Klaviyo Inc

October 2024 Cybersecurity Incident

(a) On October 25, 2024, the Company determined that an unauthorized third-party gained access to the Company’s source code, as well as other system and application credentials. Following detection of this unauthorized activity, the Company initiated its response protocols and took steps to contain, assess and remediate the incident, including launching an investigation with the assistance of counsel and leading external cybersecurity experts. As of the date of this Annual Report on Form 10-K, the Company has concluded its investigation, has found no evidence of continued unauthorized activity on its systems and believes the incident to be contained. The Company’s operations have continued throughout this matter in all material respects.

As of the date of this Annual Report on Form 10-K, the Company does not believe that the incident will have a material impact on the Company’s business, financial condition, or results of operations.

Securities Trading Plans of Directors or Executive Officers

(b) During the three months ended December 31, 2024, two of the Company’s officers (as defined in Rule 16a-1(f) under the Exchange Act) each adopted a written plan intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) of the Exchange Act for the sale of the Company’s securities as set forth in the table below.

(1)The actual number of shares of common stock sold pursuant to this plan will be less, after shares are withheld to satisfy tax withholding obligations in connection with the net settlement of equity awards.

No other directors or officers (as defined in Rule 16a-1(f) under the Exchange Act)adopted and/orterminated a “Rule 10b5-1 trading arrangement” or a “non-Rule 10b5-1 trading arrangement,” each as defined in Regulation S-K Item 408, during the three months ended December 31, 2024.