6 unchanged sentences
We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on over 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military.
−Removed: Our CISO reports to our Chief Technology and AI Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.
+Added: Our CISO oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, Business Continuity, Crisis Management, Business Technology, and Identity Security.
Our cybersecurity program is designed to align with certain industry standards and best practices, such as ISO 27001 and the National Institute of Standards and Technology Cybersecurity Framework.
1 unchanged sentence
Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.
−Removed: Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third-party consultants.
+Added: Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity program health, and activities of third-party consultants.
Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.
We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems.
−Removed: We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the criticality of such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.
−Removed: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address identified gaps in existing safeguards.
+Added: We conduct periodic assessments to identify reasonably foreseeable internal and external cybersecurity risks, the criticality of such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.
+Added: We develop risk-informed strategies, policies, standards, and action plans to minimize identified risks and reasonably address identified gaps in existing safeguards.
These safeguards include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data.
1 unchanged sentence
As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.
−Removed: We periodically engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.
+Added: We periodically engage consultants in connection with our risk management processes to help us design and implement our cybersecurity policies, procedures, and controls, as well as to monitor and test our safeguards.
We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.
The maturation and scaling of our cybersecurity program is ongoing and despite our investments in our cybersecurity program, there will always be residual risk and the potential for control failure or bypass by a determined cyber threat actor.
−Removed: Our principal executive office is located in Oakland, California, where we currently have a lease agreement that expires in 2026.
−Removed: We also lease additional facilities in London, United Kingdom and Warsaw, Poland.
−Removed: We believe that our facilities are suitable to meet our current needs.
+Added: Our principal executive office is located in Oakland, California, under a lease agreement expiring in 2028.
+Added: We also lease additional facilities in London, United Kingdom, Warsaw, Poland, Sliema, Malta, and Queensway, Gibraltar.
+Added: We believe that our existing facilities are suitable to support our current and near-term operational needs.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.