What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2020-12-04 compared with 2020-09-04 · 202 added, 130 removed, 620 unchanged (35% of the section changed)

Our business involves significant risks, some of which are described below.

You should carefully consider the following risks, together with all of the other information in this Quarterly Report on Form 10-Q, including our consolidated financial statements and the related notes included elsewhere in this Quarterly Report on Form 10-Q.

Any of the following risks could have an adverse effect on our business, results of operations, financial condition or prospects, and could cause the trading price of our common stock to decline.

Risk Factors Summary

Our business is subject to numerous risks and uncertainties, including those highlighted in the section titled “Risk Factors” immediately following this Risk Factors Summary.

These summary risks provide an overview of many of the risks we are exposed to in the normal course of our business.

As a result, the following summary risks do not contain all of the information that may be important to you, and you should read them together with the more detailed discussion of risks set forth following this section under the heading “Risk Factors,” and with the other information in this Quarterly Report on Form 10-Q.

Additional risks beyond those summary risks discussed below, in “Risk Factors” or elsewhere in this Quarterly Report on Form 10-Q, could have an adverse effect on our business, results of operations, financial condition or prospects, and could cause the trading price of our common stock to decline.

Our business, results of operations, financial condition or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Consistent with the foregoing, we are exposed to a variety of risks, including the following significant risks:

▪ We have sustained net losses since inception and we may not achieve or sustain profitability in the future.

▪ We derive a majority of our revenue from our e-signature solutions and any decline in sales (or decline or slower adoption) of e-signature without increase in our other solutions could adversely affect our results of operations.

▪ The market for software used to prepare, sign, act on and manage agreements is relatively new and evolving and if the market does not develop further, develops more slowly, or in a way that we do not expect, our business will be adversely affected.

▪ We must continue to grow our customer base to increase our revenue.

If we are unable to attract new customers and retain and expand sales to existing customers, our revenue growth will be adversely affected.

▪ We depend on co-located data centers, third-party cloud providers and our own technical operations infrastructure to securely deliver our products and solutions to our customers.

▪ Our business could be damaged, our reputation could be harmed, and we could be subject to liability if there is any unauthorized access to our data or our users’ content, including through data breaches, cyberattacks or other malicious activity.

▪ Our recent rapid growth may not be indicative of our future growth, and, if we continue to grow rapidly, we may not be able to manage our growth effectively.

We may not be able to scale our business quickly enough to meet the growing needs of our customers and if we are not able to grow efficiently, our operating results could be harmed.

▪ We recognize revenue from subscriptions over the term of the relevant contract;

therefore, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

▪ We operate in competitive markets and the market for our products is continuing to evolve.

We must evolve to meet the needs of our customers and accurately forecast, develop, and price for the market potential of our products in order to continue to compete effectively.

▪ If our products, solutions and support fail to perform properly and if we fail to develop enhancements to resolve any defect or other problems, our reputation could suffer, we could lose customers, we may become subject to service performance or warranty claims and our market share could decline.

▪ We have incurred substantial indebtedness that may decrease our business flexibility and ability to pursue inorganic growth opportunities, access to capital and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

▪ We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

Our business involves significant risks, some of which are described below.

You should carefully consider the following risks, together with all of the other information in this Quarterly Report on Form 10-Q, including in the preceding Risk Factors Summary, our consolidated financial statements and the related notes included elsewhere in this Quarterly Report on Form 10-Q.

Risks Related to Our Business and Industry

We cannot predict the impact of the COVID-19 pandemic on our business, results of operations and financial condition.

The impact of the COVID-19 pandemic and related public health measures on our business will depend largely on future developments, including the duration and severity of the COVID-19 pandemic, which are highly uncertain and cannot be accurately predicted.

The impact of the continuing COVID-19 pandemic and related public health measures on our business will depend largely on future developments, including the duration and severity of the COVID-19 pandemic, which are highly uncertain and cannot be accurately predicted.

The COVID-19 pandemic has created and is likely to continue to create significant uncertainty in global financial markets, which may decrease overall technology spending and depress demand for our solutions.

In addition, the COVID-19 pandemic may disrupt the operations of our customers or partners, limiting their ability to pay for our solutions and adversely affecting our results of operations.

We have undertaken measures to mitigate the effect of the COVID-19 pandemic on our business and to protect our employees, partners and customers, including by imposing travel restrictions for our employees, requiring almost all employees to work remotely until further notice, and shifting customer, partner and investor events to virtual-only formats.

We have undertaken measures to mitigate the effect of the COVID-19 pandemic on our business and to protect our employees, partners and customers, including by imposing travel restrictions for our employees, providing almost all employees the opportunity to work remotely until at least May 31, 2021, limiting capacity at any of our offices which have reopened or may reopen during the pandemic’s duration, and shifting customer, partner and investor events to virtual-only formats.

However, there can be no assurance that these measures will be effective, or that we can adopt them without adversely affecting our business operations.

For example, our management team has been focusing additional time on planning for and mitigating the risks of the COVID-19 pandemic, which may reduce the amount of time available for other initiatives.

The COVID-19 pandemic may lead to inefficiencies of our employees, operational and cybersecurity risks and other circumstances which could have an adverse impact to our results of operations.

In addition, the COVID-19 pandemic has caused significant volatility in financial markets and has raised the prospect of an extended global recession.

Further, the full effects of the COVID-19 pandemic cannot be predicted as a result of uncertainties including the extent and rate of the spread, the possibility and timing of any vaccine, treatment, or cure or stop to the spread, and the potential for additional peaks in infection rates later in 2020.

Public health problems resulting from COVID-19 and precautionary measures instituted by governments and businesses to mitigate its spread, including travel restrictions, school and business closures, and quarantines, could contribute to a general slowdown in the global economy, adversely impact our customers and partners, and disrupt our operations.

As our offices reopen, planning and risk management for these reopenings will require further additional time from management and other employees, which may further reduce the amount of time available for other initiatives.

The COVID-19 pandemic may also lead to inefficiencies of our employees, operational and cybersecurity risks and other circumstances which could have an adverse impact to our results of operations.

In addition, the COVID-19 pandemic has caused significant volatility in financial markets and has created a global recession which may be long-term.

Further, the full effects of the COVID-19 pandemic cannot be predicted as a result of uncertainties including the extent and rate of the spread, the possibility, timing and deployment of any vaccine, treatment, or cure or stop to the spread, and the potential for additional peaks in infection rates through early 2021.

Public health problems resulting from COVID-19 and precautionary measures instituted by governments and businesses to mitigate its spread, including travel restrictions, school and business closures, and quarantines, have contributed to a general slowdown in the global economy, which could adversely impact our customers and partners and disrupt our operations.

Changes in our operations in respect to COVID-19 or employee illnesses resulting from the COVID-19 pandemic may result in inefficiencies or delays that cannot be fully mitigated through succession planning, employees working remotely, or teleconferencing technologies.

2 unchanged sentences

We began operations in 2003 and have experienced net losses since inception.

We generated a net loss of $112.4 million and $114.4 million in the six months ended July 31, 2020 and 2019, and as of July 31, 2020, we had an accumulated deficit of $1.2 billion.

We generated a net loss of $170.9 million and $161.0 million in the nine months ended October 31, 2020 and 2019, and as of October 31, 2020, we had an accumulated deficit of $1.3 billion.

We will need to generate and sustain increased revenue levels in future periods to become profitable and, even if we do, we may not be able to maintain or increase our level of profitability.

59 unchanged sentences

Our customers have no obligation to renew their subscriptions and we cannot guarantee that our customers will renew their subscriptions with us for a similar or greater contract period or on the same or more favorable terms.

competitive conditions, customer attrition and general economic conditions, including as a result of the current COVID-19 pandemic.

Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction with our products and solutions, decreases in the number of users at our customers, changes in the type and size of our customers, pricing changes, competitive conditions, customer attrition and general economic conditions, including as a result of the current COVID-19 pandemic.

If our customers do not renew their subscriptions for our products and solutions or if they reduce their subscription amounts at the time of renewal, our revenue will decline, and our business will suffer.

37 unchanged sentences

Moreover, due to the current COVID-19 pandemic, there is an increased risk that we may experience cybersecurity related incidents as a result of our employees, service providers, and third parties working remotely on less secure systems during government mandated shelter-in-place orders.

Further, we may face additional security incidents in the future, resulting in unauthorized access to, loss of or unauthorized disclosure of sensitive and proprietary information of DocuSign or our customers, partners or employees, and such incidents may in the future result in regulatory enforcement actions, litigation (including a new private right of action under the California Consumer Privacy Act, as described in the risk factor below titled “We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Further, we may face additional security incidents in the future, resulting in unauthorized access to, loss of or unauthorized disclosure of sensitive and proprietary information of DocuSign or our customers, partners or employees, and such incidents may in the future result in regulatory enforcement actions, litigation (including a new private right of action under the California Consumer Privacy Act (“CCPA”), as described in the risk factor below titled “We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

1 unchanged sentence

Additionally, as we rely on third-party and public-cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of customer data.

Our ability to monitor our third-party service providers’ data security is limited and any breach of our providers’ security measures may result in the unauthorized access to, or misuse, loss or destruction of our and our customers’ data.

Our ability to monitor our third-party service providers’ data security is limited and any breach of our providers’ security measures may result in unauthorized access to, or misuse, loss or destruction of, our and our customers’ data.

Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based service providers have been and are expected to continue to be targeted.

2 unchanged sentences

If our security measures, or the security measures of our service providers, partners or customers, are compromised, our reputation could be damaged, our ability to attract and retain customers could be adversely affected and our business may be harmed.

In addition, a cybersecurity event could result in significant increases in costs, including costs for remediating the effects of such an event, lost revenues due to decrease in customer trust and network downtime, increases in insurance coverage due to cybersecurity incidents and damages to our reputation because of any such incident.

In addition, a cybersecurity event could result in significant increases in costs, including costs for remediating the effects of such an event, lost revenues due to decrease in customer trust and network downtime, increases in insurance costs due to cybersecurity incidents and damages to our reputation because of any such incident.

and foreign laws and regulations require companies to provide notice of data security breaches and/or incidents involving certain types of personal data to individuals, the media, government authorities or other third parties.

1 unchanged sentence

Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which may lead to widespread negative publicity.

Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect our business and operating results.

security compromise in our industry, whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect our business and operating results.

There can be no assurance that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

60 unchanged sentences

As a result, much of our revenue is generated from the recognition of contract liabilities from contracts entered into during previous periods.

Consequently, a shortfall in demand for our products and solutions and professional services or a decline in new or renewed contracts in any one quarter may not significantly reduce our revenue for that quarter but could negatively affect our revenue in future quarters.

Consequently, a shortfall in demand for our products and solutions and professional

services or a decline in new or renewed contracts in any one quarter may not significantly reduce our revenue for that quarter but could negatively affect our revenue in future quarters.

Our revenue recognition model also makes it difficult for us to rapidly increase our revenue through additional sales contracts in any period, as revenue from new customers is recognized over the applicable term of their contracts.

11 unchanged sentences

As part of our business strategy, we continually evaluate opportunities to acquire or invest in businesses, products or technologies that we believe could complement or expand our products and solutions, enhance our technical capabilities or otherwise offer growth opportunities.

For example, on September 4, 2018 we acquired SpringCM, a provider of cloud-based document generation and contract lifecycle management software, on May 1, 2020 we acquired Seal Software Group Limited, a provider of contract analytics software, and on July 6, 2020 we acquired Liveoak Technologies, Inc., a provider of secure agreement-collaboration and identity verification platform.

For example, on September 4, 2018 we acquired SpringCM, a provider of cloud-based document generation and contract lifecycle management software, on May 1, 2020 we acquired Seal Software Group Limited, a provider of contract analytics software, and on July 6, 2020 we acquired Liveoak Technologies, Inc., a provider of a secure agreement-collaboration and identity verification platform.

In the future, we may be unable to identify suitable acquisition candidates and, even if we do, we may not be able to complete desired acquisitions on favorable terms, if at all.

16 unchanged sentences

federal, state and local, as well as foreign, government agencies, as well as to customers in highly regulated industries such as financial services, pharmaceuticals, insurance, healthcare and life sciences.

Sales to such entities are

subject to a number of challenges and risks.

Sales to such entities are subject to a number of challenges and risks.

Selling to such entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale.

25 unchanged sentences

Moreover, there are inherent risks associated with upgrading, improving and expanding our systems infrastructure.

We cannot be sure that the expansion and improvements to our systems infrastructure will be effectively implemented on a timely basis, if at all.

We cannot be sure that the expansion and improvements to our systems

infrastructure will be effectively implemented on a timely basis, if at all.

These efforts may be costly and could adversely affect our financial results.

24 unchanged sentences

Our products and solutions seamlessly integrate with hundreds of other software applications, including Salesforce, Google and Microsoft.

Our growth strategy includes expanding the use of our products and solutions through complementary technology offerings and software integrations, such as third-party APIs.

Our growth strategy includes expanding the use of our products and solutions through complementary

technology offerings and software integrations, such as third-party APIs.

While we have established partnerships with providers of complementary offerings and software integrations, we cannot guarantee that we will be successful in continuing to maintain and scale these partnerships or establishing partnerships with additional providers as we grow.

In the future, third-

party providers of complementary technology offerings and software integrations may decline to enter into, or may later terminate, relationships with us;

In the future, third-party providers of complementary technology offerings and software integrations may decline to enter into, or may later terminate, relationships with us;

change their features or platforms;

35 unchanged sentences

Further, the indenture governing the Notes does not restrict our ability to incur additional indebtedness and we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in any future debt instruments existing at the time, some of which may be secured indebtedness.

The requirements of being a public company, including developing and maintaining proper and effective disclosure controls and procedures and internal control over financial reporting, may strain our resources and divert management’s attention away from other business concerns.

As a public company, we are subject to the reporting requirements of the Securities Exchange Act of 1934, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of Nasdaq and other applicable securities rules and regulations that impose various requirements on public companies.

Our management and other personnel devote a substantial amount of time to compliance with these requirements and such compliance has increased, and will continue to increase, our legal, accounting and financial costs.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to maintain and improve the effectiveness of such controls, we have expended, and anticipate that we will continue to expend, significant resources.

For example, since our IPO, we have hired additional accounting and financial staff with appropriate public company experience and technical accounting knowledge to assist in our compliance efforts.

In addition, we are required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act.

We have incurred and expect to continue to incur significant expenses and devote substantial management effort toward compliance with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act.

To assist us in complying with these requirements we may need to hire more employees in the future, or engage outside consultants, which will increase our operating expenses.

Despite significant investment, our current controls and any new controls that we develop may become inadequate because of changes in business conditions.

For example, because we have acquired companies in the past and may continue to do so in the future, we need to effectively expend resources to integrate the controls of these acquired entities with ours.

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to implement and maintain effective internal control over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in the periodic reports that we file with the SEC.

If our management team or independent registered public accounting firm were to furnish an adverse report, or if it is determined that we have a material weakness or significant deficiency in our internal control over financial reporting, investors could lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by Nasdaq, the SEC or other regulatory authorities.

In addition, as a result of the COVID-19 pandemic, most of our employees - including those critical to maintaining an effective system of disclosure controls and internal control over financial reporting - are working, and may continue to work for the near term, in a remote environment and not in the office environment from which they have historically performed their duties.

We have limited experience maintaining effective control systems with our employees working in remote environments, and risks that we have not contemplated may arise and result in our failure to maintain effective disclosure controls or internal control over financial reporting.

If we fail to maintain our brand, our ability to expand our customer base will be impaired and our financial condition may suffer.

5 unchanged sentences

If we fail to successfully promote and maintain our brand, we may fail to attract enough new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business could suffer.

We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

We receive, store and process personal information and other data from and about customers, our employees, partners and service providers.

In addition, customers use our products and solutions to obtain and store personal identifiable information, personal health information (including protected health information) and personal financial information.

Our handling of data is thus subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S.

Federal Trade Commission (the “FTC”), the U.S.

Department of Health and Human Services Office for Civil Rights (the “OCR”), and various state, local and foreign agencies and other authorities.

Our data handling also is subject to contractual obligations and industry standards.

federal government and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses.

In the United States, various laws, and regulations and agency rules and opinions apply to the collection, processing, disclosure and security of certain types of data, including:

▪ The Electronic Signatures in Global and National Commerce Act (“ESIGN Act”) in the United States, eIDAS in the EU and similar U.S.

state laws, particularly the Uniform Electronic Transactions Act (the “UETA”), which authorize the creation of legally binding and enforceable agreements utilizing electronic records and signatures.

We are particularly reliant on the UETA and the ESIGN Act, which together have solidified the legal landscape for use of electronic records and electronic signatures in commerce by confirming that electronic records and signatures carry the same weight and have the same legal effect as traditional paper documents and wet ink signatures.

▪ The EU General Data Protection Regulation (the “GDPR”), that became effective in May 2018, imposes strict requirements related to processing the personal data of EU individuals.

EU data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of a noncompliant company’s annual global turnover for the preceding financial year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects.

Such penalties are in addition to any civil litigation claims.

The GDPR imposes compliance burdens on us, including by mandating burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process information about them.

Additionally, the United Kingdom (“UK”) implemented the Data Protection Act effective in May 2018 and statutorily amended in 2019, that substantially implements the GDPR and contains provisions, including UK-specific derogations, for how GDPR is applied in the UK.

The United Kingdom's planned departure in January 2020 from the European Union (commonly referred to as Brexit) has created uncertainty with regard to the requirements for data transfers between the UK and the EU and other jurisdictions, and it is still unclear whether the transfer of data from the European Economic Area to the UK will remain lawful under GDPR following “Brexit.” The GDPR also imposes strict rules on the transfer of personal data out of the EU to the United States.

These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices.

In addition, these rules are consistently under scrutiny.

▪ On July 16, 2020, the Court of Justice of the European Union (the “Court of Justice”) invalidated the European Union-United States (“EU-U.S.”) Privacy Shield on the grounds that the Privacy Shield failed to offer adequate protections to EU personal data transferred to the United States.

On August 10, 2020, the U.S.

Department of Commerce and the European Commission announced new discussions to evaluate the potential for an enhanced EU-U.S.

Privacy Shield framework to comply with the July 16 judgment of the Court of Justice.

We rely on approved Binding Corporate Rules as both a data processor and data controller, which provide an alternative to Privacy Shield certification for legalizing EU-U.S.

cross-border flows of personal data within and among DocuSign entities and systems, in compliance with GDPR and other applicable data protection laws.

Our SpringCM business, acquired in 2018, relied on the Privacy Shield at acquisition, but is expected to be included under our Binding Corporate Rules in the near-term.

We are therefore less affected by the court’s decision (and certain regulatory guidance issued in its wake) which has led to uncertainty regarding the legality of EU-U.S.

data flows in general and those conducted under the Privacy Shield in particular.

Additional changes to data protection laws or regulations in the European Union that limit or prevent transfers of personal data from the EU to the U.S.

could cause us to incur penalties under GDPR and could increase the cost and complexity of operating our business.

▪ The CCPA took effect on January 1, 2020 and is enforceable by the California Attorney General.

The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA provides for unlimited civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

The CCPA may increase our compliance costs and potential liability, particularly in the event of a data breach.

The CCPA may regulate or impact our processing of personal information depending on the context.

Given that CCPA enforcement began on July 1, 2020, it remains unclear what, if any, modifications will be made to this legislation or how it will be interpreted.

Additionally, the CCPA has prompted a number of proposals in the U.S.

for new federal and state-level privacy legislation that, if passed, could increase our potential liability, increase our compliance costs, and adversely affect our business.

▪ The Health Insurance Portability and Accountability Act (“HIPAA”) in the United States (as amended and supplemented by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) imposes mandatory contractual terms and other obligations with respect to safeguarding the privacy, security and transmission of protected health information.

We may function as a HIPAA business associate for certain of our customers and, as such, are subject to applicable privacy and data security requirements.

Failure to comply with HIPAA can result in significant civil monetary penalties and, in certain circumstances, criminal penalties and fines.

▪ Numerous other laws including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act (“GLBA”), and other state laws relating to privacy.

In addition, many foreign governments have established or are in the process of establishing privacy and data security legal frameworks with which we, our customers, partners or our vendors must comply.

In certain cases these laws and regulations are more restrictive than those in the United States and apply broadly to the collection, use, storage, disclosure and security of various types of data.

Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future.

We expect that new laws, regulations and industry standards will continue to be proposed and enacted relating to privacy, data protection, marketing, advertising, electronic signatures, consumer communications and information security in the United States, the EU and other jurisdictions, and we cannot determine the impact such future laws, regulations and standards may have on our business.

Future laws, regulations, standards and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our customer base and increase revenue.

Future restrictions on the collection, use, sharing or disclosure of data or additional requirements for the express or implied consent of our customers, partners or end consumers for the use and disclosure of such information could require us to incur additional costs or modify our products and solutions, possibly in a material manner, and could limit our ability to develop new functionality.

If we are not able to comply with these laws or regulations or if we become liable under these evolving laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.

This may require us to expend substantial resources or to discontinue certain solutions, which would negatively affect our business, operating results and financial condition.

In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise impact the growth of our business.

Any costs incurred as a result of this potential liability could harm our business and operating results.

Additionally, any failure or perceived failure by us to comply with laws, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions (including, for example, a ban by EU data protection authorities on the processing of EU personal data under the GDPR), litigation, fines and penalties or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business.

Many of our customers deploy our products and solutions globally, and our products and solutions must comply with certain legal and regulatory requirements in varying countries.

If our products and solutions fail to meet these requirements, we could incur significant liabilities and our financial condition may suffer.

Many customers use our products and solutions globally to comply with safe harbors and other legislation in the countries in which they transact business.

For example, some of our customers rely on our certifications under the Federal Risk and Authorization Management Program in the U.S.

and eIDAS in the EU to help satisfy their own legal and regulatory compliance requirements.

If a court or regulatory body determines that our products and solutions are inadequate to meet these requirements, documents executed through our products and solutions could, in some instances, be rendered unenforceable, resulting in potential loss of customers, liability under customer contracts, and brand and reputational damage.

The success of our business depends on customers’ continued and unimpeded access to our products and solutions on the internet.

9 unchanged sentences

While we have been issued patents in the United States and other countries and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications.

In addition, any patents issued in the future may not provide us with competitive advantages or may be successfully challenged by third parties.

In addition, any patents issued in the future

may not provide us with competitive advantages or may be successfully challenged by third parties.

Any of our patents, trademarks or other intellectual property rights may be challenged or circumvented by others or invalidated through administrative process or litigation.

15 unchanged sentences

If we fail to adequately protect our intellectual property and proprietary rights, our business, operating results and financial condition could be adversely affected.

We are subject to legal proceedings and litigation, including intellectual property disputes, which are costly and may subject us to significant liability and increased costs of doing business.

Our business may suffer if it is alleged or determined that our technology infringes the intellectual property rights of others.

The software industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual and proprietary rights.

We may be subject to legal proceedings and litigation for a variety of claims, including labor and employment issues, intellectual property disputes, securities law violations and other matters, which may be costly and may subject us to significant liability and increased costs of doing business.

Our business may suffer if it is alleged or determined that our technology infringes the intellectual property rights of others or if the cost and time-commitment of litigation diverts resources from our other business activities.

From time to time, we may be involved as a party or an indemnitor in disputes or regulatory inquiries that arise in the ordinary course of business.

These may include alleged claims, lawsuits and proceedings regarding labor and employment issues, commercial disagreements, securities law violations and other matters.

In particular, the software industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual and proprietary rights.

Companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights.

14 unchanged sentences

Requiring us to change one or more aspects of the way we deliver our products and solutions may harm our business.

Lawsuits are time-consuming and expensive to resolve, and they divert management’s time and attention.

Although we carry general liability insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed.

We cannot predict the outcome of lawsuits and cannot assure you that the results of any of these actions will not have an adverse effect on our business, operating results or financial condition.

Regardless of the merits or ultimate outcome of any claims that have been or may be brought against us or that we may bring against others, lawsuits are time-consuming and expensive to resolve, divert management’s time and attention, and could harm our reputation.

Although we carry general liability insurance, our insurance may not cover potential claims that arise or may not be adequate to indemnify us for all liability that may be imposed.

We may also determine that the most cost-effective way to resolve a dispute is to enter into a settlement agreement.

Litigation is inherently unpredictable and we cannot predict the timing, nature, controversy or outcome of lawsuits or cannot assure you that the results of any of these actions will not have an adverse effect on our business, operating results or financial condition.

We use open source software in our products, which could subject us to litigation or other actions.

2 unchanged sentences

As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software.

Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition or require us to devote

additional research and development resources to change our products.

Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition or require us to devote additional research and development resources to change our products.

In addition, if we were to combine our proprietary software products with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software products.

10 unchanged sentences

From time to time, there may be changes in our management team resulting from the hiring or departure of executives and key employees, which could disrupt our business.

For example, on September 8, 2020, Cynthia Gaylor became our Chief Financial Officer and Michael Sheridan, our outgoing Chief Financial Officer, became President of International.

Our senior management and key employees are employed on an at-will basis.

We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause.

If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, retain and motivate members of our senior management team and key employees, our business could be harmed.

If we lose one or more of our

senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, retain and motivate members of our senior management team and key employees, our business could be harmed.

We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions.

10 unchanged sentences

was 18% , 17% and 17% of our total revenue.

We currently have offices in the United States, Canada, the United Kingdom, France, Germany, Ireland, Israel, Australia, Singapore, Japan, Brazil, Sweden and Egypt.

As of October 31, 2020, we have offices in the United States, the United Kingdom, France, Germany, Ireland, Israel, Australia, Singapore, Japan, Brazil, Sweden and Egypt.

We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect.

As of July 31, 2020, approximately 28% of our full-time employees were located outside of the United States.

As of October 31, 2020, approximately 28% of our full-time employees were located outside of the United States.

We expect that our international activities will continue to grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources.

4 unchanged sentences

▪ greater difficulty collecting accounts receivable and longer payment cycles;

▪ potential changes in trade relations arising from policy initiatives implemented by the Trump administration, which has been critical of existing and proposed trade agreements;

▪ potential changes in trade relations arising from U.S.

policy initiatives;

▪ unexpected changes in laws and regulatory requirements, including but not limited to, taxes or trade laws;

18 unchanged sentences

If we invest substantial time and resources to further expand our international operations and are unable to do so successfully and in a timely manner, our business and operating results will suffer.

Risks Related to Governmental Regulation including Taxation