitute similar technology from another source, we could be forced to limit or stop selling our platform, we may not be able to meet our obligations to customers under our customer contracts, revenue and operating results could be adversely impacted, and we may be unable to compete effectively. Even if we are successful in defending against allegations of intellectual property infringement, litigation may be costly and may divert the time and other resources of our management. Additionally, customers may not purchase our platform if they are concerned that they may infringe or otherwise violate third-party intellectual property rights. The occurrence of any of these events may harm our business.

Current wording

development and use of artificial intelligence may result in increased claims of infringement or other claims, including those based on unauthorized use of third-party technology or content. Moreover, in recent years, individuals and groups that are non-practicing entities, commonly referred to as “patent trolls,” have purchased patents and other intellectual property assets for the purpose of making claims of infringement or other violation of intellectual property rights in order to extract settlements. From time to time, we have received and may receive in the future threatening letters, notices or “invitations to license,” or may be the subject of claims that our technology and business operations infringe or otherwise violate the intellectual property rights of others. Responding to such claims, regardless of their merit, can be time consuming, costly to defend in litigation, divert management’s attention and resources, damage our reputation and brand and cause us to incur significant expenses. Claims of intellectual property infringement or other violations of intellectual property rights might require us to stop using technology found to infringe or violate a third party’s rights, redesign our platform, which could require significant effort and expense and cause delays of releases, enter into costly settlement or license agreements or pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our platform. If we cannot or do not license the infringed or otherwise violated technology on commercially reasonable terms or at all, or substitute similar technology from another source, we could be forced to limit or stop selling our platform, we may not be able to meet our obligations to customers under our customer contracts, revenue and operating results could be adversely impacted, and we may be unable to compete effectively. Even if we are successful in defending against allegations of intellectual property infringement, litigation may be costly and may divert the time and other resources of our management. Additionally, customers may not purchase our platform if they are concerned that they may infringe or otherwise violate third-party intellectual property rights. The occurrence of any of these events may harm our business.

Previous wording

Our Class A common stock has 40 votes per share, and our Class B common stock has one vote per share. Joshua G. James, our founder and chief executive officer, beneficially owns all of our outstanding shares of Class A common stock through Cocolalla, LLC, of which he is the managing member, and as of October 31, 2025, beneficially controlled approximately 78% of the voting power of our outstanding capital stock and therefore is able to control all matters submitted to our stockholders for approval. Mr. James may have interests that differ from yours and may vote in a way with which you disagree and which may be adverse to your interests. This concentrated control may have the effect of delaying, preventing or deterring a change in control of our company, could deprive our stockholders of an opportunity to receive a premium for their capital stock as part of a sale of our company and might ultimately affect the market price of our Class B common stock.

Current wording

Our Class A common stock has 40 votes per share, and our Class B common stock has one vote per share. Joshua G. James, our founder and chief executive officer, beneficially owns all of our outstanding shares of Class A common stock through Cocolalla, LLC, of which he is the managing member, and as of April 30, 2026, beneficially controlled approximately 76% of the voting power of our outstanding capital stock and therefore is able to control all matters submitted to our stockholders for approval. Mr. James may have interests that differ from yours and may vote in a way with which you disagree and which may be adverse to your interests. This concentrated control may have the effect of delaying, preventing or deterring a change in control of our company, could deprive our stockholders of an opportunity to receive a premium for their capital stock as part of a sale of our company and might ultimately affect the market price of our Class B common stock.

Previous wording

Future transfers by the holder of Class A common stock will generally result in those shares converting into shares of Class B common stock, subject to limited exceptions, such as certain transfers effected for estate planning or charitable purposes. Mr. James has informed us he and Cocolalla, LLC have entered into arrangements under which he has pledged all of such shares in addition to Class B shares held by him to secure a loan with a financial institution. If these shares were to be sold or otherwise transferred upon default of the underlying loan, the market price of our Class B common stock could decline or be volatile or certain governance provisions in our certificate of incorporation may be triggered, resulting in changes to our corporate governance structure. For additional information, see the section of this report captioned “—Other Risks Related to Ownership of Our Class B Common Stock—Future sales of our Class B common stock in the public market could cause our stock price to fall.”

Current wording

Future transfers by the holder of Class A common stock will generally result in those shares converting into shares of Class B common stock, subject to limited exceptions, such as certain transfers effected for estate planning or charitable purposes. Mr. James has informed us he and Cocolalla, LLC have entered into arrangements under which he has pledged all of such shares in addition to Class B shares held by him to secure a loan with a financial institution. If these shares were to be sold or otherwise transferred upon default of the underlying loan, the market price of our Class B common stock could decline or be volatile or certain governance provisions in our certificate of incorporation may be triggered, resulting in changes to our corporate governance structure. For additional information, see the section of this report captioned “—Other

Previous wording

The trading market for our Class B common stock and customer demand for our platform is influenced by the research and reports that securities and industry analysts publish about us or our business. If one or more of the analysts who cover us do not publish positive reports about our company, platform and value proposition, do not view us as a market leader, or cease or fail to regularly publish reports on us, our stock price or trading volume would likely decline. In addition, industry analysts may influence current and potential customers; if any of the foregoing were to occur, customer demand for our platform, operating results and prospects may be adversely impacted. Further, we are transitioning to a consumption-based business model and to the extent that analysts fail to appreciate the benefits of such a model, misinterpret key performance indicators associated with such a model or continue to focus on metrics unduly associated with a subscription-based model, our stock price and trading volume may decline or our business may suffer.

Current wording

The trading market for our Class B common stock and customer demand for our platform is influenced by the research and reports that securities and industry analysts publish about us or our business. If one or more of the analysts who cover us do not publish positive reports about our company, platform and value proposition, do not view us as a market leader, or cease or fail to regularly publish reports on us, our stock price or trading volume would likely decline. In addition, industry analysts may influence current and potential customers; if any of the foregoing were to occur, customer demand for our platform, operating results and prospects may be adversely impacted. Further, we have transitioned primarily to a consumption-based pricing model and to the extent that analysts fail to appreciate the benefits of such a model, misinterpret key performance indicators associated with such a model or continue to focus on metrics unduly associated with a subscription-based model, our stock price and trading volume may decline or our business may suffer.

Previous wording

Our stock price could decline as a result of sales of a large number of shares or the perception that these sales could occur. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate. For example, we filed: (i) on September 6, 2024, a shelf registration statement on Form S-3 with the SEC that became effective on September 20, 2024 and allows us to undertake various equity and debt offerings up to $300.0 million; and (ii) on September 20, 2024, a prospectus supplement to the shelf registration statement that covers the offering, issuance and sale of up to $150.0 million of our Class B common stock from time to time through an “at-the-market” program under the Securities Act. To date, we had not sold any shares under our “at-the-market” program.

Current wording

Our stock price could decline as a result of sales of a large number of shares or the perception that these sales could occur. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate. For example, we filed: (i) on September 6, 2024, a shelf registration statement on Form S-3 with the SEC that became effective on September 20, 2024 and allows us to undertake various equity and debt offerings up to $300.0 million; and (ii) on September 20, 2024, a prospectus supplement to the shelf registration statement that covers the offering, issuance and sale of up to $150.0 million of our Class B common stock from time to time through an “at-the-market” program under the Securities Act. To date, we have not sold any shares under our “at-the-market” program.

Previous wording

Further, we have been advised that Mr. James has pledged the shares of Class A common stock and Class B common stock beneficially owned by him to secure a loan with a financial institution, which loan has or will have various requirements to repay all or a portion of the loan upon the occurrence of various events, including when the price of the Class B common stock goes below certain specified levels. Mr. James has indicated that the loan matures in the last two weeks of March 2026. Although Mr. James has indicated his intention to sell other assets if necessary, shares of our common stock may need to be sold or otherwise transferred to meet these repayment requirements. Upon a default under such loan, the lenders could sell the pledged shares into the market. Sales or transfers of such shares to reduce the loan balance or by the lenders upon foreclosure are likely to adversely affect our stock price. Mr. James has also indicated to us that he may in the future from time to time refinance such indebtedness, enter into derivative transactions based on the value of our Class B common stock, dispose of shares of common stock, otherwise monetize shares of his common stock and/or engage in other transactions relating to shares of our common stock and/or other securities of the company. Any of these activities may adversely affect the price of our common stock. Mr. James has also indicated that he intends to (1) continue to beneficially own a majority of the Class A common stock that he currently beneficially owns and (2) continue to control at least a majority of the voting power of our company.

Current wording

Further, we have been advised that Mr. James has pledged the shares of Class A common stock and Class B common stock beneficially owned by him to secure a loan with a financial institution, which loan has or will have various requirements to repay all or a portion of the loan upon the occurrence of various events, including when the price of the Class B common stock goes below certain specified levels. Mr. James has indicated that he intends to extend or refinance the loan before its June 27, 2026 maturity date. Although Mr. James has indicated his intention to sell other assets if necessary, shares of our common stock may need to be sold or otherwise transferred to meet these repayment requirements. Upon a default under such loan, the lenders could sell the pledged shares into the market. Sales or transfers of such shares to reduce the loan balance or by the lenders upon foreclosure are likely to adversely affect our stock price. Mr. James has also indicated to us that he may in the future from time to time refinance such indebtedness, enter into derivative transactions based on the value of our Class B common stock, dispose of shares of common stock, otherwise monetize shares of his common stock and/or engage in other transactions relating to shares of our common stock and/or other securities of the company. Any of these activities may adversely affect the price of our common stock. Mr. James has also indicated that he intends to (1) continue to beneficially own a majority of the Class A common stock that he currently beneficially owns and (2) continue to control at least a majority of the voting power of our company.