What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-03-04 compared with 2020-03-06 · 451 added, 410 removed, 434 unchanged (66% of the section changed)

2 unchanged sentences

In such an event, the market price of our Class A common stock could decline and you could lose all or part of your investment.

Risks Related to Our Business

Risk Factor Summary

This risk factor summary contains a high-level summary of risks associated with our business.

It does not contain all of the information that may be important to you, and you should read this risk factor summary together with the more detailed discussion of risks and uncertainties set forth following this summary.

A summary of our risks includes, but is not limited to, the following:

• The effects of the COVID-19 pandemic have affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

• Adverse general economic and market conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.

• We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.

• Our recent growth rates may not be indicative of our future growth.

As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.

• We have a history of losses, and we expect to incur losses for the foreseeable future.

• If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

• We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

• If we are unable to attract new customers, sell additional products to our existing customers or develop new products and enhancements to our products that achieve market acceptance, our revenue growth and profitability will be harmed.

• Our business depends on our customers renewing their subscriptions and purchasing additional licenses or subscriptions from us.

Any material decline in our Dollar-Based Net Retention Rate would harm our future results of operations.

• Customer growth could fall below expectations.

• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

• An application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.

• Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.

• There are risks related to our proposed acquisition of Auth0, including our ability to complete the acquisition in a timely manner, successfully integrate Auth0 and realize potential benefits from the acquisition.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 48% of the voting power of our capital stock as of January 31, 2021.

This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

• Servicing our debt may require a significant amount of cash.

We may not have sufficient cash flow from our business to pay our indebtedness.

Risks Related to Our Business and Industry

The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

In December 2019, a novel coronavirus (COVID-19) was reported in China, in January 2020, the World Health Organization (WHO) declared it a Public Health Emergency of International Concern and in March 2020, the WHO declared it a pandemic.

This contagious disease outbreak has continued to spread across the globe and is impacting worldwide economic activity and financial markets, resulting in an economic downturn that became a global recession.

The extent of the impact of COVID-19 on our future operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, the effectiveness, distribution and acceptance of COVID-19 vaccines, including the vaccines’ efficacy against emerging COVID-19 variants, related public health measures, and their impact on the global economy, our customers, employees and vendors.

In the absence of mass distribution and acceptance of effective COVID-19 vaccines, we expect to see continued fluctuations in business openings and closures as communities respond to local outbreaks.

This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.

As a result of the COVID-19 pandemic, we have temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions.

We shifted our annual user conference, Oktane20 Live, held in the spring of 2020, to a virtual-only conference and in the near-term we have changed our customer, employee and industry events, including Oktane21 Live, to virtual-only formats.

The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.

It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.

Our operations have also begun to be negatively affected by a range of external factors related to the COVID-19 pandemic that are not within our control.

For example, many cities, counties, states and countries have imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19.

If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus, and emerging variants, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.

Adverse general economic and market conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.

Our revenue, results of operations and cash flows depend on the overall demand for our products.

Concerns about the COVID-19 pandemic, the systemic impact of a related widespread recession (in the United States or internationally), energy costs, geopolitical issues or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.

These economic conditions can occur abruptly.

Prolonged economic slowdowns may result in customers requesting us to renegotiate existing contracts on less advantageous terms to us than those currently in place or defaulting on payments due on existing contracts or not renewing at the end of the contract term.

Our customers may merge with other entities who use alternative identity solutions and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection, either of which may harm our revenue, profitability and results of operations.

We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign

bankruptcy laws may be more difficult to predict.

In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim.

As a result, if economic growth in countries where we do business slows or if such countries experience further economic recession, it could harm our business, revenue, results of operations and cash flows.

We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.

Much of our growth has occurred in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.

7 unchanged sentences

In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all.

We believe our revenue growth depends on a number of factors, including, but not limited to, our ability to:

We believe our revenue growth depends on a number of factors, such as macroeconomic conditions and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:

• price our platform effectively so that we are able to attract and retain customers without compromising our profitability;

• attract new customers, successfully deploy and implement our platform, upsell or otherwise increase our existing customers’ use of our platform, obtain customer renewals and provide our customers with excellent customer support;

increase our network of channel partners, which include resellers, system integrators and other distribution partners and ISVs;

• increase our network of channel partners, which include resellers, system integrators and other distribution partners and independent software vendors (ISVs);

• adequately expand our sales force, and maintain or increase our sales force’s productivity;

5 unchanged sentences

If we are unable to accomplish any of these tasks, our revenue growth will be harmed.

We also expect our operating expenses to increase in future periods, and if our revenue growth does not increase to offset these anticipated

increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

We also expect our operating expenses to increase in future periods, and if our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

We have a history of losses, and we expect to incur losses for the foreseeable future.

12 unchanged sentences

For example, our headcount has grown from 2,248 employees as of January 31, 2020 to 2,806 employees as of January 31, 2021.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our Software-as-a-Service, or SaaS, infrastructure supports.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports.

Finally, our organizational structure is becoming more complex as we improve our operational, financial and management controls as well as our reporting systems and procedures.

1 unchanged sentence

If we fail to manage our anticipated growth and change in a manner that preserves the key aspects of our corporate culture, the quality of our platform may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.

We have established international offices, including offices in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada and Australia, and we may continue to expand our international operations into other countries in the future.

We have established international offices, including offices in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to continue to expand our international operations into other countries in the future.

Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, marketing and sales, administrative, financial and other resources.

35 unchanged sentences

The success of any enhancement to our products depends on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with existing technologies and our platform and overall market acceptance.

If we are unable to successfully develop new products,

enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.

If we are unable to successfully develop

new products, enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.

Further, to grow our business, we must convince developers to adopt and build their applications using our APIs and products.

7 unchanged sentences

In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates.

Our dollar-based net retention rate declined from 120% as of January 31, 2019 to 119% as of January 31, 2020 and our customer retention and expansion may decline further or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.

If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

Furthermore, if our contractual license terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue.

Furthermore, if our contractual subscription terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue.

If our sales of new or recurring subscriptions and software-related support service contracts decline from existing customers, our revenue and revenue growth may decline, and our business will suffer.

4 unchanged sentences

If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

Our continued growth depends, in part, on the ability of our existing and potential customers to access our platform 24 hours a day, seven days a week, without interruption or degradation of performance.

We may experience disruptions, data loss, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, capacity constraints, denial-of-service attacks or other security-related incidents.

In some instances, we may not be able to identify the cause or causes of these performance problems immediately or in short order.

We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our products become more complex and our user traffic increases.

For example, in October 2016, a distributed denial-of-service attack against Dyn, a domain name service vendor we use (since acquired by Oracle), prevented many of our customers and their users in the United States from accessing our platform or applications authenticated by our platform and resulted in our failing to meet certain contracted uptime levels under our service level agreements and the issuance of service credits to some of our customers, although the dollar value of such credits were not material.

If our platform is unavailable or if our customers are unable to access our products or deploy them within a reasonable amount of time, or at all, our business would be harmed.

Since our customers rely on our service to access and complete their work, any outage on our platform would impair the ability of our customers to perform their work, which would negatively

impact our brand, reputation and customer satisfaction.

Moreover, we depend on services from various third parties to maintain our infrastructure and distribute our products via the Internet.

If a service provider fails to provide sufficient capacity to support our platform or otherwise experiences service outages, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platform's reliability and our revenues.

Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our products.

In the future, these services may not be available to us on commercially reasonable terms, or at all.

Any loss of the right to use any of these services could result in decreased functionality of our products until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure.

If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls.

We may also be unable to effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology.

Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise harm our business, results of operations and financial condition.

An application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their systems and networks on an ongoing basis.

In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS or other cloud services), internal networks, our customers’ systems and the information that they store and process.

Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks.

As a well-known provider of identity and security solutions, we pose an attractive target for such attacks.

The security measures we have integrated into our internal systems and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks and platform against certain attacks.

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and personal data.

If a breach of customer data on our platform were to occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data or systems was disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Because techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures.

Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.

In addition, security breaches impacting our platform could result in a risk of loss or unauthorized disclosure of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.

Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations.

Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses.

Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems,

could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.

While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents, and any incidents may result in loss of, or increased costs of, our cybersecurity insurance.

These breaches, or any perceived breach, of our systems, our customers’ systems, or other systems or networks secured by our products, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.

In addition, a breach of the security measures of one of our key ISVs or other channel partners could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack, and if a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.

Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.

Third parties may attempt to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lock outs, and, ultimately, harm to our future business prospects and revenue.

We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

2 unchanged sentences

• our ability to attract new customers, obtain renewals from existing customers and upsell or otherwise increase our existing customers’ use of our platform;

health epidemics, such as the coronavirus outbreak stemming from China (COVID-19), influenza and other highly communicable diseases or viruses;

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;

pricing pressure as a result of competition or otherwise;

• pricing pressure as a result of competition, COVID-19 or otherwise;

• seasonal buying patterns for IT spending;

17 unchanged sentences

Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform.

We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features do not ensure their compliance and may not be effective against all potential privacy concerns.

Many jurisdictions have enacted or are considering enacting or revising privacy and/or data security legislation, including laws and regulations applying to the collection, use, storage, transfer, disclosure and/or processing of personal data.

The costs of compliance with, and other burdens imposed by, such laws and regulations that are applicable to the operations of our customers may limit the use and adoption of our service and reduce overall demand for it.

These privacy and data security related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data.

Although we are working to comply with those federal, state, and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.

In addition, some of our customers rely on our authorization under the Federal Risk and Authorization Management Program, or FedRAMP, to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance .

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, in June 2018 California enacted the California Consumer Privacy Act (CCPA) which took effect on January

1, 2020 and broadly defines personal information, gave California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

In addition to government activity, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on us.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, contractual obligations and other obligations may require us to incur additional costs and restrict our business operations.

Such laws and regulations may require companies to implement privacy and security policies, permit users to access, correct and delete personal data stored or maintained by such companies, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.

If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations our ability to successfully operate our business and pursue our business goals could be harmed.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, or any actual or suspected security incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable laws, regulations, policies, industry standards, contractual obligations or other legal obligations could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Since many of our service’s features involve the processing of personal data from our customers and their employees, contractors, customers, partners and others, any inability to adequately address privacy concerns, even if such concerns are unfounded, or to comply with applicable privacy or data security laws, regulations and policies, could result in liability to us and our business, damage to our reputation and inhibition of sales.

Around the world, there are numerous lawsuits in process against various technology companies that process personal data.

If those lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business.

Furthermore, the costs of compliance with, and other burdens imposed by laws, regulations and policies concerning privacy and data security that are applicable to the businesses of our customers may limit the use and adoption of our platform and reduce overall demand for it.

Privacy concerns, whether or not valid, may inhibit market adoption of our platform.

Additionally, concerns about security or privacy may result in the adoption of new legislation that restricts the implementation of technologies like ours or requires us to make modifications to our platform, which could significantly limit the adoption and deployment of our technologies or result in significant expense to modify our platform.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers.

Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive or misrepresentative of our practices.

Evolving and changing definitions of what constitutes “Personal Information” and “Personal Data” within the European Union, the United States and elsewhere, especially relating to classification of IP addresses, machine or device identification numbers, location data and other information, may limit or inhibit our ability to operate or expand our business, including limiting technology alliance partners that may involve the sharing of data.

In addition, rapidly-evolving privacy laws and frameworks distinguish between a data processor and data controller (or under the CCPA, whether a business is a ‘service provider’), and different risks and requirements may apply to us, depending on the nature of our data processing activities.

If our business model expands and changes over time, different sets of risks and requirements may apply to us, requiring us to re-orient the business accordingly .

If our platform is perceived to cause, or is otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability.

Existing and potential privacy laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, products and services such as ours.

Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

If enough end users

choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform.

This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions.

If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform.

This is particularly true as we further expand and diversify our capabilities.

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

If we elect not to or are unable to develop products internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations.

Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that could allocate greater resources to our competitors’ research and development programs.

Our failure to maintain adequate research and development resources or to compete effectively with the research and

development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities.

For example, we have entered into the proposed acquisition of Auth0.

If that transaction closes, our stockholders will incur substantial dilution.

For further risks related to the proposed acquisition of Auth0, please see below under “Risks Related to the Acquisition of Auth0.” The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act), or effectively manage the combined business following the acquisition.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment, which could harm our results of operations.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

• delays or reductions in customer purchases for both us and the acquired business;

• disruption of partner and customer relationships;

• potential loss of key employees of the acquired company;

• claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

• unknown liabilities or risks associated with the acquired business, product or technology, such as contractual obligations, potential security vulnerabilities of the acquired company and its products and services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

• acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

• acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

• they could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• unforeseen integration or other expenses;

• future impairment of goodwill or other acquired intangible assets.

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

If we fail to adapt to rapid technological change, our ability to remain competitive could be impaired.

5 unchanged sentences

Any delay or failure in the introduction of new or enhanced products could harm our business, results of operations and financial condition.

The recent global coronavirus outbreak could harm our business and results of operations.

In December 2019, a coronavirus (COVID-19) was reported in China, and, in January 2020, the World Health Organization declared it a Public Health Emergency of International Concern.

This contagious disease outbreak, which has continued to spread to additional countries, and any related adverse public health developments, could adversely affect workforces, customers, economies and financial markets globally, potentially leading to an economic downturn.

This could decrease technology spending, adversely affect demand for our solutions and harm our business and results of operations.

Our financial results may fluctuate due to increasing variability in our sales cycles.

1 unchanged sentence

These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers.

As we continue to focus on sales to larger organizations, we expect our sales cycles to lengthen and become less predictable, which may harm our financial results.

Factors that may influence the length and variability of our sales cycle include, among other things:

As we continue to focus on sales to larger organizations and in light of the current COVID-19 environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.

Other factors that may influence the length and variability of our sales cycle include, among other things:

• the need to raise awareness about the uses and benefits of our platform, including our customer identity products;

6 unchanged sentences

If we are unable to close one or more of such expected significant transactions in a particular period, or if such an expected transaction is delayed until a subsequent period, our results of operations for that period, and for any future periods in which revenue from such transaction would otherwise have been recognized, may be harmed.

We provide service level commitments under our customer contracts.

If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, or face contract termination with refunds of prepaid amounts related to unused subscriptions, which could harm our business, results of operations and financial condition.

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platform.

Any failure of or disruption to our infrastructure could make our platform unavailable to our customers.

If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platform, we may be contractually obligated to provide affected customers with service credits for

future subscriptions, or customers could elect to terminate and receive refunds for prepaid amounts related to unused subscriptions.

For example, in October 2016, a distributed denial-of-service attack against Dyn, a domain name service vendor we use (since acquired by Oracle), prevented many of our customers and their users in the United States from accessing our platform or applications authenticated by our platform and resulted in our failing to meet certain contracted uptime levels under our service level commitments and the issuance of service credits to some of our customers.

Our revenue, other results of operations and financial condition could be harmed if we suffer unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

Our growth depends, in part, on the success of our strategic relationships with third parties.

6 unchanged sentences

Even if we are successful, we cannot ensure that these relationships will result in increased customer usage of our applications or increased revenue.

Because we generally recognize revenue from our subscriptions and support services over the term of the relevant service period, a decrease in sales during a reporting period may not be immediately reflected in our results of operations for that period.

We generally recognize revenue from subscriptions and related support services revenue ratably over the relevant service period.

Net new revenue from new subscriptions, upsells and renewals entered into during a period can generally be expected to generate revenue for the duration of the service period.

As a result, most of the revenue we report in each period is derived from the recognition of deferred revenue relating to subscriptions and support services contracts entered into during previous periods.

Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period.

In addition, our ability to adjust our cost structure in the event of a decrease in new or renewed subscriptions may be limited.

Further, a decline in new subscriptions or renewals in a given period may not be fully reflected in our revenue for that period, but will negatively affect our revenue in future periods.

Accordingly, the effect of significant downturns in sales and market acceptance of our services, and changes in our rate of renewals, may not be fully reflected in our results of operations until future periods.

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers is generally recognized over the applicable service period.

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under Accounting Standards Update (ASU) No.

2014-09, Revenue from Contracts with Customers (Topic 606) , or ASC 606, will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

Our revenue, results of operations and cash flows depend on the overall demand for our products.

Concerns about the systemic impact of a potential widespread recession (in the United States or internationally), energy costs, geopolitical issues or the availability and cost of credit could lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.

These economic conditions can occur abruptly.

We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict.

In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our products will depend to a significant extent on our ability to expand our marketing and sales operations.

We plan to continue expanding our direct sales force and engaging additional channel partners, both domestically and internationally.

This expansion will require us to invest significant financial and other resources.

Our business will be harmed if our

efforts do not generate a corresponding increase in revenue.

We may not achieve anticipated revenue growth from expanding our direct sales force if we are unable to hire and develop talented direct sales personnel, if our new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing direct sales personnel.

We also may not achieve anticipated revenue growth from our channel partners if we are unable to attract and retain additional motivated channel partners, if any existing or future channel partners fail to successfully market, resell, implement or support our products for their customers, or if they represent multiple providers and devote greater resources to market, resell, implement and support the products and solutions of these other providers.

For example, some of our channel partners also sell or provide integration and administration services for our competitors’ products, and if such channel partners devote greater resources to marketing, reselling and supporting competing products, this could harm our business, results of operations and financial condition.

Various factors may cause our product implementations to be delayed, inefficient or otherwise unsuccessful.

Our business depends upon the successful implementation of our products by our customers.

Increasingly, we, as well as our customers, rely on our network of partners to deliver implementation services, and there may not be enough qualified implementation partners available to meet customer demand.

Various factors may cause implementations to be delayed, inefficient or otherwise unsuccessful.

For example, changes in the functional requirements of our customers, delays in timeline, or deviation from recommended best practices may occur during the course of an implementation project.

As a result of these and other risks, we or our customers may incur significant implementation costs in connection with the purchase, implementation and enablement of our products.

Some customer implementations may take longer than planned or fail to meet our customers’ expectations, which may delay our ability to sell additional products or result in customers canceling or failing to renew their subscriptions before our products have been fully implemented.

Unsuccessful, lengthy or costly customer implementation and integration projects could result in claims from customers, harm to our reputation and opportunities for competitors to displace our products, each of which could have an adverse effect on our business and results of operations.

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our sales are to partners that resell our services to government agencies, and we have made, and may continue to make, investments to support future sales opportunities in the government sector.

Government demand for our products could be impacted by budgetary cycles, and there may be governmental certification requirements for our products.

Further, we may be subject to audits and investigations regarding our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including termination of the contract, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale.

Government entities often require contract terms that differ from our standard arrangements and impose compliance requirements that are complicated, increased attention to pricing practices, termination rights tied to funding availability, or are otherwise time consuming and expensive to satisfy.

Government entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

If we represent that we meet special standards or requirements and do not meet them, we could be subject to increased liability from our customers, investigation by regulators or termination rights.

Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.

Moreover, changes in the underlying regulatory conditions that affect these types of customers could harm our ability to efficiently provide our service to them and to grow or maintain our customer base.

Any of these risks related to contracting with government entities could adversely impact our future sales and results of operations, or make them more difficult to predict .

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers.

Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.

Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices.

In the past, our efforts to build our brand have involved significant expenses.

Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand.

If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could suffer.

We may not set optimal prices for our products.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product.

We expect that we may need to change our pricing in future periods and potentially in response to COVID-19 pricing pressures.

Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally.

In addition, if our mix of products sold changes, then we may need to, or choose to, revise our pricing.

As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations and financial condition.

Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to expand our international operations.

In each of fiscal 2020 and 2021, our international revenue was 16% of our total revenue.

Any international expansion efforts that we may undertake may not be successful.

In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States.

These risks include, among other things:

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• macroeconomic conditions and the economic impact of the COVID-19 pandemic;

• unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;

• lack of familiarity and burdens of complying with foreign laws, legal standards, privacy standards, regulatory requirements, tariffs and other barriers;

• laws and business practices favoring local competitors or commercial parties;

• costs and liabilities related to compliance with the EU General Data Protection Regulation 2016/679 and disparate data privacy standards and enforcement;

• greater risk that our foreign employees or partners will fail to comply with U.S.

and foreign laws;

• practical difficulties of enforcing intellectual property rights in countries with fluctuating laws and standards and reduced or varied protection for intellectual property rights in some countries;

• restrictive governmental actions focusing on cross-border trade, including taxes, trade laws, tariffs, import and export restrictions or quotas, barriers, sanctions, custom duties or other trade restrictions;

• unexpected changes in legal and regulatory requirements;

• difficulties in managing systems integrators and technology partners;

• differing technology standards;

• longer accounts receivable payment cycles and difficulties in collecting accounts receivable;

• difficulties in managing and staffing international operations and differing employer/employee relationships and local employment laws;

• political, economic and social instability, war, armed conflict or terrorist activities;

• global economic uncertainty caused by global political events, including the United Kingdom's exit from the European Union, and similar geopolitical developments;

• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;

• potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems and restrictions on the repatriation of earnings.

Additionally, operating in international markets also requires significant management attention and financial resources.

We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability.

We have not engaged in currency hedging activities to limit risk of exchange rate fluctuations.

Changes in exchange rates affect our costs and earnings, and may also affect the book value of our assets located outside the United States and the amount of our stockholders’ equity.

We have limited experience in marketing, selling and supporting our platform abroad.

Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful.

If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.

Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all.

If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.

If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

• develop and enhance our products;

• continue to expand our product development, sales and marketing organizations;

• hire, train and retain employees;

• respond to competitive pressures or unanticipated working capital requirements;

• pursue acquisition opportunities.

Our inability to do any of the foregoing could reduce our ability to compete successfully and harm our business, results of operations and financial condition.

We may be subject to liability claims if we breach our contracts and our insurance may be inadequate to cover our losses.

We are subject to numerous obligations in our contracts with our customers and partners.

Despite the procedures, systems and internal controls we have implemented to comply with our contracts, we may breach these commitments, whether through a weakness in these procedures, systems and internal controls, negligence or the willful act of an employee or contractor.

Our insurance policies, including our errors and omissions insurance, may be inadequate to compensate us for the potentially significant losses that may result from claims arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters or otherwise.

In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all.

Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

We may experience disruptions, data loss, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure and functionality changes, human or software errors, capacity constraints or security-related incidents.

In some instances, we may not be able to identify the cause or causes of these performance problems immediately or in short order.

If our platform is unavailable or if our customers are unable to access our products or deploy them within a reasonable amount of time, or at all, our business would be harmed.

Since our customers rely on our service to access and complete their work, any outage on our platform would impair the ability of our customers to perform their work, which would negatively impact our brand, reputation and customer satisfaction.

Moreover, we depend on services from various third parties to maintain our infrastructure and distribute our products via the internet.

Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our products.

In the future, these services may not be available to us on commercially reasonable terms, or at all.

If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls.

Increasingly, companies are subject to a wide variety of attacks on their systems and networks on an ongoing basis.

and the information that they store and process.

Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks.

As a well-known provider of identity and security solutions, we pose an attractive target for such attacks.

Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations.

Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses.

Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.

Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.

Third parties may attempt to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lock outs and, ultimately, harm to our future business prospects and revenue.

We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform.

These privacy and data security related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data.

Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.

In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, the California Consumer Privacy Act (CCPA) took effect on January 1, 2020, which broadly defines personal information and gives California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

In addition, on November 3, 2020, California voters passed the California Privacy Rights Act (CPRA) into law.

The CPRA will take substantial effect on January 1, 2023 with enforcement scheduled for July 1, 2023 and will significantly modify the CCPA and create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Some observers have noted the CCPA and CPRA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.

Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform.

This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.

We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S.

data transfers.

We are subject to the EU General Data Protection Regulation 2016/679 (GDPR) that took effect on May 25, 2018, and, as a result of the United Kingdom’s exit from the European Union, as of January 1, 2021, the UK General Data Protection Regulation and Data Protection Act 2018 (UK Data Protection Laws).

The GDPR and UK Data Protection Laws have enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher.

The UK Data Protection Laws mirror the fines under the GDPR.

Given the breadth and depth of changes in data protection obligations, complying with its requirements has caused us to expend significant resources and such expenditures are likely to continue into the near future as we respond to new interpretations and enforcement actions following the effective date of the regulation and as we continue to negotiate data processing agreements with our customers and business partners.

Separate EU laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving.

A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties.

We cannot yet determine the impact that such future laws, regulations and standards may have on our business.

Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.

We may incur substantial expense in complying with any new obligations and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

In addition, the GDPR restricts transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the United States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (SCCs) approved by the European Commission and, until July 16, 2020, the Privacy Shield for EU-U.S.

data transfers.

On July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-U.S.

Privacy Shield Framework (Privacy Shield) under which personal data could be transferred from the EEA to U.S.

entities who had self-certified under the Privacy Shield scheme.

While the CJEU upheld the adequacy of the SCCs (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances.

Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain.

The CJEU went on to state that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer.

There are few viable alternatives to the SCCs, and the law in this area remains dynamic.

These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

These regulations may deter customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from

the EU are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.

Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

We may find it necessary to establish systems to maintain EU personal data within in the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates.

We function as a business associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a business associate for the purposes of HIPAA.

The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them.

These agreements impose stringent data security obligations on us.

If we are unable to comply with our obligations as a HIPAA business associate or under the terms of the business associate agreements we have executed, we could face substantial civil and even criminal liability as well as contractual liability under the applicable business associate agreement, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain new customers.

Modifying the already stringent penalty structure that was present under HIPAA prior to HITECH, HITECH created four new tiers of civil monetary penalties and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions.

In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

In addition, the U.S.

Department of Health & Human Services recently proposed additional draft HIPAA guidance which is subject to public comment before being finalized.

We will continue to monitor whether the final guidance may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

We provide service level commitments under our customer contracts.

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platform.

Any failure of or disruption to our infrastructure could make our platform unavailable to our customers.

If we are unable to ensure that our products integrate or interoperate with a variety of operating systems and software applications that are developed by others, our platform may become less competitive and our results of operations may be harmed.

10 unchanged sentences

Without the development of these applications and integrations, both current and potential customers may not find our service sufficiently attractive, and our business, results of operations and financial condition could suffer.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our products will depend to a significant extent on our ability to expand our marketing and sales operations.

We plan to continue expanding our direct sales force and engaging additional channel partners, both domestically and internationally.

This expansion will require us to invest significant financial and other resources.

Our business will be harmed if our efforts do not generate a corresponding increase in revenue.

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform.

This is particularly true as we further expand and diversify our capabilities.

Maintaining adequate research

and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Interruptions or delays in the services provided by third-party data centers or internet service providers could impair the delivery of our platform and our business could suffer.

31 unchanged sentences

These delays and feature limitations, if they occur, could harm our business, results of operations and financial condition.

Various factors may cause our products implementations to be delayed, inefficient or otherwise unsuccessful.

Our business depends upon the successful implementation of our products by our customers.

Various factors may cause implementations to be delayed, inefficient or otherwise unsuccessful.

For example, changes in the functional requirements of our customers, delays in timeline, or deviation from recommended best practices may occur during the course of an implementation project.

As a result of these and other risks, we or our customers may incur significant implementation costs in connection with the purchase, implementation and enablement of our products.

Unsuccessful, lengthy, or costly customer implementation and integration projects could result in claims from customers, harm to our reputation, and opportunities for competitors to displace our products, each of which could have an adverse effect on our business and results of operations.

Real or perceived errors, failures, vulnerabilities or bugs in our products, including deployment complexity, could harm our business and results of operations.

4 unchanged sentences

Real or perceived errors, failures, vulnerabilities or bugs in our products, or delays in or difficulties implementing our product releases, could result in negative publicity, loss of customer data, loss of or delay in market acceptance of our products, a decrease in customer satisfaction or adoption rates, loss of competitive position, or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002, or effectively manage the combined business following the acquisition.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

Acquisitions could also result in dilutive issuances of equity securities,

use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment, which could harm our results of operations.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

delays or reductions in customer purchases for both us and the acquired business;

disruption of partner and customer relationships;

potential loss of key employees of the acquired company;

claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

unknown liabilities or risks associated with the acquired business, product or technology, such as contractual obligations, potential security vulnerabilities of the acquired company and its products and services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

they could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

unforeseen integration or other expenses;

future impairment of goodwill or other acquired intangible assets.

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our sales are to governmental agencies, and we have made, and may continue to make, investments to support future sales opportunities in the government sector.

Government demand for our products could be impacted by budgetary cycles, and there may be governmental certification requirements for our products.

Further, we may be subject to audits and investigations regarding our governmental contracts, and any violations could result in penalties and sanctions, including termination of the contract, refunding or forfeiting payments, fines and suspension or disbarment from future government business.

Government entities often require contract terms that differ from our standard arrangements and impose compliance requirements that are complicated, require preferential pricing, termination rights tied to funding availability or “most favored nation” terms and conditions, or are otherwise time consuming and expensive to satisfy.

Government entities may also have statutory, contractual, or other legal rights to terminate contracts with our partners for convenience, for lack of funding, or due to a default, and any such termination may adversely impact our future results of operations.

If we undertake to meet special standards or requirements and do not meet them, we could be subject to increased liability from our customers or regulators or termination rights.

Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.

Any of these risks related to contracting with government entities could adversely impact our future sales and results of operations, or make them more difficult to predict .

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer.

Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.

Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices.

In the past, our efforts to build our brand have involved significant expenses.

Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.

4 unchanged sentences

Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.

Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.

Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate.

13 unchanged sentences

In addition, the patent portfolios of many of our competitors are larger than ours, and this disparity may increase the risk that our competitors may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses.

Other companies have claimed in the past, and may claim in the future, that we infringe upon their

intellectual property rights.

Other companies have claimed in the past, and may claim in the future, that we infringe upon their intellectual property rights.

A claim may also be made relating to technology that we acquire or license from third parties.

21 unchanged sentences

We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not subject us to liability.

We may face exposure to foreign currency exchange rate fluctuations.

Today, a vast majority of our customer contracts are denominated in U.S.

Over time, however, an increasing portion of our international customer contracts may be denominated in local currencies.

In addition, the majority of our international costs are denominated in local currencies.

As a result, fluctuations in the value of the U.S.

dollar and foreign currencies may affect our results of operations when translated into U.S.

We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations.

However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates.

The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place.

Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

10 unchanged sentences

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.

We may face particular privacy, data security and data protection risks in Europe due to the invalidation of the Safe Harbor Program and the European General Data Protection Regulation.

In the European Community, Directive 95/46/EC, or the Directive, has required European Union member states to implement data protection laws to meet the strict privacy requirements of the Directive.

Among other requirements, the Directive regulates transfers of personally identifiable data that is subject to the Directive, or Personal Data, to third countries, such as the United States, that have not been found to provide adequate protection to such Personal Data.

Our customers have in the past relied upon our adherence to the U.S.

Department of Commerce’s Safe Harbor Privacy Principles and compliance with the U.S.-EU and U.S.-Swiss Safe Harbor Frameworks as agreed to and set forth by the U.S.

Department of Commerce, and the European Union and Switzerland, which established a means for legitimating the transfer of Personal Data by data controllers in the European Economic Area, or EEA, to the United States.

As a result of the October 6, 2015 European Union Court of Justice, or ECJ, opinion in Case C-362/14 (Schrems v.

Data Protection Commissioner) regarding the adequacy of the U.S.-EU Safe Harbor Framework, the U.S.-EU Safe Harbor Framework is no longer deemed to be a valid method of compliance with requirements set forth in the Directive (and member states’ implementations of it) regarding the transfer of Personal Data outside of the EEA.

After the invalidation of the Safe Harbor Framework, negotiators from the European Union and United States worked to arrive at a new solution to legitimize transfers of Personal Data from the EEA to the United States and eventually reached political agreement on a successor to the Safe Harbor Framework.

The Privacy Shield was formally adopted and as of August 1, 2016, interested companies have been permitted to register for the program.

There continue to be concerns about the future of Privacy Shield as a legitimate data transfer mechanism as it continues to be subject to legal challenges.

Until the remaining legal uncertainties regarding the future of the EU-US Privacy Shield are settled and we determine whether we will participate in the program, we will continue to face uncertainty as to whether our efforts to comply with our obligations under European privacy laws will be sufficient.

In addition, the other bases on which we and our customers rely for the transfer of data, such as the Standard Contractual Clauses, continue to be subjected to regulatory and judicial scrutiny.

In 2017, a legal challenge to the validity of the EU Standard Contractual Clauses (a data transfer mechanism) was referred to the ECJ for review.

While the Advocate General of the Court of Justice of the European Union recommended that the validity of the Standard Contractual Clauses be upheld, such opinion is not legally binding.

If the Standard Contractual Clauses are struck down as a lawful data transfer mechanism as a result of these proceedings or otherwise, it could harm us and our customers who rely on these clauses.

If we are investigated by a European data protection authority, we may face fines and other penalties.

Any such investigation

or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

In light of the ECJ opinion in Case C-362/14, we offer our customers other methods to enable compliant data transfers from the EEA to the United States and have begun to undertake efforts to conform transfers of Personal Data from the EEA based on current regulatory obligations, the guidance of data protection authorities, and evolving best practices.

Despite this, we may be unsuccessful in establishing conforming means or means that are acceptable to our customers of transferring such data from the EEA, including due to ongoing legislative activity, which may vary the current data protection landscape.

We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our service due to the potential risk exposure to such customers as a result of the ECJ ruling in Case C-362/14 and the current data protection obligations imposed on them by certain data protection authorities.

Such customers may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain or otherwise objectionable and decide not to do business with us.

In addition, data protection regulation is an area of increased focus and changing requirements.

On April 27, 2016 the European Union adopted the General Data Protection Regulation 2016/679, or GDPR, that took effect on May 25, 2018, replacing the data protection laws of each European Union member state.

The GDPR applies to any company established in the European Union as well as to those outside the European Union if they collect and use personal data in connection with the offering of goods or services to individuals in the European Union or the monitoring of their behavior.

The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher.

Separate European Union laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving.

We cannot yet determine the impact that such future laws, regulations, and standards may have on our business.

Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.

We may incur substantial expense in complying with the new obligations to be imposed by the GDPR and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

We and our customers are at risk of enforcement actions taken by certain European Union data protection authorities until such point in time that we may be able to ensure that all transfers of Personal Data to us in the United States from the EEA are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.

We may find it necessary to establish systems to maintain Personal Data originating from the European Union in the EEA, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their respective implementing regulations, or HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates.

The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them.

These agreements impose stringent data security obligations on us.

In addition, additional guidance regarding HIPAA is expected to be issued in 2020 by the U.S.

Department of Health & Human Services, and we are continuing to monitor whether such guidance may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

Risks Related to the Acquisition of Auth0

The proposed acquisition of Auth0 may cause a disruption in our business.

The proposed acquisition (the Acquisition) of Auth0 could cause disruptions to our business or business relationships, which could have an adverse impact on results of operations.

Parties with which we have business relationships may experience uncertainty as to the future of such relationships and may delay or defer certain business decisions, seek alternative relationships with third parties or seek to alter their present business relationships with us.

Parties with whom we otherwise may have sought to establish business relationships may seek alternative relationships with third parties.

The pursuit of the Acquisition, the preparation for the transition and the integration of Auth0 may place a significant burden on our management and internal resources.

The diversion of management’s attention away from day-to-day business concerns and any difficulties encountered in the transition and integration process could adversely affect our financial results.

We have incurred and expect to continue to incur significant costs, expenses and fees for professional services and other transaction costs in connection with the Acquisition.

We may also incur unanticipated costs in the integration of Auth0’s business with our business.

The substantial majority of these costs will be non-recurring expenses relating to the Acquisition, and many of these costs are payable regardless of whether or not the Acquisition is consummated.

We also could be subject to litigation related to the proposed Acquisition, which could result in significant costs and expenses.

Failure to complete the Acquisition in a timely manner or at all could negatively impact the market price of our Class A common stock, as well as our future business and our financial condition, results of operations and cash flows.

We currently anticipate the Acquisition will be completed in the second quarter of fiscal 2022, the quarter ending July 31, 2021, but we cannot be certain when or if the conditions for the Acquisition will be satisfied or (if permissible under applicable law) waived.

The Acquisition cannot be completed until certain customary conditions to closing are satisfied or (if permissible under applicable law) waived.

Our obligation to complete the Acquisition is also subject to, among other conditions, the absence of regulatory authorities requiring certain actions on our part.

The satisfaction of the required conditions could delay the completion of the Acquisition for a significant period of time or prevent it from occurring.

Further, there can be no assurance that the conditions to the closing of the Acquisition will be satisfied or waived or that the Acquisition will be completed.

If the Acquisition is not completed in a timely manner or at all, our ongoing business may be adversely affected as follows:

• we may experience negative reactions from the financial markets, and our stock price could decline to the extent that the current market price reflects an assumption that the transaction will be completed;

• we may experience negative reactions from employees, customers, suppliers or other third parties;

• management’s focus may have been diverted from pursuing other opportunities that could have been beneficial to us;

• our costs of pursuing the Acquisition may be higher than anticipated.

If the Acquisition is not consummated, there can be no assurance that these risks will not materialize and will not materially adversely affect our stock price, business, financial condition, results of operations or cash flows.

We may not realize potential benefits from the Acquisition because of difficulties related to integration, the achievement of synergies, and other challenges.

We and Auth0 have operated and, until completion of the Acquisition, will continue to operate, independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.

Any integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven.

If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized.

Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition so the combined company performs as the parties hope:

• combining the companies’ corporate functions;

• combining Auth0’s business with our business in a manner that permits us to achieve the synergies anticipated to result from the Acquisition, the failure of which would result in the anticipated benefits of the Acquisition not being realized in the timeframe currently anticipated or at all;

• maintaining existing agreements with customers, distributors, providers, talent and vendors and avoiding delays in entering into new agreements with prospective customers, distributors, providers, talent and vendors;

• determining whether and how to address possible differences in corporate cultures and management philosophies;

• integrating the companies’ administrative and information technology infrastructure;

• developing products and technology that allow value to be unlocked in the future;

• evaluating and forecasting the financial impact of the Acquisition transaction, including accounting charges;

• effecting potential actions that may be required in connection with obtaining regulatory approvals.

In addition, at times the attention of certain members of our management and resources may be focused on completion of the Acquisition and integration planning of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.

We may incur significant, non‑recurring costs in connection with the Acquisition and integrating the operations of Okta and Auth0, including costs to maintain employee morale and to retain key employees.

Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the long term or at all.

Purchase price accounting in connection with our Acquisition requires estimates that may be subject to change and could impact our consolidated financial statements and future results of operations and financial position .

Pursuant to the acquisition method of accounting, the purchase price we will pay for Auth0 will be allocated to the underlying Auth0 tangible and intangible assets acquired and liabilities assumed based on their respective fair market values with any excess purchase price allocated to goodwill.

The acquisition method of accounting is dependent upon certain valuations and other studies that are preliminary.

Accordingly, the purchase price allocation as of the Acquisition date will be preliminary.

We currently anticipate that all the information needed to identify and measure values assigned to the assets acquired and liabilities assumed will be obtained and finalized during the one‑year measurement period following the date of completion of the Acquisition.

Differences between these preliminary estimates and the final acquisition accounting may occur, and these differences could have a material impact on the consolidated financial statements and the combined company’s future results of operations and financial position.

Auth0 may have liabilities that are not known to us.

Auth0 may have liabilities that we failed, or were unable, to discover, or that we underestimated, in the course of performing our due diligence investigations of Auth0’s business and we, as the successor owner of such acquired company, might be responsible for those liabilities.

Such potential liabilities could include employment-, retirement- or severance-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties.

We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition in connection with such agreement will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we will assume upon consummation of the Acquisition.

We may learn additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws.

Any such liabilities, individually or in the aggregate, could have a material adverse effect on our business, results of operations and financial condition.

While the Acquisition is pending, we and Auth0 will be subject to business uncertainties that could adversely affect our respective businesses, results of operations and financial conditions.

Our success following the announcement of the Acquisition will depend in part upon the ability of us and Auth0 to maintain our respective business relationships.

Uncertainty about the effect of the Acquisition on customers, suppliers, employees and other constituencies may have a material adverse effect on us and Auth0.

Customers, suppliers and others who deal with us or Auth0 may delay or defer business decisions, decide to terminate, modify or renegotiate their relationships or take other actions as a result of the Acquisition that could negatively affect the revenues, earnings and cash flows of our company or Auth0.

If we are unable to maintain these business and operational relationships, our financial position, results of operations or cash flows could be materially affected.

Risks Related to Legal, Accounting and Tax Matters

We generally recognize revenue from subscriptions and related support services revenue ratably over the relevant service period.

Net new revenue from new subscriptions, upsells and renewals entered into during a period can generally be expected to generate revenue for the duration of the service period.

Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period.

In addition, our ability to adjust our cost structure in the event of a decrease in new or renewed subscriptions may be limited.

Further, a decline in new subscriptions or renewals in a given period may not be fully reflected in our revenue for that period, but will negatively affect our revenue in future periods.

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under Accounting Standards Update No.

2014-09, Revenue from Contracts with Customers (Topic 606) , or ASC 606, will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

We may face exposure to foreign currency exchange rate fluctuations.

Today, a vast majority of our customer contracts are denominated in U.S.

Over time, however, an increasing portion of our international customer contracts may be denominated in local currencies.

In addition, the majority of our international costs are denominated in local currencies.

As a result, fluctuations in the value of the U.S.

dollar and foreign currencies may affect our results of operations when translated into U.S.

We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations.

However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates.

Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S.

Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S.

Foreign Corrupt Practices Act of 1977, as amended (FCPA), the U.S.

domestic bribery statute contained in 18 U.S.C.

19 unchanged sentences

If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result

in the delay or loss of sales opportunities.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities.

Although we take precautions to prevent our products from being provided in violation of such laws, our products may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take.

This could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

We may not set optimal prices for our products.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product.

We expect that we may need to change our pricing in future periods.

Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally.

In addition, if our mix of products sold changes, then we may need to, or choose to, revise our pricing.

As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations and financial condition.

We currently have sales personnel outside the United States and maintain offices outside the United States in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada and Australia, and we intend to expand our international operations.

In each of fiscal 2019 and 2020 , our international revenue was 16% of our total revenue.

Any international expansion efforts that we may undertake may not be successful.

In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States.

These risks include, among other things:

unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;

lack of familiarity and burdens of complying with foreign laws, legal standards, privacy standards, regulatory requirements, tariffs and other barriers;

laws and business practices favoring local competitors or commercial parties;

costs and liabilities related to compliance with the GDPR and disparate data privacy standards and enforcement;

greater risk that our foreign employees or partners will fail to comply with U.S.

and foreign laws;

practical difficulties of enforcing intellectual property rights in countries with fluctuating laws and standards and reduced or varied protection for intellectual property rights in some countries;

restrictive governmental actions focusing on cross-border trade, including taxes, trade laws, tariffs, import and export restrictions or quotas, barriers, sanctions, custom duties or other trade restrictions;

unexpected changes in legal and regulatory requirements;

difficulties in managing systems integrators and technology partners;

differing technology standards;

longer accounts receivable payment cycles and difficulties in collecting accounts receivable;

difficulties in managing and staffing international operations and differing employer/employee relationships and local employment laws;

political, economic and social instability, war, armed conflict or terrorist activities;

health epidemics, such as the coronavirus outbreak stemming from China (COVID-19), influenza and other highly communicable diseases or viruses;

fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;

potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems and restrictions on the repatriation of earnings.

Additionally, operating in international markets also requires significant management attention and financial resources.

We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability.

We have not engaged in currency hedging activities to limit risk of exchange rate fluctuations.

Changes in exchange rates affect our costs and earnings, and may also affect the book value of our assets located outside the United States and the amount of our stockholders’ equity.

We have limited experience in marketing, selling and supporting our platform abroad.

Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful.

If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.

Our international operations may give rise to potentially adverse tax consequences.

28 unchanged sentences

Liability for past taxes may also include substantial interest and penalty charges.

Any successful action by state, foreign or other authorities to compel us to collect and remit sales tax, use tax or other taxes, either retroactively, prospectively or both, could harm our business, results of operations and financial condition.

We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

Our success depends largely upon the continued services of our executive officers and other key employees.

We rely on our leadership team in the areas of research and development, operations, security, marketing, sales, customer support, general and administrative functions, and on individual contributors in our research and development and operations functions.

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business.

We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and they could terminate their employment with us at any time.

The loss of one or more of our executive officers or key employees, and any failure to have in place and execute an effective succession plan for key executives, could harm our business.

Changes in our executive management team may also cause disruptions in, and harm to, our business.

In addition, to execute our growth plan, we must attract and retain highly qualified personnel.

Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in other locations where we maintain offices, is intense, especially for engineers experienced in designing and developing software and SaaS applications and experienced sales professionals.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions, or at all.

Many of the companies with which we compete for experienced personnel have greater resources than we have.

If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources.

In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment.

If the perceived value of our equity awards declines, it may harm our ability to recruit and retain highly skilled employees.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all.

If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

develop and enhance our products;

continue to expand our product development, sales and marketing organizations;

hire, train and retain employees;

respond to competitive pressures or unanticipated working capital requirements;

pursue acquisition opportunities.

Our inability to do any of the foregoing could reduce our ability to compete successfully and harm our business, results of operations and financial condition.

Any successful action by state,

foreign or other authorities to compel us to collect and remit sales tax, use tax or other taxes, either retroactively, prospectively or both, could harm our business, results of operations and financial condition.

Our ability to use our net operating loss carry-forwards and certain other tax attributes may be limited.

Under Section 382 of the Internal Revenue Code of 1986, as amended, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three year period, the corporation’s ability to use its pre-change net operating loss carry-forwards and other pre-change tax attributes, such as research tax credits and distributed interest deduction carryover, to offset its post-change income may be limited.

We have experienced ownership changes in the past and any such ownership change in the future could result in increased future tax liability.

In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership.

As a result, if we earn net taxable income, our ability to use our pre-change net operating loss carry-forwards to offset U.S.

federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

On March 27, 2020, the U.S.

government enacted the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) which included temporary relief from the net operating loss limitations imposed by the Tax Cuts and Jobs Act for tax years beginning after December 31, 2017 and before January 1, 2021, and made certain technical corrections to applying the net operating loss utilization limitations for tax years beginning after January 1, 2021.

Our ability to use our net operating losses is conditioned upon generating future U.S.

federal taxable income.

Since we do not know whether or when we will generate the U.S.

federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

5 unchanged sentences

Any failure to maintain effective controls could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the Securities and Exchange Commission (SEC).

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock.

7 unchanged sentences

Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

GAAP is subject to interpretation by the Financial Accounting Standards Board, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

Accounting principles generally accepted in the United States (GAAP) are subject to interpretation by the Financial Accounting Standards Board (FASB), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

A change in these principles or interpretations could have a significant effect on our reported financial results, and could affect the reporting of transactions completed before the announcement of a change.

5 unchanged sentences

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Catastrophic events may disrupt our business.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business.

We have a large employee presence in San Francisco, California and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business.

For example, in October 2019, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely.

In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, terrorist attack or health epidemic (including the recent coronavirus outbreak stemming from China (COVID-19)), we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition.

In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

We may be subject to liability claims if we breach our contracts and our insurance may be inadequate to cover our losses.

We are subject to numerous obligations in our contracts with our customers and partners.

In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all.

Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Exposure to political developments in the United Kingdom, including the exit of the United Kingdom from the European Union, could harm us.

On June 23, 2016, a referendum was held on the United Kingdom’s membership in the European Union, the outcome of which was a vote in favor of leaving the European Union.

The withdrawal was extended several times due to deadlocks in negotiations.

On January 31, 2020, the United Kingdom withdrew from the European Union and entered into a transition period to, among other things, negotiate an agreement with the European Union governing the future relationship between the European Union and the United Kingdom.

The referendum and subsequent withdrawal of the United Kingdom from the European Union has created significant political and economic uncertainty about the future relationship between the United Kingdom and the European Union.

The referendum, withdrawal and transition period mean that the long-term nature of the United Kingdom’s relationship with the European Union is unclear.

The political and economic instability created by the United Kingdom’s vote to leave the European Union has caused and may continue to cause significant volatility in global financial markets and the value of the British Pound or other currencies, including the Euro.

In addition, this uncertainty may cause some

of our customers or potential customers to curtail or delay spending, and any exit from the European Union may result in new regulatory and cost challenges to our United Kingdom and global operations.

The outcome of the referendum has also created uncertainty with regard to the regulation of data protection, immigration and taxation, among other issues, in the United Kingdom.

In particular, it is unclear how the United Kingdom's vote to leave the European Union will affect the United Kingdom's enactment of the European General Data Protection Regulation, and how data transfers to and from the United Kingdom will be regulated.

Depending on the terms reached regarding any exit from the European Union, it is possible that there may be adverse practical or operational implications on our business.

Our ability to use our net operating loss carry-forwards and certain other tax attributes may be limited.

Under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three year period, the corporation’s ability to use its pre-change net operating loss carry-forwards and other pre-change tax attributes, such as research tax credits and distributed interest deduction carryover, to offset its post-change income may be limited.

We have experienced ownership changes in the past and any such ownership change in the future could result in increased future tax liability.

In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership.

As a result, if we earn net taxable income, our ability to use our pre-change net operating loss carry-forwards to offset U.S.

federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

In addition, on December 22, 2017, the U.S.

government enacted new tax legislation commonly referred to as the Tax Cuts and Jobs Act (the Tax Act).

The Tax Act makes broad and complex changes to the U.S.

tax code, including changes to the uses and limitations of net operating losses.

For example, while the Tax Act allows for federal net operating losses incurred during our taxable year ended January 31, 2018 to be carried forward indefinitely, the Tax Act also imposes an 80% limitation, and indefinite carryforward, on our net operating losses generated during our taxable year ended January 31, 2019, and forward.

Furthermore, our ability to use our net operating losses is conditioned upon generating future U.S.

federal taxable income.

Since we do not know whether or when we will generate the U.S.

federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.

Risks Related to Ownership of Our Class A Common Stock

The stock price of our Class A common stock may be volatile or may decline.

Prior to our initial public offering, or IPO, there was no public market for shares of our Class A common stock.

Prior to our IPO, there was no public market for shares of our Class A common stock.

The market prices of the securities of other newly public companies have historically been highly volatile, and our stock price has been volatile since our IPO.

21 unchanged sentences

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share.

As of January 31, 2020, our directors, executive officers, and their affiliates, held in the aggregate 53.1% of the voting power of our capital stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control a majority of the combined voting power of our common stock and be able to control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten year anniversary of the closing of our IPO.

As of January 31, 2021, our directors, executive officers and their affiliates held in the aggregate 48% the voting power of our capital stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten year anniversary of the closing of our IPO.

This concentrated control may limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

5 unchanged sentences

In addition, we have options outstanding that, if fully exercised, would result in the issuance of shares of our Class A and Class B common stock.

We also have restricted stock units, or RSUs, outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock.

All of the shares of Class A and Class B common stock issuable upon the exercise of stock options and vesting of RSUs and the shares reserved for future issuance under our equity incentive plans, are registered for public resale under the Securities Act.

We also have restricted stock units (RSUs) outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock.

Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.

1 unchanged sentence

If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.

The requirements of being a public company may strain our resources, divert management’s attention, and affect our ability to attract and retain executive management and qualified board members.

We are subject to the reporting requirements of the Exchange Act, the listing standards of NASDAQ and other applicable securities rules and regulations.

We expect that the requirements of these rules and regulations will continue to increase our legal, accounting, and financial compliance costs, make some activities more difficult, time-consuming, and costly, and place significant strain on our personnel, systems, and resources.

For example, the Exchange Act requires, among other things, that we file annual, quarterly and current reports with respect to our business and results of operations.

As a result of the complexity involved in complying with the rules and regulations applicable to public companies, our management’s attention may be diverted from other business concerns, which could harm our business, results of operations and financial condition.

Although we have already hired additional employees to assist us in complying with these requirements, we may need to hire more employees in the future or engage outside consultants, which will increase our operating expenses.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs, and making some activities more time-consuming.

These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to invest substantial resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from business operations to compliance activities.

If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed.

Being a public company under these new rules and regulations has made it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage.

These factors could also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

As a result of disclosure of information in filings required of a public company, our business and financial condition is visible, which may result in an increased risk of threatened or actual litigation, including by competitors and other third parties.

If such claims are successful, our business and results of operations could be harmed, and even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and harm our business, results of operations and financial condition.

If securities or industry analysts do not publish or cease publishing research, or publish inaccurate or unfavorable research, about our business, the price of our Class A common stock and trading volume could decline.

16 unchanged sentences

• provide that only the Chairperson of our board of directors, our Chief Executive Officer, or a majority of our board of directors are authorized to call a special meeting of stockholders;

provide for a dual class common stock structure in which holders of our Class B common stock have the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our Class A and Class B common stock, including the election of directors and significant corporate transactions, such as a merger or other sale of our company or its assets;

• provide for a dual class common stock structure in which holders of our Class B common stock have the ability to effectively control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our Class A and Class B common stock, including the election of directors and significant corporate transactions, such as a merger or other sale of our company or its assets;

• prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

8 unchanged sentences

• any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws;

or any action asserting a claim against us that is governed by the internal affairs doctrine.

• any action asserting a claim against us that is governed by the internal affairs doctrine.

This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits with respect to such claims.

2 unchanged sentences

Servicing our debt may require a significant amount of cash.

We may not have sufficient cash flow from our business to pay our indebtedness, and we may not have the ability to raise the funds necessary to settle for cash conversions of the Notes or to repurchase the Notes for cash upon a fundamental change, which could adversely affect our business and results of operations.

In February 2018, we issued $345.0 million aggregate principal amount of the 2023 Notes in a private offering (2023 Notes).

The interest rate is fixed at 0.25% per annum and is payable semi-annually in arrears on February 15 and August 15 of each year, beginning on August 15, 2018.

In September 2019, the Company repurchased $224.4 million aggregate principal amount of the 2023 Notes in privately-negotiated transactions for aggregate consideration of $604.8 million, consisting of approximately $224.4 million in cash and approximately 3.0 million shares of Class A common stock (2023 Notes Partial Repurchase).

Following the 2023 Notes Partial Repurchase, $120.6 million of the 2023 Notes remained outstanding.

In September 2019, concurrent with the 2023 Notes Partial Repurchase, we issued $1,060.0 million aggregate principal amount of the 2025 Notes in a private offering, including the initial purchasers’ partial exercise of their option to purchase additional notes (2025 Notes, the 2025 Notes together with the 2023 Notes, the Notes).

The interest rate on the 2025 Notes is fixed at 0.125% per annum and is payable semi-annually in arrears on March 1 and September 1 of each year, beginning on March 1, 2020.

We may not have sufficient cash flow from our business to pay our indebtedness.

Since February 2018, we have issued convertible notes due in 2023 (2023 Notes), 2025 (2025 Notes) and 2026 (2026 Notes, and together with the 2023 Notes and 2025 Notes, the Notes).

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

5 unchanged sentences

Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.

In addition, holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (as defined in the indentures governing their respective Notes) at a repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid interest, if any.

We may not have the ability to raise the funds necessary for cash settlement upon conversion of the Notes or to repurchase the Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the Notes or to repurchase the Notes.

Holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (as defined in the Indentures governing their respective Notes) at a repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid interest, if any.

Upon conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted.

We may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of Notes surrendered or Notes being converted.

In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

Our failure to repurchase Notes at a time when the repurchase is required by the indenture governing such notes or to pay any cash payable on future conversions of the Notes as required by such indenture would constitute a default under such indenture.

14 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

As disclosed in Note 9 to our consolidated financial statements, the conditional conversion feature of the 2023 Notes was triggered as of January 31, 2020, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between February 1, 2020 and April 30, 2020.

Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

As disclosed in Note 9 to our consolidated financial statements, the conditional conversion features of the 2023 Notes and 2025 Notes were triggered as of January 31, 2021, and the 2023 Notes and 2025 Notes are currently convertible at the option of the holders, in whole or in part, between February 1, 2021 and April 30, 2021.

Whether the 2023 Notes or 2025 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

From the date of issuance through January 31, 2021, the conditions allowing holders of the 2026 Notes to convert were not met.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The 2023 Notes were classified as current liabilities on the consolidated balance sheet as of January 31, 2020.

The 2023 Notes and 2025 Notes were classified as current liabilities on the consolidated balance sheet as of January 31, 2021.

Transactions relating to our Notes may affect the value of our Class A common stock.

2 unchanged sentences

If holders of our Notes elect to convert their notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders.

In addition, in connection with the issuance of the 2023 Notes, we entered into convertible note hedge transactions (Note Hedges) with certain financial institutions (the 2023 Notes Option Counterparties).

We also entered into warrant transactions with the 2023 Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (Warrants).

The Note Hedges are expected generally to reduce the potential dilution to our Class A common stock upon any conversion or settlement of the 2023 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2023 Notes, as the case may be.

In addition, in connection with the issuance of the 2023 Notes, we entered into convertible note hedges (Note Hedges) with certain financial institutions (the 2023 Notes Option Counterparties).

We also entered into warrant transactions with the 2023 Notes Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (Warrants).

The Note Hedges are expected generally to reduce the potential dilution to our Class A common stock upon any conversion or settlement of the 2023 Notes and/or offset any cash payments we

are required to make in excess of the principal amount of converted 2023 Notes, as the case may be.

The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.

In September 2019, and in connection with the 2023 Notes Partial Repurchase, the Company terminated Note Hedges corresponding to approximately 4.6 million shares.

As of January 31, 2020, Note Hedges giving the Company the option to purchase approximately 2.5 million shares (subject to adjustment) remained outstanding.

In September 2019, and in connection with the 2023 Notes Partial Repurchase, the Company terminated warrants corresponding to approximately 4.6 million shares.

Through January 31, 2021, Note Hedges corresponding to approximately 6.3 million shares have been terminated or settled.

As of January 31, 2021, Note Hedges giving us the option to purchase approximately 0.8 million shares (subject to adjustment) remained outstanding.

Through January 31, 2021, we have terminated Warrants corresponding to approximately 6.1 million shares.

As of January 31, 2021, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

In addition, in connection with the issuance of the 2025 Notes, we entered into capped call transactions (Capped Calls) with certain financial institutions (the 2025 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the Option Counterparties).

The Capped Calls are generally expected to reduce potential dilution to our Class A common stock upon any conversion or settlement of the 2025 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2025 Notes, as the case may be, with such reduction and/or offset subject to a cap.

In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into capped call transactions (Capped Calls) with certain financial institutions (the 2025 Notes and 2026 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the Option Counterparties).

The Capped Calls are generally expected to reduce potential dilution to our Class A common stock upon any conversion or settlement of the 2025 Notes and 2026 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2025 Notes and 2026 Notes, as the case may be, with such reduction and/or offset subject to a cap.

From time to time, the Option Counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivative transactions with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes.

1 unchanged sentence

The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.

Under Financial Accounting Standards Board Accounting Standards Codification 470-20, Debt with Conversion and Other Options , which we refer to as ASC 470-20, an entity must separately account for the liability and equity components of convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.

Under FASB Accounting Standards Codification 470-20, Debt with Conversion and Other Options (ASC 470-20), an entity must separately account for the liability and equity components of convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.

ASC 470-20 requires the value of the conversion options of the Notes, representing the equity component, to be recorded as additional paid-in capital within stockholders’ equity in our consolidated balance sheet and as a discount to the Notes, which reduces their initial carrying value.

1 unchanged sentence

Accordingly, we will report lower net income or higher net loss in our financial results because ASC 470-20 requires interest to include both the current period’s accretion of the debt discount and the instrument’s coupon interest, which could adversely affect our reported or future financial results, the trading price of our Class A common stock and the respective trading price of the Notes.

In addition, under certain circumstances, convertible debt instruments (such as the Notes) that may be settled entirely or partly in cash are currently permitted to be accounted for utilizing the treasury stock method, the effect of which is that the shares issuable upon conversion of the Notes are not included in the calculation of diluted earnings per share except to the extent that the conversion value of the Notes exceeds their principal amount.

Under the treasury stock method, for diluted earnings per share purposes, the transaction is accounted for as if the number of shares of Class A common stock that would be necessary to settle such excess, if we elected to settle such excess in shares, are issued.

We cannot be sure that the accounting standards in the future will continue to permit the use of the treasury stock method.

For example, the Financial Accounting Standards Board recently published an exposure draft proposing to amend these accounting standards to eliminate the treasury stock method for convertible instruments and instead require application of the “if-converted” method.

We currently already apply the “if-converted” method for calculating any potential dilutive effect of the conversion options embedded in the Notes on diluted net income per share, which assumes that all of the Notes were converted solely into shares of Class A common stock at the beginning of the reporting period, unless the result would be anti-dilutive.

Accounting standards in the future will result in changes to the current ASC 470-20 accounting model.

The FASB issued an accounting standards update that eliminates the liability and equity component separation model for convertible debt instruments with a cash conversion feature.

Among other potential impacts, this change is expected to reduce reported interest expense, increase reported net income or lower net loss and result in a reclassification of certain balance sheet amounts from stockholders' equity to liabilities as it relates to the Notes.

General Risk Factors

Our success depends largely upon the continued services of our executive officers and other key employees.

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, such as the recent retirement of our former President, Worldwide Field Operations and upcoming retirement of our Chief Financial Officer, which could disrupt our business.

The loss of one or more of our executive officers or key employees, and any failure to have in place and execute an effective succession plan for key executives, could harm our business.

Changes in our executive management team may also cause disruptions in, and harm to, our business.

In addition, to execute our growth plan, we must attract and retain highly qualified personnel.

Our efforts to attract new personnel may be compounded by intensified restriction on travel (including during the COVID-19 pandemic), changes to immigration policy or the availability of work visas.

Many of the companies with which we compete for experienced personnel have greater resources than we have.

In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment.

If the perceived value of our equity awards declines, it may harm our ability to recruit and retain highly skilled employees.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

Catastrophic events may disrupt our business.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business.

We have a large employee presence in San Francisco, California and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business.

For example, in the fall of 2019 and 2020, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely.

In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, terrorist attack or health epidemic (including COVID-19), we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors