What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-05-27 compared with 2020-12-03 · 213 added, 220 removed, 694 unchanged (38% of the section changed)

19 unchanged sentences

• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

• There are risks related to our ability to successfully integrate Auth0, Inc.

(“Auth0”) and realize potential benefits from the acquisition.

• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

1 unchanged sentence

• Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 49% of the voting power of our capital stock as of October 31, 2020.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 46.5% of the voting power of our capital stock as of April 30, 2021.

This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

4 unchanged sentences

In December 2019, a novel coronavirus (“COVID-19”) was reported in China, in January 2020, the World Health Organization (“WHO”) declared it a Public Health Emergency of International Concern and in March 2020, the WHO declared it a pandemic.

This contagious disease outbreak has continued to spread across the globe and is impacting worldwide economic activity and financial markets, resulting in an economic downturn that may become a global recession.

The extent of the impact of COVID-19 on our future operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, the possibility and timing of any vaccine, treatment, or cure or stop to the spread, related public health measures, and their impact on the global economy, our customers, employees and vendors.

In the absence of a vaccine or effective therapeutics, we expect to see continued fluctuations in business openings and closures as communities respond to local outbreaks.

The extent of the impact of COVID-19 on our future operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, the effectiveness, distribution and acceptance of COVID-19 vaccines, including the vaccines’ efficacy against emerging COVID-19 variants, related public health measures, and their impact on the global economy, our customers, employees and vendors.

While some governments around the world have started to lift restrictions and vaccine distributions have begun, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of the new variants of COVID-19.

This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.

As a result of the COVID-19 pandemic, we have temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions.

We shifted our annual user conference, Oktane20 Live, held in the spring of 2020, to a virtual-only conference and in the near-term we have changed our customer, employee and industry events to virtual-only formats.

The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.

1 unchanged sentence

Our operations have also begun to be negatively affected by a range of external factors related to the COVID-19 pandemic that are not within our control.

For example, many cities, counties, states, and countries have imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19.

For example, many cities, counties, states, and countries have imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential

customers’ physical movement to limit the spread of COVID-19.

If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the severity and transmission rate of the virus, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus, and emerging variants, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.

35 unchanged sentences

Because the market for our platform is rapidly evolving and has not yet reached widespread adoption, it is difficult for us to predict our future results of operations.

We expect our operating expenses to significantly increase over the next several years as we hire additional personnel, particularly in sales and marketing, expand and improve the effectiveness of our distribution channels, expand our operations and infrastructure, both domestically and internationally, pursue business combinations and continue to develop our platform.

We expect our operating expenses to significantly increase over the next several years as a result of the Auth0 acquisition, and as we hire additional personnel, particularly in sales and marketing, expand and improve the effectiveness of our distribution channels, expand our operations and infrastructure, both domestically and internationally, pursue business combinations and continue to develop our platform.

As we continue to develop as a public company, we may incur additional legal, accounting and other expenses that we did not incur historically.

6 unchanged sentences

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

For example, our headcount has grown from 2,116 employees as of October 31, 2019 to 2,604 employees as of October 31, 2020.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our Software-as-a-Service, or SaaS, infrastructure supports.

For example, our headcount has grown from 2,379 employees as of April 30, 2020 to 3,056 employees as of April 30, 2021.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports.

Finally, our organizational structure is becoming more complex as we improve our operational, financial and management controls as well as our reporting systems and procedures.

2 unchanged sentences

We have established international offices, including offices in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to continue to expand our international operations into other countries in the future.

Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, marketing and

sales, administrative, financial and other resources.

Moreover, we have added several additional offices through our acquisition of Auth0.

Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, marketing and sales, administrative, financial and other resources.

If we are unable to manage our continued growth successfully, our business and results of operations could suffer.

24 unchanged sentences

In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with systems integrators, third-party consulting firms or other parties.

Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete.

Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market

share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete.

Furthermore, organizations may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our products.

These competitive pressures in our market or our failure to compete effectively may result in price

reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share.

Any failure to meet and address these factors could harm our business, results of operations and financial condition.

17 unchanged sentences

If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

Furthermore, if our contractual license terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue.

Furthermore, if our contractual subscription terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue.

If our sales of new or recurring subscriptions and software-related support service contracts decline from existing customers, our revenue and revenue growth may decline, and our business will suffer.

3 unchanged sentences

These factors could cause customer growth to fall below analyst or investor expectations.

If we fail to meet or exceed such expectations for these or any

other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

24 unchanged sentences

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions.

If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform.

This is particularly true as we further expand and diversify our capabilities.

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

If we elect not to or are unable to develop products internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations.

Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that could allocate greater resources to our competitors’ research and development programs.

Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment, which could harm our results of operations.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

• delays or reductions in customer purchases for both us and the acquired business;

• disruption of partner and customer relationships;

• potential loss of key employees of the acquired company;

• claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

• unknown liabilities or risks associated with the acquired business, product or technology, such as contractual obligations, potential security vulnerabilities of the acquired company and its products and services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

• acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

• acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

• they could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• unforeseen integration or other expenses;

• future impairment of goodwill or other acquired intangible assets.

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

For further risks related to our acquisition of Auth0, please see below under “Risks Related to the Acquisition of Auth0.”

If we fail to adapt to rapid technological change, our ability to remain competitive could be impaired.

24 unchanged sentences

Further, some of our partners are or may become competitive with certain of our products and may elect to no longer integrate with our platform.

If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to compete in the marketplace or to grow

our revenue could be impaired, and our results of operations may suffer.

If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations may suffer.

Even if we are successful, we cannot ensure that these relationships will result in increased customer usage of our applications or increased revenue.

7 unchanged sentences

For example, some of our channel partners also sell or provide integration and administration services for our competitors’ products, and if such channel partners devote greater resources to marketing, reselling and supporting competing products, this could harm our business, results of operations and financial condition.

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform.

This is particularly true as we further expand and diversify our capabilities.

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

Various factors may cause our product implementations to be delayed, inefficient or otherwise unsuccessful.

6 unchanged sentences

Unsuccessful, lengthy, or costly customer implementation and integration projects could result in claims from customers, harm to our reputation, and opportunities for competitors to displace our products, each of which could have an adverse effect on our business and results of operations.

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002, or effectively manage the combined business following the acquisition.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

• delays or reductions in customer purchases for both us and the acquired business;

• disruption of partner and customer relationships;

• potential loss of key employees of the acquired company;

• claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

• acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

• acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

• they could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• unforeseen integration or other expenses;

• future impairment of goodwill or other acquired intangible assets.

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our sales are to government agencies, and we have made, and may continue to make, investments to support future sales opportunities in the government sector.

A portion of our sales are to partners that resell our services to government agencies, and we have made, and may continue to make, investments to support future sales opportunities in the government sector.

Government demand for our products could be impacted by budgetary cycles, and there may be governmental certification requirements for our products.

Further, we may be subject to audits and investigations regarding our government contracts, and violations could result in penalties and sanctions, including termination of the contract, refunding or forfeiting payments, fines and

suspension or debarment from future government business.

Further, we may be subject to audits and investigations regarding our role as a

subcontractor in government contracts, and violations could result in penalties and sanctions, including termination of the contract, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale.

1 unchanged sentence

Government entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

If we undertake to meet special standards or requirements and do not meet them, we could be subject to increased liability from our customers or regulators or termination rights.

If we represent that we meet special standards or requirements and do not meet them, we could be subject to increased liability from our customers, investigation by regulators or termination rights.

Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.

17 unchanged sentences

We currently have sales personnel outside the United States and maintain offices outside the United States in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to expand our international operations.

We also have added several additional offices outside the United States through our acquisition of Auth0.

In each of fiscal 2020 and 2021, our international revenue was 16% of our total revenue.

2 unchanged sentences

These risks include, among other things:

• health epidemics, such as the coronavirus outbreak (COVID-19), influenza and other highly communicable diseases or viruses;

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• macroeconomic conditions and the economic impact of the COVID-19 pandemic;

2 unchanged sentences

• laws and business practices favoring local competitors or commercial parties;

• costs and liabilities related to compliance with the GDPR and disparate data privacy standards and enforcement;

• costs and liabilities related to compliance with the EU General Data Protection Regulation 2016/679 and disparate data privacy standards and enforcement;

• greater risk that our foreign employees or partners will fail to comply with U.S.

8 unchanged sentences

• political, economic and social instability, war, armed conflict or terrorist activities;

• global economic uncertainty caused by global political events, including the United Kingdom's exit from the European Union, and similar geopolitical developments;

• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;

10 unchanged sentences

If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.

If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we engage in additional debt financing, we may be

required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

11 unchanged sentences

Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Risks Related to the Acquisition of Auth0

The acquisition of Auth0 may cause a disruption in our business.

The acquisition of Auth0 (the “Acquisition”) could cause disruptions to our business or business relationships, which could have an adverse impact on results of operations.

Parties with which we have business relationships may experience uncertainty as to the future of such relationships and may delay or defer certain business decisions, seek alternative relationships with third parties or seek to alter their present business relationships with us.

Parties with whom we otherwise may have sought to establish business relationships may seek alternative relationships with third parties.

The transition and integration of Auth0 may place a significant burden on our management and internal resources.

The diversion of management’s attention away from day-to-day business concerns and any difficulties encountered in the transition and integration process could adversely affect our financial results.

We have incurred and expect to continue to incur significant costs, expenses and fees for professional services and other transaction costs in connection with the Acquisition.

We may also incur unanticipated costs in the integration of Auth0’s business with our business.

The substantial majority of these costs will be non-recurring expenses relating to the Acquisition, and many of these costs are payable regardless of whether or not the Acquisition is consummated.

We also could be subject to litigation related to the proposed Acquisition, which could result in significant costs and expenses.

We may not realize potential benefits from the Acquisition because of difficulties related to integration, the achievement of synergies, and other challenges.

We and Auth0 have operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.

Any integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven.

If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized.

Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers,

disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition so the combined company performs as the parties hope:

• combining the companies’ corporate functions;

• combining Auth0’s business with our business in a manner that permits us to achieve the synergies anticipated to result from the Acquisition, the failure of which would result in the anticipated benefits of the Acquisition not being realized in the timeframe currently anticipated or at all;

• maintaining existing agreements with customers, distributors, providers, talent and vendors and avoiding delays in entering into new agreements with prospective customers, distributors, providers, talent and vendors;

• determining whether and how to address possible differences in corporate cultures and management philosophies;

• integrating the companies’ administrative and information technology infrastructure;

• developing products and technology that allow value to be unlocked in the future;

• evaluating and forecasting the financial impact of the Acquisition transaction, including accounting charges;

• effecting potential actions that may be required in connection with obtaining regulatory approvals.

In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.

We may incur significant, non‑recurring costs in connection with the Acquisition and integrating the operations of Okta and Auth0, including costs to maintain employee morale and to retain key employees.

Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the long term or at all.

Purchase price accounting in connection with our Acquisition requires estimates that may be subject to change and could impact our condensed consolidated financial statements and future results of operations and financial position .

Pursuant to the acquisition method of accounting, the purchase price we paid for Auth0 will be allocated to the underlying Auth0 tangible and intangible assets acquired and liabilities assumed based on their respective fair market values with any excess purchase price allocated to goodwill.

The acquisition method of accounting is dependent upon certain valuations and other studies that are preliminary.

Accordingly, the purchase price allocation as of the Acquisition date is preliminary.

We currently anticipate that all the information needed to identify and measure values assigned to the assets acquired and liabilities assumed will be obtained and finalized during the one‑year measurement period following the date of completion of the Acquisition.

Differences between these preliminary estimates and the final acquisition accounting may occur, and these differences could have a material impact on the condensed consolidated financial statements and the combined company’s future results of operations and financial position.

Auth0 may have liabilities that are not known to us.

Auth0 may have liabilities that we failed, or were unable, to discover, or that we underestimated, in the course of performing our due diligence investigations of Auth0’s business and we, as the successor owner of such acquired company, might be responsible for those liabilities.

Such potential liabilities could include employment-, retirement- or severance-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties.

We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition in connection with such agreement will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we will assume upon consummation of the Acquisition.

additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws.

Any such liabilities, individually or in the aggregate, could have a material adverse effect on our business, results of operations and financial condition.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

1 unchanged sentence

Our continued growth depends, in part, on the ability of our existing and potential customers to access our platform 24 hours a day, seven days a week, without interruption or degradation of performance.

We may experience disruptions, data loss, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, capacity constraints, denial-of-service attacks or other security-related incidents.

We may experience disruptions, data loss, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure and functionality changes, human or software errors, capacity constraints or security-related incidents.

In some instances, we may not be able to identify the cause or causes of these performance problems immediately or in short order.

We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our products become more complex and our user traffic increases.

For example, in October 2016, a distributed denial-of-service attack against Dyn, a domain name service vendor we use (since acquired by Oracle), prevented many of our customers and their users in the United States from accessing our platform or applications authenticated by our platform and resulted in our failing to meet certain contracted uptime levels under our service level agreements and the issuance of service credits to some of our customers, although the dollar value of such credits were not material.

If our platform is unavailable or if our customers are unable to access our products or deploy them within a reasonable amount of time, or at all, our business would be harmed.

15 unchanged sentences

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to

prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and personal data.

8 unchanged sentences

These breaches, or any perceived breach, of our systems, our customers’ systems, or other systems or networks secured by our products, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.

In addition, a breach of the security measures of one of our key ISVs or other channel partners could result in the exfiltration of confidential corporate

information or other data that may provide additional avenues of attack, and if a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.

In addition, a breach of the security measures of one of our key ISVs or other channel partners could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack, and if a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.

Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.

3 unchanged sentences

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform.

We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features do not ensure their compliance and may not be effective against all potential privacy concerns.

Many jurisdictions have enacted or are considering enacting or revising privacy and/or data security legislation, including laws and regulations applying to the collection, use, storage, transfer, disclosure and/or processing of personal data.

3 unchanged sentences

Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.

In addition, some of our customers rely on our authorization under the Federal Risk and Authorization Management Program, or FedRAMP, to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, in June 2018 California enacted the California Consumer Privacy Act (CCPA) which took effect on January 1, 2020 and broadly defines personal information, gave California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

Additionally, certain countries have passed or are considering passing laws requiring local data residency.

In addition, the California Privacy Rights Act of 2020 (“CPRA”) was approved in November 2020.

The measure strengthens California privacy law in several ways.

It establishes a new category of sensitive personal information and gives consumers the ability to limit use of this data;

prohibits precise geolocation tracking;

adds e-mail addresses and passwords to the list of personal information that, if lost or breached, gives the affected consumers the right to bring lawsuits;

increases the maximum penalties for violations concerning consumers under age 16;

and establishes the California Privacy Protection Agency to enforce the new law and impose administrative fines.

These new obligations take effect on January 1, 2023 (with certain provisions having retroactive effect to January 1, 2022).

The CPRA’s implementing regulations are expected on or before July 1, 2022, and enforcement is scheduled to begin July 1, 2023.

We will continue to monitor developments related to the CPRA and anticipate additional costs and expenses associated with CPRA compliance.

In addition to government activity, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on us.

Future laws, regulations, standards and other obligations, and changes in the

interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, contractual obligations and other obligations may require us to incur additional costs and restrict our business operations.

Such laws and regulations may require companies to implement privacy and security policies, permit users to access, correct and delete personal data stored or maintained by such companies, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.

In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, which broadly defines personal information and gives California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

In addition, on November 3, 2020, California voters passed the California Privacy Rights Act (“CPRA”) into law.

The CPRA will take substantial effect on January 1, 2023 with enforcement scheduled for July 1, 2023 and will significantly modify the CCPA and create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Some observers have noted the CCPA and CPRA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.

If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations our ability to successfully operate our business and pursue our business goals could be harmed.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, or any actual or suspected security incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable laws, regulations, policies, industry standards, contractual obligations or other legal obligations could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Since many of our service’s features involve the processing of personal data from our customers and their employees, contractors, customers, partners and others, any inability to adequately address privacy concerns, even if such concerns are unfounded, or to comply with applicable privacy or data security laws, regulations and policies, could result in liability to us and our business, damage to our reputation and inhibition of sales.

Around the world, there are numerous lawsuits in process against various technology companies that process personal data.

If those lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business.

Furthermore, the costs of compliance with, and other burdens imposed by laws, regulations and policies concerning privacy and data security that are applicable to the businesses of our customers may limit the use and adoption of our platform and reduce overall demand for it.

Privacy concerns, whether or not valid, may inhibit market adoption of our platform.

Additionally, concerns about security or privacy may result in the adoption of new legislation that restricts the implementation of technologies like ours or requires us to make modifications to our platform, which could significantly limit the adoption and deployment of our technologies or result in significant expense to modify our platform.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.

Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive or misrepresentative of our practices.

Evolving and changing definitions of what constitutes “Personal Information” and “Personal Data” within the European Union, the United States and elsewhere, especially relating to classification of IP addresses, machine or device identification numbers, location data and other information, may limit or inhibit our ability to operate or expand our business, including limiting technology alliance partners that may involve the sharing of data.

In addition, rapidly-evolving privacy laws and frameworks distinguish between a data processor and data controller (or under the CCPA, whether a business is a ‘service provider’), and different risks and requirements may apply to us, depending on the nature of our data processing activities.

If our business model expands and changes over time, different sets of risks and requirements may apply to us, requiring us to re-orient the business accordingly.

If our platform is perceived to cause, or is otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability.

1 unchanged sentence

Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using

our platform.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform.

This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.

We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S.

data transfers.

We are subject to the EU General Data Protection Regulation 2016/679 (“GDPR”) that took effect on May 25, 2018, and, as a result of the United Kingdom’s exit from the European Union, as of January 1, 2021, the UK General Data Protection Regulation and Data Protection Act 2018 (“UK Data Protection Laws”).

The GDPR and UK Data Protection Laws have enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher.

The UK Data Protection Laws mirror the fines under the GDPR.

Given the breadth and depth of changes in data protection obligations, complying with its requirements has caused us to expend significant resources and such expenditures are likely to continue into the near future as we respond to new interpretations and enforcement actions following the effective date of the regulation and as we continue to negotiate data processing agreements with our customers and business partners.

Separate EU laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving.

A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties.

We cannot yet determine the impact that such future laws, regulations and standards may have on our business.

Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.

We may incur substantial expense in complying with any new obligations and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

In addition, the GDPR restricts transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the United States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (“SCCs”) approved by the European Commission and, until July 16, 2020, the Privacy Shield for EU-U.S.

data transfers.

On July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S.

Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S.

entities who had self-certified under the Privacy Shield scheme.

While the CJEU upheld the adequacy of the SCCs (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances.

Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain.

The CJEU went on to state that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer.

There are few viable alternatives to the SCCs, and the law in this area remains dynamic.

These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

These regulations may deter customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from the EU are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.

Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

We may find it necessary to establish systems to maintain EU personal data within in the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

If we fail to comply with any of these requirements, we could

be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates.

We function as a business associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a business associate for the purposes of HIPAA.

The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them.

These agreements impose stringent data security obligations on us.

If we are unable to comply with our obligations as a HIPAA business associate or under the terms of the business associate agreements we have executed, we could face substantial civil and even criminal liability as well as contractual liability under the applicable business associate agreement, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain new customers.

Modifying the already stringent penalty structure that was present under HIPAA prior to HITECH, HITECH created four new tiers of civil monetary penalties and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions.

In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

In addition, the U.S.

Department of Health & Human Services recently proposed additional draft HIPAA guidance which is subject to public comment before being finalized.

We will continue to monitor whether the final guidance may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

We provide service level commitments under our customer contracts.

2 unchanged sentences

Any failure of or disruption to our infrastructure could make our platform unavailable to our customers.

If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platform, we may be contractually obligated to provide affected customers with service credits for future subscriptions, or customers could elect to terminate and receive refunds for prepaid amounts related to unused subscriptions.

For example, in October 2016, a distributed denial-of-service attack against Dyn, a domain name service vendor we use (since acquired by Oracle), prevented many of our customers and their users in the United States from accessing our platform or applications authenticated by our platform and resulted in our failing to meet certain contracted uptime levels under our service level commitments and the issuance of service credits to some of our customers.

Our revenue, other results of operations and financial condition could be harmed if we suffer unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

16 unchanged sentences

Although we have disaster recovery plans that use multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform.

A prolonged AWS service

disruption affecting our platform for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business.

A prolonged AWS service disruption affecting our platform for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business.

We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

27 unchanged sentences

Errors, failures, vulnerabilities or bugs may occur in our products, especially when updates are deployed or new products are rolled out.

Our platform is often used in connection with large-scale computing environments with

different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of products, or other aspects of the computing environment into which our products are deployed.

Our platform is often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of products, or other aspects of the computing environment into which our products are deployed.

In addition, deployment of our products into complicated, large-scale computing environments may expose errors, failures, vulnerabilities or bugs in our products.

7 unchanged sentences

Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.

Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.

Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate.

45 unchanged sentences

Such license may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain products.

As a result, we may also be required to

develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our platform, which could negatively affect our business.

As a result, we may also be required to develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our platform, which could negatively affect our business.

From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform.

1 unchanged sentence

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.

data transfers.

On April 27, 2016 the European Union (EU) adopted the General Data Protection Regulation 2016/679, or GDPR, that took effect on May 25, 2018, replacing the data protection laws of each EU member state.

The GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior.

The GDPR has enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher.

Separate EU laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving.

We cannot yet determine the impact that such future laws, regulations, and standards may have on our business.

Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.

We may incur substantial expense in complying with the new obligations to be imposed by the GDPR and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

In addition, the GDPR restricts transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (SCCs) approved by the European Commission and, until July 16, 2020, the Privacy Shield for EU-U.S.

data transfers.

On July 16, 2020, the European Court of Justice (ECJ) invalidated the EU-U.S.

Privacy Shield, but it deemed that the SCCs are valid.

However, the ECJ noted that transfers made pursuant to the SCCs and other alternative transfer mechanisms need to be analyzed on a case-by-case basis to ensure EU standards of data protection are met in the jurisdiction where the data importer is based, and there continue to be concerns about whether the SCCs and other mechanisms will face additional challenges.

We rely on SCCs to transfer personal data contained within customers’ data to the U.S.

On November 10, 2020, the European Data Protection Board (EDPB) issued its draft guidance, which expressed doubts about whether data exporters could transfer personal data to third countries, such as the U.S., for storage and processing by cloud service providers such as Okta in compliance with the GDPR, unless such cloud service providers encrypt personal data in-transit and at-rest, and unless the data exporter holds the encryption key.

This draft guidance also requires controllers and processors to conduct extensive assessments regarding the protections in place for EU data in the destination country, for each relevant transfer of data.

Additionally, on November 12, 2020, the EC released a draft implementing decision on new, updated versions of the SCCs, reflecting, in part, aspects of the ECJ’s July 16, 2020 ruling and imposing additional obligations on companies transferring personal data to third countries, including providing enhanced transparency to data subjects, flowing down new terms to third parties and sub-processors and complying with accountability requirements.

Both the EDPB’s recommendations and the EC’s draft updated SCCs

are now open for public comment, before final versions are issued.

Until the remaining legal uncertainties regarding how to legally continue transfers pursuant to the SCCs and other mechanisms are settled, we will continue to face uncertainty as to whether our efforts to comply with our obligations under European privacy laws and with EU authorities’ data transfer guidance will be sufficient.

We may experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our service due to the potential risk exposure to such customers as a result of such developments and the current data protection obligations imposed on them by certain data protection authorities.

Such customers may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain or otherwise objectionable and decide not to do business with us.

Although the EC’s draft updated SCCs provide for a one-year transition period for parties to put the new SCCs in place, we may face additional costs and expenses associated with moving to the new SCCs, including resigning agreements with customers and vendors, which could prove expensive and time-consuming.

This and other future developments regarding the flow of data across borders will increase the cost and complexity of delivering our products and services in some markets, potentially prohibiting us from providing our products and services in select jurisdictions, and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have an adverse effect on our reputation and business.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their respective implementing regulations, or HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates.

The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them.

These agreements impose stringent data security obligations on us.

In addition, additional guidance regarding HIPAA is expected to be issued in 2020 by the U.S.

Department of Health & Human Services, and we are continuing to monitor whether such guidance may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

Risks Related to Legal, Accounting and Tax Matters

9 unchanged sentences

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under Accounting Standards Update No.

2014-09, Revenue from Contracts with Customers (Topic 606) , or ASC 606, will depend on contract-specific terms and may result in greater variability in revenue from period to period.

2014-09, Revenue from Contracts with Customers (Topic 606), will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

11 unchanged sentences

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S.

Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S.

Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.S.

domestic bribery statute contained in 18 U.S.C.

4 unchanged sentences

In addition, we use channel partners to sell our products and conduct business on our behalf abroad.

We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

28 unchanged sentences

If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to purchase our products in the future.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and

other costs, as well as the costs of our products.

Further, these events could decrease the capital we have available to operate our business.

1 unchanged sentence

As a multinational organization, we may be subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain.

The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased

tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could harm our liquidity and results of operations.

The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could harm our liquidity and results of operations.

In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries, any of which could harm us and our results of operations.

12 unchanged sentences

Our ability to use our net operating loss carry-forwards and certain other tax attributes may be limited.

Under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three year period, the corporation’s ability to use its pre-change net operating loss carry-forwards and other pre-change tax attributes, such as research tax credits and distributed interest deduction carryover, to offset its post-change income may be limited.

Under Section 382 of the Internal Revenue Code of 1986, as amended, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three year period, the corporation’s ability to use its pre-change net operating loss carry-forwards and other pre-change tax attributes, such as research tax credits and distributed interest deduction carryover, to offset its post-change income may be limited.

We have experienced ownership changes in the past and any such ownership change in the future could result in increased future tax liability.

2 unchanged sentences

federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

On December 22, 2017, the U.S.

government enacted new tax legislation commonly referred to as the Tax Cuts and Jobs Act (the Tax Act).

Among other provisions, the Tax Act imposed limitations on the use of certain net operating losses and allows such losses to be carried forward indefinitely.

Additionally, the Tax Act further limits annual interest deductibility which the Company has considered in its determination of deferred taxes.

On March 27, 2020, the U.S.

government enacted the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) which included temporary relief from the net operating loss limitations imposed by the Tax Act for tax years beginning after December 31, 2017 and before January 1, 2021, and made certain technical corrections to applying the net operating loss utilization limitations for tax years beginning after January 1, 2021.

government enacted the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) which included temporary relief from the net operating loss limitations imposed by the Tax Cuts and Jobs Act for tax years beginning after December 31, 2017 and before January 1, 2021, and made certain technical corrections to applying the net operating loss utilization limitations for tax years beginning after January 1, 2021.

Our ability to use our net operating losses is conditioned upon generating future U.S.

9 unchanged sentences

Any failure to maintain effective controls could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the Securities and Exchange Commission (SEC).

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock.

7 unchanged sentences

Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

GAAP is subject to interpretation by the Financial Accounting Standards Board, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

Accounting principles generally accepted in the United States (“GAAP”) are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.

A change in these principles or interpretations could have a significant effect on our reported financial results, and could affect the reporting of transactions completed before the announcement of a change.

7 unchanged sentences

The stock price of our Class A common stock may be volatile or may decline.

Prior to our initial public offering, or IPO, there was no public market for shares of our Class A common stock.

Prior to our IPO, there was no public market for shares of our Class A common stock.

The market prices of the securities of other newly public companies have historically been highly volatile, and our stock price has been volatile since our IPO.

19 unchanged sentences

If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 49% of the voting power of our capital stock as of October 31, 2020.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 46.5% of the voting power of our capital stock as of April 30, 2021.

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share.

As of October 31, 2020, our directors, executive officers, and their affiliates, held in the aggregate 49% the voting power of our capital stock.

As of April 30, 2021, our directors, executive officers, and their affiliates, held in the aggregate 46.5% the voting power of our capital stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten year anniversary of the closing of our IPO.

6 unchanged sentences

In addition, we have options outstanding that, if fully exercised, would result in the issuance of shares of our Class A and Class B common stock.

We also have restricted stock units, or RSUs, outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock.

All of the shares of Class A and Class B common stock issuable upon the exercise of stock options and vesting of RSUs and the shares reserved for future issuance under our equity incentive plans, are registered for public resale under the Securities Act.

We also have restricted stock units (“RSUs”) outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock.

Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.

31 unchanged sentences

• any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws;

• or any action asserting a claim against us that is governed by the internal affairs doctrine.

• any action asserting a claim against us that is governed by the internal affairs doctrine.

This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits with respect to such claims.

3 unchanged sentences

We may not have sufficient cash flow from our business to pay our indebtedness.

In February 2018, we issued the 2023 convertible senior notes in a private offering (2023 Notes), in September 2019, we issued the 2025 convertible senior notes in a private offering (2025 Notes) and in June 2020 we issued the 2026 convertible senior notes in a private offering (2026 Notes, and together with the 2023 Notes and 2025 Notes, the Notes).

Since February 2018, we have issued convertible notes due in 2023 (“2023 Notes”), 2025 (“2025 Notes”) and 2026 (“2026 Notes” and together with the 2023 Notes and 2025 Notes, the “Notes”).

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

11 unchanged sentences

Our failure to repurchase Notes at a time when the repurchase is required by the indenture governing such notes or to pay any cash payable on future conversions of the Notes as required by such indenture would constitute a default under such indenture.

A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under

agreements governing our future indebtedness.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

If the repayment of the related indebtedness were to be accelerated

after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

In addition, our indebtedness, combined with our other financial obligations and contractual commitments, could have other important consequences.

11 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

As disclosed in Note 9 to our condensed consolidated financial statements, the conditional conversion feature of the 2023 Notes was triggered as of October 31, 2020, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between November 1, 2020 and January 31, 2021.

As disclosed in Note 9 to our condensed consolidated financial statements, the conditional conversion features of the 2023 Notes were triggered as of April 30, 2021, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between May 1, 2021 and July 31, 2021.

Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

From the date of their respective issuances through October 31, 2020, the conditions allowing holders of the 2025 Notes and the 2026 Notes, respectively, to convert were not met.

From the date of their respective issuances through April 30, 2021, the conditions allowing holders of the 2025 Notes and the 2026 Notes, respectively, to convert were not met.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The 2023 Notes were classified as current liabilities on the condensed consolidated balance sheet as of October 31, 2020.

The 2023 Notes and 2025 Notes were classified as current liabilities on the condensed consolidated balance sheet as of April 30, 2021.

Transactions relating to our Notes may affect the value of our Class A common stock.

3 unchanged sentences

In addition, in connection with the issuance of the 2023 Notes, we entered into convertible note hedges (“Note Hedges”) with certain financial institutions (the “2023 Notes Option Counterparties”).

We also entered into warrant transactions with the 2023 Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (Warrants).

We also entered into warrant transactions with the 2023 Notes Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).

The Note Hedges are expected generally to reduce the potential dilution to our Class A common stock upon any conversion or settlement of the 2023 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2023 Notes, as the case may be.

The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.

In September 2019 and June 2020, and in connection with the first partial repurchase of 2023 Notes (First Partial Repurchase) and the second partial repurchase of 2023 Notes (Second

Partial Repurchase), the Company terminated Note Hedges corresponding to approximately 4.6 million shares and 1.4 million shares, respectively.

As of October 31, 2020, Note Hedges giving the Company the option to purchase approximately 0.8 million shares (subject to adjustment), remained outstanding.

In September 2019 and June 2020, and in connection with the First Partial Repurchase of 2023 Notes and the Second Partial Repurchase of 2023 Notes, the Company terminated warrants corresponding to approximately 4.6 million shares and 1.4 million shares, respectively.

As of October 31, 2020, warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

Through April 30, 2021, Note Hedges corresponding to approximately 6.5 million shares have been terminated or settled.

As of April 30, 2021, Note Hedges giving us the option to purchase approximately 0.7 million shares (subject to adjustment) remained outstanding.

Through April 30, 2021, we have

terminated Warrants corresponding to approximately 6.1 million shares.

As of April 30, 2021, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into capped call transactions (“Capped Calls”) with certain financial institutions (the 2025 Notes and 2026 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the “Option Counterparties”).

3 unchanged sentences

The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.

Under Financial Accounting Standards Board Accounting Standards Codification 470-20, Debt with Conversion and Other Options , which we refer to as ASC 470-20, an entity must separately account for the liability and equity components of convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.

Under FASB Accounting Standards Codification 470-20, Debt with Conversion and Other Options (“ASC 470-20”), an entity must separately account for the liability and equity components of convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.

ASC 470-20 requires the value of the conversion options of the Notes, representing the equity component, to be recorded as additional paid-in capital within stockholders’ equity in our condensed consolidated balance sheet and as a discount to the Notes, which reduces their initial carrying value.

1 unchanged sentence

Accordingly, we will report lower net income or higher net loss in our financial results because ASC 470-20 requires interest to include both the current period’s accretion of the debt discount and the instrument’s coupon interest, which could adversely affect our reported or future financial results, the trading price of our Class A common stock and the respective trading price of the Notes.

In addition, under certain circumstances, convertible debt instruments (such as the Notes) that may be settled entirely or partly in cash are currently permitted to be accounted for using the treasury stock method, the effect of which is that the shares issuable upon conversion of the Notes are not included in the calculation of diluted earnings per share except to the extent that the conversion value of the Notes exceeds their principal amount.

Under the treasury stock method, for diluted earnings per share purposes, the transaction is accounted for as if the number of shares of Class A common stock that would be necessary to settle such excess, if we elected to settle such excess in shares, are issued.

Accounting standards in the future will not permit the use of the treasury stock method.

As disclosed in Note 2 to our condensed consolidated financial statements, the Financial Accounting Standards Board recently issued an accounting standards update to amend these accounting standards to eliminate the treasury stock method for convertible instruments and instead require application of the “if-converted” method which would be effective for us beginning in fiscal 2023, but may be voluntarily adopted earlier.

We currently already apply the “if-converted” method for calculating any potential dilutive effect of the conversion options embedded in the Notes on diluted net income per share, which assumes that all of the Notes were converted solely into shares of Class A common stock at the beginning of the reporting period or the issuance date of the corresponding Notes, unless the result would be anti-dilutive.

The standards update also eliminates the liability and equity component separation model for convertible debt instruments with a cash conversion feature, which is expected to reduce reported interest expense, increase reported net income, and result in a reclass of certain balance sheet amounts from stockholders' equity to liabilities as it relates to our Notes.

General Risks

Accounting standards in the future will result in changes to the current ASC 470-20 accounting model.

The FASB issued an accounting standards update that eliminates the liability and equity component separation model for convertible debt instruments with a cash conversion feature.

Among other potential impacts, this change is expected to reduce reported interest expense, increase reported net income or lower net loss and result in a reclassification of certain balance sheet amounts from stockholders' equity to liabilities as it relates to the Notes.

General Risk Factors

We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

1 unchanged sentence

We rely on our leadership team in the areas of research and development, operations, security, marketing, sales, customer support, general and administrative functions, and on individual contributors in our research and development and operations functions.

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business.

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.

For example, we recently announced that our Chief Financial Officer is stepping down from his role and a new interim Chief Financial Officer has been appointed effective June 1, 2021.

Such changes in our executive management team may be disruptive to our business.

We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and they could terminate their employment with us at any time.

2 unchanged sentences

In addition, to execute our growth plan, we must attract and retain highly qualified personnel.

Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in other locations where we maintain offices, is intense, especially for engineers experienced in designing and developing software and SaaS applications and experienced sales professionals.

applications and experienced sales professionals.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions, or at all.

5 unchanged sentences

If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

Exposure to political developments in the United Kingdom, including the exit of the United Kingdom from the European Union, could harm us.

On January 31, 2020, the United Kingdom withdrew from the European Union and entered into a transition period through December 31, 2020 to, among other things, negotiate an agreement with the European Union governing the future relationship between the European Union and the United Kingdom.

The referendum and subsequent withdrawal of the United Kingdom from the European Union has created significant political and economic uncertainty about the future relationship between the United Kingdom and the European Union.

The referendum, withdrawal and transition period mean that the long-term nature of the United Kingdom’s relationship with the European Union is unclear.

The political and economic instability created by the United Kingdom’s vote to leave the European Union has caused and may continue to cause significant volatility in global financial markets and the value of the British Pound or other currencies, including the Euro.

In addition, this uncertainty may cause some of our customers or potential customers to curtail or delay spending, and any exit from the European Union may result in new regulatory and cost challenges to our United Kingdom and global operations.

The outcome of the referendum has also created uncertainty with regard to the regulation of data protection, immigration and taxation, among other issues, in the United Kingdom.

In particular, it is unclear how the United Kingdom's vote to leave the European Union will affect the United Kingdom's enactment of the European General Data Protection Regulation, and how data transfers to and from the United Kingdom will be regulated.

Depending on the terms reached regarding any exit from the European Union, it is possible that there may be adverse practical or operational implications on our business.

The requirements of being a public company may strain our resources, divert management’s attention, and affect our ability to attract and retain executive management and qualified board members.

We are subject to the reporting requirements of the Exchange Act, the listing standards of NASDAQ and other applicable securities rules and regulations.

We expect that the requirements of these rules and regulations will continue to increase our legal, accounting, and financial compliance costs, make some activities more difficult, time-consuming, and costly, and place significant strain on our personnel, systems, and resources.

For example, the Exchange Act requires, among other things, that we file annual, quarterly and current reports with respect to our business and results of operations.

As a result of the complexity involved in complying with the rules and regulations applicable to public companies, our management’s attention may be diverted from other business concerns, which could harm our business, results of operations and financial condition.

Although we have already hired additional employees to assist us in complying with these requirements, we may need to hire more employees in the future or engage outside consultants, which will increase our operating expenses.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs, and making some activities more time-consuming.

These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to invest substantial resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from business operations to compliance activities.

If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed.

Being a public company under these new rules and regulations has made it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage.

These factors could also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

As a result of disclosure of information in filings required of a public company, our business and financial condition is visible, which may result in an increased risk of threatened or actual litigation, including by competitors and other third parties.

If such claims are successful, our business and results of operations could be harmed, and even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and harm our business, results of operations and financial condition.

Catastrophic events may disrupt our business.

1 unchanged sentence

We have a large employee presence in San Francisco, California and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business.

For example, in October 2019, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely.

For example, in the fall of 2019 and 2020, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely.

In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, terrorist attack or health epidemic (including COVID-19), we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition.

4 unchanged sentences

Incorporated by Reference from

2.1 Agreement and Plan of Merger, dated as of March 3, 2021, by and among Okta, Inc., Auth0, Inc., Ardbeg Merger Sub, Inc., and Fortis Advisors LLC.

Exhibit 2.1 to Form 8-K filed on May 10, 2021

31.1 Certification of the Chief Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

16 unchanged sentences

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

December 2, 2020 /s/ William E.

May 26, 2021 /s/ Michael Kourey

Michael Kourey

Chief Financial Officer

(Principal Financial Officer)

May 26, 2021 /s/ Christopher K.

Christopher K.

Chief Accounting Officer

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors