4 unchanged sentences
We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security.
−Removed: We have developed comprehensive cybersecurity and data privacy programs across our employee groups and systems, building a culture of cybersecurity and data privacy awareness throughout the organization.
−Removed: In 2024, we achieved both SOC2 Type 1 and TX-Ramp certifications, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA).
−Removed: Our process to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms.
−Removed: On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party services.
+Added: We have implemented comprehensive cybersecurity and data privacy programs, fostering a culture of awareness across all employee groups and systems.
+Added: In 2025, we achieved SOC2 Type 2 certification, reflecting our commitment to supporting our clients by aligning our controls and processes with the System
+Added: and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA).
+Added: This achievement builds on our previous SOC2 Type 1 certification and complements our ongoing TX Ramp compliance.
+Added: Our proces s to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms.
+Added: On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party ser vices.
We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms.
−Removed: Our marketplace services are protected by multiple layers of security, employing a "defense in depth"
−Removed: approach to asset protection that is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals.
−Removed: This same organization provides proactive notification and consultation on emerging threats and potential mitigation.
−Removed: In addition, we undertake integrated planning activities to support business continuity and operational resiliency.
+Added: Our marketplace services are protected by multiple layers of security including firewalls, endpoint protection, WAF and Bot mitigation.
+Added: Our "defense in depth" approach to asset protection is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals.
+Added: We maintain a formal incident response plan, which is regularly tested and updated to ensure prompt detection, reporting, and mitigation of cybersecurity incidents.
+Added: In addition, we undertake integrated planni ng activities to support business continuity and operational resiliency.
We assess our program's effectiveness through various exercises, including active Disaster Recovery production environment tests, tabletop exercises, continuous vulnerability tests, and annual penetration testing.
6 unchanged sentences
Board and Committee Oversight .
−Removed: Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources.
+Added: Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk ide ntifica tion, mitigation strategy and efforts, and resources and receives quarterly updates on cybersecurity risks and mitigation efforts from management, including our Chief Technology Officer (CTO).
The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules.
−Removed: We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employ dedicated resources to protect our systems.
+Added: We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employs dedicated resources to protect our systems.
Management's Role .
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.