What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-26 compared with 2023-03-01 · 225 added, 219 removed, 484 unchanged (48% of the section changed)

23 unchanged sentences

and retain and motivate existing personnel, and attract, integrate, and retain new personnel, particularly to our sales and marketing and engineering and product development teams.

Our future growth also depends on changes in our customers’ budgetary constraints, the timing and success of new products and services introduced by us or our competitors, the pace of development of the construction management software industry, regulatory and macroeconomic conditions, and economic conditions and business practices within the construction industry, including construction spending in the public and private sectors.

Our future growth also depends on changes in our customers’ IT budgets, the timing and success of new products and services introduced by us or our competitors, the pace of development of the construction management software industry, regulatory and macroeconomic conditions, and economic conditions and business practices within the construction industry, including construction spending in the public and private sectors.

If we are not able to maintain revenue growth or accurately forecast future growth, our business, financial condition, results of operations, and prospects could be materially adversely affected.

2 unchanged sentences

We incurred net losses of $265.2 million in 2021, $286.9 million in 2022, and $189.7 million in 2023.

As of December 31, 2022, we had an accumulated deficit of $949.1 million.

As of December 31, 2023, we had an accumulated deficit of $1.1 billion.

We are not certain whether or when we will be able to achieve or sustain profitability in the future.

1 unchanged sentence

In particular, we intend to continue to expend substantial financial and other resources on the following:

expanding our sales and marketing and customer success teams to drive new subscriptions, increase the use of our products, services, and platform by existing customers, and support our international expansion;

developing our technology infrastructure, including systems architecture, scalability, availability, performance, and security;

developing our technology infrastructure, including systems architecture, scalability, availability, performance, and data security and privacy;

and investing in our engineering and product development teams and developing new products, services, and platform functionality.

2 unchanged sentences

We may also incur significant losses in the future for a number of reasons, including the other risks described in this Annual Report on Form 10-K, and unforeseen expenses, difficulties, complications, delays, and other unknown events.

If we are unable to successfully address these risks and challenges, our business, financial condition, results of operations, and prospects could be materially adversely affected.

If we are unable to successfully address these risks and

challenges, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our business may be significantly impacted by changes in the economy and in spending across the construction industry.

22 unchanged sentences

Competitors may also develop and introduce new products or entirely new technologies to replace our existing products, which could make our platform obsolete or adversely affect our business.

If our research and development investments do not accurately anticipate user demand or if we fail to develop our products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Furthermore, o ur ability to grow our customer base and increase revenue from customers depends on our ability to enhance and improve our platform in response to changes in the construction management software industry and customer demand.

If our investments in engineering and product development do not accurately anticipate user demand or if we fail to develop our products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Furthermore, our ability to grow our customer base and increase revenue from customers depends on our ability to enhance and improve our platform in response to changes in the construction management software industry and customer demand.

In response to such shifts, we may introduce changes to our existing offerings or introduce new offerings, which may require significant expenditures in research and development and customer support, which may harm our results of operations.

4 unchanged sentences

Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could harm our business.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to retain and expand our customer base may be impaired, and our business may be harmed.

We believe that our brand identity and awareness is critical to our sales and marketing efforts.

We also believe that maintaining and enhancing our brand is critical to retaining and expanding our customer base and, in particular, conveying to customers and collaborators that our platform offers capabilities that address the needs of the construction ecosystem throughout the project lifecycle.

We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become increasingly difficult and expensive.

If we experience difficulties with software development that negatively impact new or existing offerings, we may experience negative publicity or lose market acceptance.

Any unfavorable publicity or negative perception of our products, services, or platform or the providers of construction management software generally, could adversely affect our reputation and our ability to attract and retain customers.

If we fail to promote and maintain our brand, or if we incur increased expenses in this effort, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our ability to increase our customer base, expand existing customers' use of our platform, and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities, the failure of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Continuing and increasing sales of subscriptions to access our products and of our services depend to a significant extent on our ability to expand our sales and marketing capabilities.

It is difficult to predict customer demand, customer retention, and expansion rates, the size and growth rate of the market, the entry of competitive products and services, or the success of existing competitive products and services.

Our sales efforts involve educating prospective customers about the uses and benefits of our products, services, and platform.

We spend substantial time and resources on our sales efforts without any assurance that our efforts will result in a sale.

We expect that we will continue to need intensive sales efforts to educate prospective customers about the uses and benefits of our construction management software and services, and we may have difficulty convincing prospective customers of the value of adopting our products and services.

We plan to continue expanding our sales force, both domestically and internationally.

Identifying, recruiting, and training qualified sales representatives is time-consuming and resource-intensive, and they may not be fully trained and productive for a significant amount of time following their hiring, if ever.

In addition, the cost to acquire customers is high due to these considerable sales and marketing efforts.

Our business will be harmed if our efforts do not generate a corresponding increase in revenue.

Even if we are successful in convincing prospective customers of the value of our products and services, they may decide not to purchase our products and services for a variety of reasons, some of which are out of our control.

The failure of our efforts to secure sales after investing resources in a lengthy sales process could materially adversely affect our business, financial condition, results of operations, and prospects.

We are continuing to expand our operations outside the U.S., where we may be subject to increased business, regulatory, and economic risks (including fluctuations in currency exchange rates) that could materially adversely affect our business, financial condition, results of operations, and prospects.

2 unchanged sentences

Any new markets or countries into which we attempt to sell subscriptions to access our products may not be receptive to our efforts.

For example, we may not be able to expand further in some markets if we are not able to adapt our products, services, and platform to fit the needs of prospective customers in those markets or if we are unable to satisfy certain government- and industry-specific laws or regulations.

In addition, our international operations and expansion efforts requires considerable management attention and the investment of significant resources, while subjecting us to new risks and increasing certain risks that we already face, including risks associated with:

For example, we may not be able to expand further our operations in some markets if we are not able to adapt our products, services, and platform to fit the needs of prospective customers in those markets or if we are unable to satisfy certain government- and industry-specific laws or regulations.

In addition, our international operations and expansion efforts require considerable management attention and the investment of significant resources, while subjecting us to new risks and increasing certain risks that we already face, including risks associated with:

• providing our products, services, and platform in different languages and customizing them to support local requirements;

compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection, consumer protection, and unsolicited email, and unauthorized practice of law (“UPL”), and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

• compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection, consumer protection, and unsolicited email, and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

• recruiting and retaining talented and capable employees outside the U.S., including employees who speak multiple languages and come from a wide variety of different cultural backgrounds and customs, and managing an employee base in jurisdictions with differing employment regulations;

1 unchanged sentence

and navigating the practical enforcement of such intellectual property rights outside of the U.S.;

political and economic instability (including as a result of the COVID-19 pandemic or the military conflict involving Russia and Ukraine);

• political and economic instability, including as a result of the Russia-Ukraine war;

• generally longer payment cycles and greater difficulty in collecting accounts receivable;

13 unchanged sentences

Dollar currencies.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to retain and expand our customer base may be impaired, and our business may be harmed.

We believe that the Procore brand identity and awareness is critical to our sales and marketing efforts.

We also believe that maintaining and enhancing the Procore brand is critical to retaining and expanding our customer base and, in particular, conveying to customers and collaborators that our platform offers capabilities that address the needs of the construction ecosystem throughout the project lifecycle.

We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become increasingly difficult and expensive.

If we experience difficulties with software development that negatively impact new or existing offerings, we may experience negative publicity or lose market acceptance.

If we fail to promote and maintain the Procore brand, or if we incur increased expenses in this effort, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our ability to increase our customer base and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities, the failure of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Continuing and increasing sales of subscriptions to access our products and of our services depend to a significant extent on our ability to expand our sales and marketing capabilities.

It is difficult to predict customer demand, customer retention and expansion rates, the size and growth rate of the market, the entry of competitive products and services, or the success of existing competitive products and services.

Our sales efforts involve educating prospective customers about the uses and benefits of our products, services, and platform.

We spend substantial time and resources on our sales efforts without any assurance that our efforts will result in a sale.

We plan to continue expanding our sales force, both domestically and internationally.

In addition, the cost to acquire customers is high due to these considerable sales and marketing efforts.

Our business will be harmed if our efforts do not generate a corresponding increase in revenue.

We operate in a competitive market, and we must continue to compete effectively.

4 unchanged sentences

Some of our competitors may make acquisitions or enter into strategic relationships with third parties to offer a broader range of products and services than we do;

others may use sales and marketing strategies that enable them to acquire customers at a lower cost than we can.

These combinations may make it more difficult for us to effectively compete.

Additionally, as we introduce new products and services in the market, such as materials financing, we may face new or different competitors who may similarly have competitive advantages over us.

Such competitive pressures may erode our market share and may hinder or slow our expansion into new markets, including materials financing.

Additionally, as we introduce new products and services in the market, we may face new or different competitors who may similarly have competitive advantages over us.

Such competitive pressures may erode our market share and may hinder or slow our expansion into new markets.

We expect these competitive dynamics to continue as competitors attempt to strengthen or maintain their market positions.

Many factors affect our pricing strategies.

We currently sell our products at a premium as compared to some of our competitors.

For example, the quality of our products and services allows us to sell them at a premium as compared to some of our competitors.

Certain competitors offer, or may in the future offer, lower-priced or free products or services that compete with our products or may bundle and offer a broader range of products or services.

We may not be able to compete at such lower price points or with such product configurations.

Similarly, competitors may use marketing strategies that enable them to acquire customers at a lower cost than we can.

There can be no assurance that we will not be forced to engage in price-cutting initiatives or other discounts or to increase our marketing and other expenses, to attract and retain customers in response to competitive pressures, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

There can be no assurance that we will not be forced to engage in price-cutting initiatives or other discounts, or to increase our marketing and other expenses, in order to attract and retain customers in response to competitive pressures, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Interruptions or performance issues associated with our products, services, and platform, including the interoperability of our platform across devices, operating systems, and third-party applications, could materially adversely affect our business, financial condition, results of operations, and prospects.

7 unchanged sentences

One of the most important features of our platform is its broad interoperability with a range of devices, web browsers, operating systems, and integrations.

Accessibility across this range is oftentimes out of our control.

Accessibility across this range is oftentimes out of our control, including as a result of reliance on third-party service providers or applications.

Integrations and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with such developments.

In addition, some of our competitors may be able to disrupt the compatibility of our platform with their integrations, which some of our customers may rely upon.

If our platform has interoperability failures with these integrations, customers may not adopt our platform, and our App Marketplace may not be useful to customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

In other instances, the operability of our platform features relies on third-party service providers or partners that may be unable to accommodate our evolving service needs, choose to terminate or decline to renew agreements with us, or demand more favorable terms,

among other things, any of which may cause service changes, interruptions, or delays for our customers.

If our platform has operability or interoperability challenges with any of our integrations, customers may not adopt our platform, and our App Marketplace may not be useful to customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Additionally, our products, services, and platform are inherently complex and may contain material defects or errors, particularly when new products or features are released.

3 unchanged sentences

Any of these risks could materially adversely affect our business, financial condition, results of operations, and prospects.

We rely on third-party data centers, such as AWS, to host and operate our platform, and any disruption of or interference with these resources may negatively affect our ability to maintain the performance and reliability of our platform, which could cause our business to suffer.

We rely on third-party data centers, such as Amazon Web Services (“AWS”), to host and operate our platform, and any disruption of or interference with these resources may negatively affect our ability to maintain the performance and reliability of our platform, which could cause our business to suffer.

Our customers depend on the continuous availability of our platform, which relies in large part on third-party data centers.

We currently host our platform and serve our customers primarily using Amazon Web Services (“AWS”).

We currently host our platform and serve our customers primarily using AWS.

Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our control, including:

7 unchanged sentences

It takes a significant amount of time to plan, develop, and test improvements to our technologies and cloud infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements.

To the extent that we do not effectively scale

our infrastructure to meet the needs of our growing customer base and maintain performance as our customers expand their use of our products, or if our cloud-based server costs were to increase, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our materials financing program subjects us to new risks, including new credit, performance, and liquidity risks, that could materially adversely affect our business, financial condition, results of operations, and prospects.

In connection with our acquisition of Levelset in November 2021, we assumed, and are continuing to develop, a materials financing program, pursuant to which we facilitate the purchase of construction materials from fulfillment partners (our suppliers) on behalf of our customers, allowing such customers to finance their materials purchases from us on deferred payment terms.

Holding these receivables on our balance sheet exposes us to credit, performance, and liquidity risk, which may adversely affect our financial performance.

While we earn finance charges on such deferred payment balances, we bear credit risk and may incur financial losses in the event customers default on the deferred payment terms under our materials financing agreements.

Although our internal data can help us assess a customer’s default risk, there can be no guarantee that our processes will accurately forecast repayments.

We are in the early stages of this program and therefore we may not be as accurate in forecasting default rates in the near term as we expect to be in the long term once we have had the opportunity to develop and enhance our internal data sets and analytics capabilities to better predict, assess, and manage risk of default.

As a result, we may carry appropriate reserves on our books for projected losses.

Although we have a credit policy in place designed to limit our exposure to any particular customer, we may ultimately be unable to adequately or successfully limit such exposure.

Furthermore, since our materials financing program customers are largely consolidated in the construction industry, we may be subject to concentrated risks since our customers’ ability to pay us may be impacted by the economic strength of the construction industry.

Failure to accurately forecast our customers’ payment ability or a material increase in payment defaults may adversely impact our results of operations, cash flows, liquidity, and profitability.

In addition, our customers may not fully comply with their obligations under their materials financing agreements, which could negatively impact our mechanic’s liens rights and therefore, our ability to collect outstanding balances or finance charges.

We primarily rely on mechanic’s lien rights to protect against instances of non-payment.

Our ability to enforce our rights as a lienholder and receive payment from materials financing program customers may be limited or hindered by differing laws and regulations that define lienholder rights among the various jurisdictions in which we operate.

Compliance with these disparate laws could lead to operating inefficiencies and cause us to incur expenses to enforce our lienholder rights and collect payment, or we may be unable to enforce our lienholder rights altogether or be unsuccessful in those efforts.

Repeated inability to effectively assert or enforce our lienholder rights could materially adversely affect our business, financial condition, results of operations, and prospects.

We currently finance all originations for our materials financing program out of cash on hand.

Although we believe that we currently have adequate liquidity to support our materials financing program, there are a number of factors that could reduce or deplete our existing liquidity position.

If our materials financing program grows rapidly, or we otherwise become unable to finance any portion of our originations directly, we may need to fund all or part of our materials financing program through financing arrangements with third-party financial institutions.

In such instance, we may be unable to secure funding from such third parties on terms favorable to us or at all, which could materially adversely affect our business, financial condition, results of operations, and prospects.

To the extent that we do not effectively scale our infrastructure to meet the needs of our growing customer base and maintain performance as our customers expand their use of our products, or if our cloud-based server costs were to increase, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Risks Related to Our Employees and Culture

4 unchanged sentences

We rely on our management team in the areas of operations, security, research and development, sales and marketing, support, and general and administrative functions.

Our employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time.

employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time.

Courtemanche or one or more of our key personnel or members of our management team resigns or otherwise ceases to provide us with their services, our business, financial condition, results of operations, and prospects could be materially adversely affected.

8 unchanged sentences

As we grow, we may find it difficult to maintain our corporate culture.

In addition, many of our employees continue to work remotely since the onset of the COVID-19 pandemic, and there is no guarantee that we will be able to maintain our corporate culture when much of our team is dispersed.

In addition, many of our employees work remotely and there is no guarantee that we will be able to maintain our corporate culture when much of our team is dispersed.

Any failure to preserve our culture could harm our future success, including our ability to recruit and retain qualified personnel, innovate and operate effectively, and execute on our business strategies.

If we experience any of these risks in connection with future growth, it could impair our ability to attract new customers and retain existing customers and expand their use of our platform, all of which could materially adversely affect our business, financial condition, results of operations, and prospects.

In addition, from time to time, we carry out reductions in our workforce to ensure that our resources are aligned to our business strategy.

If we experience any of these risks, our ability to attract new customers and retain existing customers and expand their use of our platform could be impaired, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Risks Related to Our Regulatory and Legal Environment

3 unchanged sentences

Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, internal and external privacy and security policies, contracts (including with our customers and other third parties), and other obligations that govern the processing of certain sensitive information by us and on our behalf.

In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws, and other similar laws.

For example, the California Consumer Privacy Act of 2018 (the “CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

In addition, the California Privacy Rights Act of 2020 (“CPRA”) expands the CCPA’s requirements, including by establishing a new regulatory agency to implement and enforce the law.

Other states have enacted data privacy laws as well.

For example, Virginia passed the Consumer Data Protection Act, Colorado passed the Colorado Privacy Act, and Utah passed the Utah Consumer Privacy Act, all of which will take effect this year.

For example, in the past few years, numerous U.S.

states, including California, have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information.

As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

These state laws also allow for statutory fines for noncompliance.

For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”) applies to personal information

of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA provides for administrative fines of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

Additionally, several states and localities have enacted measures related to the use of AI and machine learning in products and services.

Moreover, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data.

Our inability or failure to do so could result in adverse consequences.

Data privacy and security laws have been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts .

Our data processing practices are subject to increased challenges by class action plaintiffs.

Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts.

As we expand globally, our obligations related to data protection may increase.

Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security.

For example, the European Union’s (“EU”) General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) GDPR (the “U.K.’s GDPR”) impose strict requirements for processing personal data.

Under the EU’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater, for

certain violations.

For example, the European Union’s (“EU”) General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data.

Similarly, under the U.K.’s GDPR, government regulators may impose fines of up to 17.5 million pounds sterling or 4% of annual global turnover, whichever is greater, for certain violations.

The application of the EU’s GDPR alongside the U.K.’s GDPR exposes us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations.

2 unchanged sentences

This may require investing in additional resources and more technology.

In addition, individuals and consumer protection agencies may initiate litigation related to the processing of individuals’ personal data.

There are also stringent local data protection requirements in Germany and cloud-server initiatives in France which may impact our expansion into these countries.

In Europe, there is a proposed regulation related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems.

In addition, individuals and consumer protection agencies (which are authorized by law to represent individuals’ interests) may initiate litigation related to the processing of individuals’ personal data.

There are also stringent local data protection requirements in Germany and cloud-server initiatives in France which may impact our operations in these countries.

In Europe, regulators have reached political agreement on the text of the Artificial Intelligence Act, which, when adopted and in force, will have a direct effect across all EU jurisdictions and could impose onerous obligations related to the use of AI-related systems.

The act may also influence the approach taken to AI in other jurisdictions, including the U.S.

We may have to change our business practices to comply with such obligations.

6 unchanged sentences

The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU’s GDPR.

Additionally, India’s new privacy legislation, the Digital Personal Data Protection Act, may also apply to our operations.

Further, in certain limited applications or situations, we use generative AI in our products and services.

In addition, our employees and personnel use generative AI technologies to perform their work.

Several jurisdictions around the globe, including Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing AI, including the EU’s AI Act, and we expect other jurisdictions will adopt similar laws.

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may be incompatible with our use of AI and may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI, or prevent our use of AI.

For example, the Federal Trade Commission has required other companies to turn over or disgorge valuable insights or trainings generated through the use of AI where they allege the company has violated privacy and consumer protection laws.

Our use of this technology could also result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the U.S.

3 unchanged sentences

have significantly restricted the transfer of personal data to the U.S.

and other countries whose privacy laws it believes are inadequate.

and other countries whose privacy laws it generally believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the U.K.

in compliance with law, such as the EEA and U.K.’s standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

in compliance with law, such as the EEA and U.K.’s standard contractual clauses, the U.K.’s International Data Transfer Agreement / Addendum, and the EU-U.S.

Data Privacy Framework (which allows for transfers of personal data to relevant U.S.-based organizations that participate in and self-certify compliance with the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

2 unchanged sentences

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the cross-border data transfer limitations of the EU’s GDPR.

For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of standard contractual clauses to transfer personal data from Europe to the U.S.

was insufficient and levied a 1.2 billion euro fine against the company and prohibited it from transferring personal data to the U.S.

We are bound by contractual obligations and laws related to data privacy and security, and our efforts to comply with such obligations and laws may not be successful.

For example, certain privacy laws, such as the EU’s GDPR, the U.K.’s GDPR, and the CPRA, require our customers to impose specific contractual restrictions on their service providers.

We also publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security.

If any of these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

For example, certain privacy laws, such as the EU’s GDPR, the U.K.’s GDPR, and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

We also publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications, standards, or self-regulatory principles, regarding data privacy and security.

If any of these policies, materials, or statements are found by our customers or regulators to be overly broad, deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

In addition, privacy advocates and industry groups have proposed, and may further propose, standards with which we are legally or contractually bound to comply.

6 unchanged sentences

Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.

In addition, these obligations may require

us to change our business practices.

In addition, these obligations may require us to change our business practices.

Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail, or be perceived to have failed, to do so.

Moreover, despite our efforts, our personnel or third parties upon which we rely, such as vendors or developers, may fail to comply with such obligations, which could negatively impact our business operations and compliance posture.

For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse consequences for us, including our inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences.

These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse consequences for us,

including our inability to, or interruption in our ability to, operate our business and proceedings against us by governmental entities or others.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

If our IT systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

In the ordinary course of business, we process substantial amounts of sensitive information.

Cyberattacks, malicious internet-based activity, and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of such sensitive information and information technology systems, and those of the third parties on which we rely.

Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of such sensitive information and IT systems, and those of the third parties on which we rely.

Cloud-based platform providers of products and services have been targeted by such activities and are expected to continue to be targeted.

1 unchanged sentence

Some actors now engage and are expected to continue to engage in cyberattacks including, without limitation, nation-states and nation-state-supported actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers are subject to a variety of evolving threats, including, but not limited to, social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, and other similar threats.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers are subject to a variety of evolving threats, including, but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other IT assets, adware, telecommunications failures, and other similar threats.

Our products and services may also be subject to fraudulent usage and schemes, including from third parties accessing customer accounts or viewing data from our platform.

Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Severe ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

While extortion payments have the potential to alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments for a variety of reasons, including, but not limited to, applicable laws or regulations prohibiting such payments.

Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.

In addition, business transactions, such as acquisitions or integrations, could expose us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

Remote work has become more common and has increased risks to our IT systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.

We rely upon third-party developers, service providers, and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions.

1 unchanged sentence

Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

We may also share or receive sensitive information with or from third parties.

may also share or receive sensitive information with or from third parties.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages or we may be unable to recover such award.

In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products, services, and platform) or the third-party information technology systems that support us and our services.

In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our IT systems (including our products, services, and platform) or the third-party IT systems that support us and our services.

While we have implemented security measures designed to help protect against security incidents, there can be no assurance that these measures will be effective.

Although we take certain steps to detect, mitigate, and remediate various vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties upon which we rely, and those used to operate our products), doing so takes significant time and resources and we may not be able to detect and have not been able to remediate all vulnerabilities in our IT systems (including those that operate our products and those that are used to provide our services).

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high and critical unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed.

We have taken, and are taking, steps designed to mitigate these vulnerabilities in a prioritized manner based on our assessment of the risk posed by such vulnerabilities.

Despite our efforts, there can be no assurance that these vulnerability mitigation measures will be effective.

Moreover, we may also experience delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities.

Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption.

1 unchanged sentence

A security incident or other interruption could disrupt our ability, and that of third parties upon which we rely, to provide our products and services.

Our current security measures may be insufficient to prevent or deter such incidents or interruptions.

We may expend significant resources or modify our business activities to try to protect against security incidents.

Certain data privacy and security obligations may require us to implement and maintain security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

While we have implemented security measures designed to help protect against security incidents, there can be no assurance that these measures will be effective.

Although we take certain steps to detect and remediate various vulnerabilities, doing so takes significant time and resources and we may not be able to detect or remediate all vulnerabilities in our software (including third-party software we utilize) or information technology systems (including those that operate our product and those that are used to provide our services).

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a number of unremediated vulnerabilities may always exist.

Unremediated vulnerabilities, alone or in combination, may have been exploited, and could be exploited, to cause a material security incident or seriously harm our business, interrupt our operations and ability to provide services, damage our reputation and ability to obtain and retain customers, and expose sensitive information of ours and our customers, including personal information and intellectual property.

In addition, the threats and techniques used to exploit vulnerabilities change frequently and are often sophisticated in nature, and vulnerabilities in our software and information technology systems could be exploited before we are able to detect or remediate them.

Any efforts to remediate vulnerabilities present in our software or information technology systems may not be successful, and we may experience delays in developing and deploying or installing patches and remedial measures.

We may also be reliant on third parties to help or fully remediate such vulnerabilities.

Remediating vulnerabilities may interrupt our operations, products, and services.

As we continue to expand the features and functionality of our products, services, and platform, and to introduce new products and services, we may become even more vulnerable to security incidents and at increased risk of vulnerabilities in the future.

Any vulnerabilities, alone or in combination, could pose material and significant risks to our business.

Applicable data privacy and security obligations, including data breach laws and contractual obligations to various customers, may require us to notify relevant stakeholders of security incidents.

Certain data privacy and security obligations may require us to implement and maintain security measures or industry-standard or reasonable security measures to protect our IT systems and sensitive information.

In addition, business transactions, such as acquisitions or integrations, have exposed us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Applicable data privacy and security obligations, including data breach laws and contractual obligations to various customers, may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents.

Such disclosures are costly, and the disclosures, or the failure to comply with such requirements, could lead to adverse consequences.

If we or third parties upon which we rely experience a security incident or are perceived to have experienced a security incident, we could experience significant consequences.

If we or third parties upon which we rely experience a security incident or are perceived to have experienced a security incident, we could experience significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm.

Security incidents and attendant consequences may also cause customers to stop using our products, services, and platform (including by declining to renew their subscriptions), deter new customers from using our products, services, and platform, and negatively impact our ability to grow and operate our business.

In addition, security incidents experienced by others, such as our competitors or customers, may lead to widespread negative publicity for us, our customers, or the construction software industry generally.

Our contracts may not contain indemnification, limitations of liability, or other protective provisions, and even where they do, there can be no assurance that indemnification clauses, limitations of liability, or other protective provisions in our contracts are applicable, enforceable, or sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.

Our contracts may not contain indemnification, limitations of liability, or other protective provisions.

Even where they do, there can be no assurance that indemnification clauses, limitations of liability, or other protective provisions in our contracts are applicable, enforceable, or sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.

We cannot be sure that our general liability insurance coverage and coverage for cyber liability or errors or omissions will be adequate or sufficient to protect us from, or to mitigate liabilities arising out of, our data privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could materially adversely affect our business, financial condition, results of operations, and prospects.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Furthermore, sensitive information of our company or our customers could be leaked, disclosed, or revealed as a result of, or in connection with, our employees’, personnel’s, or vendors’ use of generative AI technologies.

Our business depends upon the appropriate and successful implementation of our products by our customers.

4 unchanged sentences

We are subject to a number of laws and regulations that apply generally to businesses, including laws and regulations governing the internet and the marketing, sale, and delivery of goods and services over the internet.

These laws and regulations, which continue to evolve, cover, among other things, taxation, tariffs, privacy and data protection, data security, pricing, content, copyrights, distribution, mobile and other communications, advertising practices, electronic contracts, sales procedures, automatic subscription renewals, credit card processing procedures, consumer protection, the provision of online payment services, the design and operation of websites, and the characteristics and quality of products that are offered online.

These laws and regulations, which continue to evolve, cover, among other things, taxation, tariffs, data protection and privacy, data security, data governance, pricing, content, copyrights, distribution, mobile and other communications, advertising practices, electronic contracts, sales procedures, automatic subscription renewals, credit card processing procedures, consumer protection, consumer financial protection, payment regulation, payment processing and settlement services, domestic and cross-border money transmission, foreign currency exchange, anti-money laundering, fraud detection, economic and trade sanctions, the design and operation of websites, and the characteristics and quality of products that are offered online.

We cannot guarantee that we have been or will in the future be fully compliant with such laws and regulations in every jurisdiction, as it is not entirely clear in every jurisdiction how existing laws and regulations governing such areas apply or will be enforced.

2 unchanged sentences

Future regulations, or changes in laws and regulations or their existing interpretations or applications, could also require us to change our business practices and raise compliance costs or other costs of doing business.

For example, the re-adoption of “network neutrality” rules in the U.S.

by the Federal Communications Commission (the “FCC”), which the current president of the U.S.

supported during his campaign, and which is supported by the current Democratic FCC commissioners, could affect the services we and our customers use by restricting the offerings made by internet service providers or reducing their incentives to invest in their networks.

For example, the Federal Communications Commission (the “FCC”) has proposed to re-adopt “network neutrality” rules in the U.S.

If the FCC adopts those rules, it could affect the services we and our customers use by restricting the offerings made by internet service providers or reducing their incentives to invest in their networks.

After a federal court judge denied a request for an injunction against California’s state-specific network neutrality law, California began enforcing that law on March 25, 2021.

Trade associations representing internet service providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

The trade associations sought rehearing with the full court of appeals, but their request was denied on April 20, 2022 and they voluntarily dismissed their lawsuit on May 4, 2022.

Other states could begin to enforce existing laws or adopt new network neutrality requirements.

For example, a temporary injunction preventing implementation of a similar law in Vermont expired on April 20, 2022, although the challenge to that law remains pending.

For example, a temporary injunction preventing implementation of a similar law in Vermont expired on April 20, 2022, although the challenge to that law remains pending and has been suspended until an appeal in another case addressing state powers to adopt internet regulation is resolved.

Additionally, various federal, state, and foreign labor laws govern our relationships with our employees and affect operating costs.

These laws include employee classifications as exempt or non-exempt, minimum wage requirements, unemployment tax rates, workers’ compensation rates, overtime, family leave, workplace health and safety standards, payroll taxes, citizenship requirements, and other laws and regulations.

In certain instances, we rely on third-party service providers or partners to facilitate certain features of our platform or products that are subject to laws and regulations that may be complex, wide-ranging, and evolving, and whose compliance practices and licensure we are unable to control.

If such third parties or partners are unable to effectively manage their compliance and licensure obligations in connection with the services they provide to us, or choose not to renew agreements with us because of the costs or burden of compliance with such obligations or for any other reason, our users may experience service changes, interruptions, or delays.

Furthermore, we may be unable to find new service providers or partners, or may need to obtain replacement services on less favorable terms.

For example, we rely on a payment partner to facilitate payments through Procore Pay.

Our payment partner may be subject to extensive compliance obligations as well as enforcement actions, fines, and litigation if found to violate any legal or regulatory requirements that apply to it.

Our payment partner may choose not to renew its agreement with us for this or any other reason, or may seek to involve us in enforcement actions, fines, or litigation related to the services they provide.

Any claim, lawsuit, proceeding, investigation, inquiry, or request under any of the foregoing could:

result in reputational harm, criminal sanctions, consent decrees, and/or orders preventing us from offering certain features, functionalities, products, or services;

result in reputational harm, criminal sanctions, consent decrees, and orders preventing us from offering certain features, functionalities, products, or services;

limit our access to credit;

3 unchanged sentences

consume financial and other resources which may otherwise be utilized for other purposes, such as advancing other products and services on our platform;

cause a breach or cancelation of certain contracts;

cause a breach or cancellation of certain contracts;

or result in a loss of customers, investors, or partners.

3 unchanged sentences

Some companies that have experienced volatility in the trading price of their shares have also been the subject of securities class action litigation.

Declines in stock price, which we have experienced and may experience from time to time, can increase the risk of such litigation.

Such litigation can be costly and time-consuming, divert the attention of management and key personnel from our business operations, and dissuade prospective customers from subscribing to our products or services.

Certain of our platform features and products are subject to complex and evolving laws and regulations, which vary across U.S.

and foreign jurisdictions, and we may face increased litigation risk as a result of offering these platform features and products, including the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

For example, we offer payment processing services through Procore Pay.

We rely on a payment partner to facilitate these services.

Any significant disruption in the services provided through Procore Pay could prevent transactions from being processed in a timely manner or at all.

If we or our payment partner experience delays or disruptions in services or other issues, including in networks or systems that result in the inability to process payment in a timely manner or at all, we could become involved in enforcement actions, fines, or litigation.

We may need to settle disputes on terms that are unfavorable to us, or we may be subject to an unfavorable judgment requiring us to cease some or all of our operations or pay out substantial amounts of money.

7 unchanged sentences

The technology industry is subject to intense media, political, and regulatory scrutiny, which may expose us to government investigations, legal actions, and penalties.

Various regulatory agencies, including competition, consumer protection, and privacy authorities, have active proceedings and investigations concerning multiple technology companies, some of which have offerings, like app marketplaces and collaboration tools, that are similar to services and features we offer.

Various regulatory agencies, including competition, consumer protection, and privacy authorities, have active proceedings and investigations concerning technology companies, some of which have offerings, like app marketplaces and collaboration tools, that are similar to services and features we offer.

If proceedings or investigations targeted at other companies result in determinations that certain practices are unlawful, we could be required to change our products and services or alter our business operations, which could harm our business.

Legislators and regulators also have proposed new laws and regulations intended to restrain the activities of technology companies.

Legislators and regulators also have proposed new laws and regulations intended to restrain the activities of some technology companies.

If such laws or regulations are enacted, they could adversely impact us, even if they are not intended to affect our company.

2 unchanged sentences

In addition, the introduction of new products and services, expansion of our activities in certain jurisdictions, or other actions we may take may subject us to additional laws, rules, and regulations, or other government scrutiny.

We may not always be able to accurately predict the scope or applicability of certain laws, rules, or regulations to our business, particularly as we expand into new areas of operations, such as materials financing and lien rights management, which could negatively affect our business and our ability to pursue future plans.

We may not always be able to accurately predict the scope or applicability of certain laws, rules, or regulations to our business, particularly as we expand into new areas of operations, such as Procore Pay, which could negatively affect our business and our ability to pursue future plans.

In addition, any perceived or actual breach by us of applicable laws, rules, and regulations could have a significant impact on our reputation as a trusted brand and could cause us to lose customers in existing and emerging lines of business, prevent us from acquiring new customers, require us to expend significant resources to remedy issues caused by such breaches and to avert further breaches, and expose us to legal risk and potential liability.

4 unchanged sentences

Congress and the Executive branch have proposed further changes or amendments each year since 2019, including, among other things, proposals that would narrow CDA immunity, expand government enforcement power relating to content moderation concerns, or repeal the CDA altogether.

some states have passed, and others may adopt, laws intended to limit the protection afforded by Section 230 of the CDA.

Laws passed by Florida and Texas are the subject of judicial appeals and the U.S.

Supreme Court has agreed to hear a separate case that could limit the protections afforded by Section 230 of the CDA.

Such changes could decrease or change our protections from liability for third-party content in the U.S.

In addition, some states have passed, and others may adopt, laws intended to limit the protection afforded by Section 230 of the CDA.

Laws passed by Florida and Texas are the subject of judicial appeals, but those laws have been stayed by federal courts.

On September 29, 2023, the U.S.

Supreme Court announced that it would review both the Florida and Texas decisions, and a decision is expected during the first half of 2024.

Any changes to the protection afforded by Section 230 of the CDA could decrease or change our protections from liability for third-party content in the U.S.

There are other cases pending before the judiciary that may result in changes to the protections Section 230 of the CDA affords to internet platforms.

We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages or license costs.

16 unchanged sentences

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection of this information, we cannot assure you that these procedures have been effective or that we, or third parties, many of whom we do not control, have complied with all laws or regulations in this regard.

Failure by our employees, representatives, contractors, partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations in the collection of this information also could have negative consequences to us, including reputational harm, government investigations, and penalties.

Failure by our customers, employees, representatives, contractors, partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations in the collection of this information also could have negative consequences to us, including reputational harm, government investigations, and penalties.

Although we take precautions to prevent our information collection practices from being in violation of such laws, our information collection practices may have been in the past, and could in the future be, in violation of such laws.

If we or our employees, representatives, contractors, partners, agents, intermediaries, or other third parties fail to comply with these laws and regulations, we could be subject to civil or criminal penalties, including the possible loss of export privileges and fines and penalties.

We may also be adversely affected through other penalties, reputational harm, loss of access to certain markets, or otherwise.

We may also be adversely affected through other penalties, reputational harm, loss of access to certain countries, or otherwise.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

While we are working to implement additional controls designed to prevent similar activity from occurring in the future, these controls may not be fully effective.

Changes in our platform, or changes in sanctions and import and export laws, may delay the introduction and sale of subscriptions to access our products or services in international markets, prevent our customers with international operations from using our platform, or in some cases, prevent the access or use of our platform to and from certain countries, governments, persons, or entities altogether.

Changes in our platform, or changes in sanctions and import and export laws, may delay the introduction and sale of subscriptions to access our products or services internationally, prevent our customers with international operations from using our platform, or in some cases, prevent the access or use of our platform to and from certain countries, governments, persons, or entities altogether.

Further, any change in export or import regulations, economic sanctions, or related laws, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons, or technologies targeted by such regulations could result in decreased use of our platform or in our decreased ability to export or sell subscriptions to use our platform to existing or prospective customers with international operations.

9 unchanged sentences

While we have policies and procedures to facilitate compliance with the FCPA, the Bribery Act, and other anti-corruption, sanctions, anti-bribery, anti-money laundering, and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, partners, agents, intermediaries, or other third parties have taken, or will not take actions, in violation of our policies and procedures and applicable law, for which we may be ultimately held responsible.

As we increase our international sales and business, our risks under these laws may increase.

As we increase our

international sales and business, our risks under these laws may increase.

Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S.

1 unchanged sentence

Any investigations, actions, or sanctions could materially adversely affect our business, financial condition, results of operations, and prospects.

Certain of our services subject us to complex and evolving laws and regulations regarding UPL.

Certain of our services subject us to complex and evolving laws and regulations regarding the unauthorized practice of law (“UPL”).

UPL generally refers to a person or entity that is not licensed to practice law but that gives legal advice or advertises its services as the practice of law.

2 unchanged sentences

In the past, various aspects of Levelset’s lien rights management offering have been subject to claims of UPL.

In the future, we could face similar claims, actions, or proceedings.

We currently face, and may in the future, continue to face, similar claims, actions, or proceedings.

The laws and regulations that define UPL, and the governing bodies that enforce UPL rules, differ among the various jurisdictions in which we operate, and the scope of these laws and regulations is often vague, broad, and evolving.

3 unchanged sentences

Maintaining compliance with UPL rules across various jurisdictions may cause us to incur significant expenses and may require that we dedicate significant management time to dealing with UPL issues, which could divert management’s attention from other matters.

As we continue to supportgrow our lien rights management offering or expand into new jurisdictions, we may face increased scrutiny and risk of additional UPL claims, actions, or proceedings.

As we continue to support our lien rights management offering or expand into new jurisdictions, we may face increased scrutiny and risk of additional UPL claims, actions, or proceedings.

Any failure or perceived failure by us to comply with applicable UPL laws and regulations may subject us to regulatory inquiries, actions, lawsuits, or proceedings.

3 unchanged sentences

A negative outcome in any of these proceedings may result in claims, actions, changes to or discontinuance of some of our services, potential liabilities, and additional costs that could materially adversely affect our business, financial condition, results of operations, and prospects.

Our materials financing program may subject us to additional and changing legal, regulatory, and compliance requirements, and failure to comply with such requirements could materially adversely affect our business, financial condition, results of operations, and prospects.

Our materials financing program may be subject to regulation in the jurisdictions in which we operate this program.

Furthermore, with the geographic expansion of our materials financing program into new markets, we may become subject to additional and changing legal, regulatory, and compliance requirements and industry standards with respect to materials financing.

As a result of offering our materials financing program, we may become subject to regulatory scrutiny, which may impose significant compliance costs and make it uneconomical for us to continue to operate in our current markets or to expand into new markets.

For example, certain state legislatures have recently adopted regulations for commercial financing that have provisions that, among other things, may extend protections similar to those found in consumer credit protection laws to commercial financing arrangements.

Further, state legislatures and financial regulators across the country are actively considering proposals to impose additional regulations on business-purpose credit products, especially products offered to small business customers.

As a result, such new or expanded regulations, or changes in interpretation or enforcement of

existing regulations, could result in new restrictions affecting the terms under which we offer our materials financing program, our potential inability to comply with such regulations, and increased compliance costs or other costs of doing business, any of which may materially adversely affect our business, financial condition, results of operations, and prospects.

Our materials financing transactions are structured as credit sales, rather than purchase-money loans.

Credit sales are generally subject to regulatory regimes at the state and federal level that are more favorable (to the party offering deferred payment terms) than those applicable to purchase-money loans.

However, if a regulator or court concluded that our materials financing transactions should be characterized as loans, and thus subject to laws and regulations governing loans and lending activities, then we may be forced to restructure the transactions in a way that is commercially less desirable in order to support the credit sale characterization, or we may be required to comply with laws and regulations governing loans and lending activities, which may subject us to additional restrictions and requirements, such as compliance with usury laws and state lending, loan brokering, or debt collection licensing laws and regulations.

If we fail, or are perceived to have failed, to address or comply with new or existing compliance obligations with respect to our materials financing program we could face significant consequences.

These consequences may include, but are not limited to, enforcement actions, fines, penalties, litigation, additional reporting requirements and oversight, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our materials financing program, loss of revenue or profits, loss of customers, loss of investor confidence, negative publicity, and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Risks Related to Our Intellectual Property

3 unchanged sentences

and 73 pending patent applications in the U.S.

Additionally, we had 16 pending patent applications in foreign countries, as well as nine pending international patent applications that preserve our right to file additional foreign patent applications in the future.

Additionally, we had 18 pending patent applications in foreign countries, as well as 10 pending international patent applications that preserve our right to file additional foreign patent applications in the future.

Our issued patents in the U.S.

2 unchanged sentences

We have devoted substantial resources to the development of our proprietary technologies and related processes.

We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate.

Even when we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our products, services, or platform.

25 unchanged sentences

Furthermore, there exists today an increasing number of types of open source software licenses, almost none of which have been tested in courts of law to provide clarity on their proper legal interpretation.

If we were to receive a claim of non-compliance with the terms of any of these open source licenses, we may be required to publicly release certain portions of our proprietary source code.

we were to receive a claim of non-compliance with the terms of any of these open source licenses, we may be required to publicly release certain portions of our proprietary source code.

We could also be required to expend substantial time and resources to re-engineer some or all of our software.

6 unchanged sentences

These actions are in violation of our policies.

However, our efforts to defeat spamming attacks, illegal robocalls, and other fraudulent activity will not prevent all such attacks and activity.

Our efforts to defeat spamming attacks, illegal robocalls, and other fraudulent activity will not prevent all such attacks and activity.

Such use of our platform could damage our reputation and we could face claims for damages, regulatory enforcement, copyright or trademark infringement, defamation, negligence, or fraud.

2 unchanged sentences

Although we retain the right to verify that customers and other users are abiding by our policies, our customers and other users are ultimately responsible for compliance with our policies, and we do not systematically audit our customers or other users to confirm compliance with our policies.

Although Section 230 of the CDA currently limits liability for third-party content posted on internet platforms, we cannot

predict whether that protection will remain in effect.

Although Section 230 of the CDA currently limits liability for third-party content posted on internet platforms, we cannot predict whether that protection will remain in effect.

See the risk factor titled “Increased government scrutiny of the technology industry could negatively affect our business.”

3 unchanged sentences

Any of these transactions could be material to our business, financial condition, results of operations, and prospects.

However, we may not be able to find suitable acquisition, joint venture, and strategic investment candidates, and we may not be able to complete these transactions on favorable terms or at all.

However, we may not be able to find suitable acquisition, joint venture, and strategic investment candidates, transactions may be subject to regulatory scrutiny, and we may not be able to complete transactions on favorable terms or at all.

Even if we are able to complete these transactions, we may not be able to realize the anticipated benefits of such transactions in the time frame expected or at all.

In particular, if we are unable to successfully operate as a combined business after the completion of such transactions, including in respect of the LaborChart and Levelset acquisitions, to achieve shared growth opportunities or combine reporting or other processes within the expected time frame, such delay may materially and adversely affect the benefits that we expect to achieve as a result of any such acquisition.

In particular, if we are unable to successfully operate as a combined business after the completion of such transactions, including in respect of the Levelset acquisition, to achieve shared growth opportunities or combine reporting or other processes within the expected time frame, such delay may materially and adversely affect the benefits that we expect to achieve as a result of any such acquisition.

For example, in October 2023, we ceased originations under our materials financing program, which we assumed pursuant to the Levelset acquisition.

Such transactions may not ultimately strengthen our competitive position or achieve our strategic goals and may disrupt our ongoing business, increase our expenses, and otherwise present risks not contemplated at the time of the transaction.

Valuations supporting our acquisitions and strategic investments could change rapidly.

Following any such transaction, we could determine that such valuations have experienced impairments or other-than-temporary declines in fair value which could materially adversely affect our business, financial condition, and operating results, and prospects through the write-off of goodwill and other impairment charges.

Following any such transaction, we could determine that such valuations have experienced impairments or other-than-temporary declines in fair

value which could materially adversely affect our business, financial condition, operating results, and prospects through the write-off of goodwill and other impairment charges.

To finance such transactions, we may have to pay cash, incur debt, or issue securities, including equity-based securities, each of which could affect our financial condition or the value of our capital stock.

2 unchanged sentences

Any of these factors could materially adversely affect our ability to consummate a transaction, and our business, financial condition, results of operations, and prospects.

Risks Related to Tax and Accounting Matters

Tax authorities may successfully assert that we, including our acquired companies, should have collected, or in the future should collect, sales and use, value added, or similar taxes, and we could be subject to substantial liabilities with respect to past or future sales, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We currently collect and remit applicable sales taxes and other applicable transfer taxes in jurisdictions where we, through our employees or economic activity, have a presence and where we have determined, based on applicable legal precedents, that sales of subscriptions to access our products, services, and platform are classified as taxable.

We do not currently collect and remit state and local excise, utility user, or ad valorem taxes, fees, or surcharges in jurisdictions where we believe we do not have sufficient “nexus.” There is uncertainty as to what constitutes sufficient nexus for a state or local jurisdiction to levy taxes, fees, and surcharges on sales made over the internet, and there is also uncertainty as to whether our characterization of our products, services, and platform as not taxable in certain jurisdictions will be accepted by state and local tax authorities.

Tax authorities may challenge our position that we do not have sufficient nexus in a taxing jurisdiction or that our products, services, and platform are not taxable in such jurisdiction and may decide to audit our business and operations with respect to sales, use, value added, goods and services, and other taxes, which could result in significant tax liabilities (including related penalties and interest) for us or our customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Risks Related to Tax Matters

We could be required to collect additional sales and use, value added, goods and services, business, gross receipts, and other indirect tax liabilities in various jurisdictions, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We currently collect and remit applicable indirect taxes in jurisdictions where we, through our employees or economic activity, have a presence and where we have determined, based on applicable legal precedents, that sales of subscriptions to access our products, services, and platform are taxable.

We do not currently collect and remit indirect taxes, including state and local excise, utility user, and ad valorem taxes, fees, and surcharges in jurisdictions where we believe we do not have sufficient “nexus.” There is uncertainty as to what constitutes sufficient nexus for a state or local jurisdiction to levy taxes, fees, and surcharges on sales made over the internet, and there is also uncertainty as to whether our characterization of our products, services, and platform as not taxable in certain jurisdictions will be accepted by state and local tax authorities.

Tax authorities may challenge our position that we do not have sufficient nexus in a taxing jurisdiction or that our products, services, and platform are not taxable in such jurisdiction and may decide to audit our business and operations with respect to indirect taxes, which could result in significant tax liabilities (including related penalties and interest) for us or our customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

The application of indirect taxes, such as sales and use, value added, goods and services, business, and gross receipts taxes, to businesses that transact online, such as ours, is a complex and evolving area.

4 unchanged sentences

The details and effective dates of these collection requirements vary from state to state.

As a result, it may be necessary for us to reevaluate whether our activities give rise to sales, use, and other indirect taxes as a result of any

nexus in those states in which we are not currently registered to collect and remit taxes.

As a result, it may be necessary for us to reevaluate whether our activities give rise to sales, use, and other indirect taxes as a result of any nexus in those states in which we are not currently registered to collect and remit taxes.

Additionally, we may need to assess our potential tax collection and remittance obligations based on the requirements of existing or future economic nexus laws.

There have been, and will continue to be, substantial ongoing costs associated with complying with the various indirect tax requirements in the numerous markets in which we conduct or may conduct business.

There have been, and will continue to be, substantial ongoing costs associated with complying with the various indirect tax requirements in the numerous jurisdictions in which we conduct or may conduct business.

If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such obligations.

2 unchanged sentences

Our corporate structure and intercompany arrangements cause us to be subject to the tax laws of various jurisdictions, and we could be obligated to pay additional taxes, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We are expanding our international operations and personnel to support our business in international markets.

We are expanding our international operations and personnel to support our business internationally.

We generally conduct our international operations through wholly-owned subsidiaries and are or may be required to report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

Our intercompany relationships are subject to complex transfer pricing regulations administered by tax authorities in various jurisdictions.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of such jurisdictions, including the U.S., to our international business activities, changes in tax rates, new or revised tax laws, or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The relevant tax authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which are generally required to be computed on an arm’s-length basis pursuant to intercompany arrangements, or may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

3 unchanged sentences

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes (including income taxes, sales taxes, and value added taxes) against us.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes against us.

Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could differ materially from our historical tax provisions and accruals, which could have an adverse effect on our results of operations or cash flows in the period or periods for which a determination is made.

2 unchanged sentences

Changes in tax laws, regulations, or rulings, or changes in interpretations of existing laws and regulations, could materially adversely affect our business, financial condition, results of operations, and prospects.

For example, the TCJA enacted many significant changes to the U.S.

tax laws, some of which were modified in 2020 by the CARES Act and may be further modified in the future by the current or a future administration.

For example, the Tax Cuts and Jobs Act (the “TCJA”), the Coronavirus Aid, Relief and Economic Security Act, and the Inflation Reduction Act (the “IRA”) made many significant changes to the U.S.

Beginning in 2022, the TCJA requires taxpayers to capitalize and amortize certain research and development expenditures over five years if incurred in the U.S.

1 unchanged sentence

Although there have been legislative proposals to repeal or defer the research and development expenditure capitalization requirement to later years, there can be no assurance that the provision will be repealed or otherwise modified.

As another example, the Inflation Reduction Act, which was recently enacted, includes provisions that will impact the U.S.

As another example, the IRA includes provisions that will impact the U.S.

federal income taxation of certain corporations, including imposing a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that would be imposed on the corporation repurchasing such stock.

Regulatory or accounting guidance with respect to existing or future tax laws could materially affect our tax obligations and effective tax rate.

Further, it is uncertain if, and to what extent, various states will conform to current federal law or any newly enacted federal tax legislation.

It is uncertain if, and to what extent, various states will conform to current federal law or any newly enacted federal tax legislation.

In addition, many countries in Europe, as well as a number of other countries and organizations (including the Organization for Economic Cooperation and Development (the “OECD”) and the European Commission), have recently proposed, recommended, or (in the case of certain countries) enacted, or are in the process of enacting, changes to existing tax laws or new tax laws that could significantly increase our tax obligations in the countries where we do business or require us to change the manner in which we operate our business.

In particular, the OECD is working on a two-pillar solution to address the tax challenges arising from the digitalization of the economy, commonly referred to as BEPS 2.0, which, if implemented, would make important changes to the international tax system by allocating taxing rights in respect of certain profits of multinational enterprises above a fixed profit margin to the jurisdictions within which they carry on business (subject to certain revenue threshold rules which we do not currently meet but may meet in the future), referred to as the Pillar One proposal, and imposing a minimum effective tax rate on certain multinational enterprises, referred to as the Pillar Two proposal.

A number of countries within which we carry on our business are currently proposing to implement core elements of the Pillar Two proposal by the start of 2024.

Based on our current understanding of the minimum revenue thresholds contained in the proposed Pillar Two rules, we anticipate that we

could potentially be within their scope and so their implementation could impact the amount of tax we have to pay.

Any of the foregoing could materially adversely affect our business, financial condition, results of operations, and prospects.

Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

A number of countries within which we carry on our business have implemented, or are currently expected to implement, core elements of the Pillar Two proposal, with effect from the start of 2024.

Based on our current understanding of the minimum revenue thresholds contained in the proposed Pillar Two rules, we are likely to be within their scope.

The OECD has issued administrative guidance providing transition and safe harbor rules in relation to the implementation of the Pillar Two proposal.

We are monitoring developments and evaluating the potential impacts of these new rules, including on our effective tax rates, and considering our eligibility to qualify for these safe harbor rules.

Any of the foregoing could materially adversely affect our business, financial condition, results of operations, and prospects, and we may be required to incur additional material costs and expenditure to ensure compliance with any such rules in each of the relevant jurisdictions within which we carry on our business.

Our ability to use our net operating loss carryforwards (“NOL carryforwards”) and certain other tax attributes may be limited.

As of December 31, 2023, we had $866.7 million of U.S.

federal and $567.2 million of state net operating loss carryforwards (“NOL carryforwards”) available to reduce taxable income that we may have in the future.

federal and $626.4 million of state NOL carryforwards available to reduce taxable income that we may have in the future.

It is possible that we will not generate taxable income sufficient to use certain of these NOL carryforwards.

Under legislative changes made by the 2017 Tax Cuts and JOBS Act (the “TCJA”), as modified by the Coronavirus Aid, Relief and Economic Security Act (the “CARES Act”), our U.S.

federal net operating losses incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but the ability to utilize such federal net operating losses to offset taxable income in taxable years beginning after 2020 is limited to 80% of the current-year taxable income.

It is uncertain if and to what extent various states will conform to the TCJA.

Under current law, our U.S.

federal NOLs incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but the ability to utilize such federal NOL carryforwards to offset taxable income is limited to 80% of the current-year taxable income.

In addition, federal NOL carryforwards and certain tax credits may be subject to significant limitations under Section 382 and Section 383 of the Internal Revenue Code (the “IRC”), respectively.

Under those sections of the IRC, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change NOL carryforwards and other pre-change attributes, such as research tax credits, to offset its post-change income or tax may be limited.

Under those sections of the IRC, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change NOL carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income or taxes may be limited.

In general, an “ownership change” will occur if there is a cumulative change in our ownership by “5-percent shareholders” that exceeds 50 percentage points over a rolling three-year period.

We performed an analysis to determine whether net operating loss and credit carryover limitations existed under Section 382 as of December 31, 2021, and determined that a portion of the net operating losses and credit carryovers are subject to Section 382 annual limitations.

We have determined that we should be able to fully utilize these net operating losses and credit carryovers before they expire, provided that we generate sufficient taxable income.

We have since performed interim updates of our Section 382 analysis.

We may experience additional ownership changes in the future as a result of shifts in our stock ownership after December 31, 2022, some of which may be outside of our control.

State NOL carryforwards and other state tax credits may be subject to similar limitations under state tax laws, and there may be periods during which the use of state net operating losses is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

If an ownership change occurs and our ability to use our NOL carryforwards and tax credits is limited, or if our ability to utilize NOL carryforwards and certain tax credits is otherwise restricted by law, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Risks Related to Capital Requirements and Our Marketable Securities Portfolio

We have experienced ownership changes in the past, and may experience additional ownership changes in the future as a result of shifts in our stock ownership, some of which may be outside of our control.

Our ability to utilize our NOL carryforwards is conditioned upon generating future U.S.

federal taxable income, and we do not know whether or when we will do so.

Therefore, our NOL carryforwards generated prior to 2018 could expire unused.

State NOL carryforwards and other state tax credits may be subject to similar limitations under state tax laws, and there may be periods during which the use of state NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

If our ability to use our NOL carryforwards and tax credits is limited, or if our ability to utilize NOL carryforwards and certain tax credits is otherwise restricted by law, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Risks Related to Capital Requirements, Our Marketable Securities Portfolio, and Liquidity

We may need to raise additional capital to grow our business, and such capital may not be available on terms acceptable to us, or at all, which could reduce our ability to compete and could materially adversely affect our business, financial condition, results of operations, and prospects.

11 unchanged sentences

In particular, the value of our portfolio may decline due to changes in interest rates, instability in the global financial markets that reduces the liquidity of securities in our portfolio, and other factors, including unexpected or unprecedented events such as the COVID-19 pandemic.

As a result, we may experience a significant decline in value or loss of liquidity of our investments, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We attempt to mitigate

these risks through diversification of our investments and continuous monitoring of our portfolio’s overall risk profile, but the value of our investments may nevertheless decline.

We attempt to mitigate these risks through diversification of our investments and continuous monitoring of our portfolio’s overall risk profile, but the value of our investments may nevertheless decline.

To the extent that we increase the amount of our security investments in the future, these risks could be exacerbated.

Adverse developments affecting the financial services industry, such as events or concerns involving the liquidity of, or defaults or non-performance by, financial institutions, could materially adversely affect our business, financial conditions, results of operations, and prospects.

Adverse events involving the liquidity of, defaults or non-performance by, or other adverse developments involving, financial institutions, transactional counterparties, other companies in the financial services industry, or the financial services industry generally, or concerns or rumors about any such events or developments, or other similar risks, have in the past and may in the future lead to market-wide liquidity problems and may lead to liquidity constraints for us.

We maintain our cash, cash equivalents, and marketable securities with financial institutions, and our account balances with any such institutions typically exceed the individual account limit of $250,000 insured by the Federal Deposit Insurance Corporation (“FDIC”).

There is a possibility that we may not be able to access a portion of our existing cash, cash equivalents, and marketable securities, or that all or part of our balances may be at risk, due to market conditions affecting such financial institutions or the financial services industry.

In the event of a bank failure or liquidity crisis, there can be no assurance that our deposits in excess of FDIC insurance limits, or other comparable insurance limits, if any, would be backstopped by the U.S.

or applicable foreign governments, or that any bank or financial institution with which we do business will be able to obtain needed liquidity from other banks or governmental institutions or be acquired.

If other banks and financial institutions enter receivership or become insolvent in the future in response to market conditions affecting the financial services industry, our ability to access our cash, cash equivalents, and marketable securities may be threatened or compromised, which could materially adversely affect our business, financial condition, results of operations, and prospects.

General Risks Related to Our Business and Investing in Our Common Stock

If we fail to maintain an effective system of disclosure controls and internal control over our financial reporting, including our acquired companies, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired and our business, financial condition, results of operations, and prospects could be materially adversely affected.

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the New York Stock Exchange (the “NYSE”).

Our management and other personnel devote a substantial amount of time to compliance with these requirements.

2 unchanged sentences

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

We are required, pursuant to Section 404 of the Sarbanes-Oxley Act (“Section 404”) to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting as of December 31, 2022.

Failure to maintain effective disclosure controls could cause us to be required to revise our financial statements, result in material misstatements in our financial statements, and cause us to fail to timely meet our periodic reporting obligations, among other outcomes.

In addition, we are required, pursuant to Section 404 of the Sarbanes-Oxley Act (“Section 404”) to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting.

This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

2 unchanged sentences

We may need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and compile the system and process documentation necessary to perform the evaluation needed to comply with Section 404.

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business, including our acquisitions.

In addition, changes in accounting principles or interpretations could also challenge our internal controls and require that we establish new business processes, systems, and controls to accommodate such changes.

If our current and new systems, controls, or standards and any associated process changes do not give rise to the benefits that we expect or do not operate as intended, our financial reporting systems and processes, our ability to produce timely and accurate financial reports, or the effectiveness of our internal control over financial reporting could be adversely affected.

Our current disclosure controls and procedures and internal control over financial reporting, and any new controls that we develop, may become inadequate because of changes in conditions in our business, including our acquisitions.

In addition, changes in accounting principles or interpretations could also challenge our controls and require that we establish new business processes, systems, and controls to accommodate such

If our current and new systems, controls, or standards and any associated process changes do not give rise to the benefits that we expect or do not operate as intended, our financial reporting systems and processes, our ability to produce timely and accurate financial reports or disclosures, or the effectiveness of our internal control over financial reporting could be adversely affected.

Moreover, our business may be harmed if we experience problems with any new systems or controls that result in delays in their implementation or increased costs to correct any post-implementation issues that may arise.

Our ability to manage our operations and growth through, for example, the integration of recently acquired businesses, the adoption of new accounting principles and tax laws, and our back office systems that, for example, support our revenue recognition processes, will require us to further develop our controls and reporting systems and implement or amend new or existing controls and reporting systems in those areas where the implementation and integration is still ongoing.

All of these changes to our financial systems and the implementation and integration of acquisitions create an increased risk of deficiencies in our internal controls over financial reporting.

During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to certify that our internal control over financial reporting is effective.

All of these changes to our financial systems and the implementation and integration of acquisitions create an increased risk of deficiencies in our disclosure controls and procedures or internal controls over financial reporting.

During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our disclosure controls and procedures and internal control over financial reporting, we will be unable to certify that our internal control over financial reporting is effective.

We cannot assure you that there will not be material weaknesses or significant deficiencies in our internal control over financial reporting in the future.

Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations.

Any failure to maintain effective disclosure controls and procedures or internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations.

If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines that we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities.

5 unchanged sentences

Our subscriptions generally have annual or multi-year terms.

As a result, the significant majority of our revenue is generated from subscriptions entered into during previous periods.

As a result, the significant majority of our revenue is generated from subscriptions entered into during prior periods.

Consequently, a decline in new or renewed subscriptions in any one quarter may not significantly reduce our revenue for that quarter, but could negatively affect our revenue in future periods.

5 unchanged sentences

As a result, we anticipate increased sales to large enterprises will lead to higher upfront sales costs and greater unpredictability, which could materially adversely affect our business, results of operations, financial condition, and prospects.

In addition, as required by the recent revenue recognition standard under Accounting Standards Codification Topic 606, Revenue from Contracts with Customers, we disclose the transaction price allocated to remaining performance obligations.

It is possible that analysts and investors could misinterpret our disclosure or that the terms of our customer subscriptions or other circumstances could cause our methods for calculating this disclosure to differ significantly from others, which could lead to inaccurate or unfavorable forecasts by analysts and investors.

It is possible that analysts and investors could misinterpret our disclosure or that the terms of our customer subscriptions or other circumstances could cause our methods for

calculating this disclosure to differ significantly from others, which could lead to inaccurate or unfavorable forecasts by analysts and investors.

If we experience excessive fraudulent activity or cannot meet evolving credit card association merchant standards, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly and could materially adversely affect our business, financial condition, results of operations, and prospects.

8 unchanged sentences

If we fail to comply with such standards, the credit card associations could fine us or terminate their agreements with us, and we would be unable to accept credit cards as payment for our products.

Our business could be disrupted by catastrophic occurrences and similar events.

Our platform and the infrastructure on which our platform relies are vulnerable to damage or interruption from catastrophic occurrences, such as earthquakes, floods, fires, other natural disasters, power loss, telecommunication failures, military conflict or war, terrorist attacks, criminal acts, sabotage, other intentional acts of vandalism and misconduct, geopolitical events, disease (such as the COVID-19 pandemic), and other similar events, each of which could materially adversely affect our business, financial condition, results of operations, and prospects, or the business of our customers, partners, vendors, or the economy as a whole.

Our business could be disrupted by macroeconomic and geopolitical events or catastrophic occurrences.

Our platform and the infrastructure on which our platform relies are vulnerable to damage or interruption from macroeconomic and geopolitical events, including military conflict or war (such as the Russia-Ukraine war), disease (such as the COVID-19 pandemic), trends within the commercial construction industry, inflation and responses by governments to address it, supply chain disruptions, and bank failures, or catastrophic occurrences, including earthquakes, floods, fires, other natural disasters, power loss, telecommunication failures, terrorist attacks, criminal acts, sabotage, and other intentional acts of vandalism and misconduct, or other similar events, each of which could materially adversely affect our business, financial condition, results of operations, and prospects, or the business of our customers, partners, vendors, or the economy as a whole.

For example, our corporate headquarters are located near Santa Barbara, California, a region known for seismic activity and severe fires, and a catastrophic event in this region could materially adversely affect our business, financial condition, results of operations, and prospects.

The impact of climate change could result in an increase in the frequency or

severity of such events.

The impact of climate change could result in an increase in the frequency or severity of such events.

Climate-related events have the potential to disrupt our business, our third-party suppliers, and the business of our customers, may cause us to experience higher attrition, losses, and additional costs to maintain and resume operations, and may subject us to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business.

Although we maintain incident management and disaster response plans, in the event of a major disruption, we may be unable to continue our operations and may experience system interruptions and reputational harm.

1 unchanged sentence

The market price of our common stock may be volatile, and you could lose all or part of your investment.

The market price of our common stock is likely to be volatile.

In light of recent macroeconomic factors such as inflation, interest rate changes, and the ongoing impacts of the COVID-19 pandemic, as well as geopolitical factors such as the Russia-Ukraine conflict, and the market for technology companies in particular, the stock market in general has experienced extreme volatility, which has often been unrelated to the operating performance of particular companies.

The market price of our common stock has in the past been volatile, and is likely to be volatile again in the future.

In light of recent macroeconomic factors such as trends within the commercial construction industry, inflation, interest rate changes, bank failures, and the COVID-19 pandemic, geopolitical events such as the Russia-Ukraine war, and the market for technology companies in particular, the stock market in general has

experienced extreme volatility, which has often been unrelated to the operating performance of particular companies.

The market price for our common stock may also be influenced by the following factors:

8 unchanged sentences

Concentration of ownership of our common stock among our existing executive officers, directors, and principal stockholders may prevent new investors from influencing significant corporate decisions, including mergers, consolidations, or the sale of us or all or substantially all of our assets.

Our executive officers, directors, and stockholders who own more than 5% of our outstanding common stock, in the aggregate, beneficially owned a significant percentage of our outstanding common stock.

Furthermore, many of our current directors were appointed by our principal stockholders.

As a result, such persons or their appointees to our board of directors (our “Board”), acting together, will have the ability to control or significantly influence all matters submitted to our Board or stockholders for approval, including the appointment of our management, the election and removal of directors, and the approval of any significant transactions, as well as our management and business affairs.

Our executive officers, directors, and stockholders who own more than 5% of our outstanding common stock, beneficially own, in the aggregate, a significant percentage of our outstanding common stock.

Furthermore, several of our current directors were appointed by our principal stockholders.

As a result, such persons or their appointees to our board of directors of the Company (our “Board”), acting together, will have the ability to control or significantly influence all matters submitted to our Board or stockholders for approval, including the appointment of our management, the election and removal of directors, and the approval of any significant transactions, as well as our management and business affairs.

If these persons choose to act together, they may be able to significantly influence all matters requiring stockholder approval, including the election and removal of directors and the approval of any merger, consolidation, or sale of all or substantially all of our assets.

2 unchanged sentences

Likewise, it may result in the management of our company in ways with which other stockholders disagree.

Certain provisions in our organizational documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove members of our board of directors or current management, and adversely affect our stock price.

Certain provisions in our organizational documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove members of our Board or current management, and adversely affect our stock price.

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could delay or prevent a change in control of our company.

7 unchanged sentences

• the requirement that a special meeting of stockholders may be called only by the chairperson of our Board, chief executive officer, president, or by our Board acting pursuant to a resolution adopted by a majority of our Board, which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

certain amendments to our amended and restated certificate of incorporation will require the approval of two-thirds of the then-outstanding voting power of our capital stock;

• the requirement to obtain approval of two-thirds of the then-outstanding voting power of our capital stock in order to make certain amendments to our amended and restated certificate of incorporation;

• advance notice procedures with which stockholders must comply to nominate candidates to our Board or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us.

5 unchanged sentences

This provision would not apply to lawsuits brought to enforce a duty or liability created by the Securities Act, the Exchange Act, or any other claim for which the federal courts have exclusive jurisdiction.

In addition, to prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation will further provide that the U.S.

federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

However, as Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all lawsuits brought to enforce any duty or liability created by the Securities Act, and an investor cannot waive compliance with the federal securities laws and the rules and regulations thereunder, there is uncertainty as to whether a court would enforce such a provision.

While the Delaware courts have determined that such choice of forum provisions are facially valid, a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

In such instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our amended and restated certificate of incorporation.

In such an instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our amended and restated certificate of incorporation.

This may require significant additional costs associated with resolving such action in other jurisdictions and there can be no assurance that the provisions will be enforced by a court in those other jurisdictions.

1 unchanged sentence

If a court were to find either exclusive forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur further significant additional costs associated with resolving the dispute in other jurisdictions, all of which could seriously harm our business.

Unresolved Staff Comments.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors