Data Storage Corp

Evaluation of Disclosure Controls and Procedures

As of the end of the period covered by this Quarterly Report on Form 10-Q, under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation of our disclosure controls and procedures, as such term is defined under Rule 13a-15(e) and Rule 15d-15(e) promulgated under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Rule 13a-15(e) under the Exchange Act defines “disclosure controls and procedures” as controls and other procedures of a company that are designed to ensure that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to a company’s management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures were effective at the reasonable assurance level as of June 30, 2026.

A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Due to its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Accordingly, our disclosure controls and procedures are designed to provide reasonable, not absolute, assurance that the objectives of our disclosure control system are met. As set forth above, our Chief Executive Officer and Chief Financial Officer have concluded, based on the evaluation as of the end of the period covered by this Quarterly Report on Form 10-Q, that our disclosure controls and procedures were effective to provide reasonable assurance that the objectives of our disclosure control system were met.

Remediation of Previously Reported Material Weakness

In connection with the preparation of our Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, management identified a material weakness in our internal control over financial reporting. The material weakness related to the design and operating effectiveness of controls over the accounting and disclosure of significant and unusual transactions—specifically, those arising from the divestiture of a material portion of our business. Our controls were not effectively designed to ensure a complete and accurate technical review of the complex accounting and tax elements associated with this transaction.

This deficiency identified during the third quarter of 2025 resulted in an error related to the income tax implications of the divestiture of the CloudFirst Business. Subsequently, in connection with the preparation of the 2025 Annual Report, we identified an additional error stemming from the same material weakness regarding the treatment of certain warrants impacted by the divestiture. Specifically, on September 11, 2025, the closing of the divestiture of the CloudFirst Business triggered a cash-settlement provision within our Common Stock Purchase Warrants issued by us on July 21, 2021 to institutional investors (the “July 2021 Warrants”), requiring them to be reclassified from equity to a liability at fair value. We determined that the initial recognition of the $2,461,663 warrant liability was incorrectly recorded in the Quarterly Report on Form 10-Q for the quarter ended September 30, 2025 as a component of Gain on sale of discontinued operations, net of tax, rather than as a reduction to Additional Paid-in Capital.

Accordingly, within the 2025 Annual Report, we restated certain financial statements previously included in the Quarterly Report on Form 10-Q for the period ended September 30, 2025, to reflect the initial recognition of the July 2021 warrant liability as a debit to equity, with subsequent changes in fair value of the warrant liability recognized in the consolidated statements of operations.

In 2026, we identified and implemented several steps to remediate these material weaknesses in order to comply with the rules and regulations of the SEC regarding compliance with Section 404(a) of the Sarbanes-Oxley Act. We prepared remediation plans for the material weakness and trained process owners, developed new controls, enhanced existing controls, evaluated process adoption, and monitored such results. These remediation measures included the following:

Our management completed its documentation, testing and evaluation of the enhanced control activities and determined that, as of June 30, 2026, these control activities have been appropriately designed and implemented, and have operated effectively for a sufficient period of time to conclude that the previously identified material weakness has been remediated.

Changes in Internal Control over Financial Reporting

Other than as set forth above, there have been no changes in our internal control over financial reporting during the quarter ended June 30, 2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.