What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-16 compared with 2023-02-23 · 400 added, 346 removed, 600 unchanged (55% of the section changed)

3 unchanged sentences

You should not interpret our disclosure of any of the following risks to imply that such risks have not already materialized.

Table o f Contents

Risk Factors Summary

Below is a summary of the principal factors that make an investment in our Class A common stock speculative or risky:

• We have a history of losses, and we may not be able to achieve profitability or, if achieved, sustain profitability.

• We have experienced significant growth in recent periods, and our recent growth rates may not be indicative of our future growth.

• We have a limited operating history at our current scale, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

• Macroeconomic uncertainties, including inflationary pressures, supply chain disruptions, labor shortages, significant volatility in global markets, and recession risks have in the past and may continue to adversely affect our business, future results of operations, and financial condition, the effects of which remain uncertain.

• Our quarterly results may fluctuate significantly and may not meet our expectations or those of investors or securities analysts.

• Sales efforts to large customers, which are a growing part of our business involve risks that may not be present or that are present to a lesser extent with respect to sales to smaller organizations.

If we fail to effectively manage these risks, our business, financial condition, and results of operations may be adversely affected.

• If we are unable to attract new customers, convert customers using our trial versions into paying customers, and expand usage of our products within or across organizations, our revenue growth would be harmed.

• Our ability to attract new customers and increase revenue from existing customers depends on our ability to develop new features, integrations, capabilities, and enhancements and to partner with third parties to design complementary products.

• We operate in a highly competitive industry, and competition presents an ongoing threat to the success of our business.

• We recognize revenue over the term of our customer contracts.

Consequently, downturns or upturns in new sales may not be immediately reflected in our operating results and may be difficult to discern.

• We track certain key business metrics, which are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and materially adversely affect our stock price, business, results of operations, and financial condition.

• We believe our long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability.

• Our business depends substantially on our customers renewing their subscriptions and purchasing additional subscriptions from us.

Any decline in our customer retention would harm our future operating results.

• A substantial portion of our business and operations are located in India, and we are subject to regulatory, economic, social, and policy uncertainties in India.

We are subject to various labor laws, regulations and standards.

Those uncertainties and non-compliance with and changes in such laws may adversely affect our business, results of operations, and financial condition.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our stock prior to our initial public offering, including our executive officers, employees, and directors and their affiliates, and limiting your ability to influence corporate matters, which could adversely affect the trading price of our Class A common stock.

Risks Related to Our Business

8 unchanged sentences

In addition, we may find that these efforts are more expensive than we currently anticipate or that they may not result in increases in our revenue.

We have experienced rapid growth in recent periods, and our recent growth rates may not be indicative of our future growth.

We have experienced rapid growth in recent periods.

Even if our revenue continues to increase, our growth rate has in certain periods declined and we expect that our revenue growth rate may decline in the future as a result of a variety of factors, including the maturation of our business.

O ur growth may continue to be impacted by macroeconomic factors beyond our control, including, but not limited to rising interest rates, foreign exchange rate volatility, COVID-19 pandemic related factors, global geopolitical uncertainties, and supply-chain issues.

We have experienced significant growth in recent periods and our recent growth rates may not be indicative of our future growth.

While we have experienced significant growth in recent periods, our revenue growth rate has declined more recently.

Even if our revenue continues to increase, we expect that our revenue growth rate may continue to decline in the future as a result of a variety of factors, including the maturation of our business.

O ur growth may continue to be impacted by macroeconomic factors beyond our control, including, but not limited to rising interest rates, foreign exchange rate volatility, global geopolitical uncertainties, and supply-chain issues.

Further, as we operate in a rapidly changing industry, widespread acceptance and use of our products are critical to our future growth and success.

3 unchanged sentences

• gain continued acceptance and use of our products both inside and outside of the United States;

• expand the features and capabilities of our products;

• expand the features and capabilities of our products, including artificial intelligence (AI) and machine learning features;

• provide excellent customer experience and customer service;

11 unchanged sentences

• product development, including investments in our product development team and the development of new products and new features and functionality, as well as investments in further differentiating our existing offerings;

Table o f Contents

• strategic technology and sales channel partnerships;

6 unchanged sentences

We have a limited operating history at our current scale, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

We have been growing rapidly in recent periods and, as a result, have a relatively short history operating our business at its current scale.

We have been growing significantly in recent periods and, as a result, have a relatively short history operating our business at its current scale.

The growth and expansion of our business and products may place a significant strain on our management and our operational and financial resources.

9 unchanged sentences

If our assumptions regarding these risks and uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in the market, or if we do not address these risks successfully, our results of operations could differ materially from our expectations, and our business, results of operations, and financial condition would suffer.

We track certain key business metrics, which are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and materially adversely affect our stock price, business, results of operations, and financial condition.

We track certain key business metrics that may differ from estimates or similar metrics published by third parties due to differences in sources, methodologies, or the assumptions on which we rely.

Our internal systems and tools are subject to a number of limitations, and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we publicly disclose.

For example, our designations of customers as “small- and mid-sized businesses,” “mid-market,” or “enterprise” are based on third-party reporting which may be inaccurate.

In addition, our estimates of number of total customers may be impacted by mergers or acquisitions of such customers or such customers purchasing our products via resellers.

If the internal systems and tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate.

While these numbers are based on what we believe to be reasonable estimates of our metrics for the applicable period of measurement, there are inherent challenges in measuring how our products are used across large populations globally.

Limitations or errors with respect to how we measure data or with respect to the data that we measure may affect our understanding of certain details of our business, which could affect our long-term strategies.

Table o f Contents

our reputation may be significantly harmed, and our business, results of operations, and financial condition could be materially adversely affected.

We believe our long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability.

A significant part of our business strategy and culture is to focus on long-term growth and customer success over short-term financial results.

For example, in the year ended December 31, 2022, we increased our operating expenses to $635.6 million as compared to $497.8 million for the year ended December 31, 2021, while continuing to generate a net loss of $232.1 million in the year ended December 31, 2022.

We expect that we will continue to operate at a loss, and our profitability may be lower than it would be if our strategy were to maximize near-term profitability.

If we are ultimately unable to achieve or improve profitability at the level or during the time frame anticipated by securities or industry analysts and our stockholders, the trading price of our Class A common stock may decline.

Our quarterly results may fluctuate significantly and may not meet our expectations or those of investors or securities analysts.

Our quarterly results of operations, including the levels of our revenue, deferred revenue, working capital, and cash flows, may vary significantly in the future, such that period-to-period comparisons of our results of operations may not be meaningful.

Our quarterly financial results may fluctuate due to a variety of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

Macroeconomic uncertainties, including inflationary pressures, supply chain disruptions, labor shortages, significant volatility in global markets, and recession risks, have in the past adversely affected and may continue to adversely affect our business, future results of operations, and financial condition, the effects of which remain uncertain.

Global economic and business activities continue to face widespread macroeconomic uncertainties, including inflation, supply chain disruptions, labor shortages, as well as recession risks, which may continue for an extended period and which have resulted and may in the future result in decreased business spending by our customers and prospective customers and business partners and third-party business partners, reduced demand for our products, lower renewal rates by our customers, longer or delayed sales cycles, including due to existing customers and prospective customers delaying contracts, entering into new subscriptions, renewing existing subscriptions, or reducing budgets related to the products that we offer, all of which could have an adverse impact on our business operations and financial condition.

To the extent that macroeconomic uncertainties continue to harm our business, many of the other risks described in these risk factors may be exacerbated including but not limited to, those relating to our ability to increase sales to existing and new customers, develop and deploy new offerings and applications and maintain effective marketing and sales capabilities.

Our quarterly results have and may continue to fluctuate significantly and may not meet our expectations or those of investors or securities analysts.

Our quarterly results of operations, including the levels of our revenue, deferred revenue, working capital, and cash flows, have varied significantly in the past and may vary significantly in the future, such that period-to-period comparisons of our results of operations may not be meaningful.

Our quarterly financial results have and may continue to fluctuate due to a variety of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

• the level of demand for our products;

14 unchanged sentences

• costs and timing of expenses related to the potential acquisition of businesses, talent, technologies, or intellectual property, including potentially significant amortization costs and possible write-downs;

• health epidemics, such as the COVID-19 pandemic, influenza, and other highly communicable diseases or viruses;

• health epidemics, influenza, and other highly communicable diseases or viruses;

• adverse litigation judgments, other dispute-related settlement payments, or other litigation-related costs;

• general economic conditions in either domestic or international markets, including inflationary pressures and geopolitical uncertainty and instability and their effects on software spending.

Table o f Contents

Any one or more of the factors above may result in significant fluctuations in our quarterly results of operations, which may negatively impact the trading price of our Class A common stock.

You should not rely on our past results as an indicator of our future performance.

Sales efforts to large customers involve risks that may not be present or that are present to a lesser extent with respect to sales to smaller organizations.

Larger customers are becoming a bigger part of our business.

Sales to large customers involve risks that may not be present or that are present to a lesser extent with sales to smaller organizations, such as longer sales cycles, more complex customer

requirements, substantial upfront sales costs, and less predictability in completing some of our sales.

For example, large customers may require considerable time to evaluate and test our products prior to making a purchase decision.

A number of factors influence the length and variability of our sales cycle, including the need to educate potential customers about the uses and benefits of our products, the discretionary nature of purchasing and budget cycles, and the competitive nature of evaluation and purchasing approval processes.

As a result, the length of our sales cycle, from identification of the opportunity to deal closure, may vary significantly from customer to customer, with sales to large enterprises typically taking longer to complete.

Our typical sales cycle for mid-market and enterprise customers is approximately 150 days, as compared to 30 days for SMB customers.

Moreover, large customers are often more demanding than other customers and begin to deploy our products on a limited basis but nevertheless require implementation services and negotiate pricing discounts or other onerous terms, which increase our upfront investment in the sales effort with no guarantee that sales to these customers will justify our substantial upfront investment, which can affect our roadmaps and deliverables.

If we fail to effectively manage these risks associated with sales cycles and sales to large customers, our business, financial condition, and results of operations may be adversely affected.

If we are unable to attract new customers, convert customers using our trial versions into paying customers, and expand usage of our products within or across organizations, our revenue growth would be harmed.

10 unchanged sentences

Any new features, integrations, and capabilities that we develop may not be introduced in a timely or cost-effective manner, may contain errors, failures, vulnerabilities, or bugs, or may not achieve the market acceptance necessary to generate significant revenue.

Our ability to grow is also subject to the risk of future disruptive technologies.

Uncertainty around new and emerging AI applications, such as generative AI content creation, may require additional investment in the development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex.

Developing, testing and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

Additionally, we rely on third parties to develop products that are complementary to ours in order to retain existing customers and attract new customers.

In order for such complementary products to enhance our customers’ use of our products, we must maintain interoperability as described further below.

We recognize revenue over the term of our customer contracts.

Consequently, downturns or upturns in new sales may not be immediately reflected in our operating results and may be difficult to discern.

We generally recognize subscription revenue from customers ratably over the terms of their contracts, and a majority of our revenue is derived from subscriptions that have terms longer than one month.

As a result, a portion of the revenue we report each quarter is derived from the recognition of deferred revenue relating to subscriptions entered into during previous quarters.

Consequently, a decline in new or renewed subscriptions with terms that are longer than one month in any single quarter may have a small impact on our revenue for that quarter.

However, such a decline will negatively affect our revenue in future quarters.

Accordingly, the effect of significant downturns in sales and market acceptance of our products, and potential changes in our pricing policies or rate of expansion or retention, may not be fully reflected in our results of operations until future periods.

We may also be unable to reduce our operating expenses in a timely fashion if our revenues were to significantly decline.

In addition, because we believe a substantial percentage of subscriptions to our products are shorter than many comparable SaaS companies and because we have many variations of billing cycles, our deferred revenue may be a less meaningful indicator of our future financial results as compared to other SaaS companies.

A significant portion of our costs are expensed as incurred, while revenue is recognized over the life of the agreement with the applicable customer.

Table o f Contents

Our business depends substantially on our customers renewing their subscriptions and purchasing additional subscriptions from us.

Any decline in our customer retention would harm our future operating results.

Our business is subscription based, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

In order for us to maintain or improve our operating results, it is important that our customers renew their subscriptions when the initial contract term expires and add additional users to their subscriptions.

Our customers have no obligation to renew their subscriptions, and we cannot ensure that customers will renew subscriptions with a similar contract period, with the same or greater number of users, or for the same or upgraded level of subscription plan.

Customers may or may not renew their subscription plans as a result of a number of factors, including their satisfaction or dissatisfaction with our products, our pricing or pricing structure, the pricing or capabilities of the products and services offered by our competitors, the effects of general economic conditions, inflation, or customers’ budgetary constraints.

If customers do not renew their subscriptions, renew on less favorable terms, or fail to add more users, or if we fail to upgrade trial customers to our paid subscription plans, or expand the adoption of our products within and across organizations, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations, and financial condition.

We have also experienced and may experience in the future a reduction in renewal rates and increased churn rates, particularly within our SMB customers, many of whom are on month-to-month subscriptions, as well as reduced customer spend and delayed payments that could materially impact our business, results of operations, and financial condition in future periods.

If we fail to predict customer demands or fail to attract new customers and maintain and expand new and existing customer relationships, our revenue may grow more slowly than expected, may not grow at all, or may decline, and our business may be harmed.

Macroeconomic uncertainties, including inflationary pressures, supply chain disruptions, labor shortages, significant volatility in global markets, recession risks, and the COVID-19 pandemic have in the past and may continue to adversely affect our business, future results of operations, and financial condition, the effects of which remain uncertain.

Global economic and business activities continue to face widespread macroeconomic uncertainties, including inflation, supply chain disruptions, labor shortages, as well as recession risks, which may continue for an extended period and which could result in decreased business spending by our customers and prospective customers and business partners and third-party business partners, reduced demand for our products, lower renewal rates by our customers, longer or delayed sales cycles, including customers and prospective customers delaying contracts, entering into new subscriptions, renewing existing subscriptions, or reducing budgets related to the products that we offer, all of which could have an adverse impact on our business operations and financial condition.

In addition, the mitigation measures we have taken in responses to the COVID-19 pandemic have represented a significant disruption in how we operate our business, including a loss of productivity both in the United States and in India, where we have significant operations.

The operations of our partners, vendors, and customers have likewise been disrupted.

While our offices are now reopened, many of our employees who were hired remotely during the pandemic continue to work remotely and others are working on a hybrid basis.

We do not currently have visibility on whether we may return to normal operations of having everyone work in office on a full-time basis.

Our efforts to keep our offices open safely may not be successful and could expose our employees to health risks.

If there are further waves or variants of the virus, we may need to further modify our business practices in a manner that may impact our business.

If our employees are not able to perform their job duties due to illness or are unable to perform them as efficiently at home for an extended period of time, we may not be able to deliver on our business priorities, and we may experience an overall lower productivity of our workforce.

The COVID-19 pandemic has already had an adverse effect on the global economy and our business.

Actual and potential impacts include:

• an increase in certain prospective and current customers seeking lower prices or other more favorable contract terms and changes in the way we interact with our customers and prospective customers;

• the ability of our direct sales force to travel to customers and potential customers has been limited and we have altered, postponed, or canceled planned customer, employee, and industry events or shifted them to a virtual only format, and we may continue to do so;

• overall lower productivity of our workforce;

• slowdowns in the businesses of our existing and potential customers, which in turn could reduce the value or duration of subscriptions, negatively affect our collections of accounts receivable, reduce spending from our customers, cause some of our customers to go out of business, and increase contraction or attrition rates of our customers, all of which could adversely affect our business, results of operations, and financial condition;

Table o f Contents

• extreme volatility in financial and other capital markets as a result of concerns over the economic impact of the COVID-19 pandemic, which have in the past and may in the future adversely affect our stock price and our ability to access capital markets.

We continue to monitor the impact of the COVID-19 pandemic and there may be additional costs or impacts to our business and operations, including in connection with returning to our offices, if we return to normal operations of having everyone work in office on a full-time basis.

In addition, there is no guarantee that a future outbreak of this or any other widespread epidemics will not occur, or that the global economy will recover, either of which could seriously harm our business.

The potential long-term impact of the COVID-19 pandemic or a similar health epidemic on our business, operations, or the global economy as a whole remains uncertain.

Accordingly, it remains difficult for us to predict the duration and extent to which this will affect our business, including productivity of our employees in the United States and in India, future results of operations, and financial condition at this time.

To the extent that macroeconomic uncertainties and the COVID-19 pandemic continue to harm our business, many of the other risks described in these risk factors may be exacerbated including but not limited to, those relating to our ability to increase sales to existing and new customers, develop and deploy new offerings and applications and maintain effective marketing and sales capabilities.

We use generative artificial intelligence, including in certain of our products and services, which may result in operational challenges, legal liability and reputational concerns that could adversely affect our business and results of operations.

We deploy generative AI into certain of our products and services, which may result in adverse effects to our operations, legal liability, reputation and competitive risks.

The use of generative AI may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time.

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies.

For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results.

In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability.

For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results.

Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability.

Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results.

Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

We operate in a highly competitive industry, and competition presents an ongoing threat to the success of our business.

The market for customer experience (CX), IT service management (ITSM), and customer relationship management (CRM) products is rapidly evolving and increasingly competitive, fragmented, and subject to rapidly changing technology, shifting user and customer needs, new market entrants, and frequent introductions of new products and services.

The market for customer service (CS), IT service management (ITSM), and customer relationship management (CRM) products is rapidly evolving and increasingly competitive, fragmented, and subject to rapidly changing technology, shifting user and customer needs, new market entrants, and frequent introductions of new products and services.

We compete with a significant number of companies that range in size from large and diversified enterprises with significant financial resources to smaller companies.

These competitors have developed or are developing products and services that currently, or in the future may, compete with some or all of our offerings.

Within CX, we primarily face competition from CX suites, such as Salesforce and Zendesk, and legacy vendors, such as Oracle and SAP.

Within CS, we primarily face competition from CS suites, such as Salesforce and Zendesk, and legacy vendors, such as Oracle and SAP.

Within ITSM, we primarily face competition from traditional vendors, such as ServiceNow, BMC, Ivanti/Cherwell, and modern pure-play vendors, such as Atlassian.

13 unchanged sentences

Moreover, large customers may demand greater price concessions or other more favorable terms.

We track certain key business metrics that may differ from estimates or similar metrics published by third parties due to differences in sources, methodologies, or the assumptions on which we rely.

For example, our designations of customers as “small- and mid-sized businesses,” “mid-market,” or “enterprise” are based on third-party reporting which may be inaccurate.

In addition, our estimates of number of total customers may be impacted by mergers or acquisitions of such customers or such customers purchasing our products via resellers.

If the internal systems and tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate.

If our key business metrics are not accurate representations of our business, if we discover material inaccuracies with respect to these figures, or if investors perceive there to be inaccuracies, our stock price could decline, we may be, and currently are, subject to stockholder litigation, our reputation may be significantly harmed, and our business, results of operations, and financial condition could be materially adversely affected.

We believe our long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability.

A significant part of our business strategy and culture is to focus on long-term growth and customer success over short-term financial results.

For example, in the year ended December 31, 2023, we increased our operating expenses to $663.2 million as compared to $635.6 million for the year ended December 31, 2022, while continuing to generate a net loss of $137.4 million in the year ended December 31, 2023.

We expect that we will continue to operate at a loss, and our profitability may be lower than it would be if our strategy were to maximize near-term profitability.

We recognize revenue over the term of our customer contracts.

Consequently, downturns or upturns in new sales may not be immediately reflected in our operating results and may be difficult to discern.

As a result, a portion of the revenue we report each quarter is derived from the recognition of deferred revenue relating to subscriptions entered into during previous quarters.

Consequently, a decline in new or renewed subscriptions with terms that are longer than one month in any single quarter may have a small impact on our revenue for that quarter.

However, such a decline will negatively affect our revenue in future quarters.

We may also be unable to reduce our operating expenses in a timely fashion if our revenues were to significantly decline.

In addition, because we believe a substantial percentage of subscriptions to our products are shorter than many comparable SaaS companies and because we have many variations of billing cycles, our remaining performance obligations may be a less meaningful indicator of our future financial results as compared to other SaaS companies.

A significant portion of our costs are expensed as incurred, while revenue is recognized over the life of the agreement with the applicable customer.

Our business depends substantially on our customers renewing their subscriptions and purchasing additional subscriptions from us.

Any decline in our customer retention would harm our future operating results.

Our business is subscription based, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

If customers do not

renew their subscriptions, renew on less favorable terms, or fail to add more users, or if we fail to upgrade trial customers to our paid subscription plans, or expand the adoption of our products within and across organizations, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations, and financial condition.

Failure to effectively develop and expand our direct sales capabilities would harm our ability to expand usage of our products within our customer base and achieve broader market acceptance of our products.

2 unchanged sentences

This expansion will require us to continue to invest significant financial and other resources to grow and train our direct sales force.

Our business, results of operations, and financial condition will be harmed if these efforts do not

Table o f Contents

generate a corresponding increase in revenue.

Our business, results of operations, and financial condition will be harmed if these efforts do not generate a corresponding increase in revenue.

We may not achieve anticipated revenue growth from expanding our direct sales force if we are unable to hire and develop talented direct sales personnel, if our new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if we are unable to retain our existing direct sales personnel.

11 unchanged sentences

Our success depends largely upon the continued services and performance of our senior management and other key personnel.

From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives and key employees, which could disrupt our business.

From time to time, there have been and may in the future be changes in our senior management team resulting from the hiring or departure of executives and key employees, which could disrupt our business.

Our senior management and key employees are employed on an at-will basis.

2 unchanged sentences

In addition, to execute our business model, we must attract and retain highly qualified personnel.

Competition for executive officers, software engineers, sales personnel, and other key personnel in our industry and in the San Francisco Bay Area, where our headquarters is located, in India where our engineering, product, and inside sales resources are concentrated, and in other locations where we maintain offices, is intense.

Competition for executive officers, software engineers and product managers (particularly with AI and machine learning backgrounds), sales personnel, and other key personnel in our industry and in the San Francisco Bay Area, where our headquarters is located, in India where our engineering, product, and inside sales resources are concentrated, and in other locations where we maintain offices, is intense.

As we become a more mature company, we may find our recruiting efforts more challenging.

9 unchanged sentences

Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel.

If our sites, networks, and systems, or those of third parties upon which we rely, are or were to experience security incidents or breaches affecting our confidential information or the confidential information of our users, customers, or other third parties, we could experience damage to our reputation and brand, and material harm to our business and results of operations.

Table o f Contents

We collect, receive, access, store, process, generate, use, transfer, disclose, share, make accessible, protect, secure, and dispose of (collectively, Process or Processing) a large amount of information from our users, customers, and our own employees, including personally identifiable and other sensitive and confidential information necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.

We rely on IT networks and systems (some of which are managed or operated by third-party service providers) to Process such data, and this data is often accessed through transmissions over public and private networks, including the internet.

These IT networks and systems, and the Processing they perform, may be susceptible to damage, disruptions, or shutdowns, software or hardware vulnerabilities, security incidents, ransomware attacks, social engineering attacks (including phishing), supply-chain attacks, failures during the process of upgrading or replacing software, databases, or components, power outages, fires, natural disasters, hardware failures, computer viruses (such as worms, spyware, or other malware), denial-of-service attacks, credential harvesting or stuffing, attacks by computer hackers, telecommunication failures, user errors (including non-employees who may have authorized access to our networks), user malfeasance, or catastrophic events.

We and our third-party service providers are also subject to system malfunctions, natural disasters, public health epidemics (such as the COVID-19 pandemic), war or military conflicts (such as the conflict between Russia and Ukraine), telecommunication and electrical failures.

While we have implemented security measures, technical controls, and contractual precautions designed to identify, detect, and prevent unauthorized Processing of our data, our security measures, as well as those of our third-party service providers, could fail or may be insufficient, resulting in the unauthorized access to or the disclosure, modification, misuse, unavailability, destruction, or loss of our or our customers’ data or other sensitive information.

Ransomware attacks in particular are becoming increasingly prevalent and severe.

To alleviate the potential financial, operational, and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).

Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and networks or the systems and networks of third parties that support us and our services.

Any such security breach, material disruption of, or damage to, our operational systems, physical facilities, or Processing activities, or the systems of our third-party partners, or the perception that one has occurred, could result in a loss of customer confidence in the security of our platform and damage to our brand, reduce the demand for our offerings, disrupt business operations, result in the exfiltration of proprietary data, including source code, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement and indemnity obligations, claims by our customers or other relevant parties that we have failed to comply with contractual obligations (e.g.

to implement specified security measures), and adversely affect our business, financial condition, and results of operations.

Despite our efforts to maintain the security, privacy, integrity, confidentiality, availability, and authenticity of our Processing, information, and IT networks and systems, we or our third-party vendors may not be able to anticipate or implement effective preventive and remedial measures against all data security and privacy threats.

If our information technology, systems, or those of third parties upon which we rely, or our data are or were to be compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.

In the ordinary course of business, we and the third parties upon which we rely collect, receive, access, store, process, generate, use, transfer, disclose, share, make accessible, protect, secure, and dispose of (collectively, Process or Processing) a large amount of information from our users, customers, and our own employees, including personal information and other sensitive and confidential information including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, and financial information (collectively, Sensitive Information).

As a result, we and the third parties upon which we rely face a variety of evolving threats that could cause security incidents.

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive data and information technology systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

We and the third parties upon which we rely are susceptible to a variety of evolving threats, including, but not limited to, damage, disruptions, or shutdowns, software or hardware vulnerabilities, security incidents, server malfunctions, software bugs, ransomware attacks, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), supply-chain attacks, failures during the process of upgrading or replacing software, databases, or components, power outages, fires, natural disasters, hardware failures, malicious code (such as viruses, worms, spyware), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential harvesting or stuffing, attacks by computer hackers, personnel misconduct or error, telecommunication failures, attacks enhanced or facilitated by AI, user errors (including non-employees who may have authorized access to our networks), user malfeasance, catastrophic events, or other similar threats.

Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major geopolitical conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services.

While we have implemented security measures, technical controls, and contractual precautions designed to identify, detect, and prevent unauthorized Processing of Sensitive Information, our security measures, as well as those of our third-party service providers, could fail or may be insufficient, resulting in the unauthorized access to or the disclosure, modification, misuse, unavailability, destruction, or loss of our or our customers’ data or other Sensitive Information.

Ransomware attacks in particular are becoming increasingly prevalent and severe, and can lead to significant interruptions in operations, loss of Sensitive Information and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments, for example, due to applicable laws or regulations prohibiting such payments.

Similarly, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions.

We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business.

Our ability to monitor these third parties’ information security practices is limited, and these

third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations.

Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

Despite our efforts to maintain the security, privacy, integrity, confidentiality, availability, and authenticity of our Processing, information, and IT networks and systems, we or our third-party vendors have not in the past and may not in the future be able to anticipate or implement effective preventive and remedial measures against all data security and privacy threats.

No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident.

For example, we and our third-party providers have been and may in the future be compromised by the aforementioned or similar threats, and result in unauthorized, unlawful, or accidental Processing of our information, or vulnerabilities in the products or systems upon which we rely.

For example, we and our third-party providers have been in the past and may in the future be compromised by threats like those described above, and result in unauthorized, unlawful, or accidental Processing of our information, or vulnerabilities in the products or systems upon which we rely.

The risk of unauthorized circumvention of our security measures or those of our third-party providers, customers, and partners has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques.

2 unchanged sentences

Third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, software, applications, systems, networks, Sensitive Information, and/or physical facilities utilized by our vendors.

If any of these breaches of security or other incidents should occur, we cannot guarantee that recovery protocols and backup systems will be sufficient to prevent data loss or ensure that we are able to recover promptly any data rendered inaccessible.

Additionally, if any of these breaches of security or other incidents occur, our reputation and brand could be damaged, our business may suffer, we could be required to expend significant capital and other resources to alleviate problems caused by such breaches or incidents, and we could be exposed to risk of loss, litigation, or regulatory action, and other potential liability.

Actual or perceived security breaches or attacks on our systems or those of our third-party service providers may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants and may require notification under applicable data privacy regulations or contractual obligations, or for customer relations or publicity purposes, which could result in additional reputational harm, costly litigation (including class action litigation), material contract breaches, liability, settlement costs, loss

Table o f Contents

of sales, regulatory scrutiny, actions or investigations, a loss of confidence in our business, systems and Processing, a diversion of management’s time and attention, and significant fines, penalties, assessments, fees, and expenses.

Additionally, although we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps designed to detect and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely).

We may not, however, detect and remediate all such vulnerabilities including on a timely basis.

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Vulnerabilities could be exploited and result in a security incident.

Following a breach of security or other incident, we cannot guarantee that recovery protocols and backup systems will be sufficient to prevent data loss or ensure that we are able to recover promptly any data rendered inaccessible.

Additionally, breaches of security or other incidents can damage our reputation and brand, cause our business to suffer, and could require us to expend significant capital and other resources to alleviate problems caused by such breaches or incidents, and we could be exposed to risk of loss, litigation, or regulatory action, and other potential liability.

Actual or perceived security breaches or attacks on our systems or those of our third-party service providers can cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants and may require notification under applicable data privacy regulations or contractual obligations, or for customer relations or publicity purposes, which could result in additional reputational harm, costly litigation (including class action litigation), material contract breaches, liability, settlement costs, loss of sales, regulatory scrutiny, actions or investigations, a loss of confidence in our business, systems and Processing, a diversion of management’s time and attention, and significant fines, penalties, assessments, fees, and expenses.

We continue to devote significant resources to protect against security breaches or other incidents, and we may need to devote significant resources in the future to address problems caused by breaches, including notifying affected customers and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

We continue to devote significant resources to protect against security breaches or other incidents, and we may need to devote significant resources in the future to address problems caused by breaches, including notifying affected individuals, regulators, investors, customers, or other relevant stakeholders of security incidents, and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

Actual or anticipated security breaches, including a breach of the systems or networks of our third-party providers, could compromise our systems or networks, creating system outages, disruptions or slowdowns and exploiting security vulnerabilities of our networks.

1 unchanged sentence

A breach of the security measures of one of our third-party providers could result in the destruction, modification or exfiltration of confidential corporate information or other data that may provide additional avenues of attack.

These breaches, such as the incident in April 2021 in which one of our third-party vendors, Codecov, discovered instances of unauthorized access to its software, whereby a threat actor was able to cause such software to be modified allowing for the export of information of Codecov customers stored in continuous integration environments, or any perceived breach, of our systems or networks or the systems or networks of our third-party providers, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in us or our industry and result in damage to our reputation, negative publicity, loss of users, partners and sales, increased remediation costs, and costly litigation or regulatory fines.

Breaches or perceived breaches of our systems or networks or the systems or networks of our third-party providers, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in us or our industry and result in damage to our reputation, negative publicity, loss of users, partners and sales, increased remediation costs, and costly litigation or regulatory fines.

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, and other harm to our business and our competitive position.

3 unchanged sentences

In addition, we cannot be sure that our existing insurance coverage, cyber coverage, and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss (including, for example, as a result of the payment of ransomware) or that our insurance premiums will not increase as a result of any claims.

Our risks are likely to increase as we continue to expand, grow our customer base, and Process increasingly large amounts of proprietary and sensitive data.

Our risks are likely to increase as we continue to expand, grow our customer base, and Process increasingly large amounts of Sensitive Information.

Additionally, policing unauthorized use of our know-how, technology and intellectual property is difficult and may not be effective.

5 unchanged sentences

Any unauthorized disclosure or use of our trade secrets or other confidential proprietary information could make it more expensive to do business, thereby harming our operating results.

In addition to experiencing a security incident, third parties may gather, collect, or infer Sensitive Information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Additionally, our Sensitive Information or our customers’ Sensitive Information could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies.

Some generative AI tools may be offered under terms that do not protect the confidentiality of the prompts or inputs that users submit to such tools, and even if the terms do include confidentiality protections, the vendors of these generative AI tools may fail to comply with their contractual obligations regarding the confidentiality or security of any data or other inputs provided to such vendor, or outputs generated by their generative AI tools.

Additionally, the providers of generative AI tools could use inputs to further train the third parties’ AI/ML model.

Not all providers offer an option to opt-out of such usage, and, even where we do opt-out, we cannot guarantee that the opt-out will be fully effective.

Additionally, where an AI/ML model ingests personal information and makes connections using such data, those technologies may reveal other personal or Sensitive Information generated by the model.

We do not have formal policies and procedures in place to review and track our employees’, personnel’ and vendors’ use of generative AI, and accordingly, these risks could be particularly difficult to eliminate or manage, and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition, and future prospects.

Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct.

This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”).

We may use AI/ML outputs to make certain decisions.

Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment,

and ability to obtain certain pricing, products, services, or benefits, including exposure to reputational and competitive harm, customer loss, and legal liability.

If we fail to manage our technical operations infrastructure, or experience service outages, interruptions, or delays in the deployment of our products, our results of operations may be harmed.

We may experience system slowdowns and interruptions from time to time.

We have in the past and may in the future experience system slowdowns and interruptions from time to time.

In addition, continued growth in our customer base could place additional demands on our products and could cause or exacerbate slowdowns or interrupt the availability of our products.

3 unchanged sentences

Some of our subscriptions include standard service-level commitments.

Table o f Contents

significantly affect our revenue in the periods in which the uptime or delivery failure occurs and the credits are applied.

If we are unable to meet the stated service-level commitments, including failing to meet the uptime and delivery requirements under our customer subscription agreements, we may be obligated to provide these customers with service credits which could significantly affect our revenue in the periods in which the uptime or delivery failure occurs and the credits are applied.

Additionally, we could also face subscription terminations, which could significantly affect both our current and future revenue.

3 unchanged sentences

We have a long-term commitment with AWS pursuant to a commercial agreement, and our products, mobile applications, and internal tools use computing, storage capabilities, bandwidth, and other services provided by AWS.

Our commercial agreement with AWS will remain in effect until terminated by AWS or us.

We may terminate the agreement for convenience by providing AWS prior written notice, and AWS may terminate the agreement for convenience by providing at least two years’ prior written notice.

Either party may terminate the agreement for cause upon a breach of the agreement, subject to such terminating party providing prior written notice and a 30-day cure period.

AWS may also terminate the agreement for cause (i) if our products pose certain security or liability risks, subject to AWS providing prior written notice and a 90-day cure period or (ii) in order to comply with applicable law or requirements of government entities, subject to AWS providing prior written notice and a 30-day cure period.

Any significant disruption of, limitation of our access to, or other interference with our use of AWS would negatively affect our operations and could seriously harm our business.

18 unchanged sentences

Third-party services and products are constantly evolving, and we may not be able to modify our products to assure their compatibility with that of all other third parties.

In addition, some of our competitors may be able to disrupt the operations or compatibility of our products with their products or services, or exert strong business influence on our ability to, and terms on

Table o f Contents

which we, operate our products.

Should any of our competitors modify their products or standards in a manner that degrades the functionality of our products or gives preferential treatment to competitive products or services, whether to enhance their competitive position or for any other reason, the interoperability of our products with these products could decrease.

15 unchanged sentences

Any reduction in the number of users directed to our website could reduce our revenue or require us to increase our sales and marketing expenditures.

We rely on third parties maintaining open digital marketplaces to distribute our mobile applications for our Freshdesk (Freshdesk Omnichannel Suite, Freshdesk Support Desk, Freshdesk Contact Center, Freshdesk Customer Success), Freshservice, Freshsales, Freshmarketer, Freshsales Suite, and Freshteam products.

We rely on third parties maintaining open digital marketplaces to distribute our mobile applications for our Freshdesk, Freshchat, Freshcaller, Freshservice, and Freshsales products.

If such third parties interfere with the distribution of our mobile applications, our business would be adversely affected.

We rely on third parties maintaining open digital marketplaces, including the Apple App Store and Google Play, which make our mobile applications for our Freshdesk (Freshdesk Omnichannel Suite, Freshdesk Support Desk, Freshdesk Contact Center, Freshdesk Customer Success), Freshservice, Freshsales, Freshmarketer, Freshsales Suite, and Freshteam products available for download.

We rely on third parties maintaining open digital marketplaces, including the Apple App Store and Google Play, which make our mobile applications for our Freshdesk, Freshchat, Freshcaller, Freshservice, and Freshsales, products available for download.

We cannot assure you that the marketplaces through which we distribute these mobile applications will maintain their current structures or that such marketplaces will not charge us fees to list our application for download.

1 unchanged sentence

In addition, Apple and Google, among others, for competitive or other reasons, could stop allowing or supporting access to our mobile applications through their products, could allow access for us only at an unsustainable cost, or could make changes to the terms of access in order to make our mobile applications less desirable or harder to access.

Furthermore, the promulgation of new laws or regulations in the European Union (EU) and the United Kingdom (UK), such as the EU Digital Markets Act (DMA), EU Digital Services Act (DSA), and the UK Online Safety Act (OSA) that restrict or otherwise unfavorably impact the marketplaces through which we distribute our products could require us to change certain aspects of our business and operations.

In addition, our products are enabled to allow our customers to use multiple communication methods with their consumers, including email, web widget, WhatsApp, SMS, and iMessage among others.

To comply with the DMA, third parties may increase the cost of or otherwise limit our ability to integrate our products with certain communication methods.

Real or perceived errors, failures, vulnerabilities, or bugs in our products would harm our business, results of operations, and financial condition.

4 unchanged sentences

Real or perceived errors, failures, vulnerabilities, or bugs in our products could result in an interruption in the availability of our products, negative publicity, unfavorable user experience, loss or leaking of personal information and data of organizations, loss of or delay in market acceptance of our products, loss of competitive position, regulatory fines, or claims by organizations for losses sustained by them, all of which would harm our business, results of operations, and financial condition.

Table o f Contents

If we experience excessive fraudulent activity, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly.

2 unchanged sentences

If we (or a third-party processing payment card transactions on our behalf) suffer a security breach affecting payment card information, we may have to pay significant fines, penalties, and assessments arising out of the major card brands’ rules and regulations, contractual indemnifications, or liability contained in merchant agreements and similar contracts, and we may lose our ability to accept payment cards for payment for our goods and services, which could materially impact our operations and financial performance.

If customers pay for their subscription plans with stolen credit cards, we could incur substantial third-party vendor costs for which we may not be reimbursed or be able to recover.

If customers pay for their subscription plans with stolen credit cards, we could incur substantial third-party vendor costs for which we may not be reimbursed or able to recover.

Further, our customers provide us with credit card billing information online, and we do not review the physical credit cards used in these transactions, which increases our risk of exposure to fraudulent activity.

7 unchanged sentences

The features and functionality we provide within our solutions enable our customers to promote customer self-service and otherwise efficiently and cost-effectively address product support requests without the need for substantial human interaction.

As a result of these features, customer agent staffing requirements may be minimized, and our revenue may be decreased.

As a result of these features, customer agent staffing requirements may be minimized, and our revenue may be adversely affected.

Conversely, customers may overestimate their agent needs when they initially use our solutions, negatively affecting our ability to accurately forecast the number of agents our customers need in forward periods.

3 unchanged sentences

If customers do not accept our new purchase plans, we may increasingly have difficulty in attracting new customers, as well as our ability to retain existing customers to the extent we apply new pricing models to existing customer subscriptions.

Our pricing model may impact our customer’s pricing decisions and adoption of our subscription plans and negatively impact our overall revenue.

Our pricing model may impact our customer’s pricing decisions and adoption of our subscription plans and negatively impact our

overall revenue.

In the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.

7 unchanged sentences

technological changes and developments within the markets we serve;

Table o f Contents

contraction, and rapid evolution of our market;

growth, contraction, and rapid evolution of our market;

and general economic conditions and trends.

If we are unable to continue to meet the demands of users and customers to keep up with trends in preferences for CX, ITSM, or CRM products, or to achieve more widespread market acceptance of our products, our business, results of operations, and financial condition would be harmed.

In addition, some current and potential customers, particularly larger organizations, may develop or acquire their own tools or continue to rely on traditional tools and software for their CX, ITSM, or CRM needs, which would reduce or eliminate their demand for our products.

If we are unable to continue to meet the demands of users and customers to keep up with trends in preferences for CS, ITSM, or CRM products, or to achieve more widespread market acceptance of our products, our business, results of operations, and financial condition would be harmed.

In addition, some current and potential customers, particularly larger organizations, may develop or acquire their own tools or continue to rely on traditional tools and software for their CS, ITSM, or CRM needs, which would reduce or eliminate their demand for our products.

If demand for our products declines for any of these or other reasons, our business, results of operations, and financial condition would be adversely affected.

Sales efforts to large customers involve risks that may not be present or that are present to a lesser extent with respect to sales to smaller organizations.

Sales to large customers involve risks that may not be present or that are present to a lesser extent with sales to smaller organizations, such as longer sales cycles, more complex customer requirements, substantial upfront sales costs, and less predictability in completing some of our sales.

For example, large customers may require considerable time to evaluate and test our products prior to making a purchase decision.

Our typical sales cycle for mid-market and enterprise customers is approximately 90 days, as compared to 30 days for SMB customers.

If we fail to effectively manage these risks associated with sales cycles and sales to large customers, our business, financial condition, and results of operations may be affected.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to expand our base of customers may be impaired, and our business and results of operations will be harmed.

13 unchanged sentences

Any failure to provide such support could harm our reputation.

We are subject to stringent and evolving US and foreign laws, regulations, industry standards, policies, rules, contractual obligations, and other obligations related to data privacy and security.

Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions;

litigation (including class action claims) and mass arbitration demands;

fines and penalties;

disruptions of our business operations;

reputational harm;

loss of revenue or profits;

and other adverse business consequences.

As a regular part of our business, we Process Sensitive Information belonging to our users, customers, suppliers, partners, consultants, leads and employees.

Our Processing of such information subjects us to numerous federal, state, local, and foreign laws, orders, codes, regulations, and regulatory guidance regarding privacy, data protection, information security, and the Processing of personal information (collectively, Data Protection Laws), the number and scope of which are changing, subject to differing applications and interpretations, and may be inconsistent among countries, or conflict with other rules, laws, or Data Protection Obligations (defined below).

We are also subject to the terms of our internal and external privacy and security policies, representations, certifications, industry standards, publications, frameworks, contractual requirements, and other obligations to third parties related to privacy, data protection, and information security (collectively, Data Protection Obligations).

The requirements or obligations of the regulatory framework for privacy, information security, data protection, and data Processing worldwide is, and is likely to remain, uncertain for the foreseeable future and any significant change in Data Protection Laws or Data Protection Obligations could increase our costs and could require us to modify our products or operations, possibly in a material manner, and may limit our ability to develop new services and features that make use of the data that our users and customers voluntarily share, or may limit our ability to store and Process customer data and operate our business.

In the United States, federal, state, and local governments have enacted numerous Data Protection Laws, including data breach notification laws, personal information privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Additionally, in the past few years, numerous U.S.

states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information.

As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments.

These state laws allow for statutory fines for noncompliance.

For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, CCPA) applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights, such as those noted below.

The CCPA provides for administrative fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

These new developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Additionally, under various Data Protection Laws and other obligations, we may be required to obtain certain consents to Process personal information.

For example, some of our Processing practices, including certain of our products or services, may be challenged under wiretapping laws if we obtain consumer information from, or share consumer information with, third parties through various methods including chatbots or third-party marketing pixels.

These practices may be subject to increased challenges by class action plaintiffs.

Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Outside the United States, an increasing number of Data Protection Laws and Data Protection Obligations may govern privacy, data protection, and information security.

For example, the EU General Data Protection Regulation (EU GDPR), the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR), Australia’s Privacy Act, and India’s new privacy legislation, the Digital Personal Data Protection Act (DPDP), impost strict requirements for Processing personal information.

For example, under the EU GDPR, we may be subject to fines of up to €20 million or 4% of the total worldwide annual group turnover of the preceding financial year (whichever is higher) and up to the greater of £17.5m or 4% of annual global revenues in respect of the UK GDPR.

In addition to the foregoing, violations of the EU GDPR or UK GDPR could result in regulatory investigations, reputational damage, orders to cease/change our Processing of our data, enforcement notices, assessment notices (for a compulsory audit), and/or other corrective action, such as class action brought by classes of data subjects or by consumer protection organizations authorized at law to represent their interests.

In addition, we may be unable to transfer personal information from the EU, UK, and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows.

The EU and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries.

In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws it generally believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EU-U.S.

Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who, like us, self-certify compliance and participate in the Framework), the EEA and UK’s standard contractual clauses, and the UK’s International Data Transfer Agreement / Addendum, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to

the United States.

If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business to Processing activities to other jurisdictions (such as Europe) at significant expense, and increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our Processing or transferring of personal information necessary to operate our business.

Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information out of Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations.

We publish privacy policies, marketing materials, and other statements, regarding privacy, data protection, and information security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

In India, the Digital Personal Data Protection Act, 2023 (Data Protection Act) deals with processing of all personal information in digital form, whether collected digitally or offline and digitalized later for processing.

The Data Protection Act requires companies collecting and dealing with high volumes of personal information and who are notified as significant data fiduciaries, to fulfil certain additional obligations such as appointment of a data protection officer for grievance redressal and an independent data auditor to evaluate compliance with the Data Protection Act.

It also provides for the establishment of a Data Protection Board of India for taking remedial actions and imposing penalties for breach of the provisions of the Data Protection Act.

It imposes restrictions and obligations on data fiduciaries, resulting from dealing with personal information and further, provides for levy of penalties for breach of obligations prescribed under the Data Protection Act.

The provisions of the Data Protection Act shall come into force upon being notified by the Government of India.

Our employees and personnel may use generative artificial intelligence technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations.

Governments have passed and are likely to pass additional laws regulating generative AI.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

We use AI, including generative AI, and ML technologies in our products and services.

The development and use of AI/ML present various privacy and security risks that may impact our business.

AI/ML are subject to Data Protection Laws, as well as increasing regulation and scrutiny.

Several jurisdictions around the globe, including the EU and certain US states, have proposed or enacted laws governing AI/ML.

For example, European regulators have proposed a stringent AI regulation, which will take direct effect across all EU member states if adopted, and we expect other jurisdictions will adopt similar laws.

Additionally, certain Data Protection Laws extend rights to consumers (such as the right to delete certain personal information) and regulate automated decision making, which may be incompatible with our use of AI/ML.

These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML.

For example, the Federal Trade Commission has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws.

Any failure or perceived failure by us to comply with applicable Data Protection Laws or any of our Data Protection Obligations may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us.

If we are unable to develop and offer products or internal processes that meet legal requirements or help our users and customers meet their obligations under the Data Protection Laws, or if we violate or are perceived to violate any Data Protection Laws, we may cause our customers to lose trust in us and experience reduced demand for our products, harm to our reputation, and become subject to investigations, claims, and other remedies, which would expose us to significant fines, penalties, and other damages, all of which would harm our business.

Given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.

Further, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our products and services.

We strive to comply with Data Protection Laws and Data Protection Obligations to the extent possible, but we may at times fail, or may be perceived to have failed, to do so.

Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, partners, or vendors do not comply with applicable Data Protection Laws and Data Protection Obligations.

A finding that our privacy policies are, in whole or part, inaccurate, incomplete, deceptive, unfair, or

misrepresentative of our actual practices, a failure or perceived failure by us to comply with Data Protection Laws or Data Protection Obligations or any data compromise that results in the unauthorized release or transfer of business or personal information or other user or customer data, may increase our compliance and operational costs, limit our ability to market our products or services and attract new and retain current customers, limit or eliminate our ability to Process data, and result in domestic or foreign governmental enforcement actions and fines, litigation, significant costs, expenses, and fees (including attorney fees), cause a material adverse impact to business operations or financial results, and otherwise result in other material harm to our business.

In addition, any such failure or perceived failure could result in public statements against us by consumer advocacy groups, the media or others, which may cause us material reputational harm.

Our actual or perceived failure to comply with Data Protection Laws and Data Protection Obligations could also subject us to litigation, claims (including class-action claims and mass arbitration demands), proceedings, actions, or investigations by governmental entities, authorities, or regulators that could require changes to our business practices, diversion of resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing, or other remedies that adversely affect our business.

We face exposure to foreign currency exchange rate fluctuations.

3 unchanged sentences

Fluctuations in the value of foreign currencies relative to the U.S.

dollar, have in the past and may in the future continue to adversely affect our revenue, operating expenses and results of operations due to transactional and translational remeasurement

Table o f Contents

that is reflected in our earnings.

dollar, have in the past and may in the future continue to adversely affect our revenue, operating expenses and results of operations due to transactional and translational remeasurement that is reflected in our earnings.

Specifically, our results of operations and cash flows are subject to currency fluctuations primarily in the Indian Rupee, British Pound and Euro against the U.S.

2 unchanged sentences

dollar could make it more difficult to detect underlying trends in our business and results of operations.

Additionally, global events as well as geopolitical developments, including Russia’s recent invasion of Ukraine, fluctuating commodity prices, trade tariff developments and inflation have caused, and may in the future cause, global economic uncertainty and uncertainty about the interest rate environment, which could amplify the volatility of currency fluctuations.

Beginning in January 2023, we entered into foreign exchange forward contracts to hedge a portion of our forecasted foreign currency expenses denominated in Indian Rupee.

Additionally, global events as well as geopolitical developments, such as the conflict between Russia and Ukraine and the evolving events in Israel and Gaza, fluctuating commodity prices, trade tariff developments and inflation have caused, and may in the future cause, global economic uncertainty and uncertainty about the interest rate environment, which could amplify the volatility of currency fluctuations.

In 2023, we entered into foreign exchange forward contracts to hedge a portion of our forecasted foreign currency expenses denominated in Indian Rupee.

Our hedging program is designed to reduce, but does not eliminate, the risk that our earnings and cash flows may be adversely affected by changes in exchange rates.

We may enter into other hedging transactions in the future if our exposure to foreign currency becomes more significant.

We Process business and personal information of our customers, suppliers, partners, consultants, leads and employees worldwide, which subjects us to stringent and changing laws, regulations, industry standards, information security policies, self-regulatory schemes, contractual obligations, and other legal obligations related to data Processing, protection, privacy, and security, and our actual or perceived failure to comply with such obligations could harm our business, financial condition, results of operations, and prospects and could expose us to liability.

As a regular part of our business, we Process business and personal information belonging to our users, customers, suppliers, partners, consultants, leads and employees.

Our handling of such information is subject to numerous federal, state, local, and foreign laws, orders, codes, regulations, and regulatory guidance regarding privacy, data protection, information security, and the Processing of personal information (collectively, Data Protection Laws), the number and scope of which are changing, subject to differing applications and interpretations, and may be inconsistent among countries, or conflict with other rules, laws, or Data Protection Obligations (defined below).

We expect that there will continue to be new Data Protection Laws, and we cannot yet determine the impact such future Data Protection Laws may have on our business.

We are also subject to the terms of our internal and external privacy and security policies, codes, representations, certifications, industry standards, publications, and frameworks and obligations to third parties related to privacy, data protection, and information security (collectively, Data Protection Obligations).

In the United States, Data Protection Laws are also becoming increasingly common at both the federal and state level and a range of enforcement agencies exist that can enforce these laws and regulations.

These laws and regulations may apply to our activities, including, for example, state data breach notification laws, state personal data information privacy laws, other similar laws (e.g., wiretapping laws), and federal and state consumer protection laws.

For example, California enacted the California Consumer Privacy Act of 2018 (CCPA), which affords consumers expanded privacy protections as of January 1, 2020.

Additionally, although not effective until January 1, 2023, the California Privacy Rights Act (CPRA), will expand the CCPA’s requirements, including applying to personal information of business representatives and employees and establishing a new regulatory agency to implement and enforce the law.

The potential effects of this legislation are far reaching and may require us to modify our data Processing practices and policies and to incur substantial costs and expenses in an effort to comply.

For example, the CCPA, as amended by the CPRA, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA and CPRA also provide for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation.

In addition, the CCPA has prompted a number of proposals for new federal and state privacy legislation that, if passed, could increase our potential liability, increase our compliance costs, and adversely affect our business.

Similar laws have been proposed or enacted in other states and at the federal level.

For example, Virginia enacted the Consumer Data Protection Act effective January 1, 2023, Colorado recently passed the Colorado Privacy Rights Act, effective July 1, 2023, Connecticut passed the Connecticut Data Privacy Act, effective July 1, 2023, and Utah recently passed the Utah Consumer Privacy Act, effective December 31, 2023.

Compliance with any newly enacted privacy and data security laws or regulations may be challenging and cost and time-intensive, and we may be required to put in place additional mechanisms to comply with applicable legal requirements.

Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination, and security practices that appear to be unfair or deceptive.

There are a number of legislative proposals in the United States, at both the federal and state level, and in

Table o f Contents

the European Union (EU) and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties.

We cannot yet determine the impact that future laws, regulations, and standards may have on our business.

Additionally, under various Data Protection Laws and other obligations, we may be required to obtain certain consents to process personal data and our inability or failure to do so could result in adverse consequences, including litigation.

For example, we make use of, and include in our offerings to customers, certain chat bot technologies.

Although we have not faced any litigation related to the use of such technologies, they have been the subject of increasing litigation in which plaintiffs allege wiretapping violations associated with the use of these technologies.

Data Protection Laws in Europe also have laws and regulations which apply more broadly to the collection, use, storage, disclosure, security, transfer, and other Processing of various types of data, including data that identifies or may be used to identify an individual.

For example, we are subject to the EU General Data Protection Regulation (EU GDPR), the EU GDPR as it forms part of United Kingdom (UK) law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR), and other EU member state implementing legislation includes stringent operational requirements for the use of personal data.

Under the EU GDPR we may be subject to fines of up to €20 million or up to 4% of the total worldwide annual group turnover of the preceding financial year (whichever is higher) for major violations and up to the greater of £17.5m or up to 4% of annual global revenues in respect of the UK GDPR.

In addition to the foregoing, a breach of the EU GDPR or UK GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our Processing of our data, enforcement notices, assessment notices (for a compulsory audit), and/or other corrective action, such as class action brought by classes of data subjects or by consumer protection organizations authorized at law to represent their interests.

We cannot be certain how EU regulators will interpret or enforce many aspects of the EU GDPR or UK GDPR, and some regulators may do so in an inconsistent manner, making such a prediction even more difficult.

EU member states may introduce further conditions and safeguards, which could limit our ability to Process European data, or could cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition.

European Data Protection Laws, including the EU GDPR and UK GDPR, also generally prohibit the transfer of personal data from Europe, including the European Economic Area (EEA), the UK, and Switzerland, to the United States and most other countries unless the parties to the transfer have established a legal basis for the transfer and implemented specific safeguards to protect the transferred personal data.

Other jurisdictions may adopt similarly stringent interpretations of their cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EU and UK to the United States, such as standard contractual clauses and related addendums, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

If there is no lawful manner for us to transfer personal data from the EU, UK, or other jurisdictions to the United States, we could face significant consequences, including restricting our operations or relocating part of or all of our business to other jurisdictions and increased exposure to regulatory actions, substantial fines, and injunctions against Processing or transferring personal data.

Some European regulators have prevented companies from transferring personal data out of Europe.

In addition to Europe, a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and Processing of data or similar requirements that could increase the cost and complexity of delivering our products, particularly as we further expand our operations internationally.

Some of these laws, such as the General Data Protection Law in Brazil or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR.

Others, such as those in Russia and China, would potentially impose more stringent obligations, including data localization requirements.

Should such a framework be adopted, our ability to Process business and personal information belonging to our users and customers may be further restricted.

Change in existing legislation or introduction of new legislation may require us to incur additional expenditures to ensure compliance with such legislation, which may adversely affect our financial condition.

We strive to comply with Data Protection Laws and Data Protection Obligations to the extent possible, but we may at times fail, or may be perceived to have failed, to do

Table o f Contents

A finding that our privacy policies are, in whole or part, inaccurate, incomplete, deceptive, unfair, or misrepresentative of our actual practices, a failure or perceived failure by us to comply with Data Protection Laws or Data Protection Obligations or any data compromise that results in the unauthorized release or transfer of business or personal information or other user or customer data, may increase our compliance and operational costs, limit our ability to market our products or services and attract new and retain current customers, limit or eliminate our ability to Process data, and result in domestic or foreign governmental enforcement actions and fines, litigation, significant costs, expenses, and fees (including attorney fees), cause a material adverse impact to business operations or financial results, and otherwise result in other material harm to our business.

In addition, any such failure or perceived failure could result in public statements against us by consumer advocacy groups, the media or others, which may cause us material reputational harm.

Our actual or perceived failure to comply with Data Protection Laws and Data Protection Obligations could also subject us to litigation, claims, proceedings, actions, or investigations by governmental entities, authorities, or regulators that could require changes to our business practices, diversion of resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing, or other remedies that adversely affect our business.

Risks Related to Our Operations in India

6 unchanged sentences

We may not be able to react to such changes promptly or in a cost-effective manner and therefore such changes may increase the cost of providing services to our customers, which would have an adverse effect on our operations and our financial condition and results of operations.

In order to contain the spread of the COVID-19 pandemic, the Government of India implemented a variety of restrictive measures in 2020 and 2021, including nationwide and regional lockdowns, curfews and travel restrictions.

These restrictive measures led to us having a large number of our employees work remotely, which has resulted in a loss in productivity for our Indian employees.

There is no assurance that employee productivity will improve or that we will be able to comply with any future measures on a timely and cost-effective basis.

Any uncertainties regarding the imposition of new restrictive measures related to the COVID-19 pandemic could adversely affect business and economic conditions in India generally and our business and prospects.

We are subject to various labor laws, regulations, and standards in India.

1 unchanged sentence

By virtue of having a significant number of employees in India, we are required to comply with various labor and industrial laws in India, which change regularly.

If we are unable to comply with such regulations on a timely basis, we may be subjected to sanctions, fines, or other regulatory actions.

If we are unable to comply with such regulations on a timely basis, we may be subjected

to sanctions, fines, or other regulatory actions.

We cannot assure you that our costs of complying with current and future labor laws and other regulations will not adversely affect our business, results of operations, or financial condition.

4 unchanged sentences

Unless we are able to continue to increase the efficiency and productivity of our employees over the long term, wage increases may negatively affect our financial performance.

Table o f Contents

For instance, in September 2020, the Government of India passed new legislation relating to social security and wages called the Code for Social Security, 2020 (the Social Security Code).

The provisions of the Social Security Code are yet to be fully effective, as the rules issued under the Social Security Code have not yet been notified.

For instance, in September 2020, the Government of India passed new legislation relating to social security and wages called the Code on Social Security, 2020 (the Social Security Code).

The provisions of the Social Security Code are yet to be fully effective, and the rules under the Social Security Code have not yet been notified.

Through its notifications, the Government of India has brought into force certain sections of the Social Security Code including in relation to the Employees’ Pension Scheme, 1995 and use of Aadhar number for establishment of identity of an employee or an unorganized worker for certain purposes under the Social Security Code.

The remaining provisions of the Social Security Code will be brought into force on a date to be notified by the Government of India.

The Social Security Code will impact overall employee expenses which, in turn, could impact our profitability.

2 unchanged sentences

As a consequence, the Social Security Code could increase the financial burden on the employer and could impact profitability.

Further, the Government of India has notified three other labor codes, namely, the Code on Wages 2019, Industrial Relations Code 2020, and Occupational Safety, Health & Working Condition Code 2020, which are yet to fully come into force, as the rules for these Acts have not yet been published and the effective date from which these changes are applicable is yet to be notified.

Further, the Government of India has notified three other labor codes, namely, the Code on Wages 2019, the Industrial Relations Code 2020, and the Occupational Safety, Health and Working Conditions Code 2020, which are yet to fully come into force, and the rules for these codes have not yet been published.

Further, through its notifications the Government of India has brought in force certain sections of the Code on Wages 2019 in relation to the constitution and functioning of the central advisory board and repeal of certain sections of the Minimum Wages Act, 1948, as amended.

The remaining provisions will be brought into force on a date to be notified by the Government of India.

Further, the Industrial Relations Code 2020 and the Occupational Safety, Health and Working Conditions Code 2020 will come into effect on a date to be notified by the Government of India.

Accordingly, while we are unable to ascertain with certainty the impact, financial or otherwise, due to these changes, it is possible that our wage costs in India may increase as a result of these changes when they become effective.

5 unchanged sentences

However, the Government of India has made and may continue to make revisions to the FEMA and the FDI Policy as regards e-commerce in India, including in relation to inventory, pricing, discounting, and permitted services.

The Department of Promotion of Industry and Internal Trade, Ministry of Commerce and Industry, Government of India is also in the process of legislating a national e-commerce policy, which will address e-commerce regulation and data protection.

The Department of Promotion of Industry and Internal Trade, Ministry of Commerce and Industry, Government of India is also in the process of legislating a national e-commerce

policy, which will address e-commerce regulation and data protection.

The timing or impact of this policy, which remains in draft form, is not yet certain.

8 unchanged sentences

The final determination of our tax liability involves the interpretation of local tax laws and related regulations in each jurisdiction, as well as the significant use of estimates and assumptions regarding the scope of future operations and results achieved and the timing and nature of income earned and expenditures incurred.

Table o f Contents

and Indian transfer-pricing regulations require that any international transaction involving associated enterprises be at an arm’s-length price.

2 unchanged sentences

If the income tax authorities review any of our tax returns and determine that the transfer price applied was not appropriate, we may incur increased tax liabilities, including accrued interest and penalties.

In mitigating the risk of transfer pricing arrangements, we have filed for an Advance Pricing Arrangement with the India Revenue authorities providing certainty of the arm’s-length pricing methodology for future years.

If the stockholders (being non-residents under Indian tax laws) of the foreign company exit by way of redemption of the shares held by them in the foreign company or by selling the shares in foreign company, the stockholders could be taxed in India where the foreign company derives substantial value from India subject to stockholders being either entitled to small stockholder exemption available under Income Tax Act, 1961 or a benefit under the applicable double taxation avoidance agreement.

6 unchanged sentences

We are continually under review by the Indian tax authorities and have not received any assessments to date that would have a material impact to our financial statements.

Our ability to receive dividends and other payouts from our Indian subsidiaries is subject to Indian legal restrictions and withholding tax.

Whether our Indian subsidiaries will pay us dividends in the future and the amount of any such dividends, if declared, will depend on a number of factors, including future earnings, financial condition and performance, cash flows, working capital requirements, capital expenditures and other factors considered relevant by us and the boards of our Indian subsidiaries.

We may decide to retain a substantial portion or all of our earnings in our Indian subsidiaries to finance the development and expansion of our business and, therefore, may not declare dividends.

In the event dividends are declared, the Income Tax Act, 1961 (as amended by Finance Act, 2022) requires that any dividends paid by an Indian company be subject to tax in the hands of the stockholders at applicable rates, such taxes will be withheld by the Indian subsidiary paying dividends.

Risks Related to Intellectual Property

We may become subject to intellectual property rights claims and other litigation that are expensive to support, and if resolved adversely, could have a material adverse effect on us.

We have in the past, and may in the future, become subject to intellectual property or other disputes.

Our success depends, in part, on our ability to develop and commercialize our offerings without infringing, misappropriating or otherwise violating the intellectual property rights of third parties.

However, we may not be aware that our offerings are infringing, misappropriating, or otherwise violating third-party intellectual property rights.

From time to time, our competitors or other third parties have claimed, and may in the future claim, that we are infringing upon, misappropriating, or violating their intellectual property rights, even if we are unaware of the intellectual property rights that such parties may claim cover our products or some or all of the other technologies we use in our business.

As the number of patents, copyrights and other intellectual property rights in our industry increases, and as the coverage of these rights increases, we believe that companies in our industry will face more frequent infringement claims.

Table o f Contents

processes we have enacted will prevent employees from acting without our knowledge in contravention of such policies.

As we face increasing competition and our public profile increases, the possibility of intellectual property rights claims against us may also increase.

The costs of supporting such litigation, regardless of merit, are considerable, and such litigation may divert management and key personnel’s attention and resources, which might seriously harm our business, results of operations, and financial condition.

We may be required to settle such litigation on terms that are unfavorable to us.

For example, a settlement may require us to obtain a license to continue practices found to be in violation of a third party’s rights, which may not be available on reasonable terms and may significantly increase our operating expenses.

A license to continue such practices may not be available to us at all.

As a result, we may also be required to develop alternative non-infringing technology or practices or discontinue the practices.

The development of alternative non-infringing technology or practices would require significant effort and expense.

Similarly, if any litigation to which we may be a party fails to settle and we go to trial, we may be subject to an unfavorable judgment which may not be reversible upon appeal.

For example, the terms of a judgment may require us to cease some or all of our operations or require the payment of substantial amounts to the other party.

Any of these events would cause our business and results of operations to be materially and adversely affected as a result.

Moreover, insurance might not cover such claims or disputes, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us.

A claim or dispute brought against us that is uninsured or underinsured could result in unanticipated costs and could have a material adverse effect on our business, results of operations, and financial condition.

We are also frequently required to indemnify our channel partners and customers in the event of any third-party infringement claims against our customers and third parties who offer our products, and such indemnification obligations may be excluded from contractual limitation of liability provisions that limit our exposure.

These claims may require us to initiate or defend protracted and costly litigation on behalf of our customers and channel partners, regardless of the merits of these claims.

If any of these claims succeed, we may be forced to pay damages on behalf of our customers and channel partners, may be required to modify one or more products to make it non-infringing, or may be required to obtain licenses for the products used.

If we cannot obtain all necessary licenses on commercially reasonable terms, our customers may be forced to stop using one or more products, and our channel partners may be forced to stop selling one or more of our products.

If we are unable to protect our intellectual property rights both in the United States and abroad, the value of our brand and other intangible assets may be diminished, and our business may be adversely affected.

We rely and expect to continue to rely on a combination of trademark, copyright, patent, and trade secret protection laws to protect our intellectual property rights and proprietary information both in the United States and abroad.

The intellectual property laws and protections offered in countries outside of the United States may not protect proprietary rights to the same extent as laws in the United States.

Therefore, our efforts to protect our intellectual property may not be adequate and competitors may independently develop similar technology or duplicate our products or services and compete with us in this and other geographies where enforcement of intellectual property rights is less clear than in the United States.

While we maintain a policy requiring our employees, consultants, independent contractors, and third parties who are engaged to develop any material intellectual property for us to enter into confidentiality and invention assignment agreements to control access to and use of our proprietary information and to ensure that any intellectual property developed by such employees, contractors, consultants, and other third parties are assigned to us, we cannot guarantee that the confidentiality and proprietary agreements or other employee, consultant, or independent contractor agreements we enter into adequately protect our intellectual property rights and other proprietary information.

In addition, we cannot guarantee that these agreements will not be breached, that we will have adequate remedies for any breach, or that the applicable counter-parties to such agreements will not assert rights to our intellectual property rights or other proprietary information arising out of these relationships.

Furthermore, the steps we have taken and may take in the future may not prevent misappropriation of our proprietary solutions or technologies, particularly with respect to employees who are no longer employed by us.

Furthermore, third parties may knowingly or unknowingly infringe or circumvent our intellectual property rights, and we may not be able to prevent infringement without incurring substantial expense.

Litigation brought to protect and enforce our intellectual property rights would be costly, time-consuming, and distracting to management and key personnel, and could result in the impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights.

If the protection of our intellectual property rights is inadequate to prevent use or misappropriation by third parties, the value of our brand and other intangible assets may be diminished and competitors may be able to more effectively mimic our products and methods of operations.

Any of these events would have a material adverse effect on our business, results of operations, and financial condition.

Table o f Contents

Our failure to obtain or maintain the right to use certain of our intellectual property would negatively affect our business.

Our future success and competitive position depend in part upon our ability to obtain or maintain certain intellectual property used in our products.

While we have been issued patents for certain aspects of our intellectual property in the United States and have additional patent applications pending in the United States, we have not applied for patent protection in foreign jurisdictions, and may be unable to obtain patent protection for the technology covered in our patent applications.

In addition, we cannot ensure that any of the patent applications will be approved or that the claims allowed on any issued patents will be sufficiently broad to protect our technology or products and provide us with competitive advantages.

Furthermore, any issued patents may be challenged, invalidated, or circumvented by third parties.

Many patent applications in the United States may not be public for a period of time after they are filed, and since publication of discoveries in the scientific or patent literature tends to lag behind actual discoveries by several months, we cannot be certain that we will be the first creator of inventions covered by any patent application we make or that we will be the first to file patent applications on such inventions.

Because some patent applications may not be public for a period of time, there is also a risk that we could adopt a technology without knowledge of a pending patent application, which technology would infringe a third-party patent once that patent is issued.

We also rely on unpatented proprietary technology.

It is possible that others will independently develop the same or similar technology or otherwise obtain access to our unpatented technology.

To protect our trade secrets and other proprietary information, we require employees, consultants, and independent contractors to enter into confidentiality agreements.

We cannot assure you that these agreements will provide meaningful protection for our trade secrets, know-how, or other proprietary information in the event of any unauthorized use, misappropriation, or disclosure of such trade secrets, know-how, or other proprietary information.

If we are unable to maintain the proprietary nature of our technologies, our business would be materially adversely affected.

We rely on our trademarks, trade names, and brand names to distinguish our solutions from the products of our competitors, and have registered or applied to register many of these trademarks in the United States and certain countries outside the United States.

However, occasionally third parties may have already registered identical or similar marks for products or solutions that also address the software market.

As we rely in part on brand names and trademark protection to enforce our intellectual property rights, efforts by third parties to limit use of our brand names or trademarks and barriers to the registration of brand names and trademarks in various countries may restrict our ability to promote and maintain a cohesive brand throughout our key markets.

There can also be no assurance that pending or future U.S.

or foreign trademark applications will be approved in a timely manner or at all, or that such registrations will effectively protect our brand names and trademarks.

Third parties may also oppose our trademark applications, or otherwise challenge our use of the trademarks.

In the event that our trademarks are successfully challenged, we could be forced to rebrand our products, which would result in loss of brand recognition and would require us to devote resources to advertising and marketing new brands.

Our use of “open source” and third-party software could impose unanticipated conditions or restrictions on our ability to commercialize our products and could subject us to possible litigation.

A portion of the technologies we use in our products and mobile applications incorporates “open source” software, and we may incorporate open source software in our products and mobile applications in the future.

From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and their compliance with the terms of the applicable open source license.

We may be subject to suits by parties claiming ownership of what we believe to be open source software or claiming non-compliance with the applicable open source licensing terms.

Some open source licenses require end-users who distribute or make available across a network software and services that include open source software to make available all or part of such software, which in some circumstances could include valuable proprietary code, at no cost, or license such code under the terms of the particular open source license.

While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable proprietary source code, we may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract.

Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose source code that incorporates or is a modification of such licensed software.

Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such license types.

Table o f Contents

could be subject to significant damages, enjoined from the sale of our products that contained the open source software, and required to comply with the foregoing conditions, including public release of certain portions of our proprietary source code.

In addition, the use of third-party open source software typically exposes us to greater risks than the use of third-party commercial software because open-source licensors generally do not provide warranties or controls on the functionality or origin of the software.

Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our products.

Any of the foregoing could be harmful to our business, results of operations, and financial condition.

We rely on software licensed from third parties to offer our products.

In addition, we may need to obtain future licenses from third parties to use intellectual property rights associated with the development of our products, which might not be available on acceptable terms, or at all.

Any loss of the right to use any third-party software required for the development and maintenance of our products or mobile applications could result in loss of functionality or availability of our products or mobile applications until equivalent technology is either developed by us, or, if available, is identified, obtained, and integrated.

Any errors or defects in third-party software could result in errors or a failure of our products or mobile applications.

Any of the foregoing would disrupt the distribution and sale of subscriptions to our products and harm our business, results of operations, and financial condition.

Our ability to receive dividends and other payouts from our Indian subsidiary is subject to Indian legal restrictions and withholding tax.

Whether our Indian subsidiary will pay us dividends in the future and the amount of any such dividends, if declared, will depend on a number of factors, including future earnings, financial condition and performance, cash flows, working capital requirements, capital expenditures and other factors considered relevant by us and the board of our Indian subsidiary.

We may decide to retain a substantial portion or all of our earnings in our Indian subsidiary to finance the development and expansion of our business and, therefore, may not declare dividends.

In the event dividends are declared, the Income Tax Act, 1961, as amended, requires that any dividends paid by an Indian company be subject to tax in the hands of the stockholders at applicable rates, such taxes will be withheld by the Indian subsidiary paying dividends.

Risks Related to International Operations

20 unchanged sentences

• the cost of and potential outcomes of any claims or litigation;

Table o f Contents

• future accounting pronouncements and changes in accounting policies;

1 unchanged sentence

• public health or similar issues, such as a pandemics or epidemics;

• regional and local economic and political conditions, including military actions affecting Russia, Ukraine and/or surrounding regions.

• regional and local economic and political conditions, including the evolving events in Russia, Ukraine, Israel, Gaza, and/or surrounding regions.

As we continue to expand our business globally, our success will depend, in large part, on our ability to anticipate and effectively manage these risks.

4 unchanged sentences

South Asia has from time to time experienced instances of civil unrest, terrorist attacks and hostilities among neighboring countries.

To the extent that such unrest affects or involve India, our business may be significantly impacted due to the extent of our operations in India.

To the extent that such unrest affects or involves India, our business may be significantly impacted due to the extent of our operations in India.

Further, such activities could disrupt communications, make travel more difficult, and create a greater perception that investments in companies with large operations in India involve a higher degree of risk.

2 unchanged sentences

Such restrictions include blocking sanctions on some of the largest state-owned and private Russian financial institutions, and their removal from the Society for Worldwide Interbank Financial Telecommunication (SWIFT) payment system.

The invasion of Ukraine and the retaliatory measures that have been taken, and could be taken in future, by the United States, NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business, including preventing us from performing existing contracts, pursuing new business opportunities, or receiving payments for services already provided to customers.

The Russia-Ukraine conflict and the measures that have been taken, and could be taken in future, by the United States, NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business, including preventing us from performing existing contracts, pursuing new business opportunities, or receiving payments for services already provided to customers.

We are subject to anti-corruption, anti-bribery, and similar laws, and our failure to comply with these laws could subject us to criminal penalties or significant fines and harm our business and reputation.

12 unchanged sentences

Customs regulations, and economic and trade sanctions regulations maintained by the U.S.

Department of the Treasury’s Office of Foreign Assets Control, which we refer to collectively as Trade Controls.

Department of the Treasury’s Office of Foreign Assets Control, (collectively, Trade Controls).

Trade Controls may prohibit or restrict the sale or supply of certain products and services to certain governments, persons, entities, countries, and territories, including those that are the target of comprehensive sanctions.

We incorporate encryption technology into certain of our products, which may subject their export outside of the United States to certain export authorization requirements, including licensing, compliance with license exceptions, or other appropriate government authorization.

In addition, various other countries regulate the import and export of certain encryption and other technology, including through

Table o f Contents

import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit the ability of organizations to use our products in those countries.

In addition, various other countries regulate the import and export of certain encryption and other technology, including through import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit the ability of organizations to use our products in those countries.

Although we maintain internal controls reasonably designed to ensure compliance with Trade Controls, our products and services may have in the past been, and could in the future be, provided inadvertently in violation of Trade Controls, despite the precautions we take.

20 unchanged sentences

This could in turn have an adverse effect on our operations and the value of our Class A common stock.

Risks Related to Intellectual Property

We may become subject to intellectual property rights claims and other litigation that are expensive to support, and if resolved adversely, could have a material adverse effect on us.

We have in the past, and may in the future, become subject to intellectual property or other disputes.

Our success depends, in part, on our ability to develop and commercialize our offerings without infringing, misappropriating or otherwise violating the intellectual property rights of third parties.

However, we may not be aware that our offerings are infringing, misappropriating, or otherwise violating third-party intellectual property rights.

In addition, while we maintain a policy prohibiting our employees from using the confidential information of third parties or former employers (without their express permission) in performing their work for us, we cannot guarantee that the policies or processes we have enacted will prevent employees from acting without our knowledge in contravention of such policies.