6 unchanged sentences
A summary of our risks includes, but is not limited to, the following:
−Removed: • Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
−Removed: • We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.
−Removed: • We have experienced rapid growth in recent periods, and our prior growth rates may not be indicative of our future growth.
+Added: • Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our products, which could harm our revenue, results of operations and cash flows.
+Added: • In the past we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability and adversely impacted
+Added: our financial results.
+Added: We may experience similar incidents in the future which may also include disabling access to our service.
+Added: • We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.
+Added: • Our prior growth rates may not be indicative of our future growth.
As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.
5 unchanged sentences
Any material decline in our Dollar-Based Net Retention Rate would harm our future results of operations.
−Removed: • Customer growth could fall below expectations.
−Removed: • The effects of the COVID-19 pandemic have affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
+Added: • Customer growth has slowed in recent periods and could fall below expectations.
• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.
• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.
−Removed: • In the past we have experienced and in the future we may experience cybersecurity incidents that may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
−Removed: • Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.
+Added: • We have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us.
+Added: We may experience similar incidents in the future.
• The stock price of our Class A common stock may be volatile or may decline.
5 unchanged sentences
Risks Related to Our Business and Industry
−Removed: Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
+Added: Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our products, which could harm our revenue, results of operations and cash flows.
Our revenue, results of operations and cash flows depend on the overall demand for our products.
−Removed: Concerns about the inflation and interest rate environment, the COVID-19 pandemic, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.
+Added: Concerns about the inflation and interest rate environment, the instability of financial institutions, health epidemics, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical
+Added: issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.
economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.
7 unchanged sentences
As a result, if economic growth in countries where we do business slows or if such countries experience further economic recession, it could harm our business, revenue, results of operations and cash flows.
−Removed: We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.
−Removed: Much of our growth has occurred in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.
−Removed: We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, including the risks and uncertainties described in this document.
+Added: We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.
+Added: We have experienced rapid growth since our founding in 2009.
+Added: As we continue efforts to expand our business globally, we have faced new macroeconomic conditions, as well as operational and organizational challenges, that make it difficult to forecast our revenue and evaluate our business and future prospects.
+Added: We have encountered and will continue to encounter risks and uncertainties that growing companies frequently experience in rapidly changing industries and macroeconomic environments, including the risks and uncertainties described in this document.
Additionally, the sales cycle for the evaluation and implementation of our platform, which typically extends for multiple months for enterprise deals, may also cause us to experience a delay between increasing operating expenses and the generation of corresponding revenue, if any.
1 unchanged sentence
If we do not address these risks successfully, our results of operations could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.
−Removed: We have experienced rapid growth in recent periods, and our prior growth rates may not be indicative of our future growth.
+Added: Our prior growth rates may not be indicative of our future growth.
As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.
1 unchanged sentence
In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all.
−Removed: We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment, budget constraints and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:
+Added: We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment and budget constraints, as well as, but not limited to, our ability to:
• price our platform effectively so that we are able to attract and retain customers without compromising our profitability;
• attract new customers, successfully deploy and implement our platform, upsell or otherwise increase our existing customers’ use of our platform, obtain customer renewals and provide our customers with excellent customer support;
−Removed: • increase our network of channel partners, which include resellers, system integrators and other distribution partners and independent software vendors (“ISVs”);
+Added: • increase our network of channel partners;
• adequately expand our sales force, and maintain or increase our sales force’s productivity;
+Added: • protect against security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;
• successfully identify and enter into agreements with suitable acquisition targets, integrate any acquisitions and integrate acquired technologies into our existing products or use them to develop new products;
8 unchanged sentences
We expect to continue to incur net losses for the foreseeable future.
−Removed: Because the market for our platform is rapidly evolving and has not yet reached widespread adoption, it is difficult for us to predict our future results of operations.
−Removed: We expect our operating expenses to significantly increase over the next several years as a result of the Auth0 acquisition, and as we hire additional personnel, particularly in sales and marketing, expand and improve the effectiveness of our distribution channels, expand our operations and infrastructure, both domestically and internationally, pursue business combinations and continue to develop our platform.
−Removed: As we continue to develop as a public company, we may incur additional legal, accounting and other expenses that we did not incur historically.
−Removed: If our revenue does not increase to
−Removed: offset these increases in our operating expenses, we will not be profitable in future periods.
+Added: We expect our operating expenses to significantly increase over the next several years as we hire additional personnel, particularly in sales and marketing, expand and improve the effectiveness of our distribution channels, expand our operations and infrastructure, both domestically and internationally, pursue business combinations and continue to develop our platform.
+Added: If our revenue does not increase to offset these increases in our operating expenses, we will not be profitable in future periods.
While historically, our total revenue has grown, not all components of our total revenue have grown consistently.
5 unchanged sentences
For example, our headcount has grown from 5,030 employees as of January 31, 2022 to 5,908 employees as of January 31, 2024.
+Added: In order to manage our growth and better align our organizational structure and resources with our business priorities, we may undertake restructuring plans from time to time.
+Added: For example, during the first quarter of each of fiscal 2024 and fiscal 2025, we announced separate world-wide restructuring plans intended to reduce operating expenses and improve profitability that involved a reduction of our workforce by approximately 300 and 400 full-time employees, respectively.
+Added: We may encounter challenges in the execution of these restructuring efforts, such as adverse impacts on employee morale or attrition beyond the intended reductions, and these challenges could impact our ability to execute on our business initiatives, which could cause our restructuring efforts to not be as effective as anticipated and harm our financial results.
We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports.
6 unchanged sentences
In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction.
−Removed: As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of ISVs, system integrators and other channel partners, to provide personalized account management and customer service.
+Added: As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of independent software vendors (“ISVs”), system integrators and other channel partners, to provide personalized account management and customer service.
If we are not able to continue to provide high levels of customer service, our reputation, as well as our business, results of operations and financial condition, could be harmed.
11 unchanged sentences
Our competitors vary in size and in the breadth and scope of the products and services offered.
−Removed: However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating
−Removed: histories, greater resources to make strategic acquisitions and greater name recognition than we do.
+Added: However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating histories, greater resources to make strategic acquisitions and greater name recognition than we do.
Our principal competitor is Microsoft.
13 unchanged sentences
To increase our revenue and achieve and maintain profitability, we must add new customers or sell additional products to our existing customers.
−Removed: Numerous factors, however, may impede our ability to add new customers and sell additional products to our existing customers, including our failure to convert new organizations into paying customers, failure to attract, effectively train, retain and motivate sales and marketing personnel, failure to develop or expand relationships with channel partners, failure to successfully deploy products for new customers and provide quality customer support or failure to ensure the effectiveness of our marketing programs.
+Added: Numerous factors, however, may impede our ability to add new customers and sell additional products to our existing customers, including our failure to convert new organizations into paying customers, failure to attract, effectively train, retain and motivate sales and marketing personnel, failure to develop or expand relationships with channel partners, failure to successfully deploy products for new customers and provide quality customer support, failure to ensure the effectiveness of our marketing programs, or any negative market perception stemming from past or future security breaches.
In addition, if prospective customers do not perceive our platform to be of sufficiently high value and quality, we will not be able to attract the number and types of new customers that we are seeking.
2 unchanged sentences
If we are unable to successfully develop new products, enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.
−Removed: Further, to grow our business, we must convince developers to adopt and build their applications using our application programming interfaces (“APIs”) and products.
+Added: Further, to grow our business, we must convince developers to adopt and build their applications using our APIs and products.
We believe that these developer-built applications facilitate greater usage and customization of our products.
6 unchanged sentences
In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates.
−Removed: Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.
+Added: Our customer retention and expansion has, in the past, and may, in the future, decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of macroeconomic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, negative sentiment stemming from cybersecurity incidents, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.
If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.
1 unchanged sentence
If our sales of new or recurring subscriptions and software-related support service contracts decline from existing customers, our revenue and revenue growth may decline, and our business will suffer.
−Removed: Customer growth could fall below expectations.
−Removed: We have experienced significant growth in the number of our customers in recent periods.
−Removed: As our customer base continues to grow and as we increase our focus on sales to the world’s largest organizations, we do not expect customer growth to continue at the same pace as it has previously.
−Removed: These factors could cause customer growth to fall below analyst or investor expectations.
−Removed: If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.
−Removed: The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
−Removed: The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, including vaccine mandates, and their impact on the global economy, our customers, employees and vendors.
−Removed: While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery, as well as the unknown impact of emerging variants of COVID-19.
−Removed: This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.
−Removed: The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.
−Removed: It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.
−Removed: The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.
−Removed: Although global economic conditions have generally improved with the rollout of COVID-19 vaccines, business activity may not recover as quickly as anticipated, including as a result of inflationary pressures and the responses by central banking authorities to control such inflation, rising interest rates, debt and equity market fluctuations, diminished liquidity and credit availability, increased
−Removed: unemployment rates, decreased investor and consumer confidence, political turmoil and supply chain challenges.
−Removed: Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.
+Added: Customer growth has slowed in recent periods and could fall below expectations.
+Added: We have experienced significant growth in the number of our customers since our founding, but this growth has slowed in recent periods.
+Added: As we increase our focus on sales to the world’s largest organizations, we do not expect customer growth to continue at the same pace as it has previously.
+Added: This could cause customer growth to fall below analyst or investor expectations.
+Added: If we fail to meet or exceed such expectations for this or any other reason, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.
We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.
2 unchanged sentences
• our ability to attract new customers, obtain renewals from existing customers and upsell or otherwise increase our existing customers’ use of our platform;
−Removed: • health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;
• the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;
−Removed: • pricing pressure as a result of competition, the inflation and interest rate environment and increased costs, COVID-19 or otherwise;
+Added: • security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;
+Added: • pricing pressure as a result of competition, the inflation and interest rate environment and increased costs;
• seasonal buying patterns for IT spending;
3 unchanged sentences
• increases in and timing of sales and marketing and other operating expenses that we may incur to grow and expand our operations and to remain competitive;
−Removed: • significant security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products;
−Removed: • our ability to comply with privacy laws and requirements, including the General Data Protection Regulation and California Consumer Privacy Act;
+Added: • our ability to comply with privacy laws and requirements;
• costs related to the acquisition of businesses, talent, technologies or intellectual property, including potentially significant amortization costs and possible write-downs;
5 unchanged sentences
• expenses related to real estate, including our office leases, and other fixed expenses;
+Added: • health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;
• general economic conditions in either domestic or international markets, including the inflation and interest rate environment, geopolitical uncertainty and instability.
1 unchanged sentence
You should not rely on our past results as an indicator of our future performance.
−Removed: The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or other metrics for a particular period.
+Added: The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or
+Added: other metrics for a particular period.
If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.
7 unchanged sentences
Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.
+Added: Even if we maintain adequate research and development resources, we may be unable to monetize newly developed products or features such that we can recoup our research and development expenditures.
+Added: For example, if we develop a new product feature but our competitors give an equivalent feature away for free, we may need to also include our newly developed feature for free as part of an existing product offering to remain competitive in the marketplace.
+Added: Such a loss of anticipated revenue to offset our research and development expenditures may harm our business, results of operations and financial condition.
Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.
−Removed: We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities.
+Added: We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, teams or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities.
The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.
1 unchanged sentence
If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, and adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.
−Removed: For example, we have experienced and continue to experience aspects of such challenges in connection with our May 2021 acquisition of Auth0.
+Added: For example, we have experienced aspects of such challenges in connection with our May 2021 acquisition of Auth0.
We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.
20 unchanged sentences
These risks include, among other things:
−Removed: • health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;
−Removed: • macroeconomic conditions, including the inflation and interest rate environment and the economic impact of the COVID-19 pandemic;
+Added: • macroeconomic conditions, including the inflation and interest rate environment;
• unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;
2 unchanged sentences
• costs and liabilities related to compliance with the numerous and ever-growing landscape of U.S.
−Removed: and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, including implementation of the recently-announced agreement in principle between the European Union and United States to implement a successor framework to the EU-U.S.
−Removed: Privacy Shield, to address cross-border data flows;
+Added: and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, to address cross-border data flows;
• greater risk that our foreign employees or partners will fail to comply with U.S.
9 unchanged sentences
• global economic uncertainty caused by global political events;
+Added: • health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;
• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;
4 unchanged sentences
Changes in exchange rates affect our costs and earnings, and may also affect the book value of our assets located outside the United States and the amount of our stockholders’ equity.
−Removed: We have limited experience in marketing, selling and supporting our platform abroad.
−Removed: Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful.
If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.
9 unchanged sentences
These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers.
−Removed: As we continue to focus on sales to larger organizations and in light of the current COVID-19 environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.
+Added: As we continue to focus on sales to larger organizations and in light of the current macroeconomic environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.
Other factors that may influence the length and variability of our sales cycle include, among other things:
34 unchanged sentences
The sale of our services to government agencies is tied to budget cycles, and there are government requirements and authorizations that we may be required to meet.
−Removed: Further, we may be subject to audits and investigations regarding our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines, and suspension or debarment from future government business.
+Added: Further, we may be subject to audits and investigations regarding
+Added: our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines, and suspension or debarment from future government business.
Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense.
Government entities often require contract terms that differ from our standard arrangements and impose additional compliance requirements, require increased attention to pricing practices, or are otherwise time consuming and expensive to satisfy.
+Added: For example, some of our government entity customers contract with us on the basis of our authorization under FedRAMP, which has, in the past, and may, in the future, require us to undertake additional actions and expense to ensure compliance.
Government entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.
−Removed: If we represent that we meet certain standards or requirements and do not meet them, we could be subject to increased liability from our customers, investigation by regulators or termination rights.
+Added: If we represent that we meet certain standards, authorizations (such as FedRAMP) or requirements and do not meet them, or if such authorizations are suspended or revoked, we could be subject to increased liability from our customers, investigation by regulators or termination rights.
Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.
3 unchanged sentences
We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers.
−Removed: For example, in the fourth quarter of fiscal 2023, we rebranded our Okta and Auth0 product offerings, which we now refer to as Workforce Identity Cloud and Customer Identity Cloud.
Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.
Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices.
−Removed: In the past, our efforts to build our brand have involved significant expenses.
+Added: In the past, our efforts to build our brand have involved significant expenses and have not always attracted a sufficient number of new customers to be cost-effective.
Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand.
2 unchanged sentences
In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product.
−Removed: We expect that we may need to change our pricing in future periods and potentially in response to COVID-19 pricing pressures, the inflation and interest rate environment and increased costs.
+Added: We expect that we may need to change our pricing in future periods and potentially in response to the inflation and interest rate environment and increased costs.
Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.
5 unchanged sentences
If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.
−Removed: If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified
−Removed: liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.
+Added: If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.
If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:
11 unchanged sentences
Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.
−Removed: Actions that we are taking to restructure our business to improve profitability may not be as effective as anticipated.
−Removed: During the first quarter of fiscal 2024, we announced a world-wide restructuring plan intended to reduce operating expenses and improve profitability.
−Removed: We may encounter challenges in the execution of these efforts, and these challenges could impact our ability to execute on our business initiatives and could impact our financial results.
−Removed: If we are unable to realize the expected outcomes from our restructuring efforts, our business and operating results may be harmed.
Increased and complex scrutiny of environmental, social and governance (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.
10 unchanged sentences
Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring and reporting on many ESG matters.
−Removed: Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently
+Added: Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently verified.
In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters, and increased regulation will likely lead to increased compliance costs as well as scrutiny that could heighten all of the risks identified in this risk factor.
3 unchanged sentences
Our continued growth depends, in part, on the ability of our existing and potential customers to access our platform 24 hours a day, seven days a week, without interruption or degradation of performance.
−Removed: We may experience disruptions, data loss, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure and functionality changes, human or software errors, capacity constraints or security-related incidents.
−Removed: In some instances, we may not be able to identify the cause or causes of these performance problems immediately or in short order.
+Added: We have, in the past, and may, in the future, experience disruptions, data loss or corruption, outages and other performance problems with our infrastructure or service due to a variety of factors.
+Added: These factors include, for example,
+Added: infrastructure and functionality changes, human or software errors, capacity constraints, ransomware attacks that encrypt our data and render it inaccessible or security-related incidents.
+Added: In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take months, or even years, for such problems to become pronounced enough for us to detect or for our customers to detect and inform us.
We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our products become more complex and our user traffic increases.
2 unchanged sentences
Moreover, we depend on services from various third parties to maintain our infrastructure and distribute our products via the internet.
−Removed: If a service provider fails to provide sufficient capacity to support our platform or otherwise experiences service outages, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platform's reliability and our revenues.
+Added: If a service provider fails to provide sufficient capacity to support our platform or otherwise experiences service outages, including intentionally blocking our internet traffic or all internet traffic, for example at the request of a national government intending to isolate its country’s network, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platform's reliability and our revenues.
Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our products.
4 unchanged sentences
Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise harm our business, results of operations and financial condition.
−Removed: In the past we have experienced and in the future we may experience cybersecurity incidents that may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
+Added: In the past we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability and adversely impacted our financial results.
+Added: We may experience similar incidents in the future which may also include disabling access to our service.
Increasingly, companies, including Okta, are subject to a wide variety of attacks on their systems and networks on an ongoing basis.
−Removed: In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state and nation-state-supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS’ or other cloud services providers’ systems), internal networks, our customers’ systems and the information that they store and process.
−Removed: For example, like other companies, we have experienced numerous cybersecurity attacks and have had to expend increasing amounts of human and financial capital to respond.
−Removed: We expect that these cybersecurity attacks will continue and that the scope and sophistication of these efforts may increase in future periods.
+Added: In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS’ or other cloud services providers’ systems), internal networks, our customers’ systems and the information that we and they store and process.
+Added: For example, like other companies, we have experienced an increase in cybersecurity attacks and have had to expend increasing amounts of human and financial capital to respond.
+Added: We expect that these cybersecurity attacks will continue and that the scope and sophistication of these efforts will increase in future periods.
Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks.
−Removed: As a well-known provider of identity and security solutions, we pose an attractive target for such attacks.
−Removed: The security measures we have integrated into our internal systems and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks and platform against certain attacks.
−Removed: In addition, techniques used to sabotage or to obtain unauthorized
−Removed: access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.
−Removed: As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.
−Removed: Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and users’ personal data.
+Added: As a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, we pose an attractive target for such attacks.
+Added: The security measures we have integrated into our internal systems and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected and have not in the past been, and may not in the future be, sufficient to protect our internal networks and platform against certain attacks.
+Added: In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.
+Added: As a result, we and our third-party service providers have in the past been, and may in the future be, unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.
+Added: Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and
+Added: processes customers’ proprietary information and users’ personal data.
Okta has experienced and likely will in the future experience attacks targeting such customer data.
When such breaches occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and if the confidentiality, integrity or availability of our customers’ data or systems is disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.
−Removed: Because techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures.
+Added: Techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target.
+Added: As a result, we, our third-party service providers and our customers have not in the past been, and may not in the future be, able to anticipate these techniques or to implement adequate preventive measures.
Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.
−Removed: In addition, security breaches impacting our platform have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.
+Added: In addition, security breaches impacting our platform have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure or theft of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.
Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations.
+Added: For example, our customers have in the past published public criticisms of our security practices in connection with security incidents, and these postings harm our reputation and brand.
Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses.
−Removed: Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.
−Removed: For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our product or systems, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers.
+Added: Furthermore, as a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.
Our disclosures concerning security incidents also may become the subject of litigation, and our disclosures concerning the January 2022 compromise, for example, have become the subject of lawsuits, as discussed in Item 3, “ Legal Proceedings ” below.
−Removed: While we have taken a number of remediation steps, there is no guarantee that our preventative and mitigation actions with respect to this incident and others like it will fully eliminate the risk of a malicious compromise of our, our third-party service providers’ or our customers’ systems.
+Added: While we have taken a number of remediation steps, there is no guarantee that our preventative and mitigation actions with respect to this incident and others like it will fully eliminate the risk of a malicious compromise of our or our customers’ systems.
+Added: We have experienced cybersecurity incidents resulting from our use of and oversight over third-party service providers and may experience such incidents in the future.
+Added: These incidents have, in the past, and may, in the future, result from our configuration of such providers’ products or from cybersecurity attacks on such providers of the same type that could affect our own systems.
+Added: While we have implemented security measures and configuration policies that seek to protect data stored with our third-party service providers, such measures and policies have not in the past been, and may not in the future be, sufficient to protect our data or our customers’ data.
+Added: For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our product or systems, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers.
+Added: In addition, in October 2023, a threat actor gained unauthorized access to and stole information from inside our customer support system, which was hosted by a third-party service provider.
While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents, and any incidents may result in loss of, or increased costs of, our cybersecurity insurance.
−Removed: These breaches, or any perceived breach, of our systems, our customers’ systems, or other systems or networks secured by our products, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.
−Removed: In addition, a breach of the security measures of one of our key ISVs or other channel partners could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack, and if a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.
−Removed: Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.
−Removed: Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our
−Removed: operations, account lock outs, and, ultimately, harm to our future business prospects and revenue.
+Added: These breaches, or any perceived breach, of our systems, our customers’ systems, our service providers’ systems, or other systems or networks secured by our products, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.
+Added: In addition, a breach of the security measures of one of our key ISVs or other channel partners or a security software supply chain attack even many levels removed could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack.
+Added: For example, an exploitation in an open source library that is imported and used in another framework that is used by a software product used by Okta could introduce an avenue of attack into the Okta service.
+Added: If a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.
+Added: negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.
+Added: Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lockouts, and, ultimately, harm to our future business prospects and revenue.
We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.
−Removed: Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.
+Added: We have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us.
+Added: We may experience similar incidents in the future.
Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform.
−Removed: We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features do not ensure their compliance and may not be effective against all potential privacy or related regulatory concerns.
+Added: We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features have, in the past, not ensured and may, in the future, not ensure our customers’ compliance and may not be effective against all potential privacy or related regulatory concerns.
Many jurisdictions have enacted or are considering enacting or revising privacy and/or data security legislation, including laws and regulations applying to the collection, use, storage, transfer, disclosure and/or processing of personal data.
3 unchanged sentences
Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.
−Removed: In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.
+Added: In addition, some of our customers contract with us on the basis of our authorization under FedRAMP, which, in addition to state or international regulations, has, in the past, and may, in the future, require us to undertake additional actions and expense to ensure compliance.
We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union, India and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.
For example, the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which took effect on January 1, 2023 and significantly modifies the CCPA, broadly define personal information and give California residents expanded privacy rights and protections and provide for civil penalties for violations and a private right of action for data breaches.
−Removed: The CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.
−Removed: Since the CPRA passed, Virginia, Colorado, Utah and Connecticut have each passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and will take effect in 2023.
−Removed: Some observers see this influx of state privacy regimes as a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business.
−Removed: Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.
+Added: The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.
+Added: Since the CPRA passed, a number of states have passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and, depending on the jurisdiction, will take effect in 2024 or thereafter.
+Added: Following California’s enactment of the CCPA and CPRA, a number of other states have passed new privacy laws with differing requirements and remedies for violations.
+Added: We expect that additional states will enact privacy regulations that differ from each other.
+Added: We may expend significant resources attempting to comply with conflicting and overlapping state privacy regulations, and the cost and complexity of complying with such regulations could adversely affect our business or increase our potential liability if we fail to comply.
+Added: This influx of state privacy regimes indicates a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, which could also increase our potential liability and adversely affect our business.
+Added: Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our
Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.
1 unchanged sentence
With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.
−Removed: Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually
−Removed: committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.
+Added: Any failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.
We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.
5 unchanged sentences
This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.
−Removed: Privacy is a mission-critical issue for Okta and for our customers.
+Added: Privacy is a key issue for Okta and for our customers.
We have attained multiple privacy certifications, such as the Asia-Pacific Economic Cooperation Privacy Recognition for Processors, and the European Union Cloud Code of Conduct, Level 2.
If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.
−Removed: We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S.
+Added: We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws and increased scrutiny over EU-U.S.
data transfers.
−Removed: We are subject to the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK General Data Protection Regulation and Data Protection Act 2018 (“UK Data Protection Laws”).
−Removed: The GDPR and UK Data Protection Laws have enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.
−Removed: Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher.
−Removed: The UK Data Protection Laws mirror the fines under the GDPR.
−Removed: Given the breadth and depth of changes in data protection obligations, complying with its requirements has caused us to expend significant resources and such expenditures are likely to continue into the near future as we respond to new interpretations and enforcement actions following the effective date of the regulation and as we continue to negotiate data processing agreements with our customers and business partners.
−Removed: Separate EU laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving.
−Removed: A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties.
+Added: We are subject to global data protection laws and regulations (“Data Protection Laws”) that may impact how we do business with customers.
+Added: Data Protection Laws, such as those applicable in the European Union, Canada and certain of its provinces, United Kingdom, Asia, and certain states in the United States, have enhanced data protection obligations for companies that handle personal data.
+Added: Obligations include, for example, expanded disclosures about how personal data is to be used, individual rights to access and delete personal data, limitations on retention of personal data, mandatory data breach notification requirements and strict obligations on service providers.
+Added: In addition, increasing numbers of Data Protection Laws restrict transfers of personal data outside of their country of origin to countries deemed to lack adequate privacy protections.
+Added: These types of transfers must be supported by a transfer mechanism that we may be required to implement;
+Added: for example, data transfers out of the European Economic Area may require certification to the EU-U.S.
+Added: Data Privacy Framework (“DPF”) or agreeing to the European Commission’s Standard Contractual Clauses (“SCCs”), each of which impose additional compliance obligations.
+Added: One Okta subsidiary is a certified participant of the DPF and receives European personal data in the U.S.
+Added: pursuant to the DPF and the SCCs, and by contrast, the rest of Okta relies on the SCCs for its lawful transfers of European personal data to the U.S.
+Added: The DPF and the SCCs are subject to further review by European authorities (such as the Court of Justice of the European Union) and could be invalidated in the future, requiring expenditure of additional resources to support lawful transfers of European personal data.
+Added: Additional jurisdictions continue to adopt data localization laws, which require personal data, or certain subcategories of personal data, to be stored in the jurisdiction of origin.
+Added: These regulations may deter customers from using cloud-based services such as ours and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.
+Added: This regulatory environment applicable to the handling of personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, results of operations and financial condition being harmed.
+Added: We and our customers may face a risk of enforcement actions by an increasing number of global data protection authorities in countries where data protection laws apply to us and with which we may not be able to comply.
+Added: Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, results of operations and financial condition.
+Added: Non-compliance with these obligations can trigger significant fines.
+Added: For example, in Europe fines for non-compliance can be a maximum of €20 million or 4% of total worldwide annual revenue, whichever is higher.
+Added: states, fines can be up to $7,500 per violation, multiplied by the number of impacted individuals, and, in addition, some states allow a private right of action.
+Added: Given the breadth and depth of changes in data protection obligations, complying with these requirements has caused us to expend significant resources, which is likely to continue into the near future as we respond to new interpretations and enforcement actions.
+Added: In addition, new laws are continually being passed.
+Added: For example, in the European Union, a draft ePrivacy Regulation extends strict opt-in marketing rules, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties for violations.
+Added: India recently passed a comprehensive data protection law that will apply new privacy rules for the first time in that country.
+Added: In addition, the number of U.S.
+Added: states with comprehensive Data Protection Laws significantly increased in 2023.
We cannot yet determine the impact that such future laws, regulations and standards may have on our business.
Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.
−Removed: We may incur substantial expense in complying with any new obligations and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.
−Removed: In addition, the GDPR restricts transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the United States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (“SCCs”) approved by the European Commission and, until July 16, 2020, the Privacy Shield for EU-U.S.
−Removed: data transfers.
−Removed: With regard to transfers to the United States of personal data from our employees and European customers and users, we rely upon the SCCs.
−Removed: On July 16, 2020, in what is known as the “Schrems II” decision, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S.
−Removed: Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S.
−Removed: entities who had self-certified under the Privacy Shield scheme.
−Removed: While the CJEU upheld the adequacy of the SCCs (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances.
−Removed: Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place.
−Removed: In June 2021, the European Commission issued new SCCs that account for the CJEU’s “Schrems II” decision.
−Removed: The new SCCs must be used for relevant new data transfers, and existing SCCs arrangements were required to be migrated to the new SCCs by December 27, 2022.
−Removed: These new SCCs only apply to the transfer of personal data outside the EEA, and not the United Kingdom.
−Removed: The United Kingdom’s Information Commissioner’s Office released revised UK standard contractual clauses that can be used from March 21, 2022, with a two-year grace period.
−Removed: and EU officials are actively seeking a solution to replace the Privacy Shield.
−Removed: On March 25, 2022, the U.S.
−Removed: and European Commission announced that they had agreed in principle to a new “Trans-Atlantic Data Privacy Framework” to enable trans-Atlantic data flows and address the concerns raised in the Schrems II decision.
−Removed: There is no clear timeline for the enactment of this new framework.
−Removed: Moreover, once enacted, the new framework is likely to be subject to legal challenges and may be struck down by the CJEU.
−Removed: Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA and UK to a country outside of the EEA and UK.
−Removed: This means that we may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA and UK.
−Removed: We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA and UK to apply different standards to the transfer of personal data from the EEA and UK to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA and UK to the United States.
−Removed: We also anticipate being required to engage in new contract negotiations with third parties that aid in processing data on our behalf, and entering into the new SCCs.
−Removed: We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA and UK residents.
−Removed: There are few viable alternatives to the SCCs, and the law in this area remains dynamic.
−Removed: These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.
−Removed: The regulatory environment applicable to the handling of EEA and UK residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed.
−Removed: We and our customers may face a risk of enforcement actions by data protection authorities in the EEA and UK relating to personal data transfers to us and by us from the EEA and UK.
−Removed: Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.
−Removed: We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.
−Removed: These regulations may deter customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.
−Removed: We and our customers are at risk of enforcement actions taken by certain EEA and UK data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from the EEA and UK are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.
−Removed: Any investigation or charges by EEA and UK data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.
−Removed: We may find it necessary to establish systems to maintain EEA and UK personal data within the EEA and UK, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.
+Added: We may incur substantial expense in complying with any new obligations, we may be required to make significant changes in our business operations and product and services development, and we may not be able to comply with some of these regulatory developments, all of which may adversely affect our revenues and our business overall.
We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.
If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.
−Removed: The Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.
+Added: HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.
Among other things, HITECH makes HIPAA’s security standards directly applicable to “Business Associates”.
5 unchanged sentences
In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.
−Removed: In addition, the U.S.
−Removed: Department of Health & Human Services recently proposed modifications to the HIPAA privacy regulations (“Privacy Rule”), including certain changes designed to strengthen individuals’ right to access their own health information, improve information sharing for care coordination and case management, and reduce administrative burdens on HIPAA covered entities, while continuing to protect individuals’ health information privacy interests.
−Removed: The proposed rulemaking has not yet been finalized.
−Removed: We will continue to monitor whether any final modifications to the Privacy Rule may obligate us to change our practices.
−Removed: Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.
+Added: Further, certain modifications have been proposed to the HIPAA privacy regulations, and we expect that there
+Added: will continue to be changes to health information privacy laws in the United States, including HIPAA, and we cannot yet determine the impact such changes to existing laws, regulations and standards may have on our business.
If we fail to maintain our security attestations and certifications, our business, results of operations and financial condition may suffer.
−Removed: Security is a mission-critical issue for Okta and for our customers.
−Removed: We have attained multiple certifications, including SOC 2 Type II certifications, CSA Star Level 2 Attestation, ISO/IEC 27001:2013, ISO/IEC 27018:2019 certifications, and agency FedRAMP Moderate Authorities to Operate.
−Removed: We also support FIPS 140-2 encryption requirements.
+Added: Security is essential for Okta and for our customers.
+Added: A number of our product offerings have attained multiple certifications, including SOC 2 Type II Attestations, CSA Star Level 2 Attestation, ISO/IEC 27001:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, multiple agency FedRAMP Authorities to Operate, Department of Defense Impact Level 4, are in accordance with Health Insurance Portability and Accountability Act ("HIPAA"), and comply with many other international security frameworks.
+Added: Workforce Identity Cloud also supports FIPS 140-2 encryption requirements.
If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.
5 unchanged sentences
Our revenue, other results of operations and financial condition could be harmed if we suffer unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.
−Removed: If we are unable to ensure that our products integrate or interoperate with a variety of operating systems and software applications that are developed by others, our platform may become less competitive and our results of operations may be harmed.
+Added: If we are unable to ensure that our products integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platform may become less competitive and our results of operations may be harmed.
The number of people who access the internet through mobile devices and access cloud-based software applications through mobile devices, including smartphones and handheld tablets or laptop computers, has increased significantly in the past several years and is expected to continue to increase.
3 unchanged sentences
As a result, we depend on the interoperability of our products with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control.
−Removed: Any changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services could adversely affect adoption and usage of our platform.
+Added: Past and future changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services have, in the past, and could, in the future, adversely affect adoption and usage of our platform.
+Added: Any change in our customers’ preference for cloud-based identity management or any shift towards on-premises systems could also adversely affect adoption and usage of our platform.
Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in developing products that operate effectively with a range of operating systems, networks, devices, browsers, protocols and standards.
3 unchanged sentences
Without the development of these applications and integrations, both current and potential customers may not find our service sufficiently attractive, and our business, results of operations and financial condition could suffer.
−Removed: Interruptions or delays in the services provided by third-party data centers or internet service providers could impair the delivery of our platform and our business could suffer.
−Removed: We rely on a number of third-party service providers to operate our services, any of which, if it encountered interruptions or delays, could negatively affect our platform, damage our reputation, expose us to liability, cause us to lose customers or otherwise harm our business.
−Removed: For example, we host our platform using AWS data centers and other third-party cloud infrastructure services.
+Added: Interruptions or delays in the services provided by third-party data centers or internet service providers have, in the past, and could, in the future, impair the delivery of our platform and our business could suffer.
+Added: We rely on a number of third-party service providers to operate our services, any of which, if it encounters interruptions or delays, could negatively affect our platform, damage our reputation, expose us to liability, cause us to lose customers or otherwise harm our business.
+Added: For example, we host our platform using AWS data centers and other third-party cloud infrastructure services and, in the past, service interruptions from such infrastructure providers have caused outages on our platform, which could occur again in the future.
All of our products use resources operated by us in these locations.
Our operations depend on protecting the virtual cloud infrastructure hosted in AWS or other cloud services by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit.
−Removed: Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform.
+Added: Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion or malicious action, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform.
A prolonged third-party service disruption affecting our platform for any of the foregoing reasons could be detrimental to our business.
11 unchanged sentences
We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing access to our platform.
−Removed: We also rely on third-party computer systems, broadband and other communications systems and service providers in connection with providing access to our platform generally.
+Added: We also rely on third-party information technology systems, broadband and other communications systems and service providers in connection with providing access to our platform generally.
Any interruptions, outages or delays in our systems and infrastructure, our business and/or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our platform.
−Removed: Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, other natural disasters, acts of war or terrorism and similar events or disruptions may damage or interrupt computer, broadband or other communications systems and infrastructure at any time.
+Added: Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, other natural disasters, acts of war or terrorism, unauthorized access or malicious acts, and similar events or disruptions may damage or interrupt computers, broadband or other communications systems and infrastructure at any time.
Any of these events could cause system interruption, delays and loss of critical data, and could prevent us from providing access to our platform.
9 unchanged sentences
These delays and feature limitations, if they occur, could harm our business, results of operations and financial condition.
−Removed: Real or perceived errors, failures, vulnerabilities or bugs in our products, including deployment complexity, could harm our business and results of operations.
−Removed: Errors, failures, vulnerabilities or bugs may occur in our products, especially when updates are deployed or new products are rolled out.
+Added: Real or perceived errors, failures, vulnerabilities or bugs in our products, including deployment complexity, have, in the past and could, in the future, harm our business and results of operations.
+Added: Errors, failures, vulnerabilities or bugs have, in the past and may, in the future, occur in our products, especially when updates are deployed or new products are rolled out, maintenance patches are applied, or infrastructure, architectural or configuration changes are made.
+Added: In the past, such issues have caused outages for our customers.
Our platform is often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of products, or other aspects of the computing environment into which our products are deployed.
2 unchanged sentences
Real or perceived errors, failures, vulnerabilities or bugs in our products, or delays in or difficulties implementing our product releases, could result in negative publicity, loss of customer data, loss of or delay in market acceptance of our products, a decrease in customer satisfaction or adoption rates, loss of competitive position, or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.
+Added: Issues in the development and use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations.
+Added: We use internally developed and third-party developed machine learning and artificial intelligence (“AI”) technologies in our offerings and business, and we are making investments in expanding our artificial intelligence capabilities in our products, services, and tools, including ongoing deployment and improvement of existing machine learning and AI technologies, as well as developing new product features using AI technologies, including, for example, generative AI.
+Added: AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving regulatory landscape.
+Added: For example, in the European Union, the proposed Artificial Intelligence Act, if approved, would establish obligations for providers of AI based on the type of AI and its potential risks to society.
+Added: The introduction of AI technologies into new or existing products may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.
+Added: For example, even if permitted by our privacy policy and contractual rights, our use of data in novel AI applications may, in time, expand beyond customer expectations.
+Added: The intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by courts or national or local laws or regulations, and the use or adoption of third-party AI technologies into our products and services may result in exposure to claims of copyright infringement or other intellectual property misappropriation.
+Added: Uncertainty around new and emerging AI technologies, such as generative AI, may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections and safeguards for handling the use of customer data with AI technologies, which may be costly and could impact our expenses if we decide to expand generative AI into our product offerings.
+Added: AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed.
+Added: Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability.
+Added: The use of AI technologies presents emerging ethical and social issues, and if we enable or offer solutions that draw scrutiny or controversy due to their perceived or actual impact on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, and/or legal liability.
If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.
3 unchanged sentences
We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.
−Removed: Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete
+Added: Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours.
Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.
35 unchanged sentences
If we inappropriately use open source software, or if the license terms for open source software that we use change, we may be required to re-engineer our products, incur additional costs, discontinue the sale of some or all of our products or take other remedial actions.
+Added: Some open source software may include generative AI software or other software that incorporates or relies on generative AI or other AI technologies.
+Added: The use of such software may expose us to risks as the intellectual property ownership and license rights, including copyright, of generative AI software and tools, has not been fully interpreted by U.S.
+Added: courts or been fully addressed by federal or state regulation.
In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title or controls on origin of the software.
11 unchanged sentences
From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform.
−Removed: Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.
+Added: Although we normally contractually limit our liability with
+Added: respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.
Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.
29 unchanged sentences
As we increase our international sales and business, our risks under these laws may increase.
−Removed: In addition, we use channel partners to sell our products and conduct business on our behalf abroad.
+Added: In addition, we use channel partners to sell our products and conduct business on our behalf.
We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.
We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.
−Removed: Noncompliance with the FCPA, other applicable anti-corruption laws, or anti-money laundering laws could subject us to investigations, whistleblower complaints, sanctions, settlements, prosecution, and other enforcement actions.
+Added: Noncompliance with the FCPA, other applicable anti-corruption laws, or anti-money laundering laws could subject us to investigations, whistleblower complaints, sanctions, settlements, prosecution, and other enforcement actions within the U.S.
+Added: and internationally.
Any violation of these laws could result in disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, loss of export privileges, severe criminal or civil sanctions, suspension or debarment from U.S.
9 unchanged sentences
In addition, various countries regulate the import of certain encryption technology, including through import and licensing requirements, and have enacted laws that could limit our ability to distribute our service or could limit our customers’ ability to implement our service in those countries.
+Added: These laws and regulations may change frequently in response to evolving international issues.
If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties.
10 unchanged sentences
Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.
−Removed: New income, sales, use, value-added or other taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.
−Removed: Those enactments could harm our domestic and international business operations, and our business and financial performance.
−Removed: Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us.
+Added: New income, sales, use, value-added or other transaction level taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.
+Added: Those enactments could adversely impact our domestic and international business operations, and our business and financial performance.
+Added: Further, existing tax laws, statutes, rules,
+Added: regulations or ordinances could be interpreted, changed, modified or applied adversely to us.
These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due.
9 unchanged sentences
Any successful action by state, foreign or other authorities to collect additional or past sales tax could harm our business.
−Removed: State, foreign and local taxing jurisdictions have differing rules and regulations governing sales, use and other indirect taxes, and these rules and regulations are subject to varying interpretations that may change over time.
−Removed: In particular, the applicability of sales and value-added taxes to our platform in various jurisdictions is unclear.
+Added: State, foreign and local taxing jurisdictions have differing rules and regulations governing sales, use and other indirect taxes (including digital services taxes), and these rules and regulations are subject to varying interpretations that may change over time.
+Added: In particular, the applicability of certain sales, value-added and digital services taxes to our platform in various jurisdictions is unclear.
It is possible that we could face tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities.
13 unchanged sentences
federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.
−Removed: On March 27, 2020, the U.S.
−Removed: government enacted the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”), which included temporary relief from the net operating loss limitations imposed by the Tax Cuts and Jobs Act for tax years beginning after December 31, 2017 and before January 1, 2021, and made certain technical corrections to applying the net operating loss utilization limitations for tax years beginning after January 1, 2021.
−Removed: Our ability to use our net operating losses is conditioned upon generating future U.S.
−Removed: federal taxable income.
−Removed: Since we do not know whether or when we will generate the U.S.
−Removed: federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our fiscal 2018 could expire unused.
If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.
27 unchanged sentences
For example, from February 1, 2023 through January 31, 2024, the trading price of our Class A common stock has ranged from $65.04 per share to $92.38 per share.
−Removed: The market price of our Class A common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:
+Added: The market price of our Class A common stock fluctuates significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:
• overall performance of the equity markets and/or publicly-listed technology companies;
6 unchanged sentences
• recruitment or departure of key personnel;
−Removed: • significant security breaches, technical difficulties or interruptions of our service;
+Added: • security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;
• the economy as a whole, the inflation and interest rate environment and market and industry conditions;
8 unchanged sentences
In the past, stockholders have instituted securities class action litigation following periods of market volatility.
−Removed: Our involvement in securities litigation could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.
+Added: Our involvement in securities litigation has, in the past, and could, in the future, subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.
The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 40.4% of the voting power of our capital stock as of January 31, 2024.
1 unchanged sentence
Our Class B common stock has ten votes per share and our Class A common stock has one vote per share.
−Removed: As of January 31, 2023, our directors, executive officers and their affiliates held in the aggregate 41.7% of the voting power of our capital stock.
+Added: As of January 31, 2024, our directors, executive officers and their affiliates held in the aggregate 40.4% of the voting power of our capital stock, taking into account shares of our common stock subject to options that are currently exercisable or exercisable within 60 days of January 31, 2024 and RSUs that are releasable within 60 days of January 31, 2024.
Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten-year anniversary of the closing of our IPO.
9 unchanged sentences
Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.
−Removed: Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below).
+Added: Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below).
If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the Notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.
34 unchanged sentences
We may not have sufficient cash flow from our business to pay our indebtedness.
−Removed: Since February 2018, we have issued convertible notes due in 2023 (“2023 Notes”), 2025 (“2025 Notes”) and 2026 (“2026 Notes” and together with the 2023 Notes and 2025 Notes, the “Notes”).
+Added: We have issued convertible notes due in 2025 (“2025 Notes”) and 2026 (“2026 Notes” and together with the 2025 Notes, the “Notes”).
Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.
34 unchanged sentences
If holders of our Notes elect to convert their notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders.
−Removed: In addition, in connection with the issuance of the 2023 Notes, we entered into warrant transactions with certain financial institutions (the “2023 Notes Option Counterparties”) pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).
−Removed: The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.
−Removed: Through January 31, 2023, we have terminated Warrants corresponding to approximately 6 million shares.
−Removed: As of January 31, 2023, Warrants to acquire up to approximately 1 million shares (subject to adjustment) remained outstanding.
−Removed: In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into capped call transactions (“Capped Calls”) with certain financial institutions (the 2025 Notes and 2026 Notes Capped Call Counterparties and together with the 2023 Notes Option Counterparties, the “Option Counterparties”).
+Added: We have in the past, and may in the future, engage in exchanges, repurchase, or induce conversions of the Notes.
+Added: Holders of the Notes that participate in any of these exchanges, repurchases, or induced conversions may enter into or unwind various derivatives with respect to our Class A common stock or sell shares of our Class A common stock in the open market to hedge their exposure in connection with these transactions.
+Added: These activities could decrease (or reduce the size of any increase in) the market price of our Class A common stock or the Notes, or dilute the ownership interests of our stockholders.
+Added: In addition, the market price of our Class A common stock is likely to be affected by short sales of our Class A common stock or the entry into or unwind of economically equivalent derivative transactions with respect to our Class A common stock by investors that do not participate in the exchange transactions and by the hedging activity of the counterparties to our capped call transactions ("Capped Calls") or their respective affiliates.
+Added: In addition, in connection with the issuance of the 2025 Notes and 2026 Notes, we entered into Capped Calls with certain financial institutions (the “Option Counterparties”).
The Capped Calls are generally expected to reduce potential dilution to our Class A common stock upon any conversion or settlement of the 2025 Notes and 2026 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2025 Notes and 2026 Notes, as the case may be, with such reduction and/or offset subject to a cap.
+Added: If we unwind the Capped Calls in connection with Note repurchases or otherwise, we would lose the anti-dilutive impact of any unwound Capped Calls.
From time to time, the Option Counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivative transactions with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes.
5 unchanged sentences
From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.
−Removed: For example, our President, Worldwide Field Operations retired at the end of our fiscal year and our Executive Vice Chairman and co-founder is on sabbatical through October 2023.
+Added: For example, our former Chief Operating Officer did not return as an employee following his recent sabbatical, though he is continuing to serve as a director and as Vice Chairman of the Board of Directors.
Such changes in our executive management team may be disruptive to our business.
5 unchanged sentences
We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and may not be able to fill positions in the desired regions, or at all.
−Removed: Our efforts to attract new personnel may be compounded by intensified restriction on travel (including during the COVID-19 pandemic), changes to immigration policy or the availability of work visas.
+Added: Our efforts to attract new personnel may be compounded by intensified restriction on travel, changes to immigration policy or the availability of work visas.
Many of the companies with which we compete for experienced personnel have greater resources than we have.
9 unchanged sentences
In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.
−Removed: Unresolved Staff Comments
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.