What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-06-25 compared with 2020-06-26 · 423 added, 306 removed, 509 unchanged (59% of the section changed)

Risk Factors.

A description of the risks and uncertainties associated with our business and ownership of our ordinary shares is set forth below.

A description of the risks and uncertainties associated with our business, industry and ownership of our ordinary shares is set forth below.

You should carefully consider the following risks, together with all of the other information in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes thereto, before making a decision to invest in our ordinary shares.

The risks and uncertainties described below are not the only ones we face.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important

factors that affect us.

If any of the following risks occur, our business, financial condition, operating results and prospects could be materially and adversely affected.

In that event, the price of our ordinary shares could decline, and you could lose part or all of your investment.

In addition, the impact of COVID-19 and any worsening of the economic environment may exacerbate the risks described below, any of which could have a material impact on us.

This situation is changing rapidly and additional impacts may arise that we are not aware of currently.

Risks Related to the Business

In addition, the impact of the COVID-19 pandemic and any worsening of the economic environment may exacerbate the risks described below, any of which could have a material impact on us.

This situation is continuously changing and additional impacts may arise that we are not aware of currently.

Summary of Risk Factors

The following is a summary of the key risks and uncertainties associated with our business, industry and ownership of our ordinary shares.

The below summary does not contain all of the information that may be important to you, and you should read this summary together with the more detailed description of each risk factor contained in the subheadings below.

• If we do not appropriately manage future growth or are unable to improve our systems and processes, our business and results of operations will be adversely affected.

• We have a history of losses and may not be able to achieve profitability on a consistent basis or at all or positive cash flows on a consistent basis.

• Our future growth, business and results of operations will be harmed if we are not able to keep pace with technological and competitive developments, increase sales of our subscriptions to new and existing customers, renew existing customers’ subscriptions, increase adoption of our SaaS offerings, respond effectively to evolving markets or offer high quality support services.

• The ongoing COVID-19 pandemic could harm our business and results of operations.

The ongoing COVID-19 pandemic and efforts to control its spread have significantly curtailed the movement of people, goods and services worldwide, including in most or all of the regions in which we sell our products and services and conduct our business operations.

We have taken precautionary measures intended to help minimize the risk of the virus to our employees, our customers, and the communities in which we operate.

The spread of the COVID-19 pandemic has caused us to modify our business practices (including suspending employee travel, adapting employee work locations, and holding events and trainings virtually), and we may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners.

There is no certainty that such measures will be sufficient to mitigate the risks posed by the virus or otherwise be satisfactory to government authorities.

The full extent to which COVID-19 and our precautionary measures may impact our business will depend on future developments, which are highly uncertain and cannot be predicted at this time, including but not limited to, the duration and geographic spread of the pandemic, its severity, the actions to contain the virus or treat its impact, and how quickly and to what extent normal economic

and operating conditions can resume.

It has been and, until the COVID-19 pandemic is contained and global economic activity stabilizes, will continue to be more difficult for us to forecast our operating results.

The magnitude and duration of the disruption and resulting decline in business activity is uncertain and could negatively impact our sales and marketing efforts, our ability to enter into customer contracts in a timely manner, our international expansion efforts, our ability to deliver professional services, our ability to recruit employees across the organization which, in turn, could have longer term effects on our sales pipeline, or create operational or other challenges as we adjust to a fully-remote workforce, any of which could harm our business.

In addition, the COVID-19 pandemic has disrupted, and may continue to disrupt, the operations of our customers, channel partners and government entities for an indefinite period of time, including as a result of travel restrictions and/or business shutdowns, all of which could negatively impact our business and results of operations, including cash flows.

Even after the COVID-19 pandemic has subsided, we may continue to experience materially adverse impacts to our business as a result of its global economic impact, including any recession, economic downturn, or increased unemployment that has occurred or may occur in the future.

There may be increased scrutiny of business (including technology) spending by our customers and prospective customers, particularly in industries most impacted by the COVID-19 pandemic, longer sales cycles, as well as reduced demand for our solutions, customers failing to pay us under the terms of our agreements, increased cyber threats, lower renewal rates by our customers and increased competition, all of which could result in a material adverse impact on our business operations and financial condition.

While we have developed and continue to develop plans intended to help mitigate the negative impact of the pandemic on our business, these efforts may not be effective and a protracted economic downturn may limit the effectiveness of our mitigation efforts.

• Our operating results may fluctuate from quarter to quarter.

• Our decision to no longer offer Elasticsearch and Kibana under an open source license may harm the adoption of Elasticsearch and Kibana.

• We could be negatively impacted if the Elastic License or the Server Side Public License under which some of our software is licensed are not enforceable.

• Because of the permissive rights accorded to third parties under our open source and source available licenses, there are limited technological barriers to entry into the markets in which we compete.

• We may not be able to effectively develop and expand our sales and marketing capabilities.

• Because we recognize a significant portion of the revenue from subscriptions over the term of the relevant subscription period, downturns or upturns in sales are not immediately reflected in full in our results of operations.

• A real or perceived defect, security vulnerability, error, or performance failure in our software could cause us to lose revenue, damage our reputation, and expose us to liability.

• Incorrect implementation or use of our software could negatively affect our business, operations, financial results, and growth prospects.

• Third parties may offer inadequate or defective implementations of software that we have previously made available under an open source license and our reputation could be harmed.

• Breaches of security measures or unauthorized access to private or proprietary data may result in our software being perceived as not secure, customers reducing or stopping usage of our products, and we may incur significant liabilities.

• Interruptions or performance problems, and our reliance on technologies from third parties may adversely affect our business operations and financial results.

• If our channel partners fail to perform or we are unable to maintain successful relationships with them or our other partners, our ability to market, sell and distribute our solution will be more limited, and our results of operations could be harmed.

• Failure to protect our proprietary technology and intellectual property rights could substantially harm our business and results of operations.

• We could incur substantial costs as a result of any claim of infringement, misappropriation or violation of another party’s intellectual property rights, including as a result of the indemnity provisions in various agreements.

• Our use of third-party open source software within our products could negatively affect our ability to sell our products and subject us to possible litigation.

• One of our marketing strategies is to offer some of our product features for free and to provide free trials to some of our paid features, and we may not be able to realize the benefits of this strategy.

• Our international business exposes us to several risks, and if we are not successful in sustaining and expanding our international business, we may incur additional losses and our revenue growth could be harmed.

• A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

• Our business is subject to a variety of government and industry regulations, as well as other obligations, related to privacy, data protection and information security and compliance with anti-bribery, anti-corruption, and anti-money laundering laws.

• The market price for our ordinary shares has been and is likely to continue to be volatile.

• The concentration of our share ownership with insiders will likely limit your ability to influence corporate matters.

• Dutch law and our articles of association include certain anti-takeover provisions.

• If industry or financial analysts do not publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our ordinary shares, our share price and trading volume could decline.

• Claims of U.S.

civil liabilities may not be enforceable against us.

• We may fail to maintain an effective system of disclosure controls and internal control over financial reporting.

Risks Related to our Business and Industry

Our business and operations have experienced rapid growth, and if we do not appropriately manage future growth, if any, or are unable to improve our systems and processes, our business, financial condition, results of operations, and prospects will be adversely affected.

2 unchanged sentences

For example, our total number of customers has grown from over 2,800 as of April 30, 2017 to over 15,000 as of April 30, 2021.

As a result of the COVID-19 pandemic, the number of customers may fluctuate.

Further, in light of the ongoing uncertainty related to the COVID-19 pandemic, we have taken steps to moderate the pace of hiring.

Further, our employee headcount is growing as we modify our pace of hiring in light of our growth plans.

The growth and expansion of our business and offerings places a continuous and significant strain on our management, operational, and financial resources.

In addition, as customers adopt our technology for an increasing number of use cases, we have had to support more complex commercial relationships.

We may not be able to hire, train and retain enough qualified employees, and we may not be able to hire and train new employees fast enough, to maintain our growth plans.

We must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems, our relationships with various partners and other third parties, and our ability to manage headcount and processes in an efficient manner to manage our growth to date and any future growth effectively.

5 unchanged sentences

Failure to manage any future growth effectively could result in increased costs, negatively affect our customers’ satisfaction with our offerings, and harm our results of operations.

We have a history of losses and may not be able to achieve profitability or positive cash flows on a consistent basis or at all.

If we cannot achieve profitability or positive cash flows, our business, financial condition, and results of operations may suffer.

We have a history of losses and may not be able to achieve profitability on a consistent basis or at all, and may not be able to achieve positive cash flows on a consistent basis.

As a result, our business, financial condition, and results of operations may suffer.

We have incurred losses in all years since our incorporation.

2 unchanged sentences

We anticipate that our operating expenses will increase substantially in the foreseeable future as we continue to enhance our offerings, broaden our customer base and pursue larger transactions, expand our sales and marketing activities, expand our operations, hire additional employees, and continue to develop our technology.

These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently, or at all, to offset these higher expenses.

We have, however, experienced in the quarter ended April 30, 2020 and may continue to experience net decreases in certain operating expenses as a result of the COVID-19 pandemic due to a decrease in travel and

related expenses.

These efforts

may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently, or at all, to offset these higher expenses.

Revenue growth may slow or revenue may decline for a number of possible reasons, including slowing demand for our offerings, increasing competition, or economic downturns, including as a result of the COVID-19 pandemic.

You should not consider our revenue growth in recent periods as indicative of our future performance.

Any failure to increase our revenue as we grow our business could prevent us from achieving profitability or positive cash flow at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Any failure to increase our revenue or grow our business could prevent us from achieving profitability at all or on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

Additionally, although we generated positive cash flow in fiscal 2021, any failure to grow our business could prevent us from achieving positive cash flow on a consistent basis, which would cause our business, financial condition, and results of operations to suffer.

We may not be able to compete successfully against current and future competitors.

10 unchanged sentences

• mindshare with developers and IT executives;

• adoption of products by many types of users (developers, architects, DevOps personnel, IT professionals, security analysts, and departmental and organizational leaders);

• adoption of products by many types of users and decision makers (developers, architects, DevOps personnel, IT professionals, security analysts, and departmental and organizational leaders);

• enterprise-grade technology that is secure and reliable;

6 unchanged sentences

• For Enterprise Search (app search, site search, and workplace search):

incumbent offerings such as Solr (open source offering), Lucidworks Fusion, search tools including Google Custom Search Engine (an advertisement-based site search tool with limited user controls), and workplace search tools including Coveo, Endeca (acquired by Oracle) and Autonomy (acquired by HP and now offered by Micro Focus).

incumbent offerings such as Solr (open source offering), Lucidworks Fusion, search tools including Google Custom Search Engine (an advertisement-based site search tool with limited user controls), and workplace search tools including Coveo, Endeca (owned by Oracle) and Autonomy (owned by Micro Focus).

• For Observability (logging, metrics, APM, and uptime monitoring):

1 unchanged sentence

• For Security (SIEM and endpoint security):

security analytics solutions vendors such as Splunk and ArcSight SIEM (offered by Micro Focus) and endpoint security vendors such as CrowdStrike, Carbon Black (acquired by VMware), McAfee and Symantec (acquired by Broadcom).

Certain cloud hosting providers, including Amazon Web Services, that offer SaaS products based on Elastic’s open source components.

security analytics solutions vendors such as Splunk and Azure Sentinel (by Microsoft) and endpoint security vendors such as CrowdStrike, Carbon Black (owned by VMware), McAfee and Symantec (owned by Broadcom).

• Certain cloud hosting providers and managed service providers, including Amazon Web Services, that offer products based on older Elastic Stack releases.

These offerings are not supported by Elastic and come without any of Elastic’s proprietary features, whether free or paid.

1 unchanged sentence

These factors may allow our competitors to respond more quickly than we can to new or emerging technologies and changes in customer preferences.

These competitors may engage in more extensive research and development efforts, undertake more far-reaching and successful sales and marketing campaigns, have more experienced sales professionals, and adopt more aggressive pricing policies which may allow them to build larger customer bases than we have.

New start-up companies that innovate and large competitors that

are making significant investments in research and development may develop similar offerings that compete with our offerings or that achieve greater market acceptance than our offerings.

These competitors may engage in more extensive research and development efforts, undertake more far-reaching and successful sales and marketing campaigns, have more experienced sales professionals, execute more successfully on their go-to-market strategy and have greater access to more markets and decision makers, and adopt more aggressive pricing policies which may allow them to build larger customer bases than we have.

New start-up companies that innovate and large competitors that are making significant investments in research and development may develop similar offerings that compete with our offerings or that achieve greater market acceptance than our offerings.

This could attract customers away from our offerings and reduce our market share.

16 unchanged sentences

Furthermore, our ability to increase the usage of our products depends, in part, on the development of new use cases for our products, which is typically driven by our developer community and may be outside of our control.

We also have invested, and may continue to invest, in the acquisition of complementary businesses, technologies, services, products and other assets that expand the products that we can offer our customers, such as our acquisition of Endgame in 2019.

We may make these investments without being certain that they will result in products or enhancements that will be accepted by existing or prospective customers.

1 unchanged sentence

If we are unable to successfully enhance our existing products to meet evolving customer requirements, increase adoption and usage of our products, develop new products, or if our efforts to increase the usage of our products are more expensive than we expect, then our business, results of operations and financial condition would be adversely affected.

The markets for some of our products are new, unproven and evolving, and our future success depends on the growth and expansion of these markets and our ability to adapt and respond effectively to evolving markets.

The markets for certain of our products, such as our Enterprise Search, Observability and Security solutions, are relatively new, rapidly evolving or unproven.

Accordingly, it is difficult to predict customer adoption and renewals for these products, customers’ demand for these products, the size, growth rate, expansion, and longevity of these markets, the entry of competitive products, or the success of existing competitive products.

Our ability to penetrate these new and evolving markets depends on a number of factors, including the cost, performance, and perceived value associated with our products.

The markets for some of our products are evolving, and our future success depends on the growth and expansion of these markets and our ability to adapt and respond effectively to evolving markets.

The markets for certain of our products, such as our Enterprise Search, Observability and Security solutions, are evolving and our products are relatively new in these markets.

Accordingly, it is difficult to predict continued customer adoption and renewals for these products, customers’ demand for these products, the size, growth rate, expansion, and longevity of these markets, the entry of competitive products, or the success of existing competitive products.

Our ability to penetrate these evolving markets depends on a number of factors, including the cost, performance, and perceived value associated with our products.

If these markets do not continue to grow as expected, or if we are unable to anticipate or react to changes in these markets, our competitive position would weaken, which would adversely affect our business and results of operations.

Our operating results are likely to fluctuate from quarter to quarter, which could adversely affect the trading price of our ordinary shares.

The ongoing COVID-19 pandemic could harm our business and results of operations.

We have taken precautionary measures intended to help minimize the risk of the virus to our employees, our customers, and the communities in which we operate.

The continued spread of the COVID-19 pandemic and the resurgence of infection rates in certain regions has caused us to continue to modify our business practices (including suspending employee travel, adapting employee work locations, and holding events and trainings virtually), and we may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners.

There is no certainty that such measures will be sufficient to mitigate the risks posed by the virus or otherwise be satisfactory to government authorities.

The full extent to which COVID-19 and our precautionary measures may continue to impact our business will depend on future developments, which continue to be highly uncertain and cannot be predicted at this time, including but not limited to, the duration and geographic spread of the pandemic, its severity, the actions to contain the virus or treat its impact, future spikes of COVID-19 infections resulting in additional preventative measures to contain or mitigate the spread of the virus, the effectiveness, distribution and acceptance of COVID-19 vaccines, including the vaccines’ efficacy against emerging COVID-19 variants, and how quickly and to what extent normal economic and operating conditions can resume.

It has been and, until the COVID-19 pandemic is contained and global economic activity stabilizes, will continue to be more difficult for us to forecast our operating results.

The magnitude and duration of the disruption and resulting decline in business activity remains uncertain and could negatively impact our sales and marketing efforts, our ability to enter into customer contracts in a timely manner, our international expansion efforts, our ability to deliver professional services, our ability to recruit employees across the organization which, in turn, could have longer term effects on our sales pipeline, or create operational or other challenges, any of which could harm our business.

Additionally, as we begin to re-open certain of our offices where local authorities have indicated it is safe to do so, our efforts to re-open them safely may not be successful, could expose our personnel to health risks and could involve additional costs that may adversely affect our business.

In addition, the COVID-19 pandemic has disrupted, and may continue to disrupt, the operations of our customers, vendors, channel partners and government entities for an indefinite period of time, including as a result of travel restrictions and/or business shutdowns, all of which could negatively impact our business and results of operations, including cash flows.

Further, the impact of the COVID-19 pandemic has varied significantly across different industries with certain industries experiencing increased demand for their products and services as the needs of the economy shift, while others have struggled to maintain demand for their products and services consistent with historical levels.

Because we have a limited history in understanding these impacts, our ability to adapt our sales and marketing initiatives to such changes may be uncertain and our ability to forecast rates of customer retention and expansion may be negatively impacted.

There has been increased scrutiny of business (including technology) spending by our customers and prospective customers, particularly in industries most impacted by the COVID-19 pandemic, longer sales cycles, as well as reduced demand for our solutions, customers failing to pay us under the terms of our agreements, increased cyber threats, lower renewal rates by our customers and increased competition, all of which could result in a material adverse impact on our business operations and financial condition.

For instance, our Net Expansion Rate declined to below 130% at the end of fiscal 2021 as a result of the COVID-19 pandemic, which caused customers to expand their spending with us at a slower rate than before the COVID-19 pandemic.

While we have developed and continue to develop plans intended to help mitigate the negative impacts of the pandemic on our business, these efforts may not be effective and a protracted economic downturn may limit the effectiveness of our mitigation efforts.

Our operating results are likely to fluctuate from quarter to quarter, and our financial results in any one quarter should not be relied upon as indicative of future performance.

Our results of operations, including our revenue, cost of revenue, gross margin, operating expenses, cash flow and deferred revenue, have fluctuated from quarter-to-quarter in the past and may continue to vary significantly in the future so that period-to-period comparisons of our results of operations may not be meaningful.

16 unchanged sentences

• the impact of catastrophic events, man-made problems such as terrorism, natural disasters and public health epidemics and pandemics;

• general economic, industry and market conditions;

• general political, economic, industry and market conditions, including developments resulting from the change of administration in the United States;

• increases or decreases in the number of elements of our subscriptions or pricing changes upon any renewals of customer agreements;

16 unchanged sentences

For example, the full impact of the COVID-19 pandemic is unknown and continues to evolve rapidly, and could result in material adverse changes in our results of operations for an unknown period of time as the virus and its related political, social and economic impacts spread.

Such fluctuations could cause us to fail to meet the expectations of investors or securities analysts, which could cause the trading price of our ordinary shares to fall substantially, and we could face costly lawsuits, including securities class action suits.

If we are unable to increase sales of our subscriptions to new customers, sell additional subscriptions to our existing customers, or expand the value of our existing customers’ subscriptions, our future revenue and results of operations will be harmed.

We offer certain features of our products as open source software with no payment required, and also offer some of our proprietary features with no payment required.

We offer certain features of our products with no payment required.

Customers purchase subscriptions in order to gain access to additional functionality and support.

3 unchanged sentences

In addition, a significant aspect of our sales and marketing focus is to expand deployments within existing customers.

The rate at which our customers purchase additional subscriptions and expand the value of existing subscriptions depends on a number of factors, including customers’ level of satisfaction with our offerings, the nature and size of the deployments, the desire to address additional use cases, and the perceived need for additional features, as well as general economic conditions.

The rate at which our existing customers purchase additional subscriptions and expand the value of existing subscriptions depends on a number of factors, including customers’ level of satisfaction with our offerings, the nature and size of the deployments, the desire to address additional use cases, and the perceived need for additional features, as well as general economic conditions.

If our existing customers do not purchase additional subscriptions or expand the value of their subscriptions, our Net Expansion Rate may decline.

We rely in large part on our customers to identify new use cases for our products in order to expand such deployments and grow our business.

8 unchanged sentences

We may not accurately predict future renewal trends.

If our customers do not renew their subscriptions, or renew on less favorable terms, our revenue may grow more slowly than expected or decline and our Net Expansion Rate may decline.

Because of the rights accorded to third parties under open source software licenses, there are limited technological barriers to entry into the markets in which we compete and it may be relatively easy for competitors, some of whom may have greater resources than we have, to enter our markets and compete with us.

Anyone may obtain access to the source code for our open source features and then redistribute it (either in a modified or unmodified form) and use it to compete in our markets.

Additionally, we make the source code of our proprietary features for the Elastic Stack publicly available, which may enable others to compete more effectively.

Such competition can develop without the degree of overhead and lead time required by traditional proprietary software companies, due to the permissions allowed under open source licensing.

If our existing customers do not renew their subscriptions, or renew on less favorable terms, our revenue may grow more slowly than expected or decline.

Our decision to no longer offer Elasticsearch and Kibana under an open source license may harm the adoption of Elasticsearch and Kibana.

In February 2021, with the release of version 7.11 of the Elastic Stack, we changed the source code of Elasticsearch and Kibana that had historically been licensed under Apache 2.0, to be dual licensed under the Elastic License 2.0 (“ELv2”) and the Server Side Public License Version 1.0 (“SSPL”), at the user’s election.

Neither the Elastic License nor the SSPL has been approved by the Open Source Initiative or is included in the Free Software Foundation’s list of free software licenses.

Further, neither has been interpreted by any court.

While the vast majority of downloads of Elasticsearch and Kibana from mid-2018 through early 2021 were licensed under the Elastic License, the removal of the Apache 2.0 alternative could negatively impact certain developers for whom the availability of an open source license was important.

In addition, some developers and the companies for whom they work may be hesitant to download or upgrade to new versions of Elasticsearch or Kibana under the Elastic License or SSPL because of uncertainty around how these licenses may be interpreted and enforced.

Other developers, including competitors of Elastic such as Amazon, have announced that they have “forked” Elasticsearch and Kibana.

In doing so, they will develop a new product based on the software, which they claim will continue to be licensed under Apache 2.0.

The combination of uncertainty around our dual license model and the potential competition from the forked versions of our software may negatively impact adoption of Elasticsearch and Kibana, which in turn could lead to reduced brand and product awareness, ultimately leading to a decline in paying customers, which could harm our ability to grow our business or achieve profitability.

We could be negatively impacted if the Elastic License or SSPL under which some of our software is licensed are not enforceable.

We make the source code of our products available under Apache 2.0, the Elastic License, or dual licensed under the Elastic License and SSPL, depending on the product and version.

Apache 2.0 is a permissive open source license that allows licensees to freely copy, modify and distribute Apache 2.0-licensed software provided that they meet certain conditions.

The Elastic License is our proprietary source available license.

The Elastic License permits licensees to use, copy, modify and

distribute the licensed software provided that they do not offer access to the software as a cloud service, interfere with the license key or remove proprietary notices.

SSPL is a source available license that is based on the GNU Affero General Public License (“AGPL”) open source license and permits licensees to copy, modify and distribute SSPL-licensed software, but expressly requires licensees that offer the SSPL-licensed software as a third-party service to open source all of the software that they use to offer such service.

We rely upon the enforceability of the restrictions set forth in the Elastic License and SSPL to protect our proprietary interests.

It is possible that a court could hold that the Elastic License or SSPL are unenforceable.

If a court held that the Elastic License or SSPL or certain aspects of these licenses are unenforceable, others may be able to use our software to compete with us in the marketplace in a manner not subject to the restrictions set forth in the Elastic License or SSPL.

Because of the permissive rights accorded to third parties under our open source and source available licenses, there are limited technological barriers to entry into the markets in which we compete and it may be relatively easy for competitors, some of whom may have greater resources than we have, to enter our markets and compete with us.

Anyone may obtain access to source code for the features of our software that we have licensed under open source or source available licenses.

Depending on the product and version of the Elastic software, this source code is either available under Apache 2.0, SSPL, or the Elastic License.

Each of these licenses allow anyone, subject to compliance with the conditions of the applicable license, to redistribute our software in modified or unmodified form and use it to compete in our markets.

Such competition can develop without the degree of overhead and lead time required by traditional proprietary software companies, due to the rights granted to licensees of open source and source available software.

It is possible for competitors to develop their own software, including software based on our products, potentially reducing the demand for our products and putting pricing pressure on our subscriptions.

For example, Amazon offers some of our open source features as part of its Amazon Web Services offering.

For example, Amazon offers some of the features that we had previously made available under an open source license as part of its Amazon Web Services offering.

As such, Amazon competes with us for potential customers, and while Amazon cannot provide our proprietary software, Amazon’s offerings may reduce the demand for our offerings and the pricing of Amazon’s offerings may limit our ability to adjust the price of our products.

We cannot guarantee that we will be able to compete successfully against current and future competitors or that competitive

pressure or the availability of new open source software will not result in price reductions, reduced operating margins and loss of market share, any one of which could harm our business, financial condition, results of operations and cash flows.

We cannot guarantee that we will be able to compete successfully against current and future competitors or that competitive pressure or the availability of new software will not result in price reductions, reduced operating margins and loss of market share, any one of which could harm our business, financial condition, results of operations and cash flows.

Our ability to grow our business will depend, in part, on the expansion and adoption of our SaaS offerings.

We believe our future success will depend, in part, on the growth in the adoption of Elastic Cloud, our family of SaaS products.

We have and will continue to incur substantial costs to develop, sell and support our Elastic Cloud offerings.

We believe that we must offer a family of SaaS products to address the market segment that prefers a cloud-based solution to a self-managed solution and that there will be increasing demand for cloud-based offerings of our products.

In the years ended April 30, 2021, 2020 and 2019, Elastic Cloud contributed 27%, 22% and 17% of our total revenue, respectively.

However, as the use of cloud-based computing solutions is rapidly evolving, it is difficult to predict the potential growth, if any, of general market adoption, customer adoption and retention rates of our cloud-based offerings.

There could be decreased demand for our cloud-based offerings due to reasons within or outside of our control, including, among other things, lack of customer acceptance, technological challenges with bringing cloud offerings to market and maintaining those offerings, security or privacy concerns, our inability to properly manage and support our cloud-based offerings, competing technologies and products, weakening economic conditions, and decreases in corporate spending.

For example, Amazon Web Services offers SaaS products based on older Elastic Stack releases.

As such, Amazon competes with us for potential customers, and while Amazon cannot provide our proprietary software, Amazon's offerings may reduce the demand for our offerings and the pricing of Amazon's offerings may limit our ability to adjust the price of our products.

If we are not able to develop, market or deliver cloud-based offerings that satisfy customer requirements technically or commercially, or if our investments in cloud-based offerings do not yield the expected return, or if we are unable to decrease the cost of providing our cloud-based offerings, our business, competitive position, financial condition and results of operations may be harmed.

If we do not effectively develop and expand our sales and marketing capabilities, including expanding and training our sales force, we may be unable to add new customers, increase sales to existing customers or expand the value of our existing customers’ subscriptions and our business will be adversely affected.

3 unchanged sentences

We depend on our sales force to obtain new customers and to drive additional sales to existing customers.

We believe that there is significant competition for sales personnel, including sales representatives, sales managers, and sales engineers, with the requisite skills and technical knowledge.

We believe that there is significant competition for sales personnel, including sales representatives, sales managers,

and sales engineers, with the requisite skills and technical knowledge.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining sufficient sales personnel to support our growth, and as we introduce new products, solutions and marketing strategies, we may need to re-train existing sales personnel.

2 unchanged sentences

In addition, particularly as we continue to grow rapidly, a large percentage of our sales force will have relatively little experience working with us, our subscriptions, and our business model.

If our new and existing sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective, our growth and results of operations could be negatively impacted.

Moreover, Endgame’s former sales force is small and the rest of our sales force has no experience selling Endgame’s endpoint security products.

If we are unable to hire and train sufficient numbers of effective sales personnel, our sales personnel do not reach significant levels of productivity in a timely manner, or our sales personnel are not successful in obtaining new customers or increasing sales to our existing customer base, our business will be harmed.

If we are unable to hire and train sufficient numbers of effective sales personnel, our new and existing sales personnel are unable to achieve desired productivity levels in a reasonable period of time, our sales personnel are not successful in obtaining new customers or increasing sales to our existing customer base, or our sales and marketing programs are not effective, our growth and results of operations could be negatively impacted and our business will be harmed.

Our ability to increase sales of our offerings is highly dependent on the quality of our customer support, and our failure to offer high quality support would have an adverse effect on our business, reputation and results of operations.

5 unchanged sentences

We may not be able to hire such resources fast enough to keep up with demand, particularly if the sales of our offerings exceed our internal forecasts.

Further, due to the ongoing uncertainty related to the COVID-19 pandemic, we have taken steps to moderate the pace of hiring, and there may also be delays in hiring, onboarding and training new employees.

Due to the ongoing uncertainty related to the COVID-19 pandemic, there may also be more competition for qualified employees and delays in hiring, onboarding and training new employees.

To the extent that we are unsuccessful in hiring, training, and retaining adequate support resources, our ability to provide adequate and timely support to our customers, and our customers’ satisfaction with our offerings, will be adversely affected.

12 unchanged sentences

Any limitation of liability provisions that may be contained in our customer and partner agreements may not be effective as a result of existing or future applicable law or unfavorable judicial decisions.

The sale and support of our products entail the risk of liability claims, which could be substantial in light of the use of our products in enterprise-wide environments.

The sale and support of our products

entail the risk of liability claims, which could be substantial in light of the use of our products in enterprise-wide environments.

In addition, our insurance against this liability may not be adequate to cover a potential claim.

6 unchanged sentences

Failure by us to effectively provide training and implementation services to our customers could result in lost opportunities for follow-on sales to these customers and decrease subscriptions by new customers, and adversely affect our business and growth prospects.

If third parties offer inadequate or defective implementations of our open source software, our reputation could be harmed.

Certain cloud hosting providers, including Amazon Web Services, provide SaaS offerings based on open source components of the Elastic Stack, using the names of those open source components in marketing such offerings.

If third parties offer inadequate or defective implementations of software that we have previously made available under an open source license, our reputation could be harmed.

Certain cloud hosting providers and managed service providers, including Amazon Web Services, offer SaaS products based on older Elastic Stack releases, using the names of our products in marketing such offerings.

These offerings are not supported by us and come without any of our proprietary features.

We do not control how these third parties may use or offer our open source technology.

These third parties could inadequately or incorrectly implement our open source technology, or fail to update such technology in light of changing technological or security requirements, which could result in real or perceived defects, security vulnerabilities, errors, or performance failures with respect to their open source offerings.

Users, customers, and potential customers could confuse these third party products with our own products, and attribute such defects, security vulnerabilities, errors, or performance failures to our products.

Users, customers, and potential customers could confuse these third-party products with our products, and attribute such defects, security vulnerabilities, errors, or performance failures to our products.

Any damage to our reputation and brand from defective implementations of our open source software could result in lost sales and lack of market acceptance of our products and could adversely affect our business and growth prospects.

8 unchanged sentences

If our security measures are breached or unauthorized access to private or proprietary data is otherwise obtained, our software may be perceived as not being secure, customers may reduce the use of or stop using our products, and we may incur significant liabilities.

Any security breach, including those resulting from a cybersecurity attack, phishing attack, or any unauthorized access, unauthorized usage, virus or similar breach or disruption could result in the loss of confidential information, damage to our reputation, litigation, regulatory investigations or other liabilities.

Any security breach, including those resulting from a cybersecurity attack, phishing attack, or any unauthorized access, unauthorized usage, virus, malware, ransomware or similar breach or disruption to our networks and systems, or those of third parties upon which we rely, could result in the loss of confidential information, damage to our reputation, litigation, regulatory investigations or other liabilities.

These attacks may come from individual hackers, criminal groups, and state-sponsored organizations.

Cyber threats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.

As a provider of security solutions, we may be specifically targeted by bad actors for attacks intended to circumvent our security capabilities as an entry point into customers’ endpoints, networks, or systems.

7 unchanged sentences

We engage third-party vendors and service providers to store and otherwise process some of our and our customers’ data, including sensitive and personal information.

Our vendors and service providers may also be the targets of cyberattacks, malicious software, phishing schemes, and fraud.

Our ability to monitor our vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized access to, misuse, disclosure, loss or destruction of our and our customers’ data, including sensitive and personal information.

There have been and may continue to be significant supply chain cyber attacks generally, and our third-party vendors and service providers may be targeted or impacted by such attacks.

We cannot guarantee that our or our third-party vendors and service providers’ systems and networks have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us and our services.

Our ability to monitor our third-party vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized access to, misuse, disclosure, loss or destruction of our and our customers’ data, including sensitive and personal information.

Techniques used to sabotage or obtain unauthorized access to systems or networks are constantly evolving and, in some instances, are not identified until launched against a target.

We and our service providers may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative measures.

Security risks are also heightened during the ongoing COVID-19 pandemic as more individuals are working remotely and utilizing home networks for transmitting information, and reported ransomware incidents with significant operational impacts also appear to be escalating in frequency and degree.

In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats.

We may face increased compliance burdens regarding such requirements with regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of our own supply chain.

We and our customers may also experience increased costs associated with security measures and increased risk of suffering cyberattacks, including ransomware.

Should we or the third-party vendors upon which we rely experience such attacks, including from ransomware, our operations may also be hindered or interrupted, with foreseeable secondary contractual, regulatory, financial, and reputational harms that may arise from such an incident.

Further, we cannot assure that any limitations of liability provisions in our customer and user agreements, contracts with third-party vendors and service providers or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security breach or other security-related matter.

6 unchanged sentences

In addition, our website and internal technology infrastructure may experience performance issues due to a variety of factors, including infrastructure changes, human or software errors, website or third-party hosting disruptions, capacity constraints, technical failures, natural disasters or fraud or security attacks.

Our use and distribution of open source software may increase this risk.

Our use of third-party open source software may increase this risk.

If our website is unavailable or our users are unable to download our products or order subscriptions or services within a reasonable amount of time or at all, our business could be harmed.

3 unchanged sentences

Our success depends upon our relationships with third-party service providers, including providers of cloud hosting infrastructure, customer relationship management systems, financial reporting systems, human resource management systems, credit card processing platforms, marketing automation systems, and payroll processing systems, among others.

If any of these third parties experience difficulty meeting our requirements or standards, become unavailable due to extended outages or interruptions, temporarily or permanently cease operations, face financial distress or other business disruptions, increase their fees, if our relationships with any of these providers deteriorate, or if any of the agreements we have entered into with such third parties are terminated or not renewed without adequate transition arrangements, we could suffer increased costs and delays in our ability to provide customers with our products and services, our ability to manage our finances could be interrupted, receipt of payments from customers may be delayed, our processes for managing sales of our offerings could be impaired, our ability to generate and manage sales leads could be weakened, or our business operations could be disrupted.

If any of these third parties experience difficulty meeting our requirements or standards, become unavailable due to extended outages or interruptions, temporarily or permanently cease operations, face financial distress or other business disruptions, increase their fees, if our relationships with any of these providers deteriorate, or if any of the agreements we have entered into with such third parties are terminated or not renewed without adequate transition arrangements, we could suffer liabilities, penalties, fines, increased costs and delays in our ability to provide customers with our products and services, our ability to manage our finances could be interrupted, receipt of payments from customers may be delayed, our processes for managing sales of our offerings could be impaired, our ability to generate and manage sales leads could be weakened, or our business operations could be disrupted.

Any of such disruptions may adversely impact our business and our financial condition, results of operations or cash flows could be adversely affected until we replace such providers or develop replacement technology or operations.

5 unchanged sentences

Our sales cycle can extend to more than a year for some customers, and the length of sales cycles may be further impacted due to the COVID-19 pandemic.

We generally expect that some customers will scrutinize their spending more carefully given a challenging economic environment, and this might cause sales cycles to become longer.

Some customers have been scrutinizing their spending more carefully given a challenging economic environment associated with the pandemic, and we generally expect this to continue.

This might cause sales cycles to become longer or become more unpredictable.

As we target more of our sales efforts at larger enterprise customers, we may face greater costs, longer sales cycles, greater competition and less predictability in completing some of our sales.

5 unchanged sentences

Because a substantial proportion of our expenses are relatively fixed in the short term, our cash flows and results of operations will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our ordinary shares to decline.

We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain highly skilled employees could harm our business.

We depend on our senior management and other key employees, and the loss of one or more of these employees or an inability to attract and retain highly skilled employees could harm our business.

Our future success depends, in part, on our ability to continue to attract and retain highly skilled personnel.

7 unchanged sentences

The loss of services of senior management could significantly delay or prevent the achievement of our development and strategic objectives, which could adversely affect our business, financial condition, and results of operations.

For example, we announced the transition of Aaron Katz from Chief Revenue Officer to an advisory role in which he is expected to serve through August 1, 2020.

We have commenced a search for his replacement, but this search may be prolonged, and we may not be able to attract a qualified replacement timely or at all, particularly as potential candidates may be wary to transition during the unstable economic conditions caused by the COVID-19 pandemic.

If we are unable to mitigate these or

other similar risks as we experience management turnover, our business, results of operation and financial condition may be adversely affected.

Any search for senior management in the future or any search to replace the loss of any senior management may be prolonged, and we may not be able to attract a qualified candidate or replacement, as applicable, in a timely manner or at all, particularly as potential candidates may be wary to transition during the unstable economic conditions caused by the COVID-19 pandemic.

Furthermore, the COVID-19 pandemic could make it more difficult to onboard, provide training to and integrate any senior

management or key employees, which could adversely affect their productivity and our business.

If we are unable to mitigate these or other similar risks as we experience management turnover, our business, results of operation and financial condition may be adversely affected.

Additionally, the industry in which we operate is generally characterized by significant competition for skilled personnel as well as high employee attrition.

2 unchanged sentences

Also, to the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited, that they have divulged proprietary or other confidential information, or that their former employers own their inventions or other work product.

If we are not able to maintain and enhance our brand, especially among developers, our business and operating results may be adversely affected.

If we are not able to maintain and enhance our brand, especially among developers, our ability to expand our customer base will be impaired and our business and operating results may be adversely affected.

We believe that developing and maintaining widespread awareness of our brand, especially with developers, is critical to achieving widespread acceptance of our software and attracting new users and customers.

We also believe that the importance of brand recognition will increase as competition in our market increases.

Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing efforts, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and use cases, and our ability to successfully differentiate our products and platform capability from competitive products.

Brand promotion activities may not generate user or customer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand.

For instance, our continued focus and investment in Elastic{ON} and similar investments in our brand, user engagement, and customer engagement may not generate a sufficient financial return.

If we fail to successfully promote and maintain our brand, we may fail to attract or retain users and customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our products.

For instance, our continued focus and investment in ElasticON and similar investments in our brand, user engagement, and customer engagement may not generate the desired customer awareness or a sufficient financial return.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity and entrepreneurial spirit we have worked to foster, which could harm our business.

9 unchanged sentences

We provide certain of our channel partners with specific training and programs to assist them in selling our offerings, but there can be no assurance that these steps will be effective.

In addition, our channel partners may be unsuccessful in marketing and selling our offerings.

In addition, our channel partners may be unsuccessful in marketing and selling our offerings, particularly in light of the effects of the COVID-19 pandemic.

If we are unable to develop and maintain effective sales incentive programs for our channel partners, we may not be able to incentivize these partners to sell our offerings to customers.

1 unchanged sentence

Our agreements with our channel partners typically have a duration of one to three years, and generally may be terminated for any reason by either party with advance notice prior to each renewal date.

We cannot assure you that we will retain these channel partners or that we will be able to secure additional or replacement channel partners.

We may not be able to retain these channel partners or secure additional or replacement channel partners.

The loss of one or more of our significant channel partners or a decline in the number or size of orders from any of them could harm our results of operations.

3 unchanged sentences

If we are unable to maintain successful relationships with our partners, our business operations, financial results and growth prospects could be adversely affected.

We maintain partnership relationships with a variety of partners, including cloud providers, systems integrators, channel partners, referral partners, OEM and MSP partners, and technology partners, to jointly deliver offerings to our end customers and complement our broad community of users.

In particular, we work with systems integrators and referral partners to market and sell our subscriptions.

We maintain partnership relationships with a variety of partners, including cloud providers, systems integrators, channel partners, referral partners, OEM and MSP partners, and technology partners, to deliver offerings to our end customers and complement our broad community of users.

In particular, we partner with various cloud providers to jointly market, sell and deliver our Elastic Cloud offerings, and in some instances this also involves technical integration with such cloud providers.

Our agreements with our partners are generally non-exclusive, meaning our partners may offer customers the offerings of several different companies, including offerings that compete with ours, or may themselves be or become competitors.

6 unchanged sentences

The sales prices for our offerings may decline or we may introduce new pricing models for a variety of reasons, including competitive pricing pressures, discounts, in anticipation of or in conjunction with the introduction of new offerings, or promotional programs.

For example, during the year ended April 30, 2019, we reduced prices for some of our Elastic Cloud offerings in conjunction with launching new offerings.

Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.

Competition continues to increase in the market segments in which we operate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.

Larger competitors with more diverse offerings may reduce the price of offerings that compete with ours or may bundle them with other offerings.

1 unchanged sentence

Any decrease in the sales prices for our offerings, without a corresponding decrease in costs or increase in volume, would adversely impact our gross profit.

Gross profit could also be adversely impacted by a shift in the mix of our subscriptions from self-managed to our cloud offering, which has a lower gross margin, as well as any increase in our mix of professional services relative to subscriptions.

We cannot assure you that we will be able to maintain our prices and gross profits at levels that will allow us to achieve and maintain profitability.

Gross profit could also be adversely impacted by a shift in the mix of our subscriptions from self-managed to our cloud offering, for which we incur hosting costs, as well as any increase in our mix of professional services relative to subscriptions.

We may not be able to maintain our prices and gross profits at levels that will allow us to achieve and maintain profitability.

We expect our revenue mix to vary over time, which could harm our gross margin and operating results.

We expect our revenue mix to vary over time due to a number of factors, including the mix of our subscriptions for self-managed and our cloud offerings and our professional services revenue.

We expect our revenue mix to vary over time due to a number of factors, and we expect that revenue from Elastic Cloud will continue to become a larger part of our revenue mix.

Due to the differing revenue recognition policies applicable to our subscriptions and professional services, shifts in our business mix from quarter to quarter could produce substantial variation in revenue recognized.

6 unchanged sentences

If we fail to meet or exceed such expectations for these or any other reasons, the market price of our ordinary shares could decline.

Our ability to grow our business will depend, in part, on the expansion and adoption of our SaaS Offerings.

We believe our future success will depend, in part, on the growth in the adoption of Elastic Cloud, our family of SaaS products.

We have and will continue to incur substantial costs to develop, sell and support our Elastic Cloud offerings.

In the years ended April 30, 2020, 2019 and 2018, Elastic Cloud contributed 22%, 17% and 16% of our total revenue, respectively.

For example, Amazon Web Services provides SaaS offerings based on open source components of the Elastic Stack.

business, competitive position, financial condition and results of operations may be harmed.

You should consider our business and prospects in light of the risks and difficulties we encounter in this new and evolving market.

Failure to protect our proprietary technology and intellectual property rights could substantially harm our business and results of operations.

6 unchanged sentences

In addition, defending our intellectual property rights might entail significant expense.

Any patents, trademarks, or other intellectual property rights that we have or may obtain may be challenged by others or invalidated through administrative process or litigation.

Any patents, trademarks, or other intellectual property rights that we have or may obtain

may be challenged by others or invalidated through administrative process or litigation.

As of April 30, 2021, we had 24 issued U.S.

1 unchanged sentence

patent applications, and 17 pending non-U.S.

filings, including 4 patent cooperation treaty patent applications.

There can be no assurance that our patent applications will result in issued patents.

23 unchanged sentences

The risk of patent litigation has been amplified by the increase in the number of a type of patent holder, which we refer to as a non-practicing entity, whose sole or principal business is to assert such claims and against whom our own intellectual property portfolio may provide little deterrent value.

We could incur substantial costs in prosecuting or

defending any intellectual property litigation.

We could incur substantial costs in prosecuting or defending any intellectual property litigation.

If we sue to enforce our rights or are sued by a third party that claims that our products infringe, misappropriate or violate their rights, the litigation could be expensive and could divert our management resources.

10 unchanged sentences

Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business and results of operations.

Our use of open source software could negatively affect our ability to sell our products and subject us to possible litigation.

Our technologies incorporate open source software, and we expect to continue to incorporate open source software in our products in the future.

Our use of third-party open source software within our products could negatively affect our ability to sell our products and subject us to possible litigation.

Our technologies incorporate open source software from other developers, and we expect to continue to incorporate such open source software in our products in the future.

Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

Moreover, we cannot assure you that we have not incorporated additional open source software in our software in a manner that is inconsistent with the terms of the applicable license or our current policies and procedures.

Moreover, we cannot assure that we have not incorporated third-party open source software in our software in a manner that is inconsistent with the terms of the applicable license or our current policies and procedures.

If we fail to comply with these licenses, we may be subject to certain requirements, including requirements that we offer our solutions that incorporate the open source software for no cost, that we make available source code for modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses.

5 unchanged sentences

Any of the foregoing could require us to devote additional research and development resources to re-engineer our solutions, could result in customer dissatisfaction, and may adversely affect our business, results of operations and financial condition.

One of our marketing strategies is to offer open source and free trials of our products, and we may not be able to realize the benefits of this strategy.

We are dependent upon lead generation strategies, including offering open source and free trials of our products, to generate sales opportunities.

One of our marketing strategies is to offer some of our product features for free and to provide free trials of some of our paid features, and we may not be able to realize the benefits of this strategy.

We are dependent upon lead generation strategies, including offering free use of some of our product features and free trials of some of our paid features.

These strategies may not be successful in continuing to generate sufficient sales opportunities necessary to increase our revenue.

Many users never convert from the open source or free trials to the paid versions of our products.

Many users never convert from the free use model or from free trials to the paid versions of our products.

To the extent that users do not become, or we are unable to successfully attract, paying customers, we will not realize the intended benefits of these marketing strategies and our ability to grow our revenue will be adversely affected.

Our software development and licensing model could be negatively impacted if the Apache License, Version 2.0 is not enforceable.

Important components of our software have been provided under the Apache License 2.0.

This license states that any work of authorship licensed under it, and any derivative work thereof, may be reproduced and distributed provided that certain conditions are met.

It is possible that a court would hold this license to be unenforceable or that someone could assert a claim for proprietary rights in a program developed and distributed under it.

Any ruling by a court that this license is not enforceable, or that open source components of our products may not be reproduced or distributed, may negatively impact our distribution or development of all or a portion of our products.

In connection with the operation of our business, we may collect, store, transfer and otherwise process certain personal data.

As a result, our business is subject to a variety of government and industry regulations, as well as other obligations, related to privacy, data protection and information security.

Privacy, data protection and information security have become significant issues in various jurisdictions where we offer our products.

The regulatory frameworks for these issues worldwide are rapidly evolving and are likely to remain uncertain for the foreseeable future.

Federal, state, or non-U.S.

government bodies or agencies have in the past adopted, and may in the future adopt, new laws and regulations or may make amendments to existing laws and regulations affecting data protection, data privacy and/or information security and/or regulating the use of the Internet as a commercial medium.

For example, the California Consumer Privacy Act (the “CCPA”), which provides new data privacy rights for California residents, took effect on January 1, 2020.

The CCPA provides for civil penalties and a private right of action for violations, which may increase our compliance costs and potential liability.

states also are considering omnibus privacy legislation.

Industry organizations also regularly adopt and advocate for new standards in these areas.

Many obligations under the CCPA and these other laws and legislative proposals remain uncertain, and we cannot fully predict their impact on our business.

If we fail to comply with any of these laws or standards, we may be subject to investigations, enforcement actions, civil litigation, fines and other penalties, all of which may generate negative publicity and have a negative impact on our business.

Additionally, in the United States, we may be subject to investigation and/or enforcement actions brought by federal agencies and state attorneys general and consumer protection agencies.

We publicly post statements and other documentation regarding our practices concerning the processing, use and disclosure of personally identifiable information.

Although we endeavor to comply with our published statements and documentation, we may at times fail to do so or be alleged to have failed to do so.

The publication of our privacy statement and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

Internationally, most jurisdictions in which we operate have established their own privacy, data protection and information security legal frameworks with which we or our customers must comply.

Within the European Union, the European General Data Protection Regulation (“GDPR”), became fully effective on May 25, 2018, and applies to the processing (which includes the collection and use) of personal data.

As compared to the previously effective data protection law in the European Union, the GDPR imposes additional obligations and risk upon our business and increases substantially the penalties to which we could be subject in the event of any non-compliance.

Administrative fines under the GDPR can amount up to 20 million Euros or four percent of the group’s annual global turnover, whichever is higher.

We have incurred substantial expense in complying with new data protection legal frameworks and we may be required to make additional, significant changes in our business operations, all of which may adversely affect our revenue and our business overall.

Additionally, because these new regimes lack a substantial enforcement history, we are unable to predict how emerging standards may be applied to us.

Despite our efforts to attempt to comply with new data protection obligations, a regulator may determine that we have not done so and subject us to fines and public censure, which could harm our company.

Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States.

We have undertaken certain efforts to conform transfers of personal data from the European Economic Area, (“EEA”), to the United States and other jurisdictions based on our understanding of current regulatory obligations and the guidance of data protection authorities, including standard contractual clauses approved by the European Commission.

Despite this, we may be unsuccessful in maintaining conforming means of transferring such data from the EEA, in particular as a result of continued legal and legislative activity within the European Economic Area that has challenged or called into question existing means of data transfers to countries that have not been found to provide adequate protection for personal data.

Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services.

We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our products due to the potential risk exposure to such customers as a result of shifting business sentiment in the EEA regarding international data transfers and the data protection obligations imposed on them.

We may find it necessary to establish systems to maintain personal data originating from the EEA in the EEA, or may need to take other, additional steps to provide for local data processing, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We and our customers may face a risk of enforcement actions taken by European data protection authorities until the time, if any, that personal data transfers to us and by us from the EEA are legitimized under European law.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may legally or contractually apply to us.

One example of such a self-regulatory standard is the Payment Card Industry Data Security Standard (“PCI DSS”), which relates to the processing of payment card information.

In the event we or our payment processors fail to comply with the PCI DSS, fines and other penalties could result, and we may suffer reputational harm and damage to our business.

Further, our customers increasingly expect us to comply with more stringent privacy, data protection and information security requirements than those imposed by laws, regulations or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data on or by our offerings.

Any failure to meet our customers’ requirements may adversely affect our revenues and prospects for growth.

We also expect that there will continue to be changes in interpretations of existing laws and regulations, or new proposed laws, regulations, and other obligations concerning privacy, data protection and information security, which could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our offerings, increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

Because the interpretation and application of many laws and regulations relating to privacy, data protection and information security, along with industry standards, are uncertain, it is possible that these laws and regulations may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our data management practices or the features of our products, and we could face fines, lawsuits, regulatory investigations and other claims and penalties, and we could be required to fundamentally change our products or our business practices, any of which could have an adverse effect on our business.

Any inability to adequately address privacy, data protection and information security concerns, even if unfounded, or any actual or perceived failure to comply with applicable privacy, data protection or information security laws, regulations and other obligations, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our products.

Privacy, data protection and information security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and countries outside of the United States.

If we are not able to adjust to changing laws, regulations and standards related to the Internet, our business may be harmed.

We may acquire other businesses which could require significant management attention, disrupt our business, dilute shareholder value.

We may be unable to integrate acquired businesses and technologies, and acquisitions could adversely affect our results of operations.

As part of our business strategy, we may acquire or make investments in complementary companies, products, or technologies.

We have in the past acquired, and expect in the future to acquire, businesses that we believe will complement or augment our existing business, such as our acquisition of Endgame in October 2019.

The identification of suitable acquisition candidates is difficult, and we may not be able to complete such acquisitions on favorable terms, if at all.

If we do complete future acquisitions, we may not ultimately strengthen our competitive position or achieve our goals and business strategy, we may be subject to claims or liabilities assumed from an acquired company, product, or technology, and any acquisitions we complete could be viewed negatively by our customers, investors, and securities analysts.

In addition, if we are unsuccessful at integrating Endgame or future acquisitions, or the technologies associated with such acquisitions, into our company, the revenue and results of operations of the combined company could be adversely affected.

Any integration process may require significant time and resources, which may disrupt our ongoing business and divert management’s attention, and we may not be able to manage the integration process successfully.

We may not successfully evaluate or utilize acquired technology or personnel, realize anticipated synergies from acquisitions, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, each of which could adversely affect our financial condition or the market price of our ordinary shares.

The sale of equity or issuance of equity-linked debt to finance any future acquisitions could result in dilution to our shareholders.

The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.

Additionally, we may acquire development stage companies that are not yet profitable, and that require continued investment, which could adversely

affect our results of operations and liquidity.

The occurrence of any of these risks could harm our business, results of operations, and financial condition.

With the acquisition of Endgame, we face risks related to the integration of combined businesses, our cash resources and financial results, undisclosed liabilities, and employee and customer retention.

Since the closing of the acquisition of Endgame in October 2019, we are devoting significant management attention and resources to integrating the business practices and operations of the former Endgame business with our business.

Potential difficulties we may encounter as part of the integration process include those related to the costs of integration and compliance, diversion of management’s attention, our ability to create and enforce uniform standards, procedures, policies and information systems, potential unknown liabilities, and unforeseen increased expenses or delays.

Since the closing of the acquisition of Endgame in October 2019, we have devoted significant management attention and resources to integrating the business practices and operations of the former Endgame business with our business.

Potential difficulties we may encounter as we continue to integrate Endgame into our business strategy include those related to the costs

of integration and compliance, diversion of management’s attention, our ability to create and enforce uniform standards, procedures, policies and information systems, potential unknown liabilities, and unforeseen increased expenses or delays.

Our due diligence review in connection with the acquisition may not have discovered undisclosed liabilities of Endgame.

2 unchanged sentences

The acquisition may also result in significant charges or other liabilities that could adversely affect our results of operations, such as cash expenses and non-cash accounting charges incurred in connection with the acquisition and/or integration of the combined businesses and operations.

Unfavorable or uncertain conditions in our industry or the global economy or reductions in information technology spending could limit our ability to grow our business and negatively affect our results of operations.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers.

Current or future economic uncertainties or downturns could adversely affect our business and results of operations.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, international trade relations, political turmoil, natural catastrophes, warfare, infectious diseases and terrorist attacks on the United States, Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments by our customers and potential customers, including spending on information technology, and negatively affect the growth of our business.

For example, the COVID-19 pandemic may curtail business spending by our customers, result in business disruptions for us and/or our customers, restrict travel to customer sites or result in a quarantine of affected populations impacting our employees, partners and customers.

Additionally, mitigation and containment measures adopted by government authorities to contain the spread of COVID-19 in the U.S.

and abroad may significantly impact business continuity for our partners and our customers, reduce our customers’ business operations, delay their engagement with us (including due to travel restrictions and restrictions on in-person meetings) and could thereby adversely affect our business and financial results.

To the extent our offerings are perceived by customers and potential customers as discretionary, our revenue may be disproportionately affected by delays or reductions in general information technology spending.

Also, customers may choose to develop in-house software as an alternative to using our products.

Moreover, competitors may respond to market conditions by lowering prices.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry.

If the economic conditions of the general economy or markets in which we operate do not improve, or worsen from present levels, our business, results of operations and financial condition could be adversely affected.

We are subject to governmental export and import controls and economic sanctions programs that could impair our ability to compete in international markets or subject us to liability if we violate these controls.

Our software is subject to U.S.

export control laws and regulations including the Export Administration Regulations (“EAR”), and trade and economic sanctions maintained by the Office of Foreign Assets Control (“OFAC”).

As such, an export license may be required to export or reexport our products to certain countries, end-users and end-uses.

If we were to fail to comply with such U.S.

export controls laws and regulations, U.S.

economic sanctions, or other similar laws, we could be subject to both civil and criminal penalties, including substantial fines, possible incarceration for employees and managers for willful violations, and the possible loss of our export or import privileges.

Obtaining the necessary export license for a particular sale or offering may not be possible and may be time-consuming and may result in the delay or loss of sales opportunities.

Furthermore, U.S.

export control laws and economic sanctions prohibit the export of products to certain U.S.

embargoed or sanctioned countries, governments and persons, as well as for prohibited end-uses.

Monitoring and ensuring compliance with these complex U.S.

export control laws is particularly challenging because our offerings are widely distributed throughout the world and are available for download without registration.

In addition, because we incorporate encryption functionality into our products, we are also subject to certain provisions of these laws that apply to encryption items.

Even though we take precautions to ensure that we and our partners comply with all relevant export control laws and regulations, any failure by us or our partners to comply with such laws and regulations could have negative consequences for us, including reputational harm, government investigations and penalties.

In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our end-customers’ ability to implement our products in those countries.

Changes in our products or changes in export and import regulations in such countries may create delays in the introduction of our products into international markets, prevent our end-customers with international operations from deploying our products globally or, in some cases, prevent or delay the export or import of our products to certain countries, governments or persons altogether.

Any change in export or import laws or regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing export, import or sanctions laws or regulations, or change in the countries, governments, persons, or technologies targeted by such export, import or sanctions laws or regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations.

Any decreased use of our products or limitation on our ability to export to or sell our products in international markets could adversely affect our business, financial condition and operating results.

Our international operations and expansion expose us to several risks.

1 unchanged sentence

In addition, as a result of our strategy of leveraging a distributed workforce, as of April 30, 2021, we had employees located in over 35 countries.

Our current international operations involve and future initiatives will involve a variety of risks, including:

Our current international operations involve and future initiatives may involve a variety of risks, including:

• unexpected changes in regulatory requirements, taxes, trade laws, tariffs, export quotas, custom duties or other trade restrictions;

2 unchanged sentences

• changes in a specific country’s or region’s political or economic conditions;

• political, economic and trade uncertainties related to the effect of the United Kingdom's withdrawal from the European Union (Brexit) on the economies of United Kingdom, European Union, United States and other countries;

• risks resulting from changes in currency exchange rates;

• political, economic and trade uncertainties or instability related to the effect of the United Kingdom's withdrawal from the European Union (Brexit), including the effects of the Trade and Cooperation Agreement between the European Union, the European Atomic Energy Community and the United Kingdom signed in December 2020, on the economies of, and the relationships between, the United Kingdom, European Union, United States and other countries;

• the evolving relations between the United States and China;

• changes in relations between the Netherlands and the United States;

• risks resulting from changes in currency exchange rates and inflation;

• the impact of public health epidemics or pandemics on our employees, partners and customers;

1 unchanged sentence

• risks relating to the implementation of trade and economic sanctions, including restrictions promulgated by the OFAC, and other similar trade protection regulations and measures in the United States or in other jurisdictions;

• risks relating to our third-party vendors and service providers’ storage and processing of some of our and our customers’ data, including any supply chain cyber attacks;

• reduced ability to timely collect amounts owed to us by our customers in countries where our recourse may be more limited;

7 unchanged sentences

We depend on direct sales and our channel partner relationships to sell our offerings in international markets.

Our ability to expand internationally will depend upon our

ability to deliver functionality and foreign language translations that reflect the needs of the international clients that we target.

Our ability to expand internationally will depend upon our ability to deliver functionality and foreign language translations that reflect the needs of the international clients that we target.

Our ability to expand internationally involves various risks, including the need to invest significant resources in such expansion, and the possibility that returns on such investments will not be achieved in the near future or at all in these less familiar competitive environments.

2 unchanged sentences

In addition, we have incurred and may continue to incur significant expenses in advance of generating material revenue as we attempt to establish our presence in particular international markets.

Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new offerings could reduce our ability to compete and could harm our business.

We expect that our existing cash and cash equivalents will be sufficient to meet our anticipated cash needs for at least the next twelve months.

After that, we may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all.

If we need to raise additional capital or generate the significant capital necessary to expand our operations and invest in new offerings, it could reduce our ability to compete and could harm our business.

We may need to raise additional funds in the future, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all.

If we raise additional equity financing, our shareholders may experience significant dilution of their ownership interests and the per share value of our ordinary shares could decline.

9 unchanged sentences

Our failure to have sufficient capital to do any of these things could harm our business, financial condition, and results of operations.

Failure to comply with anti-bribery, anti-corruption, and anti-money laundering laws could subject us to penalties and other adverse consequences.

We are subject to the FCPA, the U.K.

Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions both domestic and abroad.

We leverage channel partners to sell our offerings abroad and use other third parties, including recruiting firms, professional employer organizations, legal, accounting and other professional advisors, and local vendors to meet our needs associated with doing business abroad.

We and these third parties may have direct or indirect interactions with officials and employees of government agencies, or state-owned or affiliated entities, and we may be held liable for the corrupt or other illegal activities of our channel partners and third-party representatives, as well as our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

While we have policies and procedures to address compliance with such laws, we cannot assure you that the channel partners, third-party representatives, our employees, contractors or agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

Any violation of the FCPA, U.K.

Bribery Act or other applicable anti-bribery, anti-corruption laws, and anti-money laundering laws could result in whistleblower complaints, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from U.S.

government contracts, all of which may have an adverse effect on our reputation, business, operating results and prospects.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

2 unchanged sentences

Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S.

federal government, U.S.

state government, or non-U.S.

government sectors until we have attained the revised certification.

federal government sector, U.S.

state government sector, or government sectors of countries other than the United States until we have attained the revised certification.

For example, we hold a U.S.

Federal Risk and Authorization Management Program Authority to Operate at a moderate impact level;

however, such authority is costly to maintain and if we were to lose our certification in the future, it would restrict our ability to sell to government customers.

On May 12, 2021, the Biden Administration issued an Executive Order that will ultimately result in additional security requirements for government agencies and their contractors, for example, multifactor authentication, encryption for data at rest and in transit, and broad log creation, preservation, and production requirements.

Furthermore, the Executive Order accelerates agency planning and implementation requirements for “zero trust architecture” and will establish a standards-development effort for a software bill of materials.

This may increase compliance costs directly for government contracts and indirectly to the extent such requirements require changes or new efforts at an enterprise level.

If we are unable to timely meet such requirements, our ability to compete for and maintain federal government contracts may be diminished, which could adversely affect our business, results of operations and financial condition.

Government demand and payment for our offerings may be affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Sales to U.S.

federal government agencies, including classified contracts, are subject to complex federal regulations.

Failure to comply with such regulations could result in contract terminations or other adverse consequences, including but not limited to adversely affecting our eligibility to sell to U.S.

federal government agencies in the future.

Additionally, we rely on certain partners to provide technical support services to certain of our government entity customers to resolve any issues relating to our products.

Sales to government agencies, including classified contracts, are subject to complex regulations.

Failure to comply with such regulations could result in contract terminations or other adverse consequences, including but not limited to adversely affecting our eligibility to sell to government agencies in the future.

Additionally, we rely on certain partners to provide technical support

services to certain of our government entity customers to resolve any issues relating to our products.

If our partners do not effectively assist our government entity customers in deploying our products, succeed in helping our government entity customers quickly resolve post-deployment issues, or provide effective ongoing support, our ability to sell additional offerings to new and existing government entity customers would be adversely affected and our reputation could be damaged.

Government entities may have statutory, contractual, or other legal rights to terminate contracts with us or our channel partners for convenience or due to a default, and any such termination may adversely affect our future results of operations.

In addition, multi-year contracts with government entities are usually conditioned on annual fiscal funding actions that the relevant legislative or other decision-making body must take in order to fund each year of a contract.

Such legislative or decision-making bodies may elect not to fund each year of a contract.

Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.

2 unchanged sentences

The tax laws applicable to our business, including the laws of the Netherlands, the United States and other jurisdictions, are subject to change and interpretation, and certain jurisdictions may aggressively interpret their laws in an effort to raise additional tax revenue.

For example, recently, in the United States, the Biden administration has proposed a number of changes, including an increase to the U.S.

corporate income tax rate from 21% to 28%.

In addition, other countries, as well as organizations such as the Organization for Economic Cooperation and Development, have recently proposed or recommended changes to existing tax laws or have enacted new laws that could impact our tax obligations in countries where we do business or cause us to change the way we operate our business.

Any new legislation or interpretations of existing legislation could result in increased taxation of our international earnings.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for valuing developed technology or intercompany arrangements, which could increase our worldwide effective tax rate and harm our financial position and results of operations.

Tax authorities examine and may audit our income tax returns and other non-income tax returns, such as payroll, sales, value-added, net worth or franchise, property, goods and services, and excise taxes, in both the United States and foreign jurisdictions.

It is possible that tax authorities may disagree with certain positions we have taken, and any adverse outcome of such a review or audit could have a negative effect on our financial position and results of operations.

10 unchanged sentences

Our ability to use our net operating loss carryforwards to offset future taxable income may be subject to certain limitations.

As of April 30, 2020 and 2019, we had net operating loss carryforwards in various jurisdictions of $1.3 billion and $485.7 million, respectively, which may be utilized against future income taxes.

Limitations imposed by the applicable jurisdictions on our ability to utilize net operating loss carryforwards could cause income taxes to be paid earlier than would be paid if such limitations were not in effect and could cause such net operating loss carryforwards to expire unused, in each case reducing or eliminating the benefit of such net operating loss carryforwards.

As of April 30, 2021 and 2020, we had net operating loss carryforwards in various jurisdictions of $2.2 billion and $1.3 billion, respectively, which may be utilized against future income taxes.

reducing or eliminating the benefit of such net operating loss carryforwards.

Furthermore, we may not be able to generate sufficient taxable income to utilize our net operating loss carryforwards before they expire.

If any of these events occur, we may not derive some or all of the expected benefits from our net operating loss carryforwards.

Catastrophic events, or man-made problems such as terrorism, may disrupt our business.

A significant natural disaster, such as an earthquake, fire, flood, or significant power outage could have an adverse impact on our business, results of operations, and financial condition.

We have a number of our employees and executive officers located in the San Francisco Bay Area, a region known for seismic activity.

In the event our or our partners' abilities are hindered by any of the events discussed above, sales could be delayed, resulting in missed financial targets for a particular quarter.

In addition, acts of terrorism, other geo-political unrest or health issues, such as an outbreak of pandemic or epidemic diseases, such as the COVID-19 pandemic, or fear of such events, could cause disruptions in our business or the business of our partners, customers or the economy as a whole.

Any disruption in the business of our partners or customers that affects sales in

a given fiscal quarter could have a significant adverse impact on our quarterly results for that and future quarters.

For example, the full extent to which the COVID-19 pandemic impacts our business, results of operations and financial condition will depend on future developments, which are highly uncertain and cannot be predicted.

In addition, the COVID-19 pandemic has adversely affected the economies of many countries, resulting in economic downturns that could affect demand for our products and likely impact our operating results.

All of the aforementioned risks may be further increased if our disaster recovery plans prove to be inadequate.

See the risk factor entitled “The ongoing COVID-19 pandemic could harm our business and results of operations.”

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

A portion of our subscriptions are generated and operating expenses are incurred outside the United States and denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates.

In part as a result of the COVID-19 pandemic, foreign currency exchange rates have been and could continue to be subject to increased volatility.

The strengthening of the U.S.

dollar increases the real cost of our offerings to our customers outside of the United States, leading to delays in the purchase of our offerings and the lengthening of our sales cycle.

dollar continues to strengthen, this could adversely affect our financial condition and results of operations.

If the strength of the U.S.

dollar increases, this could adversely affect our financial condition and results of operations.

In addition, increased international sales in the future, including through our channel partners, may result in greater foreign currency denominated sales, increasing our foreign currency risk.

7 unchanged sentences

We expect that this seasonality will continue to affect our results of operations in the future, and might become more pronounced as we continue to target larger enterprise customers.

If our estimates or judgments relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our results of operations could fall below expectations of securities analysts and investors, resulting in a decline in the trading price of our ordinary shares.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this Annual Report on Form 10-K, the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenue, and expenses that are not readily apparent from other sources.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our ordinary shares.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, measurement of stock-based compensation expense, accounting of intangible assets, goodwill impairment test, and accounting for income taxes including deferred tax assets and liabilities.

Risks Related to Regulatory Matters

In connection with the operation of our business, we may collect, store, transfer and otherwise process certain personal data.

As a result, our business is subject to a variety of government and industry regulations, as well as other obligations, related to privacy, data protection and information security.

Privacy, data protection and information security have become significant issues in various jurisdictions where we offer our products.

The regulatory frameworks for these issues worldwide are rapidly evolving and are likely to remain uncertain for the foreseeable future.

Federal, state, or non-U.S.

For example, the recently enacted California Consumer Privacy Act (the “CCPA”) provides new data privacy rights for California residents.

The enforcement of the CCPA by the California Attorney General commenced July 1, 2020.

We cannot fully predict the impact of the CCPA on our business or operations, but we may be required to modify our data processing practices and policies and to incur substantial costs and expenses in connection with our compliance or the compliance of our customers or vendors.

The CCPA also provides for civil penalties and a private right of action for violations, which may increase our compliance costs and potential liability.

Additionally, a new privacy law, the California Privacy Rights Act (“CPRA”), was approved by California voters in the November 3, 2020 election.

The CPRA creates obligations relating to consumer data beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement beginning July 1, 2023.

We will continue to monitor developments related to the CPRA and anticipate additional costs and expenses associated with CPRA compliance.

states also are considering omnibus privacy legislation and industry organizations regularly adopt and advocate for new standards in these areas.

Many obligations under the CCPA and these other laws and legislative proposals remain uncertain, and we cannot fully predict their impact on our business.

Additionally, in the United States, we may be subject to investigation and/or enforcement actions brought by federal agencies and state attorneys general and consumer protection agencies.

We publicly post statements and other documentation

regarding our practices concerning the processing, use and disclosure of personally identifiable information.

Although we endeavor to comply with our published statements and documentation, we may at times fail to do so or be alleged to have failed to do so.

Internationally, most jurisdictions in which we operate have established their own privacy, data protection and information security legal frameworks with which we or our customers must comply.

Within the European Union, the General Data Protection Regulation (“GDPR”) became fully effective on May 25, 2018, and applies to the processing (which includes the collection and use) of personal data.

The GDPR imposes significant obligations and risk upon our business and provides for substantial penalties to which we could be subject in the event of any non-compliance.

Administrative fines under the GDPR can amount up to 20 million Euros or four percent of the group’s annual global turnover, whichever is higher.

Further, the United Kingdom has implemented legislation that substantially implements the GDPR in the United Kingdom, which legislation provides for penalties for violations of up to the greater of 17.5 million British pounds or four percent of the group’s annual global turnover.

Following the exit of the United Kingdom from the European Union however, aspects of U.K.

data protection law and the relationship of the United Kingdom and the European Union in the medium to longer term remain unclear, including with respect to how data transfers to and from the United Kingdom will be regulated.

Additionally, because these new regimes lack a substantial enforcement history, we are unable to predict how emerging standards may be applied to us.

We have undertaken certain efforts to conform transfers of personal data from the European Economic Area (“EEA”), to the United States and other jurisdictions based on our understanding of current regulatory obligations and the guidance of data protection authorities, including standard contractual clauses approved by the European Commission (the “SCCs”).

Despite this, we may be unsuccessful in maintaining conforming means of transferring such data from the EEA, in particular as a result of continued legal and legislative activity within the EEA that has challenged or called into question existing means of data transfers to countries that have not been found to provide adequate protection for personal data.

The regulatory environment applicable to handling of EEA residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs.

In the Schrems II decision issued by the Court of Justice of the European Union (“CJEU”) on July 16, 2020, the CJEU, among other things, imposed additional obligations on companies when relying on the SCCs.

We and our customers may face EEA regulators applying different standards to certain data transfers or requiring additional steps in connection with data transfers, and may be required to engage in new contract negotiations with third parties that aid in processing data on our behalf.

We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, and may experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our products due to the potential risk exposure to such customers as a result of sentiment in the EEA regarding international data transfers and data protection obligations imposed on them.

We may find it necessary to establish systems to maintain personal data originating from the EEA in the EEA, or may need to take other steps with respect to data handling and data transfers, including means to provide for local data processing, which may involve substantial expense and may require us to divert resources from other aspects of our business, all of which may adversely affect our business.

We and our customers may face a risk of enforcement actions by European data protection authorities until the time, if any, that personal data transfers to us and by us from the EEA are legitimized under European law.

These and the other risks described above could result in harm to our business, operating results and financial condition.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may legally or contractually apply to us.

One example of such a self-regulatory standard is the Payment Card Industry Data Security Standard (“PCI DSS”), which relates to the processing of payment card information.

In the event we or our payment processors fail to comply with the PCI DSS, fines and other penalties could result, and we may suffer reputational harm and damage to our business.

Any failure to meet our customers’ requirements may adversely affect our revenues and prospects for growth.

impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our offerings, increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

If we are not able to adjust to changing laws, regulations and standards related to the Internet, our business may be harmed.

Our software and services, in some cases, are subject to U.S.

export control laws and regulations including the Export Administration Regulations (“EAR”), and trade and economic sanctions maintained by the Office of Foreign Assets Control (“OFAC”).

As such, an export license may be required to export or reexport our software and services to certain countries and end-users for certain end-uses.

If we were to fail to comply with such U.S.

export controls laws and regulations, U.S.

Obtaining the necessary export license for a particular sale or offering may not be possible and may be time-consuming and may result in the delay or loss of sales opportunities.

Furthermore, U.S.

export control laws and economic sanctions in many cases prohibit the export of software and services to certain U.S.

embargoed or sanctioned countries, governments and persons, as well as for prohibited end-uses.

Monitoring and ensuring compliance with these complex U.S.

export control laws is particularly challenging because our offerings are widely distributed throughout the world, and information available on the users of these offerings is, in some cases, limited.

In addition, because we incorporate encryption functionality into our products, we are also subject to certain provisions of these laws that apply to encryption items.

In addition, various countries regulate the export and import of certain encryption software and technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products and services or could limit our end-customers’ ability to implement our products in those countries.

Changes in our products or changes in export and import regulations in such countries may create delays in the introduction of our products and services into international markets, prevent our end-customers with international operations from deploying our products globally or, in some cases, prevent or delay the export or import of our products and services to certain countries, governments or persons altogether.

The following developments could result in decreased use of our products and services by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations:

any change in export or import laws or regulations, economic sanctions or related legislation;

shift in the enforcement or scope of existing export, import or sanctions laws or regulations;

or change in the countries, governments, persons, or technologies targeted by such export, import or sanctions laws or regulations.

Any decreased use of our products or services or limitation on our ability to export to or sell our products or services in international markets could adversely affect our business, financial condition and operating results.

Failure to comply with anti-bribery, anti-corruption, and anti-money laundering laws could subject us to penalties and other adverse consequences.

We are subject to the FCPA, the U.K.

Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions both domestic and abroad.

have policies and procedures to address compliance with such laws, we cannot assure you that the channel partners, third-party representatives, our employees, contractors or agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

Any violation of the FCPA, U.K.

government contracts, all of which may have an adverse effect on our reputation, business, operating results and prospects.

Risks Related to Ownership of our Ordinary Shares

3 unchanged sentences

The economic impact and uncertainty of the ongoing COVID-19 pandemic have exacerbated this volatility in both the overall stock markets and the market price of our ordinary shares.

In the past, shareholders have

instituted securities class action litigation following periods of market volatility.

In the past, shareholders have instituted securities class action litigation following periods of market volatility.

If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business.

5 unchanged sentences

• rumors and market speculation involving us or other companies in our industry;

• a loss of investor confidence in the market for technology stocks or the stock market in general;

• a gain or loss of investor confidence in the market for technology stocks or the stock market in general;

• future sales or expected future sales of our ordinary shares;

6 unchanged sentences

• developments or disputes concerning our intellectual property rights or our solutions, or third-party proprietary rights;

• announced or completed acquisitions of businesses or technologies by us or our competitors, including our acquisition of Endgame;

• announced or completed acquisitions of businesses or technologies by us or our competitors;

• breaches of, or failures relating to, privacy, data protection or information security;

3 unchanged sentences

• other events or factors, including those resulting from war, incidents of terrorism or responses to these events.

We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

We have provided and may continue to provide guidance and other expectations in our quarterly and annual earnings conference calls, quarterly and annual earnings releases, or otherwise, regarding our future performance.

Guidance, as well as other expectations, are forward-looking and represent our management’s estimates as of the date of release and are based upon a number of assumptions and estimates that, while presented with numerical specificity, are inherently subject to significant business, economic and competitive uncertainties and contingencies on our business, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions, some of which will change.

One of those key assumptions relates to the impact of the ongoing COVID-19 pandemic and the associated economic uncertainty on our business, which is inherently difficult to predict.

Furthermore, analysts and investors may develop and publish their own projections of our business, which may form a consensus about our future performance.

Our actual business results may vary significantly from such guidance or other expectations or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions caused by the ongoing COVID-19 pandemic, and which could adversely affect our business and future operating results.

There are no comparable recent events that provide insights as to the probable effect of the ongoing COVID-19 pandemic, and, as a result, the ultimate impact of the COVID-19 outbreak is highly uncertain and subject to change.

Furthermore, if we make downward revisions of our previously announced guidance or other expectations, if we withdraw our previously announced guidance or other expectations, or if our publicly announced guidance or other expectations of future operating results fail to meet expectations of securities analysts, investors or other interested parties, the price of our ordinary shares would decline.

In light of the foregoing, investors are urged not to rely upon our guidance or other expectations in making an investment decision regarding our ordinary shares.

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this “Risk Factors” section in this report could result in the actual operating results being different from our guidance or other expectations, and the differences may be adverse and material.

The concentration of our share ownership with insiders will likely limit your ability to influence corporate matters, including the ability to influence the outcome of director elections and other matters requiring shareholder approval.

5 unchanged sentences

Our articles of association authorize us to issue up to 165 million ordinary shares and up to 165 million preference shares with such rights and preferences as included in our articles of association.

On September 28, 2018, our extraordinary general meeting of shareholders (the “2018 Extraordinary Meeting”) empowered our board of directors to issue ordinary shares

and preference shares up to our authorized share capital for a period of five years from October 10, 2018.

On September 28, 2018, our extraordinary general meeting of shareholders (the “2018 Extraordinary Meeting”) empowered our board of directors to issue ordinary shares and preference shares up to our authorized share capital for a period of five years from October 10, 2018.

Subject to compliance with applicable rules and regulations, we may issue ordinary shares or securities convertible into ordinary shares from time to time in connection with a financing, acquisition, investment, our share incentive plans or otherwise.

9 unchanged sentences

If these holders of our ordinary shares, by exercising their registration rights, sell a large number of shares, they could adversely affect the market price for our ordinary shares.

We have also registered the offer and sale of all ordinary shares that we may issue under our equity compensation plan, which may in turn be sold and may adversely affect the market price for our ordinary shares.

We have also filed registration statements on Form S-8 under the Securities Act registering all ordinary shares that we may issue under our equity compensation plan, which may in turn be sold and may adversely affect the market price for our ordinary shares.

Certain anti-takeover provisions in our articles of association and under Dutch law may prevent or could make an acquisition of our company more difficult, limit attempts by our shareholders to replace or remove members of our board of directors and may adversely affect the market price of our ordinary shares.

18 unchanged sentences

We comply with all applicable provisions of the DCGC except where such provisions conflict with U.S.

exchange listing requirements or with market practices in the United States or the Netherlands.

exchange listing requirements or with market

practices in the United States or the Netherlands.

This may affect your rights as a shareholder, and you may not have the same level of protection as a shareholder in a Dutch company that fully complies with the suggested governance provisions of the DCGC.

5 unchanged sentences

Accordingly, investors must rely on sales of their ordinary shares after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

If industry or financial analysts do not publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our ordinary shares, our share price and trading volume could decline.

The trading market for our ordinary shares is influenced by the research and reports that industry or financial analysts publish about us or our business.

We do not control these analysts, or the content and opinions included in their reports.

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our company, our stock price would likely decline.

In addition, the stock prices of many companies in the technology industry have declined significantly after those companies have failed to meet, or significantly exceed, the financial guidance publicly announced by the companies or the expectations of analysts or public investors.

If our financial results fail to meet, or significantly exceed, our announced guidance or the expectations of analysts or public investors, our stock price may decline.

Further, analysts could downgrade our ordinary shares or publish unfavorable research about us.

If one or more of the analysts who cover our company ceases to cover us, or fails to publish reports on us regularly, our visibility in the financial markets could decrease, which in turn could cause our stock price or trading volume to decline.

The requirements of being a public company may strain our resources, divert management’s attention and affect our ability to attract and retain qualified board members.

As a public company, we are subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of the NYSE and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Compliance with these rules and regulations has increased, and we expect will continue increasing our legal and financial compliance costs, make some activities more difficult, time-consuming or costly and increase demand on our systems and resources, particularly as we are no longer an “emerging growth company” as defined in the Jumpstart Our Business Act of 2012 ("JOBS Act").

Among other things, the Exchange Act requires that we file annual, quarterly and current reports with respect to our business and results of operations, and the Sarbanes-Oxley Act requires that we maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight is required.

As a result, management’s attention may be diverted from other business concerns, which could harm our business, financial condition, results of operations and prospects.

Although we have already hired additional personnel to help comply with these requirements, we may need to further expand our legal and finance departments in the future or hire outside consultants, which will increase our costs and expenses.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time-consuming.

These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expense and a diversion of management’s time and attention from revenue-generating activities to compliance activities.

If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies, regulatory authorities may initiate legal proceedings against us and our business and prospects may be harmed.

As a result of disclosure of information in the filings required of a public company and in this Annual Report on Form 10-K, our business and financial condition will become more visible, which may result in threatened or actual litigation, including by competitors and other third parties.

If such claims are successful, our business, financial condition, results of operations and prospects could be materially harmed, and even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and materially harm our business, financial condition, results of operations and prospects.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, we may be unable to accurately report our financial results or prevent fraud, and investor confidence and the market price of our ordinary shares may, therefore, be adversely affected.

As a public company in the United States, we are subject to the Sarbanes-Oxley Act, which requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended and anticipate that we will continue to expend, significant resources, including accounting-related costs and significant management oversight.

For example, since our IPO, we have hired additional accounting and financial staff with appropriate public company experience and technical accounting knowledge to assist in our compliance efforts.

In addition, effective April 30, 2020, we are no longer an “emerging growth company,” as defined in the JOBS Act, and therefore we are required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act.

We have incurred and expect to continue to incur significant expenses and devote substantial management effort toward compliance with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act.

To assist us in complying with these requirements we may need to hire more employees in the future, or engage outside consultants, which will increase our operating expenses.

Despite significant investment, our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business.

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to implement or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in our periodic reports that we file with the SEC.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, subject us to sanctions or investigations by the NYSE, the SEC or other regulatory authorities, and would likely cause the trading price of our ordinary shares to decline.

Claims of U.S.

1 unchanged sentence

We are incorporated under the laws of the Netherlands and substantial portions of our assets are located outside of the United States.

In addition, one member of our board of directors and certain experts named herein reside outside the United States.

In addition, two members of our board of directors and certain experts named herein reside outside the United States.

As a result, it may be difficult for investors to effect service of process within the United States upon us or such other persons residing outside the United States, or to enforce outside the United States judgments obtained against such persons in U.S.

6 unchanged sentences

federal securities laws, would not be enforceable in the Netherlands unless the underlying claim is re-litigated before a Dutch court of competent jurisdiction.

In such proceedings, however, a Dutch court may be expected to recognize the binding effect of a judgment of a federal or state court in the United States without re-examination of the substantive matters adjudicated thereby, if (i) the

jurisdiction of the U.S.

federal or state court has been based on internationally accepted principles of private international law, (ii) that judgment resulted from legal proceedings compatible with Dutch notions of due process, (iii) that judgment does not contravene public policy of the Netherlands and (iv) that judgment is not incompatible with (x) an earlier judgment of a Dutch court between the same parties, or (y) an earlier judgment of a foreign court between the same parties in a dispute regarding the same subject and based on the same cause, if that earlier foreign judgment is recognizable in the Netherlands.

5 unchanged sentences

federal securities laws brought in a court of competent jurisdiction in the Netherlands against us or such members, officers or experts, respectively.

holders of our ordinary shares may suffer adverse tax consequences if we are characterized as a passive foreign investment company.

persons who hold our ordinary shares may suffer adverse tax consequences if we are characterized as a passive foreign investment company.

corporation will generally be considered a passive foreign investment company (“PFIC”), for U.S.

federal income tax purposes, in any taxable year if either (1) at least 75% of its gross income for such year is passive income or (2) at least 50% of the value of its assets (based on an average of the quarterly values of the assets during such year) is attributable to assets that produce or are held for the production of passive income.

For purposes of the PFIC asset test, the value of our assets will generally be determined by reference to our market capitalization.

3 unchanged sentences

If we are a PFIC for any taxable year during which a U.S.

holder (as defined in “Material U.S.

Federal Income Tax Considerations”) holds our ordinary shares, the U.S.

holder may be subject to adverse tax consequences.

holder is strongly urged to consult its tax advisor regarding the application of these rules and the availability of any potential elections.

holder is treated as owning at least 10% of our ordinary shares, such holder may be subject to adverse U.S.

person (as defined in Section 7701(a)(30) of the Internal Revenue Code of 1986, as amended) holds our ordinary shares, such U.S.

person may be subject to adverse tax consequences.

person who holds our ordinary shares is strongly urged to consult his, her or its tax advisor regarding the application of these rules and the availability of any potential elections.

person is treated as owning at least 10% of our ordinary shares, such U.S.

person may be subject to adverse U.S.

federal income tax consequences.

holder is treated as owning (directly, indirectly, or constructively) at least 10% of the value or voting power of our ordinary shares, such holder may be treated as a “United States shareholder” with respect to each “controlled foreign corporation” in our group (if any).

Under changes implemented by the Tax Cuts and Jobs Act, because our group includes one or more U.S.

person is treated as owning (directly, indirectly, or constructively) at least 10% of the total combined voting power of our shares, or of the total value of our shares, such shareholder may be treated as a “United States shareholder” with respect to each “controlled foreign corporation” in our group (if any).

Under changes implemented by the legislation commonly referred to as the Tax Cuts and Jobs Act of 2017, because our group includes one or more U.S.

subsidiaries, certain of our non-U.S.

4 unchanged sentences

An individual that is a United States shareholder with respect to a controlled foreign corporation generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a United States shareholder that is a U.S.

We cannot provide any assurances that we will assist investors in determining whether any of our non-U.S.

We cannot provide any assurances that we will assist investors in determining whether we or any of our non-U.S.

subsidiaries is treated as a controlled foreign corporation or whether any investor is treated as a United States shareholder with respect to any such controlled foreign corporation or furnish to any investor who may be a United States shareholder information that may be necessary to comply with the aforementioned reporting and tax paying obligations.

Failure to comply with these reporting obligations may subject a U.S.

holder who is a United States shareholder to significant monetary penalties and may prevent from starting the statute of limitations with respect to such holder’s U.S.

Failure to comply with these reporting obligations may subject a shareholder who is a United States shareholder to significant monetary penalties and may prevent from starting the statute of limitations with respect to such shareholder’s U.S.

federal income tax return for the year for which reporting was due.

holder should consult its advisors regarding the potential application of these rules to an investment in our ordinary shares.

We may not be able to make distributions or repurchase shares without subjecting our shareholders to Dutch withholding tax.

Dutch dividend withholding tax may be levied on dividends and similar distributions made by us to our shareholders at the statutory rate of 15%.

If dividend distributions are structured as a repayment of capital or a repurchase of shares, Dutch withholding tax may still be due at 15%.

Such repayment of capital or repurchase of shares will be exempt from dividend withholding tax only in limited circumstances.

person should consult its advisors regarding the potential application of these rules to an investment in our ordinary shares.

We may not be able to make distributions or repurchase shares without subjecting our shareholders to Dutch withholding tax, and dividends distributed on our ordinary shares to certain related parties in low-tax jurisdictions might in the future become subject to an additional Dutch withholding tax.

We have not paid a dividend on our ordinary shares in the past and we do not intend to pay any dividends to holders of our ordinary shares in the foreseeable future.

See “Risk Factors—We do not intend to pay dividends in the foreseeable future.

As a result, your ability to achieve a return on your investment will depend on appreciation in the price of our ordinary shares.” However, if we ever do pay dividends or repurchase shares, then under current Dutch tax law, the dividend paid or repurchase price paid may be subject to Dutch dividend withholding tax at a rate of 15% under the Dutch Dividend Withholding Tax Act ( Wet op de dividendbelasting 1965 , “Regular Dividend Withholding Tax”), unless a domestic or treaty exemption applies.

On March 25, 2021, the Dutch State Secretary of Finance submitted a proposal of law to the Dutch parliament pursuant to which an alternative withholding tax (“Alternative Withholding Tax”) will be imposed on dividends paid to related entities in designated low-tax jurisdictions, effective 1 January 2024.

An entity is considered related if (i) it has a “Qualifying Interest” in our company, (ii) our company has a “Qualifying Interest” in the entity holding the ordinary shares, or (iii) a third party has a "Qualifying Interest" in both our company and the entity holding the ordinary shares.

The term “Qualifying Interest” means a direct or indirectly held interest either by an entity individually or jointly if an entity is part of a collaborating group ( samenwerkende groep ) that enables such entity or such collaborating group to exercise a definite influence over another entities' decisions, such as our company or an entity holding ordinary shares as the case may be, and allows it to determine the other entities' activities.

The Alternative Withholding Tax will be imposed at the highest Dutch corporate income tax rate in effect at the time of the distribution (currently 25%).

The Alternative Withholding Tax will be reduced, but not below zero, with any Regular Dividend Withholding Tax imposed on distributions.

As such, based on currently applicable rates, the overall effective rate of withholding of Regular Dividend Withholding Tax and Alternative Withholding Tax will not exceed the highest corporate income tax rate in effect at the time of the distribution (currently 25%).

The proposal of law is subject to amendment during the course of the legislative process and it needs to be approved by both chambers of the Dutch parliament before it can enter into force.

If we cease to be a Dutch tax resident for the purposes of a tax treaty concluded by the Netherlands and in certain other events, we could potentially be subject to a proposed Dutch dividend withholding tax in respect of a deemed distribution of our entire market value less paid-up capital.

Under a proposal of law currently pending before the Dutch parliament, the Emergency act conditional dividend exit tax ( Spoedwet conditionele eindafrekening dividendbelasting “Dividend Exit Tax”), we will be deemed to have distributed an amount equal to our entire market capitalization less recognized paid-up capital immediately before the occurrence of certain events, including if we cease to be a Dutch tax resident for purposes of a tax treaty concluded by the Netherlands and become, for purposes of such tax treaty, a tax resident of a non-qualifying jurisdiction.

This deemed distribution will be subject to a 15% tax.

An automatic interest free unconditional indefinite extension for the full amount of the tax will be granted.

However, the extension will expire, inter alia, if and to the extent we make distributions after the taxable event for the purposes of the Dividend Exit Tax (in respect of which the extension is granted).

In that event, the Dividend Exit Tax rules prescribe that we

will have a right to recover the tax from our shareholders through set-off against their dividend receivable.

If we do not recover this amount from our shareholders, we will have to pay such part of the deferred tax ourselves.

It is not certain whether the Dividend Exit Tax will be enacted and if so, in what form.

If enacted in its present form before the Dutch parliament the Dividend Exit Tax will have retroactive effect from September 18, 2020.

General Risk Factors

Unfavorable or uncertain conditions in our industry or the global economy or reductions in information technology spending, including as a result of the COVID-19 pandemic, could limit our ability to grow our business and negatively affect our results of operations.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers.

Current or future economic uncertainties or downturns could adversely affect our business and results of operations.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, international trade relations, political instability or unrest and new developments resulting from recent elections and changes of administration, natural catastrophes, warfare, infectious diseases and terrorist attacks on the United States, Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments by our customers and potential customers, including spending on information technology, and negatively affect the growth of our business.

For example, the COVID-19 pandemic has curtailed business spending by our customers, resulted in business disruptions for us and/or our customers, restricted travel to customer sites and resulted in a quarantine of affected populations impacting our employees, partners and customers.

Additionally, mitigation and containment measures adopted by government authorities to contain the spread of COVID-19 in the U.S.

Further, these measures by government authorities may continue to remain in place for a significant period of time or, even if lifted, could be reinstated at any time, and additional and/or extended measures could significantly impact the ability of our employees and customers and vendors to work productively.

Also, customers may choose to develop in-house software as an alternative to using our products.

Moreover, competitors may respond to market conditions by lowering prices.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry.

We may acquire other businesses which could require significant management attention, disrupt our business, or dilute shareholder value.

We may be unable to integrate acquired businesses and technologies, and acquisitions could adversely affect our results of operations.

As part of our business strategy, we may acquire or make investments in complementary companies, products, or technologies.

We have in the past acquired, and expect in the future to acquire, businesses that we believe will complement or augment our existing business, such as our acquisition of Endgame in October 2019.

The identification of suitable acquisition candidates is difficult, and we may not be able to complete such acquisitions on favorable terms, if at all.

The sale of equity or issuance of equity-linked debt to finance any future acquisitions could result in dilution to our shareholders.

The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.

Additionally, we may acquire development stage companies that are not yet profitable, and that require continued investment, which could adversely affect our results of operations and liquidity.

The occurrence of any of these risks could harm our business, results of operations, and financial condition.

Catastrophic events, or man-made problems such as terrorism, may disrupt our business.

A significant natural disaster, such as an earthquake, fire, flood, or significant power outage could have an adverse impact on our business, results of operations, and financial condition.

The impact of climate change may increase these risks due to changes in weather patterns, such as increases in storm intensity, sea-level rise, melting of permafrost and temperature extremes in areas where we or our suppliers and customers conduct business.

We have a number of our employees and executive officers located in the San Francisco Bay Area, a region known for seismic activity and wildfires.

In the event our or our partners’ abilities are hindered by any of the events discussed above, sales could be delayed, resulting in missed financial targets for a particular quarter.

In addition, acts of terrorism, acts of war, other geo-political unrest or health issues, such as an outbreak of pandemic or epidemic diseases, such as the COVID-19 pandemic, or fear of such events, could cause disruptions in our business or the business of our partners, customers or the economy as a whole.

Any disruption in the business of our partners or customers that affects sales in a given fiscal quarter could have a significant adverse impact on our quarterly results for that and future quarters.

All of the aforementioned risks may be further increased if our disaster recovery plans prove to be inadequate.

See the risk factor entitled “The ongoing COVID-19 pandemic could harm our business and results of operations.”

The trading market for our ordinary shares is influenced by the research and reports that industry or financial analysts publish about us or our business.

We do not control these analysts, or the content and opinions included in their reports.

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our company, our stock price would likely decline.

If our financial results fail to meet, or significantly exceed, our announced guidance or the expectations of analysts or public investors, our stock price may decline.

Further, analysts could downgrade our ordinary shares or publish unfavorable research about us.

The requirements of being a public company may strain our resources, divert management’s attention and affect our ability to attract and retain senior management and qualified board members.

procedures and internal control over financial reporting.

In order to improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight is required.

As a result, management’s attention may be diverted from other business concerns, which could harm our business, financial condition, results of operations and prospects.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

These factors could also make it more difficult for us to attract and retain qualified senior management or members of our board of directors, particularly to serve on our audit and compensation committees.

In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended and anticipate that we will continue to expend significant resources, including accounting-related costs and significant management oversight.

For example, since our IPO, we have hired additional accounting and financial staff with appropriate public company experience and technical accounting knowledge to assist in our compliance efforts.

To assist us in complying with these requirements we may need to hire more employees in the future, or engage outside consultants, which will increase our operating expenses.

Despite significant investment, our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business.

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to implement and maintain effective internal control over financial reporting could also adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in our periodic reports that we file with the SEC.

Unresolved Staff Comments.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors