What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-09-02 compared with 2021-05-27 · 118 added, 93 removed, 814 unchanged (21% of the section changed)

24 unchanged sentences

• Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 46.5% of the voting power of our capital stock as of April 30, 2021.

• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 43.2% of the voting power of our capital stock as of July 31, 2021.

This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

3 unchanged sentences

The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

In December 2019, a novel coronavirus (“COVID-19”) was reported in China, in January 2020, the World Health Organization (“WHO”) declared it a Public Health Emergency of International Concern and in March 2020, the WHO declared it a pandemic.

This contagious disease outbreak has continued to spread across the globe and is impacting worldwide economic activity and financial markets, resulting in an economic downturn that became a global recession.

The extent of the impact of COVID-19 on our future operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, the effectiveness, distribution and acceptance of COVID-19 vaccines, including the vaccines’ efficacy against emerging COVID-19 variants, related public health measures, and their impact on the global economy, our customers, employees and vendors.

While some governments around the world have started to lift restrictions and vaccine distributions have begun, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of the new variants of COVID-19.

The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, and their impact on the global economy, our customers, employees and vendors.

While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of emerging variants of COVID-19.

This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.

As a result of the COVID-19 pandemic, we have temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions.

We shifted our annual user conference, Oktane20 Live, held in the spring of 2020, to a virtual-only conference and in the near-term we have changed our customer, employee and industry events, including Oktane21 Live, to virtual-only formats.

As a result of the COVID-19 pandemic, for most of fiscal 2021, we temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions.

We shifted our customer, employee and industry events, including our annual user conferences Oktane20 Live and Oktane21 Live, to virtual-only formats.

In fiscal 2022, as the administration of vaccines has increased, we have reopened our offices to partial capacity, allowing our employees to voluntarily return, and we continue to evaluate our strategy to return to in-person sales formats and experiences for future annual user conferences.

The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.

It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.

Our operations have also begun to be negatively affected by a range of external factors related to the COVID-19 pandemic that are not within our control.

For example, many cities, counties, states, and countries have imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential

customers’ physical movement to limit the spread of COVID-19.

If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus, and emerging variants, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

Our operations have been and may continue to be negatively affected by a range of external factors related to the COVID-19 pandemic that are not within our control.

For example, many cities, counties, states, and countries imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19.

If the COVID-19 pandemic has a substantial impact

on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.

Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.

44 unchanged sentences

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

For example, our headcount has grown from 2,379 employees as of April 30, 2020 to 3,056 employees as of April 30, 2021.

For example, our headcount has grown from 2,489 employees as of July 31, 2020 to 4,176 employees as of July 31, 2021.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports.

2 unchanged sentences

If we fail to manage our anticipated growth and change in a manner that preserves the key aspects of our corporate culture, the quality of our platform may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.

We have established international offices, including offices in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to continue to expand our international operations into other countries in the future.

We have established international offices in the Americas, Asia-Pacific and Europe, and we plan to continue to expand our international operations in the future.

Moreover, we have added several additional offices through our acquisition of Auth0.

26 unchanged sentences

In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with systems integrators, third-party consulting firms or other parties.

Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market

share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete.

Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of

which could harm our ability to compete.

Furthermore, organizations may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our products.

23 unchanged sentences

We have experienced significant growth in the number of our customers in recent periods.

As our customer base continues to grow and as we increase our focus on sales to the world’s largest organizations, we do not expect customer growth to continue at the same pace as it has previously.

As our customer base continues to grow and as we increase our focus on sales to the world’s largest organizations, we do not

expect customer growth to continue at the same pace as it has previously.

These factors could cause customer growth to fall below analyst or investor expectations.

48 unchanged sentences

• claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

• unknown liabilities or risks associated with the acquired business, product or technology, such as contractual obligations, potential security vulnerabilities of the acquired company and its products and services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

• acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

• acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

• they could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• acquired businesses, technologies or products could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• unforeseen integration or other expenses;

47 unchanged sentences

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our sales are to partners that resell our services to government agencies, and we have made, and may continue to make, investments to support future sales opportunities in the government sector.

Government demand for our products could be impacted by budgetary cycles, and there may be governmental certification requirements for our products.

Further, we may be subject to audits and investigations regarding our role as a

subcontractor in government contracts, and violations could result in penalties and sanctions, including termination of the contract, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale.

Government entities often require contract terms that differ from our standard arrangements and impose compliance requirements that are complicated, increased attention to pricing practices, termination rights tied to funding availability, or are otherwise time consuming and expensive to satisfy.

Government entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

If we represent that we meet special standards or requirements and do not meet them, we could be subject to increased liability from our customers, investigation by regulators or termination rights.

A portion of our sales are to partners that resell our services to government agencies, and we have made, and plan to continue to make, investments to support future sales opportunities in the government sector.

The sale of our services to government agencies is tied to budget cycles, and there are government requirements and authorizations that we may be required to meet.

Further, we may be subject to audits and investigations regarding our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense.

Government entities often require contract terms that differ from our standard arrangements and impose additional compliance requirements, require increased attention to pricing practices, or are otherwise time consuming and expensive to satisfy.

Government entities may also have statutory, contractual or

other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

If we represent that we meet certain standards or requirements and do not meet them, we could be subject to increased liability from our customers, investigation by regulators or termination rights.

Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.

Moreover, changes in the underlying regulatory conditions that affect these types of customers could harm our ability to efficiently provide our service to them and to grow or maintain our customer base.

Moreover, changes in underlying regulatory requirements could be an impediment to our ability to efficiently provide our service to government customers and to grow or maintain our customer base.

Any of these risks related to contracting with government entities could adversely impact our future sales and results of operations, or make them more difficult to predict .

14 unchanged sentences

Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the United Kingdom, the Netherlands, Sweden, France, Germany, Canada, Australia, Singapore and Japan, and we plan to expand our international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and we plan to expand our international operations.

We also have added several additional offices outside the United States through our acquisition of Auth0.

8 unchanged sentences

• laws and business practices favoring local competitors or commercial parties;

• costs and liabilities related to compliance with the EU General Data Protection Regulation 2016/679 and disparate data privacy standards and enforcement;

• costs and liabilities related to compliance with the numerous and ever-growing landscape of U.S.

and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches;

• greater risk that our foreign employees or partners will fail to comply with U.S.

21 unchanged sentences

If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.

If we engage in additional debt financing, we may be

required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

20 unchanged sentences

We may also incur unanticipated costs in the integration of Auth0’s business with our business.

The substantial majority of these costs will be non-recurring expenses relating to the Acquisition, and many of these costs are payable regardless of whether or not the Acquisition is consummated.

The substantial majority of these costs will be non-recurring expenses relating to the Acquisition.

We also could be subject to litigation related to the proposed Acquisition, which could result in significant costs and expenses.

We may not realize potential benefits from the Acquisition because of difficulties related to integration, the achievement of synergies, and other challenges.

We and Auth0 have operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.

Prior to the consummation of the Acquisition, we and Auth0 operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.

Any integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven.

If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized.

Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers,

disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.

Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition so the combined company performs as the parties hope:

6 unchanged sentences

• evaluating and forecasting the financial impact of the Acquisition transaction, including accounting charges.

• effecting potential actions that may be required in connection with obtaining regulatory approvals.

In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.

9 unchanged sentences

Auth0 may have liabilities that we failed, or were unable, to discover, or that we underestimated, in the course of performing our due diligence investigations of Auth0’s business and we, as the successor owner of such acquired company, might be responsible for those liabilities.

Such potential liabilities could include employment-, retirement- or severance-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties.

We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition in connection with such agreement will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we will assume upon consummation of the Acquisition.

additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws.

Such potential liabilities could include employment-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties.

We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we assumed upon consummation of the Acquisition.

We may learn additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws.

Any such liabilities, individually or in the aggregate, could have a material adverse effect on our business, results of operations and financial condition.

22 unchanged sentences

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to

prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and personal data.

If a breach of customer data on our platform were to occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data or systems was disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Because techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures.

Because techniques used to obtain unauthorized access to, or to sabotage, systems

change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures.

Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.

16 unchanged sentences

In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data.

Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.

our practices or the features of our platform.

In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, which broadly defines personal information and gives California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

1 unchanged sentence

The CPRA will take substantial effect on January 1, 2023 with enforcement scheduled for July 1, 2023 and will significantly modify the CCPA and create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Some observers have noted the CCPA and CPRA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business.

Since the CPRA passed, in March 2021, Virginia enacted the Virginia Consumer Data Protection Act (“CDPA”) and, in June 2021, Colorado enacted the Colorado Privacy Act (“CPA”), both of which are comprehensive privacy statutes that share similarities with the CCPA and CPRA.

Some observers have noted the CCPA, CPRA, CDPA and CPA mark the beginning of a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business.

Additionally, in August 2021, the National People’s Congress of the People's Republic of China adopted the Personal Information Protection Law (“PIPL”), which will take effect on November 1, 2021.

The PIPL, which introduces a legal framework similar to the GDPR (as defined and further described below), marks the introduction of a comprehensive system for the protection of personal information in China.

We cannot yet determine the impact that the PIPL may have on our business;

however, we may incur substantial expense in complying with any new obligations, we could be subject to significant fines if we are found to not comply with the PIPL, and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

1 unchanged sentence

If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations our ability to successfully operate our business and pursue our business goals could be harmed.

With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

3 unchanged sentences

Existing and potential privacy laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, products and services such as ours.

Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

Public concerns regarding personal data processing, privacy and security may cause some

of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform.

14 unchanged sentences

data transfers.

On July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S.

With regard to transfers to the United States of personal data from our employees and European customers and users, we rely upon the SCCs.

On July 16, 2020, in what is known as the “Schrems II” decision, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S.

Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S.

1 unchanged sentence

While the CJEU upheld the adequacy of the SCCs (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances.

Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain.

The CJEU went on to state that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer.

The European Commission has now issued new SCCs that account for the CJEU’s “Schrems II” decision.

Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA to a country outside of the EEA.

This means that we may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA.

We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA to apply different standards to the transfer of personal data from the EEA to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA to the United States.

We also anticipate being required to engage in new contract negotiations with third parties that aid in processing data on our behalf, and entering into the new SCCs.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA residents.

There are few viable alternatives to the SCCs, and the law in this area remains dynamic.

These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.

The regulatory environment applicable to the handling of EEA residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed.

We and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.

2 unchanged sentences

Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.

We may find it necessary to establish systems to maintain EU personal data within in the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We may find it necessary to establish systems to maintain EU personal data within the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

If we fail to comply with any of these requirements, we could

be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

7 unchanged sentences

In addition, the U.S.

Department of Health & Human Services recently proposed additional draft HIPAA guidance which is subject to public comment before being finalized.

We will continue to monitor whether the final guidance may obligate us to change our practices.

Department of Health & Human Services recently proposed modifications to the HIPAA privacy regulations (“Privacy Rule”), including certain changes designed to strengthen individuals’ right to access their own health information, improve information sharing for care coordination and case management, and reduce administrative burdens on HIPAA covered entities, while continuing to protect individuals’ health information privacy interests.

The proposed rulemaking has not yet been finalized.

We will continue to monitor whether any final modifications to the Privacy Rule may obligate us to change our practices.

Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.

18 unchanged sentences

Interruptions or delays in the services provided by third-party data centers or internet service providers could impair the delivery of our platform and our business could suffer.

We host our platform using AWS data centers, a provider of cloud infrastructure services.

We rely on a number of third-party service providers to operate our services, any of which, if it encountered interruptions or delays, could negatively affect our platform, damage our reputation, expose us to liability, cause us to lose customers or otherwise harm our business.

For example, we host our platform using AWS data centers, a provider of cloud infrastructure services.

All of our products use resources operated by us in these locations.

1 unchanged sentence

Although we have disaster recovery plans that use multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform.

A prolonged AWS service disruption affecting our platform for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business.

A prolonged AWS service disruption affecting our platform for any of the foregoing reasons could be detrimental to our business.

We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

AWS enables us to order and reserve server capacity in varying amounts and sizes distributed across multiple regions.

AWS provides us with computing and storage capacity pursuant to an agreement that continues until terminated by either party.

AWS provides us with computing and storage capacity pursuant to an agreement that continues

until terminated by either party.

AWS may terminate the agreement by providing 30 days prior written notice and may, in some cases, terminate the agreement immediately for cause upon notice.

27 unchanged sentences

Any such errors, failures, vulnerabilities or bugs may not be found until after they are deployed to our customers.

Real or perceived errors, failures, vulnerabilities or bugs in our products, or delays in or difficulties implementing our product releases, could result in negative publicity, loss of customer data, loss of or delay in market acceptance of our products, a decrease in customer satisfaction or adoption rates, loss of competitive position, or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.

Real or perceived errors, failures, vulnerabilities or bugs in our products, or delays in or difficulties implementing our product releases, could result in negative publicity, loss

of customer data, loss of or delay in market acceptance of our products, a decrease in customer satisfaction or adoption rates, loss of competitive position, or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.

54 unchanged sentences

From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform.

Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Although we normally contractually limit our liability with

respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.

31 unchanged sentences

In addition, we use channel partners to sell our products and conduct business on our behalf abroad.

activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

26 unchanged sentences

Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us.

These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due.

These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties

and interest for past amounts deemed to be due.

If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to purchase our products in the future.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and

other costs, as well as the costs of our products.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

Further, these events could decrease the capital we have available to operate our business.

26 unchanged sentences

Since we do not know whether or when we will generate the U.S.

federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.

federal taxable income necessary to use our

remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

21 unchanged sentences

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

Significant assumptions and estimates used in preparing our condensed consolidated financial statements include, but are not limited to those related to revenue recognition, period of benefit for deferred commissions, incremental borrowing rates for operating leases, effective interest rates for convertible notes, valuation of deferred income taxes, business combination and valuation of goodwill and purchased intangible assets.

Significant assumptions and estimates used in preparing our condensed consolidated financial statements include, but are not limited to those related to business combination and valuation of goodwill and purchased intangible assets, revenue recognition, period of benefit for deferred commissions, incremental borrowing rates for operating leases, effective interest rates for convertible notes, valuation of deferred income taxes and valuation of certain equity awards assumed.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

19 unchanged sentences

In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies.

Stock prices of many companies have

fluctuated in a manner unrelated or disproportionate to the operating performance of those companies.

Stock prices of many companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies.

In the past, stockholders have instituted securities class action litigation following periods of market volatility.

If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 46.5% of the voting power of our capital stock as of April 30, 2021.

If we were to

become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 43.2% of the voting power of our capital stock as of July 31, 2021.

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share.

As of April 30, 2021, our directors, executive officers, and their affiliates, held in the aggregate 46.5% the voting power of our capital stock.

As of July 31, 2021, our directors, executive officers, and their affiliates, held in the aggregate 43.2% of the voting power of our capital stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten year anniversary of the closing of our IPO.

15 unchanged sentences

If one or more of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about our business, our Class A common stock price would likely decline.

If one or more of

these analysts cease coverage of us or fail to publish reports on us on a regular basis, demand for our Class A common stock could decrease, which might cause our Class A common stock price and trading volume to decline.

If one or more of these analysts cease coverage of us or fail to publish reports on us on a regular basis, demand for our Class A common stock could decrease, which might cause our Class A common stock price and trading volume to decline.

We do not intend to pay dividends for the foreseeable future.

43 unchanged sentences

A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

If the repayment of the related indebtedness were to be accelerated

after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

In addition, our indebtedness, combined with our other financial obligations and contractual commitments, could have other important consequences.

11 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

As disclosed in Note 9 to our condensed consolidated financial statements, the conditional conversion features of the 2023 Notes were triggered as of April 30, 2021, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between May 1, 2021 and July 31, 2021.

As disclosed in Note 9 to our condensed consolidated financial statements, the conditional conversion features of the 2023 Notes were triggered as of July 31, 2021, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between August 1, 2021 and October 31, 2021.

Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

From the date of their respective issuances through April 30, 2021, the conditions allowing holders of the 2025 Notes and the 2026 Notes, respectively, to convert were not met.

The conditional conversion features of the 2025 Notes were triggered as of January 31, 2021 and the 2025 Notes were convertible at the option of the holders between February 1, 2021 and April 30, 2021;

however, as of July 31, 2021, the conditions allowing holders of the 2025 Notes to convert were not met.

From the date of issuance through July 31, 2021, the conditions allowing holders of the 2026 Notes to convert were not met.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The 2023 Notes and 2025 Notes were classified as current liabilities on the condensed consolidated balance sheet as of April 30, 2021.

The 2023 Notes were classified as current liabilities on the condensed consolidated balance sheet as of July 31, 2021.

Transactions relating to our Notes may affect the value of our Class A common stock.

6 unchanged sentences

The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.

Through April 30, 2021, Note Hedges corresponding to approximately 6.5 million shares have been terminated or settled.

As of April 30, 2021, Note Hedges giving us the option to purchase approximately 0.7 million shares (subject to adjustment) remained outstanding.

Through April 30, 2021, we have

terminated Warrants corresponding to approximately 6.1 million shares.

As of April 30, 2021, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

Through July 31, 2021, Note Hedges corresponding to approximately 6.7 million shares have been terminated or settled.

As of July 31, 2021, Note Hedges giving us the option to purchase approximately 0.4 million shares (subject to adjustment) remained outstanding.

Through July 31, 2021, we have terminated Warrants corresponding to approximately 6.1 million shares.

As of July 31, 2021, Warrants to acquire up to approximately 1.0 million shares (subject to adjustment) remained outstanding.

In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into capped call transactions (“Capped Calls”) with certain financial institutions (the 2025 Notes and 2026 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the “Option Counterparties”).

15 unchanged sentences

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.

For example, we recently announced that our Chief Financial Officer is stepping down from his role and a new interim Chief Financial Officer has been appointed effective June 1, 2021.

For example, our former Chief Financial Officer stepped down from his role and an interim Chief Financial Officer was appointed effective June 1, 2021.

Such changes in our executive management team may be disruptive to our business.

3 unchanged sentences

In addition, to execute our growth plan, we must attract and retain highly qualified personnel.

Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in other locations where we maintain offices, is intense, especially for engineers experienced in designing and developing software and SaaS

applications and experienced sales professionals.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions, or at all.

15 unchanged sentences

Incorporated by Reference from

2.1 Agreement and Plan of Merger, dated as of March 3, 2021, by and among Okta, Inc., Auth0, Inc., Ardbeg Merger Sub, Inc., and Fortis Advisors LLC.

Exhibit 2.1 to Form 8-K filed on May 10, 2021

10.1# Auth0, Inc.

2014 Equity Incentive Plan .

Exhibit 99.1 to Form S-8 filed on May 10, 2021

10.2# Auth0, Inc.

Phantom Unit Plan .

Exhibit 99.2 to Form S-8 filed on May 10, 2021

10.3# Transition Agreement by and between Michael Kourey and Okta, Inc.

dated May 24, 2021 .

Filed herewith

31.1 Certification of the Chief Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

15 unchanged sentences

* The certifications furnished in Exhibit 32.1 hereto are deemed to accompany this Quarterly Report on Form 10-Q and will not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, except to the extent that the registrant specifically incorporates it by reference.

# Indicates management contract or compensatory plan, contract or agreement.

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

May 26, 2021 /s/ Michael Kourey

Michael Kourey

Chief Financial Officer

May 26, 2021 /s/ Christopher K.

September 1, 2021 /s/ Brett Tighe

Interim Chief Financial Officer

September 1, 2021 /s/ Christopher K.

Christopher K.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors