What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-06-09 compared with 2021-12-06 · 323 added, 262 removed, 566 unchanged (51% of the section changed)

6 unchanged sentences

Consistent with the foregoing, we are exposed to a variety of risks, including the following significant risks:

▪ We cannot predict the full impact of the COVID-19 pandemic on our business, results of operations and financial condition.

▪ We have a history of operating losses and may not achieve or sustain profitability in the future.

▪ We derive a majority of our revenue from our e-signature solutions, and slower or declining adoption of our e-signature solutions, without a corresponding increase in the use of our other products and solutions, could cause our operating results to suffer.

▪ The COVID-19 pandemic has materially affected and may continue to impact how we and our customers are operating our businesses, and the duration and extent to which this will impact our future business, results of operations and financial condition remain uncertain.

DocuSign, Inc.

| 2023 Form 10Q | 34

▪ We derive a majority of our revenue from our DocuSign eSignature product, and slower or declining adoption of our DocuSign eSignature product, without a corresponding increase in the use of our other products and solutions, could cause our operating results to suffer.

▪ The market for our products and solutions is relatively new and evolving.

1 unchanged sentence

▪ If we are unable to attract new customers and retain and expand sales to existing customers, our revenue growth will be adversely affected.

▪ The market in which we participate is highly competitive, which may negatively affect our ability to add new customers, retain existing customers and grow our business.

▪ We have a history of operating losses and may not achieve or sustain profitability in the future.

▪ We depend on co-located data centers and third-party cloud providers as well as our own technical operations infrastructure to provide our products and solutions to our customers in a timely manner.

4 unchanged sentences

▪ Our recent rapid growth may not be indicative of our future growth, and, if we continue to grow rapidly, we may not be able to manage our growth effectively.

DocuSign, Inc.

| 2022 Form 10Q | 38

▪ Because we recognize revenue from subscriptions over the term of the relevant contract, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

▪ The market in which we participate is highly competitive, which may negatively affect our ability to add new customers, retain existing customers and grow our business.

▪ If our products and solutions fail to perform properly and if we fail to develop enhancements to resolve any defect or other problems, we could lose customers or become subject to service performance or warranty claims and our market share could decline.

4 unchanged sentences

Our business involves significant risks, some of which are described below.

You should carefully consider the following risks, together with all of the other information in this Quarterly Report on Form 10-Q, including in the preceding Risk Factors Summary, our consolidated financial statements and the related notes included elsewhere in this Quarterly Report on Form 10-Q.

You should carefully consider the following risks, together with all of the other information in this Quarterly Report on Form 10-Q, including in the preceding Risk Factors Summary, and our consolidated financial statements and the related notes included elsewhere in this Quarterly Report on Form 10-Q.

Risks Related to Our Business and Industry

We cannot predict the full impact of the COVID-19 pandemic on our business, results of operations and financial condition.

The COVID-19 pandemic continues to evolve and the full impact of the pandemic on our business will depend largely on future developments, including the duration, spread and severity of the pandemic, the emergence of coronavirus variants, the actions undertaken to contain the virus or mitigate its impacts, including actions mandated by governments and health authorities and changing public health directives or restrictions, the speed and breadth of vaccination progress, vaccine efficacy against COVID-19 variants, current or future travel restrictions and how quickly and to what extent normal global economic and operating conditions can or will resume, all of which are highly uncertain and cannot be accurately predicted.

The pandemic has created and is likely to continue to create significant volatility in global financial markets.

Due to the widespread shift by businesses to remote, web-enabled operations and digital agreements, we experienced a substantial increase in overall demand for our products, in particular DocuSign eSignature, particularly at the beginning of the pandemic.

Although this contributed to growth in our customer base and increases in customer spending across industries and regions, the growth we experienced may not continue in future periods.

As the pandemic continued in 2021, the rate of vaccinations, emerging COVID-19 variants, and shifting governmental policies on vaccination mandates and other pandemic restrictions have had variable impacts on different regions of the world and areas of the economy.

This has caused and may continue to cause new, existing and potential customers to experience rapidly changing conditions and disruptions to their businesses.

This may result in differing levels of demand for our products as our customers’ priorities, resources, financial conditions and economic outlook change, which could adversely affect or increase the volatility of our financial results.

The COVID-19 pandemic has materially affected and may continue to impact how we and our customers are operating our businesses, and the duration and extent to which this will impact our future business, results of operations and financial condition remain uncertain.

The pandemic has materially affected and may continue to impact how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results remain uncertain.

DocuSign, Inc.

| 2023 Form 10Q | 35

During the pandemic, we experienced periods characterized by exceptionally high revenue growth, as customers rapidly shifted to remote, web-enabled operations and digital agreements.

We later experienced periods in which the urgency of customer demand slowed.

It can be difficult to predict customer demand, especially as their priorities, resources and economic outlook change, along with other shifting market conditions.

These shifts have occurred and may in the future occur more quickly than we anticipate.

If we are unable to respond quickly to rapidly changing market conditions and shifts in customer behavior, our business and results of operation could be harmed, and the trading price of our common stock could be adversely affected.

Additionally, as a service provider to U.S.

state and federal government agencies, we are subject to a variety of COVID-19 vaccination, testing, and related health and safety requirements, including the requirement that our U.S.-based employees be fully vaccinated against COVID-19 by January 4, 2022 absent a medical or religious exemption.

state and federal government agencies, we have been subject to various and fluctuating COVID-19 vaccination, testing, and related health and safety requirements.

While we cannot predict the full impact these requirements may have on our business, our ability to retain or hire employees could be impacted;

2 unchanged sentences

and our business and results of operations could be harmed.

DocuSign, Inc.

| 2022 Form 10Q | 39

During the pandemic, we have taken a number of precautionary measures to ensure the health and safety of our employees, partners and customers, including by shifting to a largely remote work environment, imposing work-related travel restrictions for our employees and shifting most planned customer, partner and investor events to virtual-only formats.

We may take additional measures in the future based on evolving conditions and applicable laws and regulations.

However, there can be no assurance that these measures will be effective, or that we can adopt them without adversely affecting our business operations and financial condition.

For example, our management team has been focusing additional time on planning for and mitigating the pandemic and its actual and potential effects on our business, including plans to reopen our offices and resume in-person business activities, which may reduce the amount of time available for other initiatives.

Changes in our operations in response to the pandemic may result in inefficiencies or delays that cannot be fully mitigated through succession planning, remote work arrangements or teleconferencing technologies.

During the pandemic, we have taken a number of precautionary measures to ensure the health and safety of our employees, partners and customers, including shifting to hybrid work arrangements, imposing work-related travel restrictions for our employees and shifting most planned customer, partner and investor events to virtual-only formats.

We are assessing the efficacy and continuation of these measures based on evolving conditions and applicable laws and regulations.

There can be no assurance that these measures will be effective, or that we can adopt or continue them without adversely affecting our business operations and financial condition.

For example, our management team has been focusing additional time on planning for and mitigating the pandemic and its actual and potential effects on our business, which may reduce the amount of time available for other initiatives.

Changes in our operations in response to the pandemic may result in inefficiencies or delays that cannot be fully mitigated through succession planning, remote or hybrid work arrangements or teleconferencing technologies.

These mitigation efforts may also lead to inefficiencies of our employees, operational and cybersecurity risks and other circumstances which could have an adverse impact to our results of operations and financial condition.

Finally, the effects of the COVID-19 pandemic also may heighten other risks, including significant volatility in global markets and the trading price of our common stock.

Finally, the effects of the COVID-19 pandemic, or the easing of COVID-19-related restrictions, also may heighten other risks, including significant volatility in global markets and the trading price of our common stock.

The full impact of the pandemic on our business will continue to depend on future developments, including but not limited to, the emergence of new coronavirus variants, the actions undertaken to contain the virus or mitigate its impacts and the easing or removal of such actions, including actions mandated by governments and health authorities and changing public health directives or restrictions, vaccine efficacy against COVID-19 variants, current or future travel restrictions and how quickly and to what extent normal global economic and operating conditions can or will resume, all of which could evolve and are difficult to predict.

Additionally, due to our subscription-based business model, the full effects of these changes may not be fully reflected in our results of operations until future periods.

If the COVID-19 pandemic continues to have a substantial impact on our employees, partners or customers or if the abatement of the pandemic results in decreased demand or a more challenging sales environment, our business, results of operations and financial condition may be harmed.

To the extent that the pandemic harms our business and results of operations, many of the other risks described in this “Risk Factors” section will be exacerbated.

We have a history of operating losses and may not achieve or sustain profitability in the future.

We began operations in 2003 and have experienced net losses since inception.

We generated a net loss of $39.5 million and $170.9 million in the nine months ended October 31, 2021 and 2020, and as of October 31, 2021, we had an accumulated deficit of $1.4 billion.

We will need to generate and sustain increased revenue levels in future periods to become profitable and, even if we do, we may not be able to maintain or increase our level of profitability.

We intend to continue to incur significant expenses to support growth, further develop and enhance our products and solutions, expand our infrastructure and technology, increase our sales headcount and marketing activities, and grow our international operations and customer base.

Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses.

We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events.

If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.

We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors, the price of our common stock could decline.

9 unchanged sentences

▪ the timing and success of new product and service introductions by us or our competitors or any other change in the competitive dynamics of our industry, including consolidation or new entrants among competitors, customers, or strategic partners ;

DocuSign, Inc.

| 2023 Form 10Q | 36

▪ rising inflation and our ability to control costs, including our operating expenses;

▪ our ability to continue operating remotely due to the COVID-19 pandemic and to adapt to “hybrid” work arrangements combining remote and in-office work;

▪ our ability to continue operating remotely and to adapt to hybrid work arrangements combining remote and in-office work;

▪ the timing of costs related to our go-to-market strategy including expansion of our sales capacity and marketing;

▪ potential accelerations of prepaid expenses and deferred costs;

▪ the amount and timing of non-cash expenses, including stock-based compensation, goodwill impairments and other non-cash charges;

▪ the amount and timing of costs associated with recruiting, training and integrating new employees;

▪ the amount and timing of non-cash expenses, including stock-based compensation, impairments and other non-cash charges;

▪ the amount and timing of costs associated with recruiting, training and integrating new employees, and retaining existing employees;

▪ the time and costs related to litigation, including securities litigation;

▪ issues relating to acquisitions and partnerships with third parties;

DocuSign, Inc.

| 2022 Form 10Q | 40

▪ general economic, market and industry conditions, including resulting from the COVID-19 pandemic;

▪ general economic, market and industry conditions, including resulting from regional or global conflicts and as a result of inflation or rising interest rates;

▪ the impact of new accounting pronouncements;

3 unchanged sentences

If our operating results fall below the expectations of investors and securities analysts who follow our stock, the price of our common stock could decline substantially, and we could face costly lawsuits, including securities class action lawsuits.

We derive a majority of our revenue from our e-signature solutions, and slower or declining adoption of our e-signature solutions, without a corresponding increase in the use of our other products and solutions, could cause our operating results to suffer.

Sales of subscriptions to our e-signature solutions account for substantially all of our subscription revenue and are the source of substantially all of our professional services revenue.

Although we continue to add to our suite of products and solutions for automating the agreement process, we expect that we will be substantially dependent on our e-signature solutions to generate revenue for the foreseeable future.

We derive a majority of our revenue from our DocuSign eSignature product, and slower or declining adoption of our DocuSign eSignature product, without a corresponding increase in the use of our other products and solutions, could cause our operating results to suffer.

Sales of subscriptions to our DocuSign eSignature product account for substantially all of our subscription revenue and are the source of substantially all of our professional services revenue.

Although we continue to add to our suite of products and solutions for automating the agreement process, we expect that we will be substantially dependent on our DocuSign eSignature product to generate revenue for the foreseeable future.

As a result, our operating results could suffer due to:

▪ any decline in demand for our e-signature solutions;

▪ macro- and micro-economic effects of the COVID-19 pandemic, including its effect on the pace of the digital transformation of business;

▪ the failure of our e-signature solutions to maintain market acceptance;

▪ any decline in demand for our DocuSign eSignature product;

▪ macro- and micro-economic effects of the COVID-19 pandemic, including its effect on the pace of the digital transformation of business and hybrid work arrangements;

▪ the failure of our DocuSign eSignature product to maintain market acceptance;

▪ the market for electronic signatures failing to grow, or growing more slowly than we expect;

▪ new products and technologies that replace or represent an improvement over, our e-signature solutions;

▪ new technological innovations or standards that our e-signature solutions do not address;

▪ new products and technologies from our competitors that replace or represent an improvement over, our DocuSign eSignature product;

▪ new technological innovations or standards that our DocuSign eSignature product does not address;

▪ changes in regulations;

▪ sensitivity to our current or future pricing;

▪ our inability to release enhanced versions of our e-signature solutions on a timely basis.

If we experience a material decline in sales of subscriptions to our e-signature solutions, without a corresponding increase in subscriptions to our other products and solutions, our revenue and operating results would be harmed.

▪ our inability to release enhanced versions of our DocuSign eSignature product on a timely basis.

If we experience a material decline in sales of subscriptions to our DocuSign eSignature product, without a corresponding increase in subscriptions to our other products and solutions, our revenue and operating results would be harmed.

DocuSign, Inc.

| 2023 Form 10Q | 37

The market for our products and solutions is relatively new and evolving.

If the market does not develop further, develops more slowly, or in a way that we do not expect, our business will be adversely affected.

The market for our products and solutions — including our e-signature solution, which is the core part of our broader DocuSign Agreement Cloud platform for automating the agreement process — is relatively new and evolving, which makes our business and future prospects difficult to evaluate.

The market for our products and solutions — including our DocuSign eSignature product, which is the core part of our broader DocuSign Agreement Cloud platform for automating the agreement process — is relatively new and evolving, which makes our business and future prospects difficult to evaluate.

We have customers in a wide variety of industries, including real estate, financial services, insurance, manufacturing, and healthcare and life sciences.

We have also expanded and intend to continue to expand our sales efforts internationally, where many countries may have less familiarity with and acceptance of e-signature products.

It is difficult to predict customer demand for our products and solutions, customer retention and expansion rates, the size and growth rate of the market for agreement automation, the entry of competitive products or the success of existing competitive products.

We expect that we will continue to need intensive sales efforts to educate prospective customers, particularly enterprise and commercial customers, about the uses and benefits of our products and solutions.

The size and growth of our addressable market depends on a number of factors, including our customers’ desire to differentiate themselves through e-signature solutions and other products and solutions that automate the agreement process, as well as changes in the competitive landscape, technological changes, budgetary constraints of our customers, changes in business practices, changes in regulations and changes in economic conditions.

We expect that we will continue to need intensive sales efforts to educate prospective customers, particularly enterprise and commercial customers and international customers, about the uses and benefits of our products and solutions.

The size and growth of our addressable market depends on a number of factors, including our customers’ desire to differentiate themselves through e-signature products and other products and solutions that automate the agreement process, as well as changes in the competitive landscape, technological changes, budgetary constraints of our customers, changes in business practices, changes in regulations and changes in economic and global market conditions.

If customers do not accept the value proposition of our offerings, then a viable market for products and solutions may not develop further, or it may develop more slowly than we expect, either of which would adversely affect our business and operating results.

4 unchanged sentences

If our pricing is not competitive or we cannot attract new customers and subsequently maintain and expand those customer relationships, our business and operating results may be harmed.

DocuSign, Inc.

| 2022 Form 10Q | 41

Our ability to increase our revenue also depends on our ability to expand the sales of our products and solutions to, and renew subscriptions with, existing customers and their organizations.

3 unchanged sentences

Our customers have no obligation to renew their subscriptions and we cannot guarantee that our customers will renew their subscriptions with us for a similar or greater contract period or on the same or more favorable terms.

Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction, decreases in the number of users at our customers, changes in the type and size of our customers, pricing, competitive conditions, customer attrition and general economic conditions, including as a result of the COVID-19 pandemic.

Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction, decreases in the number of users at our customers, changes in the type and size of our customers, pricing, competitive conditions, customer attrition and general economic and global market conditions, including as a result of the COVID-19 pandemic.

If our customers do not renew their subscriptions for our products and solutions or if they reduce their subscription amounts at the time of renewal, our revenue will decline, and our business will suffer.

1 unchanged sentence

Our products and solutions address a market that is evolving and highly competitive and face competition from different companies depending on the product or solution.

For example, our primary global e-signature competitor is currently Adobe Systems Incorporated.

We also face competition from a select number of specialized vendors that focus on specific industries, geographies or use cases.

In addition to competition in the e-signature market, our other products and solutions, such as DocuSign CLM, DocuSign Payments and DocuSign ID Verification separately face competition from companies in the contract lifecycle management, payment processing and identity verification software markets.

As we attempt to sell access to our products and solutions to potential customers with existing products and solutions, we must convince them that our products and solutions are superior to the solutions that their organizations have used in the past.

For example, our primary global e-signature competitor is currently Adobe Sign.

We also face competition from a select number of vendors that focus on specific industries, geographies or product areas such as contract lifecycle management and advanced contract analytics.

As we attempt to sell access to our products and solutions to new customers with existing products and solutions (or cross-sell additional products and solutions to existing customers), we must convince them that our products and solutions are superior to the solutions that their organizations have used in the past.

Many of our competitors have longer operating histories than us, significantly greater financial, technical, marketing and other resources, stronger brand and customer recognition, larger intellectual property portfolios and broader global distribution.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements.

Further, we could lose customers if our competitors develop new competitive products and solutions, acquire competitive products, reduce prices, form strategic alliances with other companies, are acquired by third parties with greater resources or develop and market new technologies that render our existing or future products less competitive, unmarketable or obsolete.

Our competitors may also offer lower pricing than we do or bundle certain competing products and services at a lower price.

Further, we could lose customers if our

DocuSign, Inc.

| 2023 Form 10Q | 38

competitors develop new competitive products and solutions, acquire competitive products, reduce prices, form strategic alliances with other companies, are acquired by third parties with greater resources or develop and market new technologies that render our existing or future products less competitive, unmarketable or obsolete.

If we are unable to effectively compete, our business, operating results and financial condition would be harmed.

We have a history of operating losses and may not achieve or sustain profitability in the future.

We began operations in 2003 and have experienced net losses since inception.

We generated a net loss of $27.4 million and $8.4 million in the three months ended April 30, 2022 and 2021, and as of April 30, 2022, we had an accumulated deficit of $1.5 billion.

We will need to generate and sustain increased revenue levels in future periods to become profitable and, even if we do, we may not be able to maintain or increase our level of profitability.

Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses.

If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.

We depend on co-located data centers and third-party cloud providers, as well as our own technical operations infrastructure, to provide our products and solutions to our customers in a timely manner.

3 unchanged sentences

In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions.

As a result, we depend, in part, on our data center providers’ ability to protect these facilities against damage or interruption, including from natural disasters, power or telecommunications failures, criminal acts and similar events.

As a result, we depend, in part, on our data center providers’ ability to protect these facilities against damage or interruption, including from natural disasters, regional or global conflicts, power or telecommunications failures, criminal acts and similar events.

In the event that our data center arrangements are terminated, or if there are any lapses of service or damage to a data center, we could experience lengthy interruptions in our service as well as delays and additional expenses in arranging new facilities and services.

Even with current and planned disaster recovery arrangements, including the existence of secondary data centers that become active during certain lapses of service or damage at a primary data center, our business could be harmed.

Even with current and planned disaster recovery arrangements, our disaster recovery planning may not account for all eventualities and our business could be harmed.

In addition to third-party data centers and cloud providers, we also rely on our own technical operations infrastructure to support and serve our rapidly growing customer base.

1 unchanged sentence

Design and mechanical errors, spikes in usage volume and failure to follow system protocols and procedures could cause our systems to fail, resulting in interruptions in our products and solutions.

Any interruptions or delays in our service, whether or not caused by our products, whether as a result of third-party error, our own error, natural disasters, operational disruptions related to the COVID-19 pandemic or other public health crises, or security breaches, whether

DocuSign, Inc.

| 2022 Form 10Q | 42

accidental or willful, could harm our relationships with customers and cause our revenue to decrease and/or our expenses to increase.

Any interruptions or delays in our service, whether or not caused by our products, whether as a result of third-party error, our own error, natural disasters and the effects of climate change, operational disruptions related to the COVID-19 pandemic or other public health crises, or security breaches, whether accidental or willful, could harm our relationships with customers and cause our revenue to decrease and/or our expenses to increase.

Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur.

These factors in turn could further reduce our revenue, subject us to liability and cause us to issue credits or cause customers to fail to renew their subscriptions, any of which could adversely affect our business.

DocuSign, Inc.

| 2023 Form 10Q | 39

Our systems and security measures have been, and may in the future be, compromised or subject to data breaches, cyberattacks, or other malicious activity.

Consequently, our products and solutions may be perceived as not being secure.

This may result in customers reducing or stopping their use of our products or solutions, our reputation being harmed, our incurring significant liabilities and adverse effects on our operating results and growth prospects.

Our operations involve the storage and transmission of customer data, personal data and other sensitive information, and our corporate environment contains important company data and/or business records, employee data and data from partner, vendor or other relationships, as well as a wide variety of our own internal company, partner and employee information.

Like other organizations providing valuable technology and services, we are subject to cyberattacks from malicious third parties using a wide variety of tactics, including credential stuffing and account takeover attacks, denial or degradation of service attacks, malicious code (e.g., viruses and worms) and many other techniques.

If bad actors gain improper access to our systems or databases or those of our partners and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom.

A security breach could result in monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, on-going regulatory oversight, assessments and audits, exposure to civil litigation, a breach of our contracts with third parties, all of which could harm our business, financial condition, and operating results.

Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future.

Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results.

While we have security measures in place designed to protect our production, development and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we have faced security incidents in the past.

For example, in March 2017, a malicious third party used a phishing attack to gain access to a remote employee’s laptop and then accessed a list of email addresses which were uploaded to a third-party website.

In addition, in April 2020, a malicious third party used a brute force password attack to gain access to an isolated testing environment, and exfiltrated a portion of our source code.

In both cases, upon detection we took immediate action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies.

In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies.

These efforts may not completely eliminate potential risks from such incidents, however.

While these attempts had no impact on our operations, products or services, there can be no assurance that there will be no impact from these or similar incidents in the future.

Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers and damage to our reputation and could impair our sales and harm our business.

Moreover, due to the ongoing COVID-19 pandemic, there is an increased risk that we may experience cybersecurity related incidents as a result of our employees, service providers and third parties working remotely on less secure systems during office closures or when access to facilities may be limited, including due to government mandated shelter-in-place orders.

Further, we may face additional security incidents in the future, resulting in unauthorized access to, loss of or unauthorized disclosure of sensitive and proprietary information of DocuSign or our customers, partners or employees, and such incidents may in the future result in regulatory enforcement actions, litigation (including a new private right of action under the California Consumer Privacy Act (the “CCPA”), as described in the risk factor below titled “We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations could also result in additional costs and liabilities to us or inhibit sales of our software.”), indemnity obligations and other possible liabilities, in addition to the potential harms described above.

Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers, damage to our reputation and could impair our sales and harm our business.

Additionally, as we rely on third-party and public-cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of customer data.

Our ability to monitor our third-party service providers’ data security is limited and any breach of our providers’ security measures may result in unauthorized access to, or misuse, loss or destruction of, our and our customers’ data.

Moreover, our employees, service providers and third parties work more frequently on a remote or hybrid arrangement basis, which may involve relying on less secure systems and may increase the risk of cybersecurity related incidents.

We cannot guarantee these private work environments and electronic connections to our work environment have the same robust security measures deployed in our physical offices.

Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based service providers have been and are expected to continue to be targeted.

3 unchanged sentences

If our security measures, or the security measures of our service providers, partners or customers, are compromised, our reputation could be damaged, our ability to attract and retain customers could be adversely affected and our business may be harmed.

DocuSign, Inc.

| 2022 Form 10Q | 43

and foreign laws and regulations require companies to provide notice of data security breaches and/or incidents involving certain types of personal data to individuals, the media, government authorities or other third parties.

In addition, some of our customers contractually require notification of data security breaches.

Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which may lead to widespread negative publicity.

Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect our business and operating results.

Any security compromise in our industry, whether actual or perceived, could

DocuSign, Inc.

| 2023 Form 10Q | 40

harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect our business, operating results and financial condition.

A network or data security incident against us, whether actual, alleged, or perceived, may result in our products and solutions not being perceived as secure.

This could result in customers reducing or stopping their use of our products or solutions, our reputation being harmed, our incurring significant liabilities and adverse effects on our operating results and growth prospects.

Any actual, alleged or perceived security breach in our systems or networks, or any other actual, alleged or perceived data security incident we suffer, could result in damage to our reputation, negative publicity, loss of customers and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, costly litigation, and other liability.

Our agreements with third parties, including customers, contain contractual commitments we are required to adhere to related to information security and data privacy compliance.

If we experience an incident that triggers a breach of such contractual commitments, we could be exposed to significant liability or cancellation of service under these agreements.

The damages payable to the counterparty as well as the impact to our service could be substantial and create substantial costs and loss of business.

There can be no assurance that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

We also cannot be sure that our existing general liability insurance coverage and coverage for errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims, or that insurers will not deny coverage as to any future claim.

Security breaches may result in increased costs for such insurance.

One or more large, successful claims against us in excess of our available insurance coverage, or changes in our insurance policies, including premium increases or large deductible or co-insurance requirements, could have an adverse effect on our business, operating results and financial condition.

We obtain and process a large amount of sensitive customer data.

Any real or perceived improper use of, disclosure of, or access to such data could harm our reputation, as well as have an adverse effect on our business.

We receive, store and process personal information and other data from and about customers, our employees, partners and service providers.

In addition, customers use our products and solutions to obtain and store personal information, health information (including protected health information) and personal financial information.

Our handling of data is thus subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S.

Federal Trade Commission (the “FTC”), the U.S.

Department of Health and Human Services Office for Civil Rights (the “OCR”), and various state, local and foreign agencies and other authorities.

Our data handling also is subject to contractual obligations and industry standards.

We have internal and publicly posted policies regarding our collection, processing, use, disclosure, deletion and security of information.

Although we endeavor to comply with our policies and documentation, we may at times fail to do so or be accused of having failed to do so.

The publication of our privacy policies and other documentation that provide commitments about data privacy and security can subject us to potential actions if they are found to be non-compliant, deceptive, unfair, or otherwise misrepresent our actual practices, which could materially and adversely affect our business, financial condition and results of operations.

We are subject to laws and regulations governing our use of our business data.

For more information on these laws and regulations, see the risk factor “ We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

” If we are not able to comply with these laws or regulations or if we become liable under these evolving laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.

This may require us to expend substantial resources or to discontinue certain solutions, which would negatively affect our business, operating results and financial condition.

In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise impact the growth of our business.

Any costs incurred as a result of this potential liability could harm our business and operating results.

DocuSign, Inc.

| 2023 Form 10Q | 41

Additionally, any failure or perceived failure by us to comply with laws, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions, litigation, fines and penalties or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business.

If our products and solutions do not evolve to meet the needs of our customers or fail to achieve sufficient market acceptance, our financial results and competitive position will suffer.

18 unchanged sentences

Customers frequently require considerable time to evaluate, test and qualify our offerings prior to entering into or expanding a subscription.

This is particularly true of DocuSign CLM and our other advanced offerings, where longer evaluation, testing and qualification processes often result in longer sales cycles than for our e-signature solutions.

The timing of our sales with our enterprise customers and related revenue recognition is difficult to predict because of the

DocuSign, Inc.

| 2022 Form 10Q | 44

length and unpredictability of the sales cycle for these customers.

The timing of our sales with our enterprise customers and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for these customers.

During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a sale.

6 unchanged sentences

▪ the customer’s familiarity with e-signature and agreement automation processes;

▪ the complexity of contracts with certain large business customers;

▪ customer evaluation of competing products during the purchasing process;

▪ the competitive market for our products and services;

▪ evolving customer demands.

DocuSign, Inc.

| 2023 Form 10Q | 42

Our recent rapid growth may not be indicative of our future growth, and, if we continue to grow rapidly, we may not be able to manage our growth effectively.

Our revenue grew from $974.0 million in the year ended January 31, 2020 to $1.5 billion in the year ended January 31, 2021.

Our revenue grew from $1.5 billion in the year ended January 31, 2021 to $2.1 billion in the fiscal year ended January 31, 2022.

We expect that, in the future, as our revenue increases, our revenue growth rate will decline as the scale of our business increases.

We also believe that the COVID-19 pandemic caused many businesses to accelerate the process of shifting to digital agreement processes, contributing to our significant revenue growth during the fiscal year ended January 31, 2021 and the first, second and third quarters of the fiscal year ended January 31, 2022.

While we believe that once businesses have shifted to digital agreement processes they will not return to manual ones, we have no way of knowing how much of this growth will be permanent or even indicative of future growth as the COVID-19 pandemic lessens in severity and businesses return to a more normalized, in-person work environment, nor whether demand for our products will remain strong.

For example, future period-over-period revenue growth rates, when compared against the third and fourth quarters of our fiscal year ended January 31, 2021 and the first, second and third quarters of our fiscal year ended January 31, 2022, may fail to meet the expectations of investors or securities analysts given the accelerated revenue growth experienced during such periods due to the COVID-19 pandemic and the resulting increased adoption of remote work and reduced seasonality experienced during such periods.

While we experienced an increase in paying customers and revenue due to the pandemic, there is no assurance that we will experience a continued increase in paying customers or that new or existing customers will utilize our products at similar levels when businesses return to more normalized, hybrid or in-person work environments.

Additionally, future revenue growth rates may fail to meet the expectations of investors or securities analysts, particularly if measured against periods of accelerated revenue growth such as those experienced during the earlier phases of the COVID-19 pandemic and the resulting increased adoption of remote work and reduced seasonality experienced during such periods.

We believe that future growth of our revenue depends on a number of factors, including our ability to:

2 unchanged sentences

▪ expand our DocuSign Agreement Cloud offerings for our customers;

▪ continue to introduce our products and solutions to new markets outside of the United States;

▪ mitigate and effectively manage the varying impacts of the COVID-19 pandemic, including its effect on the pace of the digital transformation of business and the costs of monitoring and complying with evolving governmental mandates;

▪ hire, maintain and train our employee base including our sales force, research and development teams and key employees;

▪ continue to introduce our products and solutions to new markets outside of the U.S.;

▪ hire, retain and train our employee base including our sales force, research and development teams and key employees;

▪ successfully identify and develop, acquire or invest in businesses, products or technologies that we believe could complement or expand our products and solutions;

2 unchanged sentences

We expect to continue to expend substantial financial and other resources on:

▪ sales and marketing, including a significant expansion of our sales organization, particularly in the United States;

▪ sales, including a significant expansion of our global sales organization and investment in training and sales enablement;

▪ marketing to expand brand awareness both in the U.S.

and internationally;

▪ our technology infrastructure, including systems architecture, management tools, scalability, availability, performance and security, as well as disaster recovery measures;

▪ product development;

▪ product development and innovation;

▪ acquisitions or strategic investments;

1 unchanged sentence

▪ general administration, including legal and accounting expenses.

DocuSign, Inc.

| 2022 Form 10Q | 45

In addition to growth in revenue, we have also experienced significant growth in the number of our customers and users, the number and complexity of the transactions we handle, and the amount of data that our infrastructure supports.

Our growth has placed and may continue to place significant demands on our management and our operational and financial resources.

Finally, our business is becoming more complex as we increase our product and solution offerings, add additional staff and acquire complementary companies, products and technologies.

Finally, our business is becoming more complex as we increase our product offerings, add additional staff, expand internationally and acquire complementary companies, products and technologies.

In connection with this increased complexity, we are working to improve our operational, financial and management controls as well as our reporting systems and procedures, including streamlining or automating manual processes, all of which requires capital expenditures and management attention.

Failure to effectively manage our growth could have an adverse effect on our business, operating results and financial condition.

Failure to effectively manage our growth and operations could have an adverse effect on our business, operating results and financial condition.

DocuSign, Inc.

| 2023 Form 10Q | 43

Because we recognize revenue from subscriptions over the term of the relevant contract, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

13 unchanged sentences

Even if our total addressable market meets our size estimates and experiences growth, we may not continue to grow our share of the market.

We have in the past, and may in the future, engage in merger and acquisition activities, which could divert the attention of management, disrupt our business, dilute stockholder value and adversely affect our operating results and financial condition.

We have in the past, and may in the future, engage in acquisition and investment activities, which could divert the attention of management, disrupt our business, dilute stockholder value and adversely affect our operating results and financial condition.

As part of our business strategy, we continually evaluate opportunities to acquire or invest in businesses, products or technologies that we believe could complement or expand our products and solutions, enhance our technical capabilities or otherwise offer growth opportunities.

For example, in September 2018, we acquired SpringCM, a provider of cloud-based document generation and contract lifecycle management software, in May 2020 we acquired Seal Software Group Ltd., a provider of contract analytics software, and in July 2020 we acquired Liveoak Technologies, Inc., a provider of a secure agreement-collaboration and identity verification platform.

For example, in May 2020, we acquired Seal Software Group Ltd., a provider of contract analytics software, and in July 2020 we acquired Liveoak Technologies, Inc., a provider of a secure agreement-collaboration and identity verification platform.

In the future, we may be unable to identify suitable acquisition candidates and, even if we do, we may not be able to complete desired acquisitions on favorable terms, if at all.

4 unchanged sentences

▪ cause adverse tax consequences or unfavorable accounting treatment;

DocuSign, Inc.

| 2022 Form 10Q | 46

▪ expose us to claims and disputes by third parties, including intellectual property claims and disputes;

▪ expose us to claims and disputes by third parties, including intellectual property and privacy claims and disputes;

▪ not generate sufficient financial return to offset additional costs and expenses related to the acquisition;

4 unchanged sentences

In addition, a failure to successfully integrate the operations, personnel or technologies of an acquired business could impact our ability to realize the full benefits of such an acquisition.

Our limited experience acquiring companies increases these risks.

Our limited experience acquiring companies

DocuSign, Inc.

| 2023 Form 10Q | 44

increases these risks.

If we are unable to achieve the anticipated strategic benefits of an acquisition or if the integration or the anticipated financial and strategic benefits, including any anticipated cost savings, revenue opportunities or operational synergies, of such an acquisition are not realized as rapidly as or to the extent anticipated by us, our business, operating results and financial condition could suffer.

3 unchanged sentences

Sales to such entities are subject to a number of challenges and risks, including those related to the COVID-19 pandemic and our status as a service provider to U.S.

state and federal governmental agencies as discussed in the risk factor above titled “We cannot predict the full impact of the COVID-19 pandemic on our business, results of operations and financial condition.” Selling to such entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale.

state and federal governmental agencies.

Selling to such entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale.

These longer sale cycles make the timing of future revenue from these entities difficult to predict.

4 unchanged sentences

We may need to reduce or change our pricing model to remain competitive.

We price our subscriptions for e-signature solutions based on the number of users within an organization who use our products and solutions to send agreements digitally for signature or the number of Envelopes that such users are provisioned to send.

We expect that we may need to change our pricing from time to time, including in connection with the launch of new or enhanced offerings for automating the agreement process.

Different pricing structures apply to our Agreement Cloud products.

For DocuSign eSignature, we price our subscriptions based on the functionality required by our customers and the quantity of Envelopes provisioned.

We expect that we may need to change our pricing or pricing structures from time to time, including in connection with the launch of new or enhanced offerings for automating the agreement process or in response to competitive pressures.

As new or existing competitors introduce new competitive products or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

We also must determine the appropriate price to enable us to compete effectively internationally.

As we expand internationally, we must also determine the appropriate price to enable us to compete effectively in non-U.S.

Moreover, mid- to large-size enterprises may demand substantial price discounts as part of the negotiation of sales contracts.

2 unchanged sentences

Our ability to increase our customer base and achieve broader market acceptance of our products and solutions depends to a significant extent on our ability to expand our marketing and sales operations.

We are continuously expanding our sales force and strategic partnerships, both domestically and internationally.

We continue to make investments in our sales force and strategic partnerships, including expansion and training, both domestically and internationally.

We also dedicate significant resources to our sales and marketing efforts by investing in advertising campaigns on a variety of media platforms, including online and social media.

The effectiveness of our online advertising has varied over time and may vary in the future due to competition for key search terms, changes in search engine use and changes in the search algorithms used by major search engines.

If we cannot cost-effectively deploy our expanding sales force and use our marketing

DocuSign, Inc.

| 2022 Form 10Q | 47

tools, or if we fail to promote our products and solutions efficiently and effectively, our ability to acquire new customers and our financial condition may suffer.

If we cannot cost-effectively deploy our expanding sales force, both domestically and internationally, and use our marketing tools, or if we fail to promote our products and solutions efficiently and effectively, our ability to acquire new customers and our financial condition may suffer.

We may not be able to scale our business quickly enough to meet the growing needs of our customers and if we are not able to grow efficiently, our operating results could be harmed.

1 unchanged sentence

In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support and professional services, to serve our growing customer base.

DocuSign, Inc.

| 2023 Form 10Q | 45

Any failure of or delay in these efforts could cause impaired system performance and reduced customer satisfaction.

11 unchanged sentences

Consequently, we or our customers may discover defects or errors after our products and solutions have been employed.

If we fail to perform timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect not to renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, potential customers may not adopt our products and solutions and our brand and reputation could be harmed.

If we fail to perform timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect to not renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, and potential customers may not adopt our products and solutions and our brand and reputation could be harmed.

In addition, the occurrence of any material defects, errors, disruptions in service or other performance problems with our software could result in warranty or other legal claims against us and diversion of our resources.

8 unchanged sentences

Our agreements with our partners are generally nonexclusive, meaning our partners may offer their customers products and services of several different companies, including products and services that compete with ours, or may themselves be or become competitors.

If our partners do not effectively market and sell our subscription offerings and solutions, choose to use

DocuSign, Inc.

| 2022 Form 10Q | 48

greater efforts to market and sell their own products and services or those of our competitors, or fail to meet the needs of our customers, our ability to grow our business and sell our subscription offerings and solutions may be harmed.

If our partners do not effectively market and sell our subscription offerings and solutions, choose to use greater efforts to market and sell their own products and services or those of our competitors, or fail to meet the needs of our customers, our ability to grow our business and sell our subscription offerings and solutions may be harmed.

Our partners may cease marketing our subscription offerings or solutions with limited or no notice and with little or no penalty.

3 unchanged sentences

Additionally, as the scale of our partnership efforts increases with our growth, the successful implementation of these relationships may become more time-consuming, difficult and costly to realize, which could negatively impact our business performance or our brand reputation.

DocuSign, Inc.

| 2023 Form 10Q | 46

Failure to establish and maintain relationships with partners that can provide complementary technology offerings and software integrations could limit our ability to grow our business.

7 unchanged sentences

or implement other changes that could functionally limit or terminate our ability to use these third-party technology offerings and software integrations with our platform, any of which could negatively impact our offerings and harm our business.

Further, these third-party providers may experience operational difficulties due to the COVID-19 pandemic, which could limit or alter our ability to use these third-party technology offerings, which in turn could have an adverse impact on our results of operations.

Unfavorable conditions in our industry or the global economy or reductions in information technology spending could limit our ability to grow our business and negatively affect our operating results.

1 unchanged sentence

The revenue growth and potential profitability of our business depend on demand for our products and solutions.

Current or future economic uncertainties or downturns could adversely affect our business and operating results.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, political turmoil, natural catastrophes, warfare and terrorist attacks on the United States, Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on information technology, and negatively affect the growth of our business.

In addition, the COVID-19 pandemic has created significant additional uncertainty in the global economy.

If the COVID-19 pandemic worsens, or continues for longer than expected, especially in regions in which we have material operations or sales, such as the United States, Canada, the United Kingdom, France, Germany, Ireland, Israel, Australia, Singapore, Japan, Brazil, Egypt or Sweden, our business activities originating from affected areas, including sales-related activities, could be adversely affected.

Disruptive activities could include business closures in impacted areas and restrictions in our employees’ and other service providers’ ability to travel.

Current or future economic and global market uncertainties or downturns could adversely affect our business and operating results.

Economic uncertainty and associated macroeconomic conditions make it difficult for our customers and us to accurately forecast and plan future business activities, and could cause our customers to slow spending on our products.

Negative conditions in the general economy both in the U.S.

and abroad, including conditions resulting from changes in interest rates, gross domestic product growth, financial and credit market fluctuations, inflation, political turmoil, natural catastrophes and the effects of climate change, regional and global conflicts and terrorist attacks on the U.S., Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on information technology, and negatively affect the growth of our business.

To the extent our products and solutions are perceived by customers and potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in general information technology spending.

5 unchanged sentences

We fund our operations through payments by our customers for use of our product offerings and related services.

In addition, as of October 31, 2021, we had issued and outstanding $50.2 million aggregate principal amount of 0.5% Convertible Senior Notes due 2023 (the “2023 Notes ” ), $690.0 million aggregate principal amount of 0.0% Convertible

DocuSign, Inc.

| 2022 Form 10Q | 49

Senior Notes due 2024 (the “2024 Notes” and together with the 2023 Notes, the “Notes”) and available borrowing capacity of $500.0 million under our credit facility.

In addition, as of April 30, 2022, we had outstanding $37.1 million aggregate principal amount of the 2023 Notes, $690.0 million aggregate principal amount of the 2024 Notes and available borrowing capacity of $500.0 million under our credit facility.

We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business.

5 unchanged sentences

If adequate funds are not available on acceptable terms when we require it, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition.

We have incurred substantial indebtedness that may decrease our business flexibility and access to capital and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

As of October 31, 2021, we had $50.2 million principal amount of indebtedness outstanding under our 2023 Notes, $690.0 million principal amount of indebtedness outstanding under our 2024 Notes and available borrowing capacity of $500.0 million under our credit facility.

DocuSign, Inc.

| 2023 Form 10Q | 47

We have incurred substantial indebtedness that may decrease our business flexibility, access to capital and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

As of April 30, 2022, we had $37.1 million principal amount of indebtedness outstanding under our 2023 Notes, $690.0 million principal amount of indebtedness outstanding under our 2024 Notes and available borrowing capacity of $500.0 million under our credit facility.

Our indebtedness may:

4 unchanged sentences

▪ place us at a competitive disadvantage compared to our less leveraged competitors;

• increase our vulnerability to the impact of adverse economic and industry conditions, including as a result of the COVID-19 pandemic.

If we fail to maintain our brand, our ability to expand our customer base will be impaired and our financial condition may suffer.

We believe that maintaining the DocuSign brand is important to supporting continued acceptance of our existing and future solutions, attracting new customers to our products and solutions and retaining existing customers.

▪ increase our vulnerability to the impact of adverse economic and industry conditions.

If we fail to promote or maintain our brand, our ability to expand our customer base will be impaired and our financial condition may suffer.

We believe that promoting and maintaining the DocuSign brand is important to supporting continued acceptance of our existing and future solutions, attracting new customers to our products and solutions and retaining existing customers.

We also believe that the importance of our brand will increase as competition in our market increases.

Successfully maintaining our brand will depend largely on the effectiveness of our marketing efforts, and our ability to provide reliable and useful solutions to meet the needs of our customers at competitive prices, maintain our customers’ trust, continue to develop new functionality and solutions and successfully differentiate our products and solutions from our competitors’.

Successfully promoting and maintaining our brand will depend largely on the effectiveness of our marketing efforts, and our ability to provide reliable and useful solutions to meet the needs of our customers at competitive prices, maintain our customers’ trust, continue to develop new functionality and solutions and successfully differentiate our products and solutions from our competitors’.

Additionally, the performance of our partners may affect our brand and reputation if customers do not have a positive experience with our partners’ services.

Brand promotion activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in building our brand.

We invest significantly in sales and marketing activities to attract new customers and expand use cases with existing customers, but these activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in building our brand.

If we fail to successfully promote and maintain our brand, we may fail to attract enough new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business could suffer.

We have also made public commitments to our corporate environmental, social, and governance (“ESG”) and human capital management initiatives, including to the recruitment of a diverse workforce and reductions in carbon emissions.

Any perceived changes in our dedication to these commitments or our failure to achieve progress in these areas on a timely basis, or at all, could adversely impact our relationships with our customers and employees, affect our reputation and the value of our brand.

We could incur substantial costs in protecting or defending our proprietary rights, and any failure to adequately protect our rights could impair our competitive position and we may lose valuable assets, experience reduced revenue and incur costly litigation to protect our rights.

2 unchanged sentences

However, the steps we take to protect our intellectual property may be inadequate.

While we have been issued patents in the United States and other countries and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications.

While we have been issued patents in the U.S.

and other countries and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications.

In addition, any patents issued in the future may not provide us with competitive advantages or may be successfully challenged by third parties.

2 unchanged sentences

Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain.

DocuSign, Inc.

| 2022 Form 10Q | 50

precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and solutions that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of jurisdictions outside the United States.

Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and solutions that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of jurisdictions outside the U.S.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our products and proprietary information may increase.

We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances.

No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information.

DocuSign, Inc.

| 2023 Form 10Q | 48

assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information.

Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our products and solutions.

4 unchanged sentences

We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.

Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property may be difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak.

and where mechanisms for enforcement of intellectual property rights may be weak.

If we fail to adequately protect our intellectual property and proprietary rights, our business, operating results and financial condition could be adversely affected.

We may be subject to legal proceedings and litigation for a variety of claims, including labor and employment issues, intellectual property disputes, securities law violations and other matters, which may be costly and may subject us to significant liability and increased costs of doing business.

We may be subject to legal proceedings and litigation for a variety of claims, including labor and employment issues, intellectual property disputes, securities law violations, derivative litigation and other matters, which may be costly and may subject us to significant liability and increased costs of doing business.

Our business may suffer if it is alleged or determined that our technology infringes the intellectual property rights of others or if the cost and time-commitment of litigation diverts resources from our other business activities.

2 unchanged sentences

In particular, companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights.

Our technologies may not be able to withstand any third-party claims or rights against their use.

In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them.

We have from time to time been subject to intellectual property claims and disputes and may be subject to such claims in the future.

In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their alleged intellectual property rights and to defend claims that may be brought against them.

Any litigation may also involve patent holding companies or other adverse patent owners that have no relevant product revenue and against which our patents may therefore provide little or no deterrence.

If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of our software or cease business activities covered by such intellectual property and may be unable to compete effectively.

If a third party is able to obtain an injunction preventing us from utilizing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of our software or cease business activities employed by such intellectual property and may be unable to compete effectively.

Any inability to license third-party technology in the future would have an adverse effect on our business or operating results and would adversely affect our ability to compete.

We also may be required to redesign our products, delay releases, enter into costly settlement or license agreements, pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our products and solutions.

Such disputes may require the Company to redesign our products, delay releases, enter into costly settlement or license agreements, pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our products and solutions.

Requiring us to change one or more aspects of the way we deliver our products and solutions may harm our business.

1 unchanged sentence

Responding to such claims, including those currently pending, regardless of their merit, can be time consuming and costly to defend in litigation and damage our reputation and brand.

Regardless of the merits or ultimate outcome of any claims that have been or may be brought against us or that we may bring against others, lawsuits are time-consuming and expensive to resolve, divert management’s time and attention, and could harm our reputation.

Although we carry general liability insurance, our insurance may not cover potential claims that arise or may not be adequate to indemnify us for all liability that may be imposed.

We may also determine that the most cost-effective way to resolve a dispute is to enter into a settlement agreement.

Litigation is inherently

For example, on February 8, 2022, a putative securities class action was filed in the U.S.

District Court for the Northern District of California, captioned Weston v.

DocuSign, Inc., et al., Case No.

3:22-cv-00824, naming DocuSign and certain of our current and former officers as defendants.

The complaint purports to allege claims under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, and Rule 10b-5 promulgated thereunder, based on allegedly false and misleading statements about our business and prospects during the course of the COVID-19 pandemic.

The suit is purportedly brought on behalf of purchasers of our securities between June 4, 2020 and December 2, 2021.

We are not yet required to respond to the complaint, but believe it is devoid of merit.

An earlier action alleging similar claims against the same defendants, captioned Collins v.

DocuSign, Inc., et al., Case No.

3:22-cv-00851, filed in the Eastern District of New York and subsequently transferred to the Northern District of California, was voluntarily dismissed on February 14, 2022.

Additionally, three putative shareholder derivative cases have been filed containing allegations based on or similar to those in the securities class action.

The cases were filed on May 17, 2022, in the U.S.

District Court for the District of Delaware, captioned Potteti v.

Springer, et al., Case No.

1:22-cv-00652;

on May 19, 2022 in the U.S.

District Court for the Northern District of California, captioned Lapin v.

Springer, et al., Case No.

3:22-cv-02980;

and on May 20, 2022,

DocuSign, Inc.

| 2023 Form 10Q | 49

unpredictable and we cannot predict the timing, nature, controversy or outcome of lawsuits or assure you that the results of any of these actions will not have an adverse effect on our business, operating results or financial condition.

also in the U.S.

District Court for the Northern District of California, captioned Votto v.

Springer, et al., Case No.

3:22-cv-02987.

Each case is allegedly brought on the Company’s behalf.

The suits name the Company as a nominal defendant and, depending on the particular case, the members of our board of directors or, in certain instances, current or former officers, as defendants.

While the complaints vary, they are based largely on the same allegations as the securities class action suit described above, including allegations relating to our disclosures between June 4, 2020 and December 2, 2021 as well as, in certain instances, alleged insider trading.

Collectively, these lawsuits purport to assert claims for, among other things, breach of fiduciary duty, aiding and abetting such breach, corporate waste, unjust enrichment, and under Sections 10(b) and 21D of the Securities Exchange Act of 1934.

The Complaints seek to recover unspecified damages and other relief on the Company’s behalf.

Although we carry general liability and other forms of insurance, our insurance may not cover potential claims that arise or may not be adequate to indemnify us for all liability that may be imposed.

We may also determine that the most cost-effective way to resolve a dispute is to enter into a settlement agreement.

Litigation is inherently unpredictable and we cannot predict the timing, nature, controversy or outcome of lawsuits or assure you that the results of any of these actions will not have an adverse effect on our business, operating results or financial condition.

We use open source software in our products, which could subject us to litigation or other actions.

We use open source software in our products and solutions.

Any use of open source software may expose us to greater risks than the use of commercial software because open source licensors generally do not provide warranties or controls on the functionality or origin of the software.

Any use of open source software may involve security risks, making it easier for hackers and other third parties to determine how to compromise our platform.

From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products.

8 unchanged sentences

Although we normally contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them and we may be required to cease use of certain functions of our products and solutions as a result of any such claims.

In addition, our customer agreements generally include a warranty that the proper use of DocuSign by a customer in accordance with the agreement and applicable law will be sufficient to meet the definition of an “electronic signature” as defined in the ESIGN Act and eIDAS.

Any warranty or indemnification claim brought by our customers could result in damage to our reputation and harm our business and operating results.

We rely on the performance of highly skilled personnel, including our management and other key employees, and failure to attract or retain such employees could harm our business.

We rely on the performance of highly skilled personnel, including our management and other key employees, and failing to attract or retain such employees could harm our business.

Our success and future growth depend upon the continued services of highly skilled personnel, including our management team and other key employees.

Changes in our management team resulting from the hiring or departure of executives and key employees from time to time could disrupt our business.

For example, in March 2022, Loren Alhadeff, our Chief Revenue Officer, notified the Company of his intention to resign and transition his responsibilities to a new global leader of the Company’s sales and customer success functions, and in May 2022, Tram Phi, our Senior Vice President and General Counsel, resigned from the Company.

Our senior management and key employees are employed on an at-will basis, meaning that we may terminate their employment at any time, with or without cause, and they may resign at any time, with or without cause.

If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, retain and motivate members of our senior management team and key employees or otherwise fail to retain a significant portion of our workforce, our business could be harmed.

If we lose one or more of our senior management or other key

DocuSign, Inc.

| 2023 Form 10Q | 50

employees and are unable to find adequate replacements, or if we fail to attract, retain and motivate members of our senior management team and key employees or otherwise fail to retain a significant portion of our workforce, our business could be harmed.

We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions.

In particular, we compete with many other companies for software developers with high levels of experience and skilled sales and operations professionals.

In particular, we compete with many other companies for software developers with high levels of experience and skilled sales and operations professionals in an increasingly tight U.S.

labor market.

We also require skilled product development, marketing, sales, and operations professionals, and we may not be successful in attracting and retaining the professionals we need, particularly in our principal U.S.

2 unchanged sentences

locations) is intense, and many of the companies we compete with for experienced personnel have greater resources than we do.

To remain competitive, we may experience increased compensation-related expenses.

Additionally, as a service provider to U.S.

state and federal government agencies, we have been subject to various and fluctuating COVID-19 vaccination, testing, and related health and safety requirements.

While we cannot predict the full impact these requirements may have on our business, our ability to retain or hire employees could be impacted;

2 unchanged sentences

and our business and results of operations could be harmed.

DocuSign, Inc.

| 2022 Form 10Q | 52

Our current operations are international in scope and we plan further geographic expansion, creating a variety of operational challenges.

2 unchanged sentences

was 23% , 20% and 18% of our total revenue.

As of October 31, 2021, we have offices in 13 countries and approximately 32% of our full-time employees were located outside of the United States.

As of April 30, 2022, we have offices in 12 countries and approximately 32% of our full-time employees were located outside of the U.S.

We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect.

17 unchanged sentences

▪ limited or insufficient intellectual property protection or difficulties enforcing our intellectual property;

▪ regional or global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions;

▪ political instability or terrorist activities;

1 unchanged sentence

Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.S.

domestic bribery statute contained in 18 U.S.C.

domestic bribery statute contained in 18

DocuSign, Inc.

| 2023 Form 10Q | 51

§ 201, the U.S.

12 unchanged sentences

▪ undergo a merger or consolidation or other transactions.

DocuSign, Inc.

| 2022 Form 10Q | 53

Our credit facility also requires that our Consolidated Leverage Ratio (as defined in the credit facility) not exceed specified levels, or that our Consolidated Interest Coverage Ratio (as defined in the credit facility) be less than specified levels.

13 unchanged sentences

To assist us in complying with these requirements we may need to hire more employees in the future, or engage outside consultants, which will increase our operating expenses.

DocuSign, Inc.

| 2023 Form 10Q | 52

Despite significant investment, our current controls and any new controls that we develop may become inadequate because of changes in business conditions.

3 unchanged sentences

If our management team or independent registered public accounting firm were to furnish an adverse report, or if it is determined that we have a material weakness or significant deficiency in our internal control over financial reporting, investors could lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by Nasdaq, the SEC or other regulatory authorities or shareholder litigation.

In addition, as a result of the COVID-19 pandemic, most of our employees (including those critical to maintaining an effective system of disclosure controls and internal control over financial reporting) are working and are expected to continue to work for the near term, in either a fully remote or a hybrid environment and not solely in the office environment from which they have historically performed their duties.

In addition, most of our employees (including those critical to maintaining an effective system of disclosure controls and internal control over financial reporting) are working and are expected to continue to work for the near term, in either a fully remote or a hybrid environment and not solely in the office environment from which they have historically performed their duties.

We have limited experience maintaining effective control systems with our employees working in remote or hybrid environments, and risks that we have not contemplated may arise and result in our failure to maintain effective disclosure controls or internal control over financial reporting.

1 unchanged sentence

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations, in particular

DocuSign, Inc.

| 2022 Form 10Q | 54

those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

We receive, store and process personal information and other data from and about customers, our employees, partners and service providers.

In addition, customers use our products and solutions to obtain and store personal information, health information (including protected health information) and personal financial information.

Our handling of data is thus subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S.

Federal Trade Commission (the “FTC”), the U.S.

Department of Health and Human Services Office for Civil Rights (the “OCR”), and various state, local and foreign agencies and other authorities.

Our data handling also is subject to contractual obligations and industry standards.

Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

federal government and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses.

In the United States, various laws, and regulations and agency rules and opinions apply to the collection, processing, disclosure and security of certain types of data, including:

▪ The Electronic Signatures in Global and National Commerce Act (“ESIGN Act”) in the United States, eIDAS in the EU and similar U.S.

In the U.S., various laws, and regulations and agency rules and opinions apply to the collection, processing, disclosure and security of certain types of data, including:

▪ The ESIGN Act in the U.S., eIDAS in the EU and similar U.S.

state laws, particularly the Uniform Electronic Transactions Act (the “UETA”), which authorize the creation of legally binding and enforceable agreements utilizing electronic signatures and records.

We are particularly reliant on the UETA and the ESIGN Act, which together have solidified the legal landscape in the United States for use of electronic signatures and records by providing that electronic signatures and records carry the same weight and have the same legal effect as paper documents and wet ink signatures.

▪ The EU General Data Protection Regulation (the “GDPR”) imposes requirements related to processing the personal data of EU citizens and residents.

EU data protection authorities have the power to impose administrative fines for repeated violations of the GDPR of up to a maximum of €20 million or 4% of a company’s annual global turnover for the preceding financial year, whichever is higher.

Violations of the GDPR may also lead to damages claims by data controllers and data subjects.

Such penalties are in addition to any civil litigation claims.

The GDPR imposes compliance burdens on us, including by mandating documentation requirements and granting certain privacy rights to individuals to control how we collect, use, disclose, retain and process information about them.

Additionally, the United Kingdom (“U.K.”) has implemented the Data Protection Act which is substantially similar to the GDPR and contains provisions, including UK-specific exceptions, for how GDPR is enacted within U.K.

The U.K.'s departure in January 2020 from the EU (commonly referred to as Brexit) has created uncertainty with regard to the requirements for data transfers between the U.K.

and the EU and other jurisdictions, and it is still unclear how the EU and U.K.

will reconcile data transfers from the European Economic Area (the “EEA”) to the U.K.

following “Brexit.” For example, the EU has issued a draft adequacy decision for personal information transfers from the EEA to the U.K.

on February 19, 2021.

Although the European Data Protection Board (the “EDPB”) issued an opinion generally supportive of the draft adequacy decision, the EDPB urged further assessment of certain issues and continued monitoring of developments in U.K.

If this adequacy decision is not passed by the EU, it would require that companies implement protection measures such as Standard Contractual Clauses for data transfers between the EU and the U.K.

The GDPR also imposes strict rules on the transfer of personal data out of the EU to the U.S, which is addressed further in the next paragraph.

These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices.

In addition, these rules are consistently under scrutiny.

▪ On July 16, 2020, the Court of Justice of the EU (the “Court of Justice”) invalidated the European Union-United States (“EU-U.S.”) Privacy Shield on the grounds that the EU-US Privacy Shield failed to offer adequate protections to EU personal data transferred to the United States, a decision commonly known as “Schrems II”.

We rely on approved Binding Corporate Rules as both a data processor and data controller as the basis for EU-U.S.

cross-border flows of personal data between DocuSign entities identified in DocuSign’s Binding Corporate Rules, in compliance with GDPR.

While the Court of Justice upheld the use of binding corporate rules as a valid data transfer mechanism, it further stated that reliance on binding corporate rules alone may not necessarily be sufficient in all circumstances and that supplemental measures may also be required to ensure an adequate level of protection by the importing jurisdiction.

As the EU data protection regulatory landscape continues to evolve following Schrems II, including harmonization of disparate guidance regarding supplemental measures amongst regional EU data protection authorities, we may need to implement additional or different supplemental measures to further enhance the security of data transferred out of the EEA, which could increase our compliance costs, expose us to further regulatory scrutiny and liability, and adversely affect our business.

Additional changes to data protection laws or regulations in the EU that limit or prevent transfers of personal data from the EU to the U.S.

could cause us to incur penalties under GDPR and could increase the cost and complexity of operating our business.

▪ The CCPA took effect on January 1, 2020 and became enforceable by the California Attorney General on July 1, 2020, along with related regulations which came into force on August 14, 2020 and were most recently amended on

DocuSign, Inc.

| 2022 Form 10Q | 55

March 15, 2021.

Additionally, the California Privacy Rights Act (the “CPRA”), which expands upon the CCPA and was passed in the November 3, 2020 election, creates obligations relating to consumer data beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement beginning July 1, 2023.

The CCPA requires (and the CPRA will require) covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt-out of certain sales of personal information, expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is collected, used and shared.

The CCPA and the CPRA provide for unlimited civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

The CCPA may increase our compliance costs and potential liability, particularly in the event of a data breach.

Additionally, the CCPA has prompted a number of proposals in the United States for new federal and state-level privacy legislation that, if passed, could increase our potential liability, increase our compliance costs, and adversely affect our business.

Two other states have recently passed personal information laws:

the Colorado Privacy Act, which goes in effect on July 1, 2023;

and Virginia’s Consumer Data Protection Act, which goes in effect on January 1, 2023.

▪ The Health Insurance Portability and Accountability Act (“HIPAA”) in the United States (as amended and supplemented by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) imposes mandatory contractual terms and other obligations with respect to safeguarding the privacy, security and transmission of protected health information.

We are particularly reliant on the UETA and the ESIGN Act, which together have solidified the legal landscape in the U.S.

for use of electronic signatures and records by providing that electronic signatures and records carry the same weight and have the same legal effect as paper documents and wet ink signatures.

▪ The Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act, and state laws relating to privacy and data security.

▪ Additionally, the FTC and many state attorney generals are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data.

For example, California has enacted the California Consumer Privacy Act (the “CCPA”) and later the California Privacy Rights Act (the “CPRA”) which will take effect on January 1, 2023 and supersede the CCPA.

The CPRA and the CCPA may lead other states to pass comparable legislation, with potentially greater penalties, and more rigorous compliance requirements relevant to our business.

▪ The Health Insurance Portability and Accountability Act (“HIPAA”) in the U.S.

(as amended and supplemented by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), and even more stringent state health information privacy laws, impose mandatory contractual terms and other obligations with respect to safeguarding the privacy, security and transmission of protected health information and de-identified health information.

We may function as a HIPAA business associate for certain of our customers and, as such, are subject to applicable privacy and data security requirements.

Failure to comply with HIPAA can result in significant civil monetary penalties and, in certain circumstances, criminal penalties and fines.

▪ We may be subject to numerous other laws including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act (“GLBA”), and other state laws relating to privacy.

As such, we may be subject to increased liability and compliance costs, and noncompliance with these regulations could adversely affect our business.

In addition, many foreign governments have established or are in the process of establishing privacy and data security legal frameworks with which we, our customers, partners or our vendors must comply, some of which are more restrictive than those in the United States and apply broadly to the collection, use, storage, disclosure and security of various types of data.

For example, some jurisdictions require that certain types of data be retained on servers within these jurisdictions.

We expect that new laws, regulations and industry standards will continue to be proposed and enacted relating to privacy, data protection, marketing, advertising, electronic signatures, consumer communications and information security in the United States, the EU and other jurisdictions, and we cannot determine the impact such future laws, regulations and standards may have on our business.

Future laws, regulations, standards and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our customer base and increase revenue.

Future restrictions on the collection, use, sharing or disclosure of data or additional requirements for the express or implied consent of our customers, partners or end consumers for the use and disclosure of such information could require us to incur additional costs or modify our products and solutions, possibly in a material manner, and could limit our ability to develop new functionality.

If we are not able to comply with these laws or regulations or if we become liable under these evolving laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.

This may require us to expend substantial resources or to discontinue certain solutions, which would negatively affect our business, operating results and financial condition.

In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise impact the growth of our business.

Any costs incurred as a result of this potential liability could harm our business and operating results.

Additionally, any failure or perceived failure by us to comply with laws, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions (including, for example, a ban by EU data protection authorities on the processing of EU personal data under the GDPR), litigation, fines and penalties or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business.

Internationally, many countries have established their own data privacy and security legal framework with which we, our customers and partners may need to comply.

For example, in Europe, the General Data Protection Regulation (the “GDPR”) contains robust obligations on data controllers and processors and fulsome documentation requirements for

DocuSign, Inc.

| 2023 Form 10Q | 53

data protection compliance programs by companies.

As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the GDPR, UK GDPR, the UK Data Protection Act 2018, and other similar regional European data protection regulations, all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner.

A breach of the GDPR, UK GDPR or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit).

Such penalties are in addition to any civil litigation claims by customers and data subjects.

We may also face civil claims including representative actions and other class action-type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

The GDPR in particular imposes strict rules on the transfer of personal data out of the EU to a “third country,” including the U.S.

These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices.

Legal developments in Europe also create complexity and uncertainty regarding transfers of personal data from the EU and the UK to the U.S.

Notable recent developments include the invalidation of the EU-U.S.

Privacy Shield Framework (“Privacy Shield”) on July 16, 2020, under which personal data could be transferred from the European Economic Area (“EEA”) to U.S.

entities who had self-certified under the Privacy Shield scheme prior to invalidation.

To safeguard data transfers from the EEA to other jurisdictions, including the U.S., we currently utilize respective Binding Corporate Rules and standard contractual contracts as the approved data transfer mechanisms by the EU Commission for corresponding applicable data transfer activity.

The EU Commission has also published revised standard contractual clauses for data transfers from the EEA:

the revised clauses must be used for relevant new data transfers from September 27, 2021;

existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022.

We expect that new laws, regulations and industry standards will continue to be proposed and enacted relating to privacy, data protection, marketing, advertising, electronic signatures, consumer communications and information security in the U.S., the EU and other jurisdictions, and we cannot determine the impact such future laws, regulations and standards may have on our business.

Many of our customers deploy our products and solutions globally, and our products and solutions must comply with certain legal and regulatory requirements in varying countries.

1 unchanged sentence

Many customers use our products and solutions globally to comply with safe harbors and other legislation in the countries in which they transact business.

For example, some of our customers rely on our certifications under the Federal Risk and Authorization Management Program (“FedRAMP”) in the United States and eIDAS in the EU to help satisfy their own legal and regulatory compliance requirements.

For example, some of our customers rely on our certifications under the FedRAMP in the U.S.

and eIDAS in the EU to help satisfy their own legal and regulatory compliance requirements.

If a court or regulatory body determines that our products and solutions are inadequate to meet these requirements, documents executed through our products and solutions could, in some instances, be rendered unenforceable, resulting in potential loss of customers, liability under customer contracts, and brand and reputational damage.

3 unchanged sentences

We may be subject to taxation in international jurisdictions with increasingly complex tax laws and precedents which could have an adverse effect on our liquidity and operating results.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of those jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of those jurisdictions, including the U.S., to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

Tax authorities in the jurisdictions in which we operate may challenge our transfer pricing policies and intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

1 unchanged sentence

Our financial statements could fail to reflect adequate reserves to cover such a contingency.

In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or to our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries which could have a material impact on us and the results of our operations.

DocuSign, Inc.

| 2023 Form 10Q | 54

to us or to our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries which could have a material impact on us and the results of our operations.

We are subject to governmental export and import controls that could impair our ability to compete in international markets or subject us to liability if we violate the controls.

1 unchanged sentence

export controls, including the Export Administration Regulations and economic sanctions administered by the Office of Foreign Assets Control, and we incorporate encryption technology into certain of our products and solutions.

These encryption products and the underlying technology may be exported outside of the United States only with export authorizations, including by license, a license exception or other appropriate government authorizations, including the filing of an encryption registration.

These encryption products and the underlying technology may be exported outside of the U.S.

only with export authorizations, including by license, a license exception or other appropriate government authorizations, including the filing of an encryption registration.

Furthermore, our activities are subject to U.S.

2 unchanged sentences

Obtaining the necessary export license or other authorization for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities even if the export license ultimately may be granted.

Additionally, sanctions regimes are rapidly changing as a result of regional or global conflicts.

While we take precautions to prevent our products and solutions from being exported in violation of these laws, including obtaining authorizations for our encryption products, implementing IP address blocking and screenings against U.S.

6 unchanged sentences

Foreign governments also regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products and solutions or could limit our end-customers’ ability to implement our products and solutions in those countries.

DocuSign, Inc.

| 2022 Form 10Q | 57

in our products and solutions or future changes in export and import regulations may create delays in the introduction of our products and solutions in international markets, prevent our end-customers with international operations from deploying our products and solutions globally or, in some cases, prevent the export or import of our products and solutions to certain countries, governments or persons altogether.

Changes in our products and solutions or future changes in export and import regulations may create delays in the introduction of our products and solutions in international markets, prevent our end-customers with international operations from deploying our products and solutions globally or, in some cases, prevent the export or import of our products and solutions to certain countries, governments or persons altogether.

From time to time, various governmental agencies have proposed additional regulation of encryption technology, including the escrow and government recovery of private encryption keys.

12 unchanged sentences

As we increase our international sales and business, our risks under these laws may increase.

DocuSign, Inc.

| 2023 Form 10Q | 55

Detecting, investigating and resolving actual or alleged violations can require a significant diversion of time, resources and attention from senior management.

10 unchanged sentences

Similar rules may apply under state and foreign tax laws.

DocuSign, Inc.

| 2022 Form 10Q | 58

Future issuances of our stock could cause an “ownership change.” It is possible that any future ownership change could have a material effect on the use of our net operating loss carryforwards or other tax attributes, which could adversely affect our profitability.

2 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate or decline substantially as a result of a variety of factors, some of which are beyond our control or are related in complex ways, including:

▪ the COVID-19 pandemic, including its effects on customer demand for our solutions and the pace of the digital transformation of business;

▪ the COVID-19 pandemic, including its effects on customer demand for our solutions and the pace of the digital transformation of business and hybrid work arrangements;

▪ actual or anticipated fluctuations in our financial condition and operating results;

7 unchanged sentences

▪ future sales of our common stock or other securities by us or our stockholders;

▪ the consummation, and the anticipated benefits, of our stock repurchase program;

▪ changes in senior management or key personnel;

1 unchanged sentence

▪ changes in the anticipated future size and growth rate of our market;

▪ changes in the political climate in the United States;

▪ terrorist attacks, natural disasters, public health crises (such as the COVID-19 pandemic) or other such events impacting countries where we have operations;

▪ general economic, regulatory and market conditions.

▪ changes in the political climate in the U.S.;

DocuSign, Inc.

| 2023 Form 10Q | 56

▪ terrorist attacks, natural disasters and the effects of climate change, regional and global conflicts, sanctions, laws and regulations that prohibit or limit operations in certain jurisdictions, public health crises (such as the COVID-19 pandemic) or other such events impacting countries where we have operations;

▪ general economic, regulatory and market conditions, including inflation and interest rate fluctuations.

In addition, broad market and industry fluctuations, as well as general economic, political, regulatory and market conditions, may negatively impact the market price of our common stock.

In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation.

We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

We have been subject to and may be in the future subject to this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

Future sales of our common stock in the public market could cause the market price of our common stock to decline.

Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities.

We have a currently effective Registration Statement on Form S-3 registering for sale approximately 247,030 shares of our common stock in connection with our acquisition of Liveoak.

We also provide eligible employees with the opportunity to purchase shares of our common stock at a discounted price per share through our ESPP and pursuant to our 2018 Plan, our management is authorized to grant stock options, restricted stock units and other equity awards to our employees, directors and consultants.

As of October 31, 2021, 8.0 million shares of our common stock are reserved for issuance under our ESPP and 42.0 million shares of our common stock are reserved and available for issuance under our 2018 Plan.

We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

Under our investors’ rights agreement, certain stockholders can require us to register shares owned by them for public sale in the United States.

Under our investors’ rights agreement, certain stockholders can require us to register shares owned by them for public sale in the U.S..

In addition, we filed a registration statement to register shares reserved for future issuance under our equity compensation plans.

As a result, subject to the satisfaction of applicable exercise periods and the expiration or waiver of the market standoff agreements and lock-up agreements referred to above, the shares issued upon exercise of outstanding stock options or upon settlement of outstanding RSU awards will be available for immediate resale in the United States in the open market.

in the open market.

Future sales of shares of our common stock may make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate.

These sales also could cause the trading price of our common stock to decline and make it more difficult for you to sell shares of our common stock.

DocuSign, Inc.

| 2022 Form 10Q | 59

If securities or industry analysts do not publish research or publish unfavorable or inaccurate research about our business, our stock price and trading volume could decline.

9 unchanged sentences

▪ require that any action to be taken by our stockholders be effected at a duly called annual or special meeting and not by written consent;

DocuSign, Inc.

| 2023 Form 10Q | 57

▪ specify that special meetings of our stockholders can be called only by our board of directors, the chairperson of our board of directors, or our chief executive officer;

10 unchanged sentences

federal district courts are the exclusive forums for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or other employees.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware is the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a breach of fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, any action asserting a claim against us arising pursuant to any provisions of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws, or any action asserting a claim against us

DocuSign, Inc.

| 2022 Form 10Q | 60

that is governed by the internal affairs doctrine.

If a court were to find any of these exclusive-forum provisions in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could seriously harm our business.

11 unchanged sentences

Any person or entity purchasing or otherwise acquiring or holding any interest in any of our securities shall be deemed to have notice of and consented to our exclusive forum provisions, including the Federal Forum Provision.

These provisions may limit a stockholder’s ability to bring a claim in a judicial forum of the stockholder's choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees.

These provisions may limit a stockholder’s ability to bring a claim in a judicial forum of the stockholder's choosing for disputes

DocuSign, Inc.

| 2023 Form 10Q | 58

with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees.

Risks Related to Our Notes

9 unchanged sentences

However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of Notes surrendered therefor or pay cash with respect to Notes being converted.

In addition, our credit facility prohibits us from making any cash payments on the conversion or repurchase of the Notes if an event of default exists under the credit facility or if, after giving effect to such conversion or repurchase (and any additional indebtedness incurred in connection with such conversion or a repurchase), we would not be in pro forma

DocuSign, Inc.

| 2022 Form 10Q | 61

compliance with our financial covenants under the credit facility.

Further, our ability to repurchase or to pay cash upon conversion of the Notes may be limited by law, regulatory authority or agreements governing our future indebtedness.

8 unchanged sentences

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.

DocuSign, Inc.

| 2023 Form 10Q | 59

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes.

4 unchanged sentences

However, a strengthening of the U.S.

dollar could increase the real cost of our offerings to our customers outside of the United States, which could adversely affect our operating results.

In addition, an increasing portion of our operating revenues and operating expenses are earned or incurred outside of the United States, and an increasing portion of our assets is held outside of the United States.

dollar could increase the real cost of our offerings to our customers outside of the U.S., which could adversely affect our operating results.

In addition, an increasing portion of our operating revenues and operating expenses are earned or incurred outside of the U.S., and an increasing portion of our assets is held outside of the U.S..

These operating revenues, expenses and assets are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates.

If we are not able to successfully hedge against the risks associated with currency fluctuations, our operating results could be adversely affected.

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, data security breaches, and terrorism may disrupt our business.

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, data security breaches, regional or global conflicts, and terrorism may disrupt our business.

We rely heavily on our network infrastructure and information technology systems for our business operations.

A disruption or failure of these systems in the event of online attack, earthquake, fire, terrorist attack, public health crisis (such as the COVID-19 pandemic), power loss, telecommunications failure or other similar catastrophic event could cause system interruptions, delays in accessing our service, reputational harm and loss of critical data or could prevent us from providing our products and solutions to our customers.

A disruption or failure of these systems in the event of online attack, earthquake, fire, terrorist attack, public health crisis (such as the COVID-19 pandemic), power loss, telecommunications failure or other similar catastrophic event, including as a result of the effects of climate change, could cause system interruptions, delays in accessing our service, reputational harm and loss of critical data or could prevent us from providing our products and solutions to our customers.

A catastrophic event that results in the destruction or disruption of our data centers, or our network infrastructure or information technology systems, including any errors, defects or failures in third-party hardware, could affect our ability to conduct normal business operations and adversely affect our operating results.

DocuSign, Inc.

| 2022 Form 10Q | 62

Additionally, while we believe our exposure from the recent conflict in Ukraine is limited, we could experience unanticipated disruptions to our business as a result of current or future regional and global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions, increased risks of potential cyberattacks, related impacts to our customers, or micro- or macro-economic effects on the global economy.

ITEMS 2, 3, 4 and 5 are not applicable and have been omitted.

5 unchanged sentences

Incorporated by Reference Exhibit Filing Date

10.1 Separation Agreement and General Release of Claims, dated as of November 29, 2021, by and between the Company and Michael Sheridan

3.1 Amended and Restated Certificate of Incorporation.

8-K 001-38465 3.1 May 1, 2018

3.2 Amended and Restated Bylaws.

8-K 001-38465 3.1 March 10, 2022

10.1# Offer Letter, dated as of May 9, 2022, by and between the Registrant and Stephen Shute.

Filed herewith

10.2# Offer Letter, dated as of May 31, 2022, by and between the Registrant and James Shaughnessy.

Filed herewith

10.3# Executive Severance and Change in Control Agreement, dated as of May 9, 2022, by and between the Registrant and Stephen Shute.

Filed herewith

10.4# Executive Severance and Change in Control Agreement, dated as of May 31, 2022, by and between the Registrant and James Shaughnessy.

Filed herewith

10.5# ` Form of Performance Stock Unit Grant Notice under the 2018 Equity Incentive Plan.

Filed herewith

31.1 Certification of the Chief Executive Officer pursuant to Exchange Act Rule 13a-14 as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

17 unchanged sentences

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

December 3, 2021

DOCUSIGN, INC.

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors