What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-24 compared with 2025-02-26 · 225 added, 212 removed, 595 unchanged (42% of the section changed)

10 unchanged sentences

We have experienced rapid growth in prior periods.

Our revenue was $1,151.7 million in 2024, $950.0 million in 2023, and $720.2 million in 2022.

Our revenue was $1.3 billion in 2025, $1.2 billion in 2024, and $1.0 billion in 2023.

Our results of operations may fluctuate significantly, which could make our future results difficult to predict and could cause our results of operations to fall below expectations.

You should not rely on the revenue growth of any prior period as an indication of our future performance.

While our revenue has continued to increase, our revenue growth rate has declined and may continue to decline in the future as a result of a variety of factors, including our ability to effectively manage our growth and investments (including through the evolution of our GTM operating model), macroeconomic conditions, and the maturation of our business.

While our revenue has continued to increase, our revenue growth rate has declined and may continue to decline in the future as a result of a variety of factors, including our ability to effectively manage our growth and investments (including through our evolved GTM operating model), macroeconomic conditions, and the maturation of our business.

Our overall revenue growth and results of operations depend on a number of factors, including many that are out of our control.

2 unchanged sentences

increase sales to owners and specialty contractors, as well as monetize new stakeholders;

develop new products and services, further improve our existing products, services, and platform, and expand our App Marketplace with additional integrations;

develop new products and services, further improve our existing products, services, and platform, and evolve our App Marketplace with new offerings and purpose-built APIs;

provide our customers and collaborators with support that meets their needs;

13 unchanged sentences

In particular, we intend to continue to expend substantial financial and other resources on the following:

expanding our sales and marketing and customer success teams, including as part of evolving our GTM operating model, to drive new subscriptions, increase the use of our products, services, and platform by existing customers, and support our international growth;

expanding our sales and marketing and customer success teams to drive new subscriptions, increase the use of our products, services, and platform by existing customers, and support our international growth;

developing our technology infrastructure, including systems architecture, scalability, availability, performance, and data security and privacy;

33 unchanged sentences

products and platform;

and the development and awareness of our brand.

Even though we use internal data to assess the likelihood of success of introducing new products and services or changes to existing products and services, we may incorrectly calculate such risks or assume undue risks with respect to such products.

Competitors may also develop and introduce new products or entirely new technologies to replace our existing products, including through the use of AI, which could make our platform obsolete or otherwise adversely affect our business.

If our investments in engineering and product development do not accurately anticipate user demand or if we fail to develop our products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

the development and awareness of our brand;

and how we sell our products, services, and platform.

Even though we use internal data to assess the likelihood of success of introducing new products, services, pricing, and packaging or changes to existing products, services, pricing, and packaging, we may incorrectly calculate such risks or assume undue risks with respect to such products, services, pricing, and packaging.

Competitors may also develop and introduce new products or entirely new technologies to replace our existing products, including through the use of AI, which could make our platform and products obsolete or otherwise materially adversely affect our business, financial condition, results of operations, and prospects.

If our investments in engineering and product development do not accurately anticipate user demand or if we fail to develop products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Furthermore, our ability to grow our customer base and retain and increase revenue from customers depends on our ability to enhance and improve our products, services, and platform in response to changes in the construction management software industry and customer demand.

2 unchanged sentences

If we do not provide effective ongoing support, our ability to sell additional products to existing and prospective customers could be adversely affected.

As part of the evolution of our GTM operating model, we are introducing new technical roles to help our customers realize the full value of our platform and thereby create deeper relationships with our customers.

If these investments do not result in increased revenue from both new and existing customers, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Additionally, we may experience difficulties with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new products, features, or capabilities.

We have in the past experienced delays in our internally planned release dates of new products, features, and capabilities, and there can be no assurance that new products, features, or capabilities will be released according to schedule.

Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could harm our business.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to retain and expand our customer base, attract investors, and recruit and retain qualified personnel may be impaired, and our business may be harmed.

Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could materially adversely affect our business, financial condition, results of operations, and prospects.

We believe that our brand identity and brand awareness are critical to our sales and marketing efforts.

2 unchanged sentences

If we experience difficulties with software development, customer service, or professional services that negatively impact new or existing products, we may experience negative publicity or lose market acceptance.

In July 2024, we began to evolve our GTM operating model by, among other things, transitioning to a general manager model.

As a part of this process, we are hiring new product and technical specialists into our GTM teams.

While we believe this transition will result in a more effective GTM organization, we have seen and may continue to see some disruptions and adverse impacts to our financial and operating results in the near-term as we invest in and implement the evolved GTM operating model.

If we fail to successfully implement the evolved GTM operating model, our ability to serve our customers and effectively address their concerns will be adversely impacted, which may result in unfavorable publicity or a negative perception of our products, services, or platform.

Any unfavorable publicity or negative perception of our products, services, or platform or the providers of construction management software generally, could adversely affect our reputation and our ability to attract and retain customers.

If we fail to promote and maintain our brand, or if we incur increased expenses in this effort, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Companies are also facing increasing scrutiny related to their environmental, social, and governance (“ESG”) practices and reporting as new laws and regulations relating to ESG matters are under consideration or being adopted, and as new norms emerge with regard to ESG reporting and initiatives.

Regardless of whether such claims are accurate, negative claims or publicity involving us in relation to ESG topics could damage our reputation, brand image, and ultimately impact our business, financial condition, results of operations, and prospects.

Our ability to increase our customer base, expand existing customers' use of our platform, and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities, including through the evolution of our GTM operating model.

Our ability to increase our customer base, expand existing customers ’ use of our platform, and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities.

Any failure to do so could materially adversely affect our business, financial condition, results of operations, and prospects.

Continuing and increasing sales of our products and services depends to a significant extent on our ability to expand our sales and marketing capabilities, including through the evolution of our GTM operating model.

Continuing and increasing sales of our products and services depends to a significant extent on our ability to expand our sales and marketing capabilities.

It is difficult to predict customer demand, customer retention, and expansion rates, the size and growth rate of the market, the entry of competitive products and services, or the success of existing competitive products and services.

Our sales efforts involve educating prospective customers about the uses and benefits of our products, services, and platform.

We spend substantial time and resources on our sales efforts without any assurance that our efforts will result in a sale.

We expect that we will continue to need intensive sales efforts to educate prospective customers about the uses and benefits of our construction management software and services, and we may have difficulty convincing prospective customers of the value of adopting our products and services.

Our sales and marketing efforts involve educating prospective customers about the uses and benefits of our products, services, and platform.

substantial time and resources on our sales and marketing efforts without any assurance that our efforts will result in a sale.

We expect that we will continue to need intensive sales and marketing efforts to educate prospective customers about the uses and benefits of our construction management software and services, and we may have difficulty convincing prospective customers of the value of adopting our products and services.

We plan to continue expanding our sales force, both domestically and internationally.

4 unchanged sentences

The failure of our efforts to secure sales after investing resources in a lengthy sales process could materially adversely affect our business, financial condition, results of operations, and prospects.

We have experienced, and may continue to experience, disruptions and adverse impacts to our financial and operating results as we continue to invest in and implement our evolved GTM operating model, and any failure to manage such disruptions and adverse impacts could materially adversely affect our business, financial condition, results of operations, and prospects.

We have experienced, and may continue to experience, headwinds with respect to our sales productivity.

These headwinds have resulted in a decline in revenue growth and current remaining performance obligations (“cRPO”) growth.

In July 2024, we began to evolve our GTM operating model, by, among other things, transitioning to a general manager model, in order to deepen customer relationships and improve our operating efficiency by building nimble, customer-focused teams under empowered general managers.

We have experienced, and may continue to experience, disruptions and adverse impacts to our financial and operating results in the near-term as we continue to invest in and implement our evolved GTM operating model.

It is difficult to predict whether these changes will achieve their desired effects, and there is no guarantee we will achieve the growth or operational improvements and efficiencies that we are anticipating as a result of our GTM operating model evolution.

Further, even if we do achieve such growth or efficiencies, there is no guarantee that we will be able to continue to increase productivity under the evolved GTM operating model once it is in place.

Implementing any operating model change presents additional potential risks including, among others, customer and partner confusion as their account teams are updated, diversion of management’s attention from core ongoing business activities, and failure to onboard and ramp new hires efficiently or at all.

If we are unable to manage the resulting short-term adverse impacts to our business, fail to successfully implement, or realize the full benefits of, our evolved GTM operating model over the long term, or otherwise fail to acquire new customers, retain existing customers, or expand existing customers’ use of our products, services, and platform, our business, financial condition, results of operations, and prospects could be materially adversely affected.

If we fail to realize the full benefits of our evolved GTM operating model over the long term or otherwise fail to acquire new customers, retain existing customers, or expand existing customers’ use of our products, services, and platform, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our failure to successfully incorporate AI into our products, services, and platform, as well as our business operations, or our failure to comply with laws, regulations, contractual obligations, or other requirements that now or in the future could apply to our use of AI, could materially adversely affect our business, financial condition, results of operations, and prospects.

We are increasingly building or incorporating AI tools (including generative and agentic AI tools) into our products, services, and platform.

We also deploy AI tools in our business operations.

We have used, and may continue to use, third parties to provide and support these tools.

Our use of AI may present significant risks, uncertainties, and challenges that could materially adversely affect our business, financial condition, results of operations, and prospects.

Developing, testing, selling, deploying, and adopting resource-intensive AI capabilities has increased and will likely continue to increase our operating costs.

We have invested, and expect to continue to invest, significant resources to develop AI tools.

We may also face greater competition from general purpose AI solutions that rely on generic large language models, generative AI, and general purpose AI agents to address a broad range of business needs.

If the integration of AI tools into our products, services, and platform fails to operate as anticipated, or as well as competing offerings, or otherwise does not meet customer needs, or if we are unable to bring AI-related offerings to market as effectively or as quickly as our competitors, we may fail to recoup our investments in AI, our competitive position may be harmed, and our business and reputation may be adversely impacted.

AI models may create flawed, inaccurate, or incomplete outputs, some of which may appear to be correct.

This may happen if the inputs that an AI model relied on were flawed, inaccurate, incomplete (including if a bad actor “poisons” an AI model with bad inputs or logic), or if the logic of the AI model is flawed (a so-called hallucination).

We, our customers or partners, or other third parties may use or rely on such outputs to our or their detriment, or such outputs may lead to adverse outcomes, including delays and errors, any of which may negatively impact our ability to attract and retain customers and to expand the use of our products, services, and platform, and expose us to brand or reputational harm, competitive risk, and legal liability.

Social or ethical concerns about the use of AI, such as the risk of AI models creating discriminatory outcomes using biased information, may also hinder the use and adoption of AI by our customers, partners, and employees.

As we expand the use of AI in our own business operations, there is a risk that we will experience such outcomes, which would harm our business and reputation.

If we use any third-party AI technologies that misuse or fail to protect the data that we or our employees, customers, partners, or vendors input, then that data (including confidential, competitive, proprietary, customer, or personal data) could be leaked, disclosed, or revealed to others.

Additionally, where an AI model ingests sensitive data without appropriate safeguards, and makes connections using such data, the AI model may produce outputs that reveal other sensitive data generated by the AI model that was not intended to be

Any such leak, disclosure, or revelation of data could harm our business, expose us to reputational harm and competitive risk, or result in legal or regulatory action against us.

We could also experience an increased risk of litigation if any AI tools that we provide or use are alleged to produce outputs that infringe or violate third-party intellectual property rights.

The legal and regulatory landscape surrounding AI is rapidly evolving and uncertain.

Several jurisdictions around the world, as well as several states and localities, have proposed, enacted, or are considering laws governing AI, including the European Union’s (“EU”) AI Act and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”) regulations on automated decision-making technology, and we expect that lawmakers and regulators will continue to maintain a heightened focus on AI and promulgate new legislation and regulations, which could impact our business and our actual or planned use of AI.

Laws and regulations governing AI may apply in new, unpredictable ways, and differences in how jurisdictions choose to address issues related to AI may require us to navigate a complex web of different obligations.

For example, the EU’s AI Act sets out a risk-based framework, subjecting certain AI technologies to numerous compliance obligations, including transparency, conformity, risk assessment, monitoring, and human oversight requirements.

Under the EU’s AI Act, non-compliant companies may be subject to administrative fines of up to 35 million euros or 7% of such company’s total worldwide annual revenue for the preceding financial year, whichever is greater.

We are subject to the EU’s AI Act.

Depending on how the EU’s AI Act is implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and current or planned products or services to comply with obligations imposed by the EU’s AI Act.

Our use of AI technologies could also lead to regulatory investigations and consumer lawsuits.

Certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may complicate our use of AI, lead to regulatory fines or penalties, be incompatible with our use of AI, require us to change our business practices, retrain our AI, or prevent our use of AI.

For example, the Federal Trade Commission has required other companies to turn over or disgorge valuable insights or trainings generated through the use of AI where they allege the company has violated privacy and consumer protection laws.

Complying with applicable laws, rules, and regulations governing AI could increase our operating costs, require significant resources or technical modifications to our systems, change the way that we operate in certain jurisdictions, and impede our ability to offer AI in certain products or use AI in our business operations.

Any of the above risks could materially adversely affect our business, financial condition, results of operations, and prospects.

Because we recognize revenue from subscriptions to access our products over the term of the subscription, downturns or upturns in new business will not be immediately reflected in our results of operations.

We generate substantially all of our revenue from subscriptions to access our products.

We recognize revenue ratably over the term of the subscription, beginning on the date that access to our products is made available to our customer.

We recognize revenue ratably over the term of the subscription, beginning on the date that access to our products is made available to the customer.

Our subscriptions generally have annual or multi-year terms.

7 unchanged sentences

We may spend substantial time, effort, and money on sales efforts for such customers without any assurance that our efforts will produce any sales or that these customers will deploy our platform widely enough across their business to justify our substantial upfront investment.

As a result, we anticipate increased sales to large enterprises, owners, and governmental entities will lead to higher upfront sales costs and greater unpredictability, which could materially adversely affect our business, results of operations, financial condition, and prospects.

As a result, we anticipate increased sales to large enterprises, owners, and governmental entities will lead to higher

upfront sales costs and greater unpredictability, which could materially adversely affect our business, results of operations, financial condition, and prospects.

In addition, as required by the revenue recognition standard under Accounting Standards Codification Topic 606, Revenue from Contracts with Customers , we disclose the transaction price allocated to remaining performance obligations (“RPO”).

7 unchanged sentences

• providing our products, services, and platform in different languages and customizing them to support local requirements;

• compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection and sovereignty, consumer protection, and unsolicited email, and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

• compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection and sovereignty, consumer protection, and unsolicited communications, and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

• recruiting and retaining talented and capable employees outside the U.S., including employees who speak multiple languages and come from a wide variety of different cultural backgrounds and customs, and managing an employee base in jurisdictions with differing employment regulations;

1 unchanged sentence

and navigating the practical enforcement of such intellectual property rights outside of the U.S.;

• political and economic instability, including as a result of the Russia-Ukraine war and the Israel-Hamas war, and a shifting and uncertain geopolitical landscape;

• political and economic instability, including as a result of the Russia-Ukraine war and other international conflicts, and a shifting and uncertain geopolitical landscape;

• generally longer payment cycles and greater difficulty in collecting accounts receivable;

5 unchanged sentences

Additionally, as we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates.

Although the majority of our cash generated from sales is denominated in U.S.

Although the majority of our cash generated from sales is

denominated in U.S.

Dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations.

14 unchanged sentences

These combinations may make it more difficult for us to effectively compete.

Further, the challenges and costs of recruiting and retaining qualified candidates with AI experience may negatively affect our ability to effectively develop and leverage AI technologies.

Our market and the technology landscape in general will also be impacted by the continued adoption of AI in ways that are currently unforeseeable and that could have significant benefits for our competitors.

17 unchanged sentences

Accessibility across this range is oftentimes out of our control, including as a result of reliance on third-party service providers or applications.

For example, in July 2024, a software update by a cybersecurity technology company caused widespread crashes of Windows systems into which it was integrated around the globe, including certain Windows systems that were used by a limited number of our employees and may have been used by our third-party service providers, vendors, and customers.

Even though we did not deem the crashes to be a material cybersecurity incident, in the future, we may be impacted by similar third-party software-induced interruptions to our operations, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Any third-party software-induced interruptions to our operations, such as software issues that affect our operating systems, could materially adversely affect our business, financial condition, results of operations, and prospects.

Integrations and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with such developments.

2 unchanged sentences

If our platform has operability or interoperability challenges with any of our integrations, customers may not adopt our platform, and our App Marketplace may not be useful to customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

In certain limited applications or situations, we use AI (including generative AI) in our products, services, and business operations.

AI presents risks, challenges, and unintended consequences that could affect our business operations and our customers’ adoption and use of our products.

Moreover, AI models may create flawed, incomplete, or inaccurate outputs, some of which may appear to be correct.

This may happen if the inputs that an AI model relied on were inaccurate, incomplete, or flawed (including if a bad actor “poisons” an AI model with bad inputs or logic), or if the logic of the AI model is flawed (a so-called “hallucination”).

We, o ur customers, or other third parties may rely on or use such outputs to our or their detriment, or it may lead to

adverse outcomes, which may negatively impact our ability to attract and retain customers and expose us to brand or reputational harm, competitive harm, and/or legal liability.

Additionally, our products, services, and platform are inherently complex and may contain material defects or errors, particularly when new products or features are released.

15 unchanged sentences

It takes a significant amount of time to plan, develop, and test improvements to our technologies and cloud infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements.

To the extent that we do not effectively scale our infrastructure to meet the needs of our growing customer base and maintain performance as our customers expand their use of our products, or if our cloud-based server costs were to increase, our business, financial condition, results of operations, and prospects could be materially adversely affected.

To the extent that we

do not effectively scale our infrastructure to meet the needs of our growing customer base and maintain performance as our customers expand their use of our products, or if our cloud-based server costs were to increase, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Sales to governmental entities, customers reliant on government funding, and other government contractors are subject to a number of additional challenges and risks.

We provide our products, services, and platform to federal, state, local, and non-U.S.

governmental customers, which may occur through direct sales to governmental entities or through channel partners that may sell directly to governmental entities.

We also provide our products, services, and platform to customers that may be reliant on funding derived from federal, state, local or non-U.S.

governmental sources.

We achieved U.S.

Federal Risk and Authorization Management Program (“FedRAMP”) Moderate authorization for our Procore for Government solution in January 2026, which we believe will allow us to expand our ability to sell to U.S.

federal government customers and contractors.

Even with FedRAMP Moderate authorization of Procore for Government, selling to governmental entities, customers reliant on government funding, and other government contractors presents a number of unique challenges and risks, including the following:

• selling to governmental entities can be highly competitive, expensive, and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale;

• governmental entities may have statutory, contractual, or other legal rights to terminate our contracts or contracts with channel partners for convenience or due to default;

• government certification or technical requirements for products and services may change, or we may be unable to achieve one or more government certifications, which may restrict our ability to sell into certain governmental entities until we have attained such certifications or technical requirements;

• contracts with governmental entities, customers reliant on government funding, and other government contractors, including channel partners in the government market, may contain terms that are less favorable than what we generally agree to in our standard commercial agreements, including terms that may be required by statute or regulation and/or maynot be negotiable with the customer;

• non-compliance with terms or conditions of government contracts, or with representations or certifications made in connection with government contracts, can result in significantly more adverse consequences than we typically would expect in the commercial market, including, depending on the circumstances, criminal liability, liability under the civil False Claims Act, and/or suspension or debarment from doing business with governmental entities;

• governmental entities routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in governmental entities refusing to continue buying our products and services, a loss of revenue, fines, and/or civil or criminal liability;

• negative publicity related to our contracts with governmental entities or with channel partners who sell to governmental entities or any proceedings surrounding them may damage our business and affect our competitive position;

• demand and payment for our products from governmental entities or other customers may be adversely impacted by, among other things, government shutdowns, changes in administrations, fiscal policies, contracting policies or requirements, efforts by government to evaluate and reduce overall government spending, budgetary cycles, and funding authorizations;

• in January 2025, the U.S.

presidential administration began issuing Executive Orders identifying new government policies and directing U.S.

federal agencies to evaluate their current actions, including certain spending, to ensure that such actions are consistent with new administration priorities.

Some of those Executive Orders are the subject of pending litigation, and there remains significant uncertainty about the ways in which agencies will implement the new Executive Orders.

Such implementation could negatively affect our current and future business with U.S.

government customers.

There is a risk that the costs of achieving and maintaining FedRAMP authorization will not be offset, in full or at all, by increased sales of our products and services.

Though our current revenue impact from contracts with governmental entities is not significant, to the extent that we become more reliant on contracts with

governmental entities, customers reliant on government funding, and/or other government contractors in the future, our exposure to such risks and challenges could increase, which in turn could materially adversely impact our business, financial condition, results of operations, and prospects.

Risks Related to Our Employees and Culture

If we lose key management personnel or if we are unable to retain or hire additional qualified personnel, we may not be able to achieve our strategic objectives and our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our future success is substantially dependent on our ability to attract, retain, and motivate the members of our management team and other key personnel throughout our organization.

In particular, we are highly dependent on the services of Craig F.

Courtemanche, Jr., our founder, President, and Chief Executive Officer, who is critical to our ability to achieve our vision and strategic priorities.

We rely on our management team in the areas of operations, security, research and development, sales and marketing, support, and general and administrative functions.

employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time.

Courtemanche or one or more of our key personnel

or members of our management team resign or otherwise cease to provide us with their services, our business, financial condition, results of operations, and prospects could be materially adversely affected.

If we lose key management personnel or if we are unable to retain or hire qualified personnel, we may not be able to achieve our strategic objectives and our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our future success is substantially dependent on our ability to attract, retain, and motivate our executive officers, other members of our management team and other key personnel throughout our organization.

employees, including our executive officers, the members of our management team, and other key personnel, work for us on an “at-will” basis, which means they may terminate their employment with us at any time.

As previously disclosed, effective November 10, 2025, Craig F.

Courtemanche, Jr., our founder, and former President and Chief Executive Officer, resigned as President and Chief Executive Officer of the Company, and Dr.

Gopal was appointed as President and Chief Executive Officer.

Gopal or one or more other members of our management team or other key personnel resign or otherwise cease to provide us with their services, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Our continued success is also dependent on our ability to attract and retain other qualified personnel possessing a broad range of skills and expertise.

3 unchanged sentences

Their former employers have in the past, and may in the future, assert that we or these employees have breached such employee’s legal obligations, resulting in a diversion of our time and resources.

If we fail to meet our hiring needs, at all or on the timeframes we expect, including in connection with the evolution of our GTM operating model, or if we fail to successfully integrate our new hires, our efficiency and ability to meet our forecasts and our employee morale, productivity, and retention could all suffer.

If we fail to meet our hiring needs, at all or on the timeframes we expect, or if we fail to successfully integrate our new hires, our efficiency and ability to meet our forecasts and our employee morale, productivity, and retention could all suffer.

Any of these factors could materially adversely affect our business, financial condition, results of operations, and prospects.

2 unchanged sentences

As we grow, we may find it difficult to maintain our corporate culture.

Further, recent leadership changes may create uncertainty or shifts in priorities that could make it more challenging to preserve our culture.

In addition, many of our employees work remotely and there is no guarantee that we will be able to maintain our corporate culture when much of our team is dispersed.

Any failure to preserve our culture could harm our future success, including our ability to recruit and retain qualified personnel, innovate and operate effectively, and execute on our business strategies.

In addition, in the past we have carried out, and we may in the future carry out, reductions in our workforce to ensure that our resources are aligned to our business strategy.

In the past we have carried out, and we may in the future carry out, reductions in our workforce to ensure that our resources are aligned to our business strategy.

Such reductions in our workforce could negatively impact our reputation as an employer and harm our company culture.

6 unchanged sentences

Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, internal and external privacy and security policies, contracts (including with our customers and other third parties), and other obligations relating to data privacy and security.

In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

In the U.S., federal, state, and local governments have enacted, and may in the future enact, numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Numerous U.S.

states, including California, have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data.

As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our

business and ability to provide our products and services.

Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments.

These state laws allow for statutory fines for noncompliance.

For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

states, including California, have enacted, and may in the future enact, comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices, affording residents with certain rights concerning their personal data, and stricter requirements for processing certain personal data.

Such rights may include the right to access, correct, or delete personal data, and to opt out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

For example, the CCPA requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA provides for administrative fines and allows private litigants affected by certain data breaches to recover significant statutory damages.

Additionally, several states and localities have enacted measures related to the use of AI in products and services.

Moreover, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data.

Our data processing practices are subject to increased challenges by class action plaintiffs.

Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts.

Our inability or failure to obtain such consents could result in adverse consequences, including class action litigation and mass arbitration demands.

Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could complicate compliance efforts.

As we continue to expand globally, our obligations related to data protection will increase.

Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security.

For example, the European Union’s (“EU”) General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data.

Under the EU’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater, for certain violations.

Similarly, under the U.K.’s GDPR, government regulators may impose fines of up to 17.5 million pounds sterling or 4% of annual global turnover, whichever is greater, for certain violations.

For example, the EU’s General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data.

Under the EU’s GDPR and the U.K.’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to the greater of (1) 20 million euros or 17.5 million pounds sterling, respectively, or (2) 4% of annual revenue.

The application of the EU’s GDPR alongside the U.K.’s GDPR exposes us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations.

2 unchanged sentences

Furthermore, as our business continues to expand and evolve, the EU’s GDPR, the U.K.’s GDPR, and similar data protection regulations may apply additional obligations on us to further secure personal data, provide further rights to data subjects, and require additional reporting to regulators.

In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, applies to our operations, as does Australia’s Privacy Act 1988.

We also have operations in Singapore and the UAE, which means that we may be subject to Singapore’s Personal Data Protection Act and the UAE’s Federal Data Protection Law No.

45 of 2021, respectively.

In addition, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No.

13,709/2018), which applies to our operations, broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU’s GDPR.

India’s new privacy legislation, the Digital Personal Data Protection Act, may also apply to our operations.

Several jurisdictions around the globe, including Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing AI, including the EU’s AI Act, and we expect other jurisdictions will adopt similar laws.

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may complicate our use of AI, lead to regulatory fines or penalties, be incompatible with our use of AI, require us to change our business practices, retrain our AI, or prevent our use of AI.

Our use of this technology could also result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

In Canada, the Personal Information Protection and Electronic Documents Act and various provincial laws, as well as Canada’s Anti-Spam Legislation, applies to our operations.

Similarly, Australia’s Privacy Act 1988,

Singapore’s Personal Data Protection Act, the UAE’s Federal Data Protection Law No.

45 of 2021, and Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No.

13,709/2018), which also apply to our operations, impose compliance obligations and penalties that are comparable to those of the EU’s GDPR.

In addition, India’s Digital Personal Data Protection Act and its implementing regulations, which provide for penalties of up to 2.5 billion Indian rupees for violations, may also apply to our operations.

We may also become subject to new laws that regulate non-personal data.

For example, the EU’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the European Economic Area (“EEA”).

Depending on how this and similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, products, and services to comply with such laws.

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the U.S.

1 unchanged sentence

Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries.

In particular, the European Economic Area (“EEA”) and the U.K.

In particular, the EEA and the U.K.

have significantly restricted the transfer of personal data to the U.S.

and other countries whose privacy laws it generally believes are inadequate.

Other jurisdictions may adopt or have already adopted similarly

stringent data localization and cross-border data transfer laws.

Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the U.K.

in compliance with law, such as the EEA and U.K.’s standard contractual clauses, the U.K.’s International Data Transfer Agreement / Addendum, and the EU-U.S.

Data Privacy Framework (which allows for transfers of personal data to relevant U.S.-based organizations that participate in and self-certify compliance with the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

in compliance with law, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy these mechanisms to lawfully transfer personal data to the U.S.

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and the U.K.

to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the cross-border data transfer limitations of the EU’s GDPR.

For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of standard contractual clauses to transfer personal data from Europe to the U.S.

10 unchanged sentences

We also rely on vendors to process payment card data who may also be subject to the PCI DSS, and our business may be negatively impacted if our vendors are fined or suffer other consequences as a result of noncompliance with the PCI DSS.

Our obligations related to data privacy and security (and consumers’ data privacy and security expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effect of future legal frameworks.

Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions.

Preparing for and complying with these obligations requires significant resources and may necessitate changes to our IT, systems, and practices and to those of any third parties that process personal data on our behalf.

In addition, these obligations may require us to change our business practices.

Our obligations related to data privacy and security (and consumers’ data privacy and security expectations) are quickly changing in an increasingly stringent fashion.

Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail, or be perceived to have failed, to do so.

Moreover, despite our efforts, our personnel or third parties with which we work, such as vendors or developers, may fail to comply with such obligations, which could negatively impact our business operations and compliance posture.

For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse consequences for us, including our inability to, or interruption in our ability to, operate our business and proceedings against us by governmental entities or others.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

For example, any failure by a third-party processor to comply with applicable law, regulations or contractual obligations could result in adverse consequences for us, including our ability to, or interruption in our ability to, operate our business and proceedings against us by governmental entities or others.

If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences, including government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

In the ordinary course of our business, we, and the third parties with which we work, process substantial amounts of sensitive information.

2 unchanged sentences

The threats posed by such activities are prevalent and continue to grow, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in cyberattacks including, without limitation, nation-states and nation-state-supported actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties with which we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and maintain the availability of our products, services, and platform.

We, the third parties with which we work, and our customers are subject to a variety of evolving threats, including, but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other IT assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats.

Further, our achievement of FedRAMP Moderate authorization for our Procore for Government solution, and heightened visibility as a provider of products and services to U.S.

federal government customers and contractors, may increase the risk of threats from nation-state, and nation-state supported, and other threat actors.

We, the third parties with which we work, and our customers are subject to a variety of evolving threats, including social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other IT assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats.

Our products and services may also be subject to fraudulent usage and schemes, including from third parties accessing customer accounts or viewing data from our platform.

In addition, remote work has become more common and has increased risks to our IT systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.

Severe ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds.

While extortion payments have the potential to alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments for a variety of reasons, including, but not limited to, applicable laws or regulations prohibiting such payments.

Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI platform could be leaked or disclosed to others, including if sensitive information is used to train the third party's AI model.

Additionally, where an AI model ingests personal data and makes

connections using such data, those technologies may reveal other personal or sensitive information generated by the model.

We employ a shared responsibility model where our customers are responsible for using, configuring, and otherwise implementing security measures related to our products, services, and platform, and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk.

Some actors, including, without limitation, organized criminal threat actors and nation-state-supported actors, now engage and are expected to continue to engage in cyberattacks for geopolitical reasons and in conjunction with military conflicts and defense activities.

For example, individuals from sanctioned jurisdictions such as North Korea have illicitly and fraudulently sought employment at U.S.

companies to get access to those companies’ sensitive information.

If we were found to have willfully or knowingly employed any such individuals, we could face criminal liability.

Ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds.

While extortion payments have the potential to alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments for a variety of reasons.

We employ a shared responsibility model where our customers are responsible for using, configuring, and otherwise implementing security measures related to our products, services, and platform in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk.

As part of this model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible.

5 unchanged sentences

Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks.

We rely upon third-party developers, service providers, and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions.

10 unchanged sentences

Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, as well as in reputational harm.

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high and critical unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed.

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed.

We have taken, and are taking, steps designed to mitigate these vulnerabilities in a prioritized manner based on our assessment of the risk posed by such vulnerabilities.

Despite our efforts, there can be no assurance that these vulnerability mitigation measures will be effective.

Moreover, we have experienced delays

in developing and deploying remedial measures and patches designed to address any identified vulnerabilities.

Moreover, we have experienced delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities.

Vulnerabilities could be exploited and result in a security incident.

1 unchanged sentence

A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or IT systems, or those of the third parties with which we work (including our customers).

A security incident or other interruption could disrupt our ability, and that of third parties with which we work, to provide our products, services, and platform.

Our current security measures may be insufficient to prevent or deter such incidents or interruptions.

We expend significant resources and have modified our business activities to try to protect against security incidents.

Certain data privacy and security obligations have required us to implement and maintain security measures or industry-standard or reasonable security measures to protect our IT systems and sensitive information.

If we or third parties with which we work experience a security incident or are perceived to have experienced a security incident, which has previously occurred, we could experience significant consequences, including government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm.

Security incidents and attendant consequences may also cause customers to stop using our products, services, and platform (including by declining to renew their subscriptions), deter new customers from using our products, services, and platform, and negatively impact our ability to grow and operate our business.

In addition, business transactions, such as acquisitions or integrations, have exposed us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we have discovered security issues that were not found during due diligence of such acquired or integrated entities, and it has been and may continue to be difficult to integrate companies into our IT environment and security program.

Furthermore, in the past, we have discovered security issues that were not found during due diligence of such acquired or integrated entities, and it has been, and may continue to be, difficult to integrate companies into our IT environment and security program.

Applicable data privacy and security obligations, including data breach laws and contractual obligations to various customers, may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents.

1 unchanged sentence

Determining whether a cybersecurity incident is notifiable or material may not be straightforward, and any such disclosures could be costly and could lead to negative publicity, loss of customer or partner confidence in the effectiveness of our security measures, diversion of management’s attention, governmental investigations, and the expenditure of significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach.

If we or third parties with which we work experience a security incident or are perceived to have experienced a security incident, we could experience significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm.

In addition, security incidents experienced by others, such as competitors or customers, may lead to widespread negative publicity for us, our customers, or the construction software industry generally.

Our contracts may not contain indemnification, limitations of liability, or other protective provisions.

3 unchanged sentences

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage.

sensitive information of our company or our customers could be leaked, disclosed, or revealed as a result of, or in connection with, our employees’, personnel’s, or vendors’ use of generative AI technologies.

Our business depends upon the appropriate and successful implementation of our products by our customers.

If our customers fail to use our products according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences.

To the extent we do not effectively address these risks, our business, financial condition, results of operations, and prospects could be materially adversely affected.

9 unchanged sentences

These rules could affect the services we and our customers use by restricting the offerings made by internet service providers or reducing their incentives to invest in their networks.

The rules were stayed pending completion of an appeal by an order of the U.S.

Court of Appeals for the Sixth Circuit on August 1, 2024.

On January 2, 2025, the U.S.

Court of Appeals for the Sixth Circuit vacated the rules.

A petition for rehearing of the decision filed by proponents of network neutrality was denied on March 11, 2025, and the time for seeking Supreme Court review of the decision has expired.

In addition, after a federal court judge denied a request for an injunction against California’s state-specific network neutrality law, California began enforcing that law on March 25, 2021.

Other states could begin to enforce existing laws or adopt new network neutrality requirements.

For example, a temporary injunction preventing implementation of a similar law in Vermont expired on April 20, 2022, although the challenge to that law remains pending and has been suspended until an appeal in another case addressing state powers to adopt internet regulation is resolved.

Several other states have adopted similar rules, including Washington, Oregon, Colorado, New Jersey, and Vermont.

Many of the laws and regulations to which we are subject are still evolving and being tested in courts and could be interpreted in ways that could harm our business.

4 unchanged sentences

In certain instances, we rely on third-party service providers or partners to facilitate certain features of our platform or products that are subject to laws and regulations that may be complex, wide-ranging, and evolving, and whose compliance practices and licensure we are unable to control.

If such third parties or partners are unable to effectively manage their compliance and licensure obligations in connection with the services they

provide to us, or choose not to renew agreements with us because of the costs or burden of compliance with such obligations or for any other reason, our users may experience service changes, interruptions, or delays.

If such third parties or partners are unable to effectively manage their compliance and licensure obligations in connection with the services they provide to us, or choose not to renew agreements with us because of the costs or burden of compliance with such obligations or for any other reason, our users may experience service changes, interruptions, or delays.

Furthermore, we may be unable to find new service providers or partners, or may need to obtain replacement services on less favorable terms.

6 unchanged sentences

prompt ancillary claims, lawsuits, proceedings, investigations, inquiries, or requests;

consume financial and other resources which may otherwise be utilized for other purposes, such as advancing other products and services on our platform;

consume financial and other

resources which may otherwise be utilized for other purposes, such as advancing other products and services on our platform;

cause a breach or cancellation of certain contracts;

5 unchanged sentences

Such litigation can be costly and time-consuming, divert the attention of management and key personnel from our business operations, and dissuade prospective customers from subscribing to our products or services.

We have become, and may in the future become, party to legal proceedings and claims alleging infringement or misappropriation of intellectual property, whether with or without merit, which have been, and could continue to be, time-consuming to defend, and have resulted, and could continue to result, in costly litigation and diversion of resources.

We have become, and may in the future become, party to legal proceedings and claims alleging infringement or misappropriation of intellectual property or violations of employment laws and workplace regulations, whether with or without merit.

These matters have been, and could continue to be, time-consuming to defend, and have resulted, and could continue to result, in costly litigation and diversion of resources.

Such legal proceedings are unpredictable, and we could receive an unfavorable outcome in pending or future proceedings.

If any such proceedings are successful, or if we need to settle disputes on terms that are unfavorable to us, we could be required to change our products and business practices, indemnify our customers or business partners, pay substantial settlement costs, or refund fees.

We may also have to seek a license to continue practices found to be in violation of third-party rights, which may not be available to us on reasonable terms or may not be available to us at all.

If any such proceedings are successful, or if we need to settle disputes on terms that are unfavorable to us, we could be required to change our products, business practices, employment policies, indemnify our customers or business partners, pay substantial settlement costs, back wages, regulatory fines, or refund fees.

For example, in 2024, Oracle America, Inc.

and certain of its affiliates filed a lawsuit against us, one of our affiliates, and an employee in federal court alleging that we had misappropriated certain trade secrets.

We are not able to estimate the extent of the damages that we would incur if we were to receive an unfavorable outcome in this lawsuit.

We may be subject to injunctive relief or ongoing government oversight that restricts our ability to manage our workforce effectively, or be required to seek a license to continue practices found to be in violation of third-party rights, which may not be available to us on reasonable terms or at all, any of which could materially impact our business.

Additionally, during the course of any litigation or dispute, we may make announcements regarding the results of hearings and motions and other interim developments.

8 unchanged sentences

The increased scrutiny of acquisitions in the technology industry also could affect our ability to enter into strategic transactions or to acquire other businesses.

Compliance with new or modified laws and

regulations could increase the cost of conducting business, limit opportunities to increase our revenues, or prevent us from offering products or services.

Compliance with new or modified laws and regulations could increase the cost of conducting business, limit opportunities to increase our revenues, or prevent us from offering products or services.

In addition, the introduction of new products and services, expansion of our activities in certain jurisdictions or with certain government customers, or other actions we may take may subject us to additional laws, rules, and regulations, or other government scrutiny.

19 unchanged sentences

These actions could also demand significant management attention and operational resources, harming our business.

We are pursuing FedRAMP authorization in order to facilitate our ability to enter into contracts with U.S.

federal entities and contractors.

Achieving FedRAMP authorization requires significant time and resources, and there is no guarantee that we will be successful on the timelines we estimate, or at all.

If we are successful, our business and operations will be subject to heightened regulatory requirements and scrutiny, along with the additional costs and challenges of complying with such requirements, and there is a risk that the costs of achieving and maintaining FedRAMP authorization will not be offset, in full or at all, by increased sales of our products, services, and platform.

Contracting with government entities involves additional risks due to, among other things, the nature of the government procurement process and the costs and burden of complying with the complex and often changing requirements that apply to government contracts.

We may face audits and investigations in connection with government contracts, and any violations thereof could lead to penalties, contract termination, fines, suspension from future government business, and damage to our reputation and operating results, among other risks.

The sale of products and services to government entities also comes with challenges, such as longer sales and collection cycles and different budgeting processes.

There can be no assurance that our business will not be materially adversely affected, individually or in the aggregate, by such scrutiny or the outcomes of any such investigations, inquiries, litigation, or changes to laws and regulations in the future.

Such government scrutiny of the technology industry, or the outcome of any investigation, inquiry, litigation, or changes to laws or regulations could materially adversely affect our business, financial conditions, results of operations, and prospects.

We are subject to governmental export and import controls that could impair our ability to compete in international markets and subject us to liability if we are not in compliance with applicable laws.

7 unchanged sentences

export control laws and economic sanctions prohibit the shipment of certain cloud-based solutions to countries, governments, and persons targeted by U.S.

In addition, various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted or could enact laws that could limit our ability to make available or implement our platform in those countries.

make available or implement our platform in those countries.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection of this information, we cannot assure you that these procedures have been effective or that we, or third parties, many of whom we do not control, have complied with all laws or regulations in this regard.

13 unchanged sentences

Anti-corruption and anti- bribery laws, which have been enforced aggressively and are interpreted broadly, prohibit companies and their employees, agents, intermediaries, and other third parties from promising, authorizing, making, or offering improper payments or other benefits to government officials and others in the private sector.

In the future, we may leverage third parties, including intermediaries, agents, and partners, to conduct our business in the U.S.

We leverage, and may continue to leverage, third parties, including intermediaries, agents, and partners, to conduct our business in the U.S.

and abroad and to sell subscriptions.

We and these third parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities, and we may be held liable for the corrupt or other illegal activities of these third-party partners and intermediaries, our employees, representatives, contractors, partners, agents, intermediaries, and other third parties, even if we do not explicitly authorize such activities.

While we have policies and procedures to facilitate compliance with the FCPA, the

Bribery Act, and other anti-corruption, sanctions, anti-bribery, anti-money laundering, and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, partners, agents, intermediaries, or other third parties have taken, or will not take actions, in violation of our policies and procedures and applicable law, for which we may be ultimately held responsible.

While we have policies and procedures to facilitate compliance with the FCPA, the Bribery Act, and other anti-corruption, sanctions, anti-bribery, anti-money laundering, and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, partners, agents, intermediaries, or other third parties have taken, or will not take actions, in violation of our policies and procedures and applicable law, for which we may be ultimately held responsible.

As we increase our international sales and business, our risks under these laws may increase.

24 unchanged sentences

Licensed money transmitters are subject to numerous requirements, including restrictions on the investment of customer funds, reporting requirements, bond requirements, and inspection by state regulatory agencies.

If we fail to comply with applicable laws or regulations required to maintain money transmitter licenses for Procore Pay, we could be subject to investigations and resulting liability, including governmental fines, restrictions on our business, or other sanctions, or be forced to cease doing business with residents of certain states or territories, forced to change our business practices, required to change our product functionality, or required to obtain additional licenses or regulatory approvals, which could impose additional costs and harm our

There can be no assurance that we will be able to obtain money transmitter licenses in all jurisdictions in which we wish to operate.

Even if we are able to do so, there could be substantial costs and potential product changes involved in maintaining such licenses, which could materially adversely affect our business, financial condition, results of operations, and prospects.

In 2025, Procore Pay began processing payments in markets where PPS is licensed as a money transmitter.

In markets where PPS is not currently licensed as a money transmitter, Procore Pay relies on payment partners to process payments.

In 2025, Procore Pay began processing payments in markets where Procore Payment Services, Inc.

("Procore Payment Services") is licensed as a money transmitter.

In markets where Procore Payment Services is not currently licensed as a money transmitter, Procore Pay relies on payment partners to process payments.

Local regulators may use their authority over such partners to prohibit, restrict, or limit us from doing business in their respective jurisdictions.

Our payment partners may be subject to extensive compliance obligations as well as enforcement actions, fines, and litigation if found to violate any legal or regulatory requirements that apply to them.

Our payment partners may be subject to extensive compliance obligations as well as enforcement actions, fines, and litigation if found to violate any legal or regulatory requirements that apply to

Our payment partners may choose not to renew their agreement with us for this or any other reason, or may seek to involve us in enforcement actions, fines, or litigation related to the services they provide.

21 unchanged sentences

In addition, we believe that the protection of our trademark rights is an important factor in product recognition, protecting our brand, and maintaining goodwill.

If we do not adequately protect our rights in our trademarks from infringement, misappropriation, and unauthorized use, any goodwill that we have developed in those trademarks could be lost

or impaired, which could harm our brand and our business.

If we do not adequately protect our rights in our trademarks from infringement, misappropriation, and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business.

In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties.

4 unchanged sentences

Others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes.

Additionally, pending and future patent, trademark, and copyright applications may not be approved, and our issued patents may be contested, circumvented, found unenforceable, or invalidated.

Additionally, pending and future patent, trademark, and copyright applications may not be approved,

and our issued patents may be contested, circumvented, found unenforceable, or invalidated.

Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual property rights.

11 unchanged sentences

As a result, our business, financial condition, and results of operations could be materially adversely affected.

Our use of third-party open source software could negatively affect our ability to sell subscriptions to access our products and subject us to possible litigation.

Our use of third-party open source software could negatively affect our ability to sell subscriptions to access our products and platform and subject us to possible litigation.

From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and compliance with the open source software license terms.

3 unchanged sentences

Furthermore, there exists today an increasing number of types of open source software licenses, almost none of which have been tested in courts of law to provide clarity on their proper legal interpretation.

If we were to receive a claim of non-compliance with the terms of any of these open source licenses, we may be required to publicly release certain

portions of our proprietary source code.

If we were to receive a claim of non-compliance with the terms of any of these open source licenses, we may be required to publicly release certain portions of our proprietary source code.

We could also be required to expend substantial time and resources to re-engineer some or all of our software.

2 unchanged sentences

Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform.

Any of the foregoing could materially adversely affect our business, financial condition, results of operations, and prospects, and could help competitors develop products and services that are similar to or better than ours.

Any of the foregoing could help competitors develop products and services that are similar to or better than ours and could materially adversely affect our business, financial condition, results of operations, and prospects.

Our customers’ and other users’ violations of our policies or other misuse of our platform to transmit unauthorized, offensive, or illegal messages, spam, phishing scams, and website links to harmful applications or for other fraudulent or illegal activity could damage our reputation, and we may face a risk of litigation and liability for illegal activities on our platform and unauthorized, inaccurate, or fraudulent information distributed via our platform.

19 unchanged sentences

In addition, we may inherit commitments, risks, and liabilities of companies that we acquire that we are unable to successfully mitigate and that may be amplified by our existing business.

Further, valuations supporting our acquisitions and strategic

investments could change rapidly.

Further, valuations supporting our acquisitions and strategic investments could change rapidly.

Following any such transaction, we could determine that such valuations have experienced impairments or other-than-temporary declines in fair value which could materially adversely affect our business, financial condition, operating results, and prospects through the write-off of goodwill and other impairment charges.

5 unchanged sentences

We could be required to collect additional sales and use, value added, goods and services, business, gross receipts, and other indirect tax liabilities in various jurisdictions, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We currently collect and remit applicable indirect taxes in jurisdictions where we, through our employees or economic activity, have a presence and where we have determined, based on applicable legal precedents, that sales of subscriptions to access our products, services, and platform are taxable.

We do not currently collect and remit indirect taxes, including state and local excise, utility user, and ad valorem taxes, fees, and surcharges in jurisdictions where we believe we do not have sufficient “nexus.” There is uncertainty as to what constitutes sufficient nexus for a state or local jurisdiction to levy taxes, fees, and surcharges on sales made over the internet, and there is also uncertainty as to whether our characterization of our products, services, and platform as not taxable in certain jurisdictions will be accepted by state and local tax authorities.

We currently collect and remit applicable indirect taxes in jurisdictions where we, through our employees or economic activity, have a presence, or “nexus,” and where we have determined, based on applicable law, that sales of subscriptions to access our products, services, and platform are taxable.

There is uncertainty as to what constitutes sufficient nexus for a state or local jurisdiction to levy taxes, fees, and surcharges on sales made over the internet, and there is also uncertainty as to whether our characterization of our products, services, and platform as not taxable in certain jurisdictions will be accepted by state and local tax authorities.

Tax authorities may challenge our position that we do not have sufficient nexus in a taxing jurisdiction or that our products, services, and platform are not taxable in such jurisdiction and may decide to audit our business and operations with respect to indirect taxes, which could result in significant tax liabilities (including related penalties and interest) for us or our customers, which could materially adversely affect our business, financial condition, results of operations, and prospects.

The application of indirect taxes, such as sales and use, value added, goods and services, business, and gross receipts taxes, to businesses that transact online, such as ours, is a complex and evolving area.

Following the 2018 U.S.

Supreme Court decision in South Dakota v.

Wayfair, Inc., states and local jurisdictions in certain circumstances may levy sales and use taxes on sales of goods and services based on “economic nexus,” regardless of whether the seller has a physical presence in such jurisdiction.

A number of states have already begun, or have positioned themselves to begin, requiring collection of sales and use taxes by online sellers.

States and local jurisdictions in certain circumstances may levy sales and use taxes on sales of goods and services based on “economic nexus,” regardless of whether the seller has a physical presence in such jurisdiction.

A number of states have begun requiring collection of sales and use taxes by online sellers.

The details and effective dates of these collection requirements vary from state to state.

9 unchanged sentences

Our intercompany relationships are subject to complex transfer pricing regulations administered by tax authorities in various jurisdictions.

The amount of taxes we pay in different jurisdictions may depend on the

application of the tax laws of such jurisdictions, including the U.S., to our international business activities, changes in tax rates, new or revised tax laws, or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which are generally required to be computed on an arm’s-length basis pursuant to intercompany arrangements, or may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of such jurisdictions, including the U.S., to our international business activities, changes in tax rates, new or revised tax laws, or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which generally are required to be computed on an arm’s-length basis pursuant to intercompany arrangements, or may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

2 unchanged sentences

Evaluating our tax positions and our worldwide provision for taxes is complicated and requires the exercise of significant judgment.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination

is uncertain.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes against us.

1 unchanged sentence

Our business could be materially adversely affected by changes to tax laws.

The tax regimes we are subject to or operate under, including income and non-income taxes, are unsettled and may be subject to significant change.

The tax regimes to which we are subject or under which we operate, including income and non-income taxes, are unsettled and may be subject to significant change.

Changes in tax laws, regulations, or rulings, or changes in interpretations of existing laws and regulations, could materially adversely affect our business, financial condition, results of operations, and prospects.

For example, the Tax Cuts and Jobs Act (the “TCJA”), the Coronavirus Aid, Relief and Economic Security Act, and the Inflation Reduction Act (the “IRA”) made many significant changes to the U.S.

Beginning in 2022, the TCJA requires taxpayers to capitalize and amortize certain research and development expenditures over five years if incurred in the U.S.

and 15 years if incurred in foreign jurisdictions, rather than deducting them currently.

Although there have been legislative proposals to repeal or defer the research and development expenditure capitalization requirement to later years, there can be no assurance that the provision will be repealed or otherwise modified.

As another example, the IRA includes provisions that will impact the U.S.

For example, the legislation commonly referred to as the One Big Beautiful Bill Act (the “OBBBA”) was recently signed into law, which, along with the Tax Cuts and Jobs Act (the “TCJA”), the Coronavirus Aid, Relief and Economic Security Act, and the Inflation Reduction Act (the “IRA”) resulted in significant changes to the taxation of business entities including, among other changes, the imposition of minimum taxes or surtaxes on certain types of income, changes to the taxation of income derived from international operations, changes in the deduction and amortization of research and development expenditures, and limitations on the deductibility of business interest.

The IRA includes provisions that will impact the U.S.

federal income taxation of certain corporations, including imposing a minimum tax on the book income of certain large corporations and a 1% excise tax on the value of certain corporate stock repurchases by publicly traded companies that would be imposed on the company repurchasing such stock.

2 unchanged sentences

In addition, many countries in Europe, as well as a number of other countries and organizations (including the Organization for Economic Cooperation and Development (the “OECD”) and the European Commission), have recently proposed, recommended, or (in the case of certain countries) enacted, or are in the process of enacting, changes to existing tax laws or new tax laws that could significantly increase our tax obligations in the countries where we do business or require us to change the manner in which we operate our business.

In particular, the OECD is working on a two-pillar solution to address the tax challenges arising from the digitalization of the economy, commonly referred to as BEPS 2.0, which, to the extent implemented, would make important changes to the international tax system by allocating taxing rights in respect of certain profits of multinational enterprises above a fixed profit margin to the jurisdictions within which they carry on business (subject to certain revenue threshold rules which we do not currently meet but may meet in the future), referred to as the Pillar One proposal, and imposing a minimum effective tax rate on certain multinational enterprises, referred to as the Pillar Two proposal.

A number of countries within which we carry on our business have implemented, or are currently expected to implement, core elements of the Pillar Two proposal.

Based on our current understanding of the minimum revenue thresholds contained in the Pillar Two rules, we currently expect to be within their scope beginning in 2025.

The OECD has issued administrative guidance providing transition and safe harbor rules in relation to the implementation of the Pillar Two proposal.

We are monitoring developments and evaluating the potential impacts of these new rules, including on our effective tax rates, and considering our eligibility to qualify for these safe harbor rules.

In particular, the OECD is working on a two-pillar solution to address the tax challenges arising from the digitalization of the economy, commonly referred to as BEPS 2.0, which has made, and is expected to continue to make, significant changes to the international tax system, including by allocating taxing rights in respect of certain profits of multinational enterprises above a fixed profit margin to the jurisdictions within which they carry on business (subject to certain revenue threshold rules which we do not currently meet but may meet in the future), referred to as the Pillar One proposal, and imposing a minimum effective tax rate on certain multinational enterprises, referred to as the Pillar Two proposal.

A number of countries within which we carry on our business have implemented, or are currently expected to implement, core elements of the Pillar Two proposal (with further provisions expected to be enacted in the future).

Based on our current understanding of the minimum revenue thresholds contained in the Pillar Two rules, we came within their scope beginning in 2025, but do not expect them to have a material impact on us for fiscal year 2025.

The OECD has issued, and continues to issue further, administrative guidance providing transition and safe harbor rules in relation to the implementation of the Pillar Two proposal and other rules.

For example, on January 5, 2026, the OECD published details of a proposed “side-by-side” arrangement providing for, among other things, additional safe harbors for multinational groups headquartered in certain qualifying jurisdictions.

We are monitoring developments and evaluating the potential impacts of the Pillar Two rules, including on our effective tax rates, and considering our eligibility to qualify for these safe harbor rules (including under the proposed “side-by-side” arrangement).

Any of the foregoing could materially adversely affect our business, financial condition, results of operations, and prospects, and we may be required to incur additional material costs and expenditure to ensure compliance with any such rules in each of the relevant jurisdictions within which we carry on our business.

4 unchanged sentences

Under current law, our U.S.

federal NOLs incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but the ability to utilize such federal NOL carryforwards to offset taxable income is limited to 80% of the current-year taxable income.

In addition, federal NOL carryforwards and certain tax credits may be subject to significant limitations under Section 382 and Section 383 of the Internal Revenue Code (the “IRC”), respectively.

federal NOLs incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but the ability to utilize such federal NOL carryforwards to offset taxable income in a tax year is limited to 80% of the taxable income in such tax year.

In addition, federal NOL carryforwards and certain tax credits may be

subject to significant limitations under Section 382 and Section 383 of the Internal Revenue Code (the “IRC”), respectively.

Under those sections of the IRC, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change NOL carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income or taxes may be limited.

2 unchanged sentences

Our ability to utilize our NOL carryforwards is conditioned upon generating future U.S.

federal taxable income, and we do not know whether or when we will do so.

federal taxable income.

Although we have generated U.S.

federal taxable income in the past, we do not know whether we will continue to do so.

Therefore, our NOL carryforwards generated prior to 2018 could expire unused.

15 unchanged sentences

These investments are subject to general credit, liquidity, market, and interest rate risks.

In particular, the value of our portfolio may decline due to changes in interest rates, instability in the global financial markets that reduces the liquidity of securities in our portfolio, and other factors, including unexpected or unprecedented events such as health epidemics or pandemics (including the COVID-19 pandemic).

As a result, we may experience a significant

decline in value or loss of liquidity of our investments, which could materially adversely affect our business, financial condition, results of operations, and prospects.

As a result, we may experience a significant decline in value or loss of liquidity of our investments, which could materially adversely affect our business, financial condition, results of operations, and prospects.

We attempt to mitigate these risks through diversification of our investments and continuous monitoring of our portfolio’s overall risk profile, but the value of our investments may nevertheless decline.

14 unchanged sentences

Our current disclosure controls and procedures and internal control over financial reporting, and any new controls that we develop, may become inadequate because of changes in conditions in our business, including our acquisitions.

In addition, changes in accounting principles or interpretations could also challenge our controls and require that we establish new business processes, systems, and controls to accommodate such changes.

Changes in accounting principles or interpretations could also challenge our controls and require that we establish new business processes, systems, and controls to accommodate such changes.

If our current and new systems, controls, or standards and any associated process changes do not give rise to the benefits that we expect or do not operate as intended, our financial reporting systems and processes, our ability to produce timely and accurate financial reports or disclosures, or the effectiveness of our internal control over financial reporting could be adversely affected.

5 unchanged sentences

Any failure to maintain effective disclosure controls and procedures or internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations.

we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines that we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities.

Failure to remedy any material weaknesses or to maintain effective disclosure controls and internal control over financial reporting could adversely affect investor confidence in our company, causing a decline in our stock price, as well as restrict our future access to capital markets.

If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines that we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities.

Failure to remedy any material weaknesses or to maintain effective disclosure controls and internal control over financial reporting could adversely affect investor confidence in our

company, causing a decline in our stock price, as well as restrict our future access to capital markets.

Such failure could also materially adversely affect our business, financial condition, results of operations, and prospects.

Our business could be disrupted by macroeconomic factors, geopolitical events, or catastrophic occurrences.

Our platform and the infrastructure on which our platform relies are vulnerable to damage or interruption from macroeconomic factors and geopolitical events, including trends within the construction industry, inflation and responses by governments to address it, interest rate changes, tariffs and trade wars, bank failures, a shifting and uncertain geopolitical landscape, military conflicts or wars (such as the Russia-Ukraine war and the Israel-Hamas war), health epidemics or pandemics (such as the COVID-19 pandemic), and supply chain disruptions, or catastrophic occurrences, including earthquakes, floods, fires, other natural disasters, power loss, telecommunication failures, terrorist attacks, criminal acts, sabotage, and other intentional acts of vandalism and misconduct, or other similar events, each of which could materially adversely affect our business, financial condition, results of operations, and prospects, or the business of our customers, partners, vendors, or the economy as a whole.

For example, our corporate headquarters and a number of our members of our management in senior roles are located near Santa Barbara, California, a region known for, among other things, seismic activity and severe fires, and a catastrophic event in this region could materially adversely affect our business, financial condition, results of operations, and prospects.

The impact of changes to our climate could result in an increase in the frequency or severity of such events.

Our platform and the infrastructure on which our platform relies are vulnerable to damage or interruption from macroeconomic factors and geopolitical events, including trends within the construction industry, inflation and responses by governments to address it, interest rate changes, tariffs and trade wars, bank failures, a shifting and uncertain geopolitical landscape, military conflicts or wars (such as the Russia-Ukraine war and other international conflicts), health epidemics or pandemics, and supply chain disruptions, or catastrophic occurrences, including earthquakes, floods, fires, other natural disasters, power loss, telecommunication failures, terrorist attacks, criminal acts, sabotage, and other intentional acts of vandalism and misconduct, or other similar events, each of which could materially adversely affect our business, financial condition, results of operations, and prospects, or the business of our customers, partners, vendors, or the economy as a whole.

For example, our corporate headquarters are located near Santa Barbara, California, a region known for seismic activity and severe fires We also have an office and a sizable workforce in Austin, Texas, which may experience extreme weather events.

A catastrophic event in one of these areas or in areas in which our other offices or sizable parts of our workforce are located could materially adversely affect our business, financial condition, results of operations, and prospects.

Further, the impact of changes to our climate could result in an increase in the frequency or severity of such events.

Climate-related events have the potential to disrupt our business, our third-party suppliers, and the business of our customers, may cause us to experience higher attrition, losses, and additional costs to maintain and resume operations, and may subject us to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business.

2 unchanged sentences

We cannot guarantee that our stock repurchase program will enhance stockholder value, and any stock repurchases we make could increase the volatility of our common stock and diminish the cash reserves we have available to fund working capital and other projects, and any failure to repurchase our common stock after we have announced our intention to do so may negatively affect the price of our common stock.

On October 29, 2024, our board of directors (our “Board”) authorized a stock repurchase program to repurchase up to $300.0 million of our outstanding common stock.

On November 3, 2025, our board of directors (our “Board”) authorized a stock repurchase program to repurchase up to $300.0 million of our outstanding common stock.

Our Board previously authorized a previous stock repurchase program on October 29, 2024, to repurchase up to $300.0 million of our outstanding common stock, which expired on October 29, 2025.

We intend to opportunistically repurchase shares of our common stock from time to time through the open market (including via pre-set trading plans) or through other transactions in accordance with applicable securities laws, in each case, subject to market conditions, applicable legal requirements, and other relevant factors.

2 unchanged sentences

The stock repurchase program does not obligate us to acquire any particular number of shares of our common stock, or any shares at all.

The stock repurchase program expires on October 29, 2025, and may be suspended or discontinued at any time at our discretion and without notice.

The stock repurchase program expires on November 3, 2026, and may be suspended or discontinued at any time at our discretion and without notice.

Although our stock repurchase program is intended to enhance long-term stockholder value, there is no assurance that it will do so because the market price of our common stock may increase above the levels at which we deem it prudent to repurchase shares, and short-term stock price fluctuations could reduce our ability to properly manage the program and the overall effectiveness of the program.

The stock repurchase program

could also affect the price of our common stock and increase volatility.

The stock repurchase program could also affect the price of our common stock and increase volatility.

The existence of our stock repurchase program could cause our stock price to be higher than it otherwise would be and could potentially reduce the market liquidity for our stock.

Repurchasing our common stock reduces the amount of cash we have available to fund working capital, capital expenditures, strategic acquisitions or investments, other business opportunities, and other general corporate projects.

Repurchasing our common stock reduces the amount of cash we have available to fund working capital, capital expenditures, strategic acquisitions or investments, other business opportunities,

and other general corporate projects.

We cannot guarantee that the stock repurchase program will be fully or partially consummated.

4 unchanged sentences

For these and other reasons, we may fail to realize the anticipated value of the stock repurchase program or enhance long-term stockholder value as a result of the stock repurchase program.

If we experience excessive fraudulent activity or cannot meet evolving credit card association merchant standards, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly and could materially adversely affect our business, financial condition, results of operations, and prospects.

Substantial losses due to fraud or our inability to accept credit card payments could cause our customer base to significantly decrease and would harm our business.

A significant portion of our customers authorize us to bill their credit card accounts directly for our products, and certain of our customers purchase from us directly and are required to keep their payment methods current for monthly billing purposes.

Our customers provide us with credit card billing information online or over the phone, and we do not review the physical credit cards used in these transactions, which increases our risk of exposure to fraudulent activity.

We have incurred charges, which we refer to as chargebacks, from credit card companies for claims that the customer did not authorize the credit card transaction for our products.

We may be required to pay for unauthorized credit charges and expenses with no reimbursement from the customer.

If the number of claims of unauthorized credit card transactions becomes excessive, we could be assessed substantial fines for excess chargebacks, and we could lose the right to accept credit cards for payment.

Although we implement multiple fraud prevention and detection controls, we cannot assure you that these controls will be adequate to protect against fraud.

In addition, credit card issuers may change merchant standards, including data protection and documentation standards, required to utilize their services from time to time.

If we fail to comply with such standards, the credit card associations could fine us or terminate their agreements with us, and we would be unable to accept credit cards as payment for our products.

The market price of our common stock may be volatile, and you could lose all or part of your investment.

The market price of our common stock has in the past been volatile, and is likely to be volatile again in the future.

In light of recent macroeconomic factors and geopolitical events, including trends within the construction industry, inflation and responses by governments to address it, interest rate changes, tariffs and trade wars, bank failures, a shifting and uncertain geopolitical landscape, military conflicts or wars (such as the Russia-Ukraine war and the Israel-Hamas war), health epidemics or pandemics (such as the COVID-19 pandemic), and supply chain disruptions, and the market for technology companies in particular, the stock market in general has experienced extreme volatility, which has often been unrelated to the operating performance of particular companies.

In light of macroeconomic factors and geopolitical events, the stock market in general has experienced significant volatility in recent years, which has often been unrelated to the operating performance of particular companies.

The market price for our common stock may also be influenced by the following factors:

6 unchanged sentences

and actual or anticipated developments in our business, competitors’ businesses, or the competitive landscape generally.

In addition, the limited public float of our common stock may tend to increase the volatility of the trading price of our common stock.

As a result of this volatility, you may not be able to sell your common stock at or above the price you paid for your shares.

Additionally, the foregoing factors, along with other market and industry factors, may cause the market price and demand for our common stock to fluctuate substantially,

regardless of our actual operating performance, which may limit or prevent investors from selling their shares at or above the price paid for the shares and may otherwise negatively affect the liquidity of our common stock.

Additionally, the foregoing factors, along with other market and industry factors, may cause the market price and demand for our common stock to fluctuate substantially, regardless of our actual operating performance, which may limit or prevent investors from selling their shares at or above the price paid for the shares and may otherwise negatively affect the liquidity of our common stock.

Substantial losses due to fraud or our inability to accept credit card payments could cause our customer base to significantly decrease and would harm our business.

We have incurred charges, which we refer to as chargebacks, from credit card companies for claims that the customer did not authorize the credit card transaction for our products.

We may be required to pay for unauthorized credit charges and expenses with no reimbursement from the customer.

Although we implement multiple fraud prevention and detection controls, we cannot assure you that these controls will be adequate to protect against fraud.

In addition, credit card issuers may change merchant standards, including data protection and documentation standards, required to utilize their services from time to time.

If we fail to comply with such standards, the credit card associations could fine us or terminate their agreements with us, and we would be unable to accept credit cards as payment for our products.

Concentration of ownership of our common stock among our officers, directors, and principal stockholders may prevent new and other existing investors from influencing significant corporate decisions, including mergers, consolidations, or the sale of us or all or substantially all of our assets.

1 unchanged sentence

Furthermore, one of our current directors is affiliated with one of our largest stockholders.

As a result, such persons or their affiliates on our Board, if any, may have the ability to significantly influence matters submitted to our Board or stockholders for approval, including the appointment of our management, the election and removal of directors, and the approval of any significant transactions (including any merger, consolidation, or sale of all or substantially all of our assets), as well as our management and business affairs.

As a result, such persons or their

affiliates on our Board, if any, may have the ability to significantly influence matters submitted to our Board or stockholders for approval, including the appointment of our management, the election and removal of directors, and the approval of any significant transactions (including any merger, consolidation, or sale of all or substantially all of our assets), as well as our management and business affairs.

This concentration of ownership may also have the effect of delaying, deferring, or preventing a change in control, impeding a merger, consolidation, takeover, or other business combination involving us, or discouraging a potential acquirer from making a tender offer or otherwise attempting to obtain control of our business, even if such a transaction would benefit other stockholders.

3 unchanged sentences

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could delay or prevent a change in control of our company.

These provisions could also make it difficult for stockholders to elect directors that are not nominated by the current members of our Board or take other corporate actions, including effecting changes in our management.

These provisions include, but are not limited to:

These provisions could also make it difficult for stockholders to elect directors that are not nominated by the current members of our Board or to take other corporate actions, including effecting changes in our management.

These provisions include:

• a classified Board with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our Board;

3 unchanged sentences

• a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

• the requirement that a special meeting of stockholders may be called only by the our Board acting pursuant to a resolution adopted by a majority of our Board, which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

• the requirement that a special meeting of stockholders may be called only by our Board acting pursuant to a resolution adopted by a majority of our Board, which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

• the requirement to obtain approval of two-thirds of the then-outstanding voting power of our capital stock in order to make certain amendments to our amended and restated certificate of incorporation;

14 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors