What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-08-08 compared with 2025-05-02 · 94 added, 96 removed, 790 unchanged (19% of the section changed)

20 unchanged sentences

• our ability to maintain and enhance our brand and increase market awareness of our company and products;

• disruptions or deterioration in quality of service and connectivity by third-party service providers;

• our reliance on network service providers and internet service providers for network service and connectivity;

• failure to set optimal prices for our products;

33 unchanged sentences

• potential decline in the market price of our common stock due to substantial future sales of shares;

• the possibility that we may not realize the anticipated long-term stockholder value of our share repurchase programs;

• the possibility that we may not realize the anticipated long-term stockholder value of our share repurchase program;

• securities or industry analysts changing their recommendations regarding our common stock;

15 unchanged sentences

If customers fail to pay us as a result of adverse macroeconomic or geopolitical conditions or otherwise, we may be required to take steps to enforce the terms of our contracts and collect amounts due, which may not succeed.

For example, in 2023, one of our customers in Brazil initiated reorganization proceedings exposing us to risks on collections of pre-petition receivables and ongoing revenue, and in 2024 its creditors approved a reorganization plan providing extended and discounted payment terms for pre-petition receivables.

As a result of a reduction in ongoing payment activity from this customer, as of December 31, 2024, we fully reserved accounts receivable balances for this customer.

Macroeconomic and political conditions and uncertainties have in the past and may in the future adversely affect our business, results of operations and financial condition, and exacerbate many of the other risks described in this “Risk Factors” section.

For example, in 2023, one of our former customers in Brazil initiated reorganization proceedings exposing us to risks on collections of pre-petition receivables and ongoing revenue, and in 2024 its creditors approved a reorganization plan providing extended and discounted payment terms for pre-petition receivables.

As a result of a reduction in ongoing payment activity, as of December 31, 2024, we fully reserved accounts receivable balances for this former customer.

Macroeconomic and political conditions and uncertainties have in the past adversely affected, and may in the future adversely affect, our business, results of operations and financial condition, and could exacerbate many of the other risks described in this “Risk Factors” section.

Our quarterly and annual results of operations have fluctuated in the past and may continue to do so in the future.

64 unchanged sentences

Such changes may not lead to wider adoption of our products or to the cost-effective acquisition of additional customers or increased revenue from existing customers as quickly or to the extent we expect, or at all, and have resulted, and may in the future result, in a reduction of productivity, which could negatively impact our growth rate and results of operations.

For example, in recent years, we have reduced the size of our sales

force to drive further efficiencies in our sales operations and are continuing to improve and rely more heavily on our use of self-service capabilities to drive sales of our products to customers that do not require direct account coverage.

For example, in recent years, we have reduced the size of our sales force to drive further efficiencies in our sales operations and are continuing to improve and rely more heavily on our use of self-service capabilities to drive sales of our products to customers that do not require direct account coverage.

We are also introducing AI and automation in our self-service platform aimed at improving sales and customer support.

These efforts may not continue to be as effective as we anticipate in driving adoption or increased usage of our products, or may take longer than we expect to drive growth.

These efforts may not continue to be as effective as we anticipate in driving adoption or increased usage of our products, or may take longer than we expect to drive growth or increase efficiency.

In addition, if the costs of the marketing channels we use increase, then we may choose to use alternative or less expensive channels, which may not be as effective as the channels we currently use.

11 unchanged sentences

For example, we have committed, and expect to continue to commit, significant resources towards developing new products and enhancements by combining our communications products with contextual data and AI in order to address evolving customer needs and expectations.

The success of any enhancements or new products depends on several factors, including timely completion, adequate quality testing, actual performance quality, market-accepted pricing levels, customer value and the ability to provide rapid time-to-value for our customers, and the emergence of competing products and services that may be delivered at lower prices, more efficiently, conveniently or securely, or render our products obsolete.

conveniently or securely, or render our products obsolete.

For example, if user authentication practices evolve to reduce or eliminate the use of one-time passwords, our revenue could be adversely affected.

6 unchanged sentences

Our platform must integrate with and leverage a variety of infrastructure, network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our products and platform to adapt to changes and innovation in these technologies.

For example, last year we launched a new channel using Rich Communication Services (“RCS”) and we are

working on a channel for Apple Messages for Business.

For example, last year we launched a new channel using Rich Communication Services (“RCS”) and we are working on a channel for Apple Messages for Business.

We are also focused on Segment’s interoperability across the data ecosystem.

25 unchanged sentences

As we expand the scope of our products, we may face additional competition and, in some cases, may find our products in competition with those of our customers, which could cause them to replace our products with competitive offerings.

If one or more of our competitors were to merge or partner with another of our competitors or our suppliers, the change in the

competitive landscape could also adversely affect our ability to compete effectively.

If one or more of our competitors were to merge or partner with another of our competitors or our suppliers, the change in the competitive landscape could also adversely affect our ability to compete effectively.

For example, certain of our competitors have engaged in acquisition activity, and we expect that our competitors will continue to evaluate the acquisition of companies and technologies that could increase competition with our products in the future.

13 unchanged sentences

We have a history of losses and may not achieve or sustain profitability in the future.

We have incurred net losses in each year since our inception, including net losses of $109.4 million and $1.0 billion in the years ended December 31, 2024 and 2023, respectively.

While we achieved net income of $42.4 million in the six months ended June 30, 2025, we have incurred net losses in each preceding year since our inception, including net losses of $109.4 million and $1.0 billion in the years ended December 31, 2024 and 2023, respectively.

In addition, while we have experienced revenue growth in prior periods, it is not indicative of future revenue growth, and our revenue and revenue growth for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period.

If we are unable to generate and sustain increased revenue levels and manage our operating expenses, we may not become profitable and achieve our stated profitability goals and, even if we do, we may not be able to maintain or increase our level of profitability.

If we are unable to generate and sustain increased revenue levels and manage our operating expenses, we may not achieve and sustain profitability and, even if we do, we may not be able increase our level of profitability or achieve our stated profitability goals.

As we implement additional initiatives to increase revenue, our operating expenses may continue to rise over the long term, potentially including, among other things:

31 unchanged sentences

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

We currently interconnect with fixed and mobile network service providers around the world to enable our customers to use our products over their networks.

Although we are in the process of acquiring authorization in many countries for direct access to phone numbers and for the provision of voice and messaging services on the networks of fixed and mobile network service providers, we expect that we will continue to rely on network service providers for these services.

We interconnect with fixed and mobile network service providers around the world to enable our customers to use our products over their networks.

Although we currently hold or are in the process of acquiring authorization in many countries for direct access to phone numbers and for the provision of voice and messaging services on the networks of fixed and mobile network service providers, we expect that we will continue to rely on network service providers for these services.

Where we do not have direct access to phone numbers, our reliance on network service providers has reduced our operating flexibility, ability to make timely service changes and control quality of service.

In addition, the fees that we are charged by network service providers may change daily or weekly and we can be subject to the imposition of additional fees, penalties, or other administrative or technical requirements, and even service interruption, due to regulatory, competitive, or other industry related changes over which we have little to no control.

For example, in recent years, multiple major U.S.

mobile carriers have introduced A2P SMS service offerings that added a new fee for A2P SMS messages delivered to their respective subscribers, and, from time to time, other U.S.

mobile carriers have added similar fees.

In addition, the fees that we are charged by network service providers are subject to change and we can be subject to the imposition of additional fees, penalties, or other administrative or technical requirements, and even service interruption, due to regulatory, competitive, or other industry related changes over which we have little to no control.

From time to time, network service providers have instituted additional or increased fees that increase our network costs.

For example, in June 2025, a major U.S.

mobile carrier increased its fees for A2P SMS messages delivered to its subscribers, which will create a modest headwind to our gross margins going forward.

mobile carriers may follow suit and such fees may increase over time.

While we have historically responded to these types of fee increases through a combination of further negotiating efforts with our network service providers, absorbing the increased costs or passing the fees through to customers, there is no guarantee that we will continue to be able to respond in these ways in the future without a material negative impact to our business.

We typically do not change our customers’ pricing as rapidly and, as a result, such fee increases could adversely affect our business and results of operations.

The fees charged by our network service providers are subject to change, in some markets daily or weekly, and we may not change our customers’ pricing as rapidly and, as a result, such fee increases could adversely affect our business and results of operations.

In addition, passing these fees through to our customers typically has the effect of increasing our revenue and cost of revenue, but typically does not impact the gross profit dollars received for sending these messages and, as a result, has a negative impact on our gross margins.

4 unchanged sentences

The occurrence of errors, service outages, security incidents, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Further, we sometimes access network services through intermediaries who have direct access to network service providers.

Although we are in the process of securing direct connections with network service providers in many countries, we expect that we will continue to rely on intermediaries for these services for some period of time.

Further, in cases where we do not have direct access to network service providers, we access network services through intermediaries.

Although we are in the process of securing additional direct connections with network service providers in many countries, we expect that we will continue to rely on intermediaries for these services for some period of time.

These intermediaries sometimes have offerings that directly compete with our products and may stop providing services to us on a cost-effective basis.

7 unchanged sentences

One of the challenges of this usage-based pricing model is the variability of the fees that we pay to network service providers over whose networks we transmit communications.

Such network fees can vary daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict.

Such network fees can vary, in some markets daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict.

This can result in us incurring increased costs that we may be unable or unwilling to pass through to our customers, which could adversely impact our business, results of operations and financial condition.

5 unchanged sentences

Our international operations expose us to risks inherent in global operations.

In the three months ended March 31, 2025 and the years ended December 31, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively.

In the six months ended June 30, 2025 and the years ended December 31, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively.

The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide.

4 unchanged sentences

• implementing and reconciling technical controls to address different technical standards, data privacy, data protection and telecommunications regulations, and registration and certification requirements outside the United States, which could prevent customers from deploying our products or limit their usage;

• our ability to comply with laws, regulations, customs and industry standards in countries and other regions in which we operate or do business, and the associated costs and management attention required to support such compliance, including with respect to data privacy, data protection, data localization, cybersecurity, intellectual property rights, environmental and sustainability matters, as well as export controls, sanctions, anti-bribery and anti-corruption matters;

compliance, including with respect to data privacy, data protection, data localization, cybersecurity, intellectual property rights, environmental and sustainability matters, as well as export controls, sanctions, anti-bribery and anti-corruption matters;

• international tax and trade policies, tariffs, and other non-tariff barriers;

32 unchanged sentences

In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and magnitude, and cloud-based companies have been targeted in the past.

In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employee theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process.

We face various threats from traditional computer hackers, sophisticated organized crime, nation-state and nation-state supported actors, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employee theft or misuse, attempts to bribe, extort, or compromise our employees or infiltrate our workforce, password spraying, phishing, smishing, vishing, credential stuffing, denial-of-service attacks, and advanced persistent threat intrusions, which threaten our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process.

Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

7 unchanged sentences

Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

Any security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities.

unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities.

For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and mobile phone numbers from unknown sources.

2 unchanged sentences

We also notified appropriate regulators and addressed their questions about the incident.

We took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, running simulated phishing attempts to increase employee security awareness, and increasing the refresh frequency for

access to certain internal applications.

Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

21 unchanged sentences

The breadth and depth of changes in data protection obligations has required significant time and resources, including a review of our technology and systems against the requirements of the GDPR.

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies.

In the United States, the CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information.

The CCPA allows for statutory fines for noncompliance.

Similar laws have been enacted in 20 other states with 13 laws currently in effect and the remainder becoming effective later in 2025 and 2026.

Numerous other states, and the U.S.

federal government, also have proposed general privacy legislation.

Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action.

If we become subject to new privacy, data protection or cybersecurity laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Numerous other states have enacted or are considering laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action, and laws in several states relating to the provision of individual home address or telephone directory information.

States and the U.S.

federal government have also proposed general privacy legislation.

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity.

For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”).

For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers.

Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher.

Further, individuals may initiate compensation claims or litigation related to our processing of their personal information.

Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices.

For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection impose strict requirements for processing personal information of covered individuals, whether within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”).

For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data retention, security, and international data transfers.

Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data transfers or other processing, require data deletion, and impose significant fines, potentially ranging up to the greater of 4% of a company’s worldwide revenue or 20 million Euros or 17.5 million GBP, respectively.

Individuals also may initiate compensation claims or litigation related to our processing of their personal information.

Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies.

As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No.

3 unchanged sentences

For example, in Europe, the Artificial Intelligence Act, once effective, will impose onerous obligations related to the development, placement on the market and use of AI-related systems.

In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI.

Other countries also are contemplating laws regulating AI and ML.

A growing number of U.S.

states are enacting legislation regulating aspects of AI or AI generally.

Other countries are also contemplating laws regulating AI and ML.

We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Further, the interpretation and application of new domestic and foreign laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly.

For example, the EU’s Digital Services Act, Digital Markets Act and Data Act entered into force in 2024, and the EU’s Network and Information Security Directive II, adopted in 2023, provides for EU member states to have issued implementing legislation by October 2024.

Additionally, the EU’s Digital Operational Resiliency Act entered into force on January 17, 2025.

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we also must comply with privacy laws associated with customer proprietary network information rules in the United States.

In addition, states such as California have increasingly adopted or proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law.

The interpretation and application of laws and regulations are in many cases uncertain, and our legal and regulatory obligations are subject to frequent and unexpected changes, including the potential for new or additional laws or regulations, rulings that invalidate prior laws or regulations, or significant increases in penalties.

Recent examples include the EU’s Digital Services Act, Digital Markets Act and Data Act effective in 2024, EU member state legislation implementing the EU’s Network and Information Security Directive II and the EU’s Digital Operational Resiliency Act effective in January 2025.

New and changing privacy, data protection or cybersecurity laws and regulations may result in additional obligations, increase the risk of enforcement action against us, and increase the types and numbers of individuals or entities that can initiate actions against us.

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we must comply with privacy laws associated with customer proprietary network information rules in the United States.

In addition, some states have adopted, proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law.

If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

In addition to our legal obligations, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and the expansion of our offerings.

In addition, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and expansion of our offerings.

Certain privacy, data protection and cybersecurity laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

5 unchanged sentences

Data Privacy Framework.

Based on this decision, personal information can flow from the

Based on this decision, personal information can flow from the EU to U.S.

companies participating in the EU-U.S.

Data Privacy Framework without having to put in place additional data protection safeguards.

Data Privacy Framework without additional data protection safeguards.

We are certified under the EU-U.S.

7 unchanged sentences

In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin.

If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for data transfers out of Europe and other applicable jurisdictions quickly enough, and valid solutions for personal information transfers to the United States or other jurisdictions are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for relevant data transfers quickly enough, and valid solutions for relevant personal information are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability.

14 unchanged sentences

We may be required to spend significant resources to monitor, enforce, maintain, and protect our intellectual property and proprietary rights.

Litigation brought to protect and enforce our intellectual property or proprietary rights could be costly, time-consuming and distracting to management, result in a diversion of significant resources, or the narrowing or invalidation of portions of our intellectual property.

of portions of our intellectual property.

Our efforts to enforce our intellectual property or proprietary rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of such rights.

13 unchanged sentences

Our products and platform incorporate open source software, and we expect to continue to incorporate open source software in our products and platform in the future.

Open source software presents certain risks in addition to those of third-party technology and intellectual property generally.

Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products and platform.

8 unchanged sentences

The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform.

In addition, if the third-party technology and intellectual property we use has errors, service

outages, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.

In addition, if the third-party technology and intellectual property we use has errors, service outages, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.

For example, we outsource a substantial majority of our cloud infrastructure to Amazon Web Services (“AWS”), which hosts our products and platform.

18 unchanged sentences

We have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, and these solutions and features may become more important to our operations or to our future growth over time.

We expect to rely on AI solutions and features to help drive future growth in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI.

We expect to rely on AI solutions and features to help drive future growth and efficiency in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI in a timely or cost-effective manner.

For example, we are focused on continued product innovations to combine our communications products with contextual data and AI to address evolving customer needs and expectations.

We are also building out new AI capabilities internally, including AI automation and agents in our self-service platform and in our internal operations.

Our investments in AI solutions and features have and may continue to negatively impact our cost of revenue and gross margins until we are able to increase revenue enough to offset these investments.

We may also fail to properly implement or market our AI solutions and features.

Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require.

Our ability to effectively implement and market our AI solutions and features will depend, in part, on our

ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require.

Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject.

For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, harmful, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject.

If we fail to obtain any required permissions to collect, use, or otherwise process data, including personal information, in relation to AI solutions or features, or if we jeopardize the privacy or security of such information, it could adversely affect our business, results of operations and financial condition.

The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations.

5 unchanged sentences

If we do not comply with FCC rules and regulations, or other communications laws and regulations, we could be subject to enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products.

For example, in early 2023, we received a “cease-and-desist” letter from the FCC related to reported fraudulent traffic on our messaging platform, and in response we undertook certain mitigation efforts and other improvements to reduce future risks.

Any enforcement action by the FCC or another regulatory authority, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

2 unchanged sentences

• the Communications Act of 1934, as amended, which regulates communications services and the provision of such services;

• the Telephone Consumer Protection Act of 1991 (“TCPA”), which limits the use of automatic dialing systems for calls and texts, artificial or prerecorded voice messages and fax machines;

• the Telephone Consumer Protection Act of 1991 (“TCPA”), which limits the use of automatic dialing systems for calls and texts, artificial or prerecorded voice messages and fax machines and establishes quiet hours for solicitations;

• the Communications Assistance for Law Enforcement Act, which requires covered entities to assist law enforcement in undertaking electronic surveillance;

3 unchanged sentences

• rules pertaining to access to our services by people with disabilities and contributions to the Telecommunications Relay Services fund.

In addition, Congress and the FCC continue to focus on mitigating the prevalence of robocalls and robotexts, including by requiring providers to implement call authentication technologies such as Signature-based Handling of Asserted Information Using toKENs (“SHAKEN”) and Secure Telephone Identity Revisited (“STIR”), which together establish a set of technical standards and protocols that allow for the authentication and verification of caller ID information for calls carried over IP networks.

Combating illegal calls has long been one of the FCC’s top consumer protection priorities, and the FCC continues to take steps to strengthen and expand its call blocking and robocall and robotext mitigation rules, including those related to the STIR/SHAKEN framework.

In addition, Congress and the FCC continue to focus on mitigating the prevalence of robocalls and robotexts, including by requiring providers to implement call authentication technologies such as Signature-based Handling of Asserted Information Using toKENs and Secure Telephone Identity Revisited, which together establish a set of technical standards and protocols that allow for the authentication and verification of caller ID information, adopting stricter Robocall Mitigation Database (“RMD”) filing requirements and increasing the base forfeiture amount for submitting false or inaccurate statements to the RMD.

Combating illegal calls is one of the FCC’s top consumer protection priorities, and the FCC continues to take steps to

strengthen, expand and enforce its rules against the origination and carrying of illegal robocalls and robotexts.

We cannot predict whether the FCC will require more or different robocall and robotext mitigation measures than those we have or are planning to implement.

1 unchanged sentence

In addition, the extension of telecommunications regulations to our non-interconnected VoIP services could result in additional federal and state regulatory obligations and taxes.

Additionally, states such as California have increasingly adopted or proposed, or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations.

If we become subject to several new

and/or different interconnected and/or non-interconnected VoIP regulations at the state level, it would increase our compliance costs and the risk of enforcement action against us, which in turn could adversely affect our business, results of operations and financial condition.

Additionally, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations.

If we become subject to several new and/or different interconnected and/or non-interconnected VoIP regulations at the state level, it would increase our compliance costs and the risk of enforcement action against us, which in turn could adversely affect our business, results of operations and financial condition.

Internationally, we currently offer our products in more than 180 countries and territories and continue to expand.

17 unchanged sentences

In addition, in order to obtain allocations of, assign and retain Numbering Resources in many international jurisdictions, we are often required to be licensed by local telecommunications regulatory authorities.

We have obtained licenses and are in the process of obtaining licenses in various countries in which we do business, but in some countries, the regulatory regime around provisioning of Numbering Resources is unclear, subject to change over time, and sometimes may conflict from jurisdiction to jurisdiction.

We have obtained licenses and are in

the process of obtaining licenses in various countries in which we do business, but in some countries, the regulatory regime around provisioning of Numbering Resources is unclear, subject to change over time, and sometimes may conflict from jurisdiction to jurisdiction.

These regulations and governments’ approach to their enforcement, as well as our products and services, are evolving and we may be unable to maintain compliance with applicable regulations, or enforce compliance by our customers, on a timely basis or without significant cost or changes in products or business practices that result in reduced revenue.

In some countries where our or our customers’ assignment and/or use of Numbering Resources in certain ways may violate applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country.

We have also been required to reclaim Numbering Resources from our customers as a result of certain

events of non-compliance.

We have also been required to reclaim Numbering Resources from our customers as a result of certain events of non-compliance.

These reclamations result in loss of customers, loss of revenue, reputational harm, erosion of customer trust, and may also result in breach of contract claims, all of which could have an adverse effect on our business, results of operations and financial condition.

Due to their limited availability, there are certain popular area code prefixes that we generally cannot obtain.

Our inability to acquire or retain Numbering Resources for our operations may make our voice and messaging products less attractive to potential customers in these geographic areas.

If we are unable to acquire or retain Numbering Resources, our voice and messaging products may be less attractive to potential customers.

Certain popular area code prefixes have limited availability, and restrictive rules generally prevent us from obtaining or assigning certain number types.

In addition, future growth in our customer base and those of other CPaaS providers may make it increasingly difficult to source larger quantities of Numbering Resources, and Numbering Resources may become more expensive or subject to more stringent regulation or conditions of usage.

17 unchanged sentences

For example, the TCPA restricts telemarketing and the use of automatic SMS text messages without prior express consent.

TCPA violations can result in significant financial penalties, as businesses can incur penalties or criminal fines up to $1,500 per violation imposed by the FCC, state attorneys general or other state actors or through private litigation.

TCPA violations can result in significant financial penalties, as businesses can incur civil or criminal penalties imposed by the FCC, state attorneys general or other state actors or through private litigation.

Regulatory enforcement is often public, which would result in reputational harm.

31 unchanged sentences

Without federal net neutrality rules, we cannot predict whether internet access service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive alternative to our competitors’ applications.

Moreover, several states such as California have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections.

Moreover, several states have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections.

State broadband regulations have been upheld by courts in certain jurisdictions, creating the potential for a patchwork of disparate regulatory regimes and operational challenges.

12 unchanged sentences

We take precautions to prevent our products from being imported or exported and our services from being provided in violation of these laws;

however, we are aware of certain of our products and services being provided to a small number of individuals and entities that are the subject of, or are located in countries or regions subject to, sanctions regulations administered by U.S.

however, we are aware of certain of our products and services being provided to, procured from, or that involve dealings with, a small number of individuals and entities that are the subject of, or are located in countries or regions subject to, sanctions regulations administered by U.S.

and foreign governmental authorities.

26 unchanged sentences

Because we fulfill email delivery on behalf of our customers, denylisting of this type could undermine the effectiveness of our customers’ transactional email, email marketing programs and other email communications, all of which could have a material negative impact on our business, financial condition and results of operations.

In the first quarter of 2024, Google and Yahoo began enforcing new email sender requirements aimed at sender authentication, including Domain-based Message Authentication, Reporting and Conformance (“DMARC”) record requirements.

These requirements have required us to devote time and resources toward compliance efforts, and these or similar authentication requirements imposed in the future could result in reduced volumes for our email products and could adversely affect our business, financial condition and results of operations.

For example, in 2024 and 2025, Google, Yahoo and Microsoft began enforcing new email sender requirements aimed at sender authentication, including Domain-based Message Authentication, Reporting and Conformance (“DMARC”) record requirements, requiring us to devote time and resources toward compliance efforts.

These or similar authentication requirements imposed in the future could result in reduced volumes for our email products and could adversely affect our business, financial condition and results of operations.

Additionally, inbox service providers can block emails from reaching their users or categorize certain emails as “promotional” emails and, as a result, direct them to an alternate or “tabbed” section of the recipient’s inbox.

32 unchanged sentences

We have incurred substantial indebtedness that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

As of March 31, 2025, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

As of June 30, 2025, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

Our indebtedness may:

47 unchanged sentences

Goodwill is required to be tested for impairment at least annually.

As of March 31, 2025, we carried a net $5.5 billion of goodwill and intangible assets.

As of June 30, 2025, we carried a net $5.4 billion of goodwill and intangible assets.

An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets.

17 unchanged sentences

federal, state and foreign net operating loss carryforwards (“NOLs”), of $2.8 billion, $2.4 billion and $0.8 billion, respectively.

Utilization of these NOL carryforwards depends on our future taxable income, and there is risk that a portion of our existing NOLs could expire unused and the use of our unexpired NOLs could be subject to limitations, which could materially and adversely affect our operating results.

Utilization of these NOLs depends on our future taxable income, and there is risk that a portion of our existing NOLs could expire unused and the use of our unexpired NOLs could be subject to limitations, which could materially and adversely affect our operating results.

Under current law, our U.S.

federal NOLs can generally be carried forward indefinitely, but the deductibility of such NOLs is generally limited to 80% of taxable income.

Our state NOLs may also be subject to limitations, including periods during which the use of state NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

For example, California recently enacted legislation that limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

Our state NOLs may also be subject to limitations, including periods during which the use of state NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

For example, in June 2024, California enacted legislation that limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), and corresponding provisions of state law, a corporation that undergoes an “ownership change” (generally defined as a greater than 50-percentage-point cumulative change (by value) in the equity ownership of certain stockholders over a rolling three-year period) is subject to limitations on its ability to utilize its pre-change NOLs and other pre-change tax attributes to offset post-change taxable income and taxes.

14 unchanged sentences

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated.

We reserved $42.2 million on our March 31, 2025 balance sheet for these tax payments.

We reserved $43.6 million on our June 30, 2025 balance sheet for these tax payments.

These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions.

18 unchanged sentences

In accordance with GAAP, we recognize income tax benefits, net of required valuation allowances and accrual for uncertain tax positions.

Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than that which is reflected in historical income tax provisions and accruals.

Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

Changes in tax laws or tax rulings, or changes in interpretations of existing laws, could cause us to be subject to additional income-based taxes and non-income taxes (such as payroll, sales, use, value-added, digital tax, net worth, property, and goods and services taxes), which in turn could materially affect our financial position and results of operations.

Changes in tax laws, including recently enacted U.S.

federal tax legislation commonly referred to as the One Big Beautiful Bill Act (the “OBBB Act”), or tax rulings, or changes in interpretations of existing laws, could cause us to be subject to additional income-based taxes and non-income taxes (such as payroll, sales, use, value-added, digital tax, net worth, property, and goods and services taxes), which in turn could materially affect our financial position and results of operations.

The OBBB Act could potentially increase our effective tax rate as we continue to expand our international operations in the coming years.

Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

For example, on August 16, 2022, the Inflation Reduction Act of 2022 was signed into law, with tax provisions primarily focused on implementing a 15% minimum tax on global adjusted financial statement income of corporations with adjusted financial statement income exceeding $1.0 billion, effective for tax years beginning after December 31, 2022, and a 1% excise tax on share repurchases occurring after December 31, 2022, which resulted in an excise tax payable calculated on our 2023 and 2024 share repurchases.

As another example, beginning in 2022, the Tax Cuts and Jobs Act of 2017 (the “Tax Act”) eliminates the option to deduct research and development expenditures currently and requires taxpayers to capitalize and amortize them over five or fifteen years pursuant to Section 174 of the Code, which impacts our effective tax rate and our cash tax liability.

On October 8, 2021, the Organization for Economic Co-operation and Development (the “OECD”) announced the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the “Framework”) which agreed to a two-pillar solution to address tax challenges arising from digitalization of the economy.

On December 20, 2021, the OECD released Pillar Two Model Rules defining the global minimum tax rules, which contemplate a minimum tax rate of 15% for large multinational companies.

On December 15, 2022, the European Union (EU) Member States formally adopted the EU’s Pillar Two Directive and various countries have enacted or are in the process of enacting legislation on these rules.

These changes, when enacted by various countries in which we do business, may increase our taxes in these countries.

As another example, in 2021, the Organization for Economic Co-operation and Development (the “OECD”) announced the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the “Framework”) and released Pillar Two Model Rules defining global minimum tax rules (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies.

In 2022, the European Union (EU) Member States adopted the EU’s Pillar Two Directive, and various other countries have proposed or enacted similar legislation that may increase our taxes in these countries.

On June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two.

However, this statement has not yet been incorporated into the Framework.

Changes to these and other areas in relation to potential U.S.

27 unchanged sentences

Additionally, the shares of common stock subject to outstanding options and restricted stock unit awards under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans will become eligible for sale in the public market upon issuance, subject to applicable insider trading policies.

We may not realize the anticipated long-term stockholder value of our share repurchase programs, and any failure to repurchase our common stock after we have announced our intention to do so may negatively impact our stock price.

We may not realize the anticipated long-term stockholder value of our share repurchase program, and any failure to repurchase our common stock after we have announced our intention to do so may negatively impact our stock price.

In January 2025, our board of directors authorized the repurchase of up to $2.0 billion of our common stock from time to time through a share repurchase program.

As of March 31, 2025, we had repurchased $130.2 million of outstanding shares of our common stock under this program, such that approximately $1.9 billion remained available for purchase as of such date.

As of June 30, 2025, we had repurchased $306.9 million of outstanding shares of our common stock under this program, such that approximately $1.7 billion remained available for purchase as of such date.

Under our share repurchase program, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws.

15 unchanged sentences

• limiting the ability of our stockholders to call and bring business before special meetings;

• providing that our board of directors is classified into three classes of directors with staggered three-year terms;

• prohibiting stockholder action by written consent, instead requiring all stockholder actions to be taken at a meeting of our stockholders;

16 unchanged sentences

The Delaware Forum Provision and the Federal Forum Provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or employees, which may discourage lawsuits against us and our directors, officers and employees.

If a court were to find the Delaware Forum Provision and the Federal

Forum Provision in our bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could seriously harm our business.

If a court were to find the Delaware Forum Provision and the Federal Forum Provision in our bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could seriously harm our business.

General Risks

16 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors