What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-05-01 compared with 2025-10-31 · 247 added, 312 removed, 571 unchanged (49% of the section changed)

1 unchanged sentence

A description of the risks and uncertainties associated with our business is set forth below.

You should carefully consider the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes, before making a decision to invest in our common stock.

You should carefully consider the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our unaudited condensed consolidated financial statements and related notes, before making a decision to invest in our common stock.

The risks and uncertainties described below may not be the only ones we face.

11 unchanged sentences

• our ability to effectively manage our growth and strategic changes to our business;

• our ability to compete effectively in intensely competitive markets;

• the evolution of the markets for our products;

• our history of losses and uncertainty about our future profitability;

• our ability to compete effectively in intensely competitive and rapidly evolving markets;

• our ability to maintain profitability;

• our ability to hire, integrate and retain highly skilled personnel;

44 unchanged sentences

Global economic and political conditions, including macroeconomic and political uncertainties, have had, and may continue to have, an adverse impact on our business, results of operations and financial condition.

Global economic and business activities continue to face widespread macroeconomic uncertainties, including market volatility, changes in international economic and trade relations, supply chain disruptions, changes in the labor market, elevated interest rates and potential increases in inflation, foreign currency exchange rate fluctuations and recession risks, which may continue for an extended period.

Additionally, the instability in the political environment in many parts of the world, including in the United States, and changes and uncertainty with respect to trade policies, actual or threatened tariffs, treaties, government regulations, executive orders, directives and enforcement priorities, as well as the extended U.S.

federal government shutdown, could have an adverse effect on the global economy and/or our business.

Given that a majority of our revenue is usage-based and therefore impacted by general consumer sentiment and activity, our business may be more immediately and severely impacted by adverse macroeconomic conditions than those that rely primarily on subscription revenue.

Global economic and business activities continue to face widespread macroeconomic uncertainties, including market volatility, changes in international economic and trade relations, supply chain disruptions, changes in the labor market, increased energy and commodity price volatility, elevated interest rates and potential increases in inflation, foreign currency exchange rate fluctuations and recession risks, which may continue for an extended period.

Additionally, the instability in the political environment in many parts of the world, including in the United States, geopolitical instability, including related to conflicts in the Middle East, and changes and uncertainty with respect to trade policies, actual or threatened tariffs, treaties, government regulations, executive orders, directives and enforcement priorities, as well as any ongoing or potential U.S.

federal government shutdown, have contributed to further disruptions in global trade and have adversely affected, and may continue to adversely affect, the global economy and/or our business.

Given that a majority of our revenue is usage-based and therefore impacted by general consumer sentiment and activity, our business may be more immediately and severely impacted by adverse

macroeconomic conditions than those that rely primarily on subscription revenue.

Additionally, increased prices resulting from the effects of tariffs and inflation could increase our operating expenses.

1 unchanged sentence

Additionally, our customers may be affected by changes and uncertainty in the global political environment with respect to trade and other policies.

For example, uncertainty regarding the impact of tariffs on certain countries by the U.S.

administration, as well as potential or actual retaliatory measures taken by trade partners, have adversely affected trade relations, put increased pressure on supply chains, and led to increased market volatility, and such effects may continue.

For example, tariffs imposed by the U.S.

administration, uncertainty related thereto, and potential or actual retaliatory measures, have adversely affected trade relations, pressured supply chains, and led to increased market volatility, and such effects may continue.

Any resulting harm to our customers’ businesses could depress their usage levels and/or purchasing power and lead them to reduce their spending with us.

If customers fail to pay us as a result of adverse macroeconomic or geopolitical conditions or otherwise, we may be required to take steps to enforce the terms of our contracts and collect amounts due, which may not succeed.

For example, in 2023, one of our former customers in Brazil initiated reorganization proceedings exposing us to risks on collections of pre-petition receivables and ongoing revenue, and in 2024 its creditors approved a reorganization plan providing extended and discounted payment terms for pre-petition receivables.

As a result of a reduction in ongoing payment activity, as of December 31, 2024, we fully reserved accounts receivable balances for this former customer.

Macroeconomic and political conditions and uncertainties have in the past adversely affected, and may in the future adversely affect, our business, results of operations and financial condition, and could exacerbate many of the other risks described in this “Risk Factors” section.

6 unchanged sentences

• our ability to introduce new products, features and enhancements;

• our ability to attract and retain new customers, obtain renewals from existing customers and cross-sell or otherwise increase revenue from existing customers;

• our ability to expand our customer base and the markets that our products address, attract and retain new customers, obtain renewals from existing customers and cross-sell or otherwise increase revenue from existing customers;

• our ability to improve, automate, and leverage more of our self-service capabilities for customers;

• our ability to maintain and expand relationships with resellers, distributors, and strategic partners, including ISVs, technology partners, and systems integrators;

• our ability to expand our customer base and the markets that our products address;

• our ability to combine our communications products with contextual data and AI and introduce compelling new products and enhancements that address the changing nature of our markets and customer needs and preferences;

2 unchanged sentences

• changes in cloud infrastructure, network services and other third-party technology, including the fees charged by their providers;

• the effectiveness of our sales and marketing efforts and the productivity of our sales force;

• the length and complexity of the sales cycle for certain of our products or customers;

• changes in the mix of products that our customers use during a particular period;

• the effectiveness of our sales and marketing efforts, the productivity of our sales force, and the length and complexity of the sales cycle for certain of our products or customers;

• changes in the mix or amount of products that our customers use, and that are sold in the United States versus internationally, during a particular period;

• seasonal trends, including due to increased consumer activity in the fourth quarter;

• changes in the mix or amount of products sold in the United States versus internationally;

• the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;

34 unchanged sentences

If we are unable to attract new customers or increase usage of our products by existing customers effectively and in a cost-efficient manner, our business, results of operations and financial condition would be adversely affected.

To grow our business, we must continue to attract new customers, increase usage of our existing products and new product adoption by existing customers, and successfully market new products, including products with higher gross margins, in a cost-effective manner.

Our sales and marketing teams work closely together to drive awareness and adoption of our platform.

We leverage our brand, marketing programs, developer network and conferences, such as SIGNAL, to expand our go-to-market motions.

We leverage our brand, marketing programs and conferences, such as SIGNAL, to expand our go-to-market motions.

Our go-to-market model has three motions:

our self-service platform, primarily aimed at developers, marketers, and other technical users;

our direct sales motion, primarily aimed at enterprise and commercial customers;

and our partner-led motion, including resellers, distributors, and strategic partners, such as ISVs, technology partners and systems integrators, which is primarily aimed at customers who do not have the available developer resources to build their own applications.

our self-service platform, primarily aimed at developers and other technical customers;

our direct sales motion, primarily aimed at enterprises and other organizations with complex, high-scale business needs;

Our sales and marketing strategies, and their effectiveness, are influenced by numerous factors.

1 unchanged sentence

Such changes may not lead to wider adoption of our products or to the cost-effective acquisition of additional customers or increased revenue from existing customers as quickly or to the extent we expect, or at all, and have resulted, and may in the future result, in a reduction of productivity, which could negatively impact our growth rate and results of operations.

For example, in recent years, we have reduced the size of our sales

force to drive further efficiencies in our sales operations and are continuing to improve and rely more heavily on our use of self-service capabilities to drive sales of our products to customers that do not require direct account coverage.

For example, we are focusing increasingly on solution selling and platform services.

We are focused on driving efficiencies in our sales operations, and are continuing to improve and rely increasingly on our self-service capabilities to drive sales to customers that do not require direct account coverage.

We are also introducing AI and automation in our self-service platform aimed at improving sales and customer support.

2 unchanged sentences

New products that we develop or markets that we pursue may require increasingly sophisticated and more costly sales efforts and result in longer sales cycles.

For example, we are focusing increasingly on sales to enterprises, such as through our Segment product, which is primarily aimed at complex customer data platform implementations at larger companies, and additional product innovations combining our communications products with contextual data and AI.

As we seek to increase the adoption of our products by enterprises, we expect to encounter higher costs and more complex sales efforts for these customers.

17 unchanged sentences

Our platform must integrate with and leverage a variety of infrastructure, network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our products and platform to adapt to new integrations and changes and innovation in integrated technologies which may present significant complexity, obstacles or other adverse impacts on our products or our business.

For example, last year we launched a new channel using Rich Communication Services (“RCS”) and

we are working on a channel for Apple Messages for Business.

For example, in 2025 we launched a new channel using Rich Communication Services (“RCS”) and we are working on a channel for Apple Messages for Business.

We are also focused on the interoperability of our products across the data ecosystem.

8 unchanged sentences

If we fail to effectively manage our growth and strategic changes to our business, then our business, results of operations and financial condition could be adversely affected.

We have experienced substantial growth in our business and operations, which has placed, and may continue to place, significant demands on our management, operational and financial resources and systems, especially as we continue to focus on improving our operating efficiency.

improving our operating efficiency.

Although we have conducted workforce reductions in the past, we may experience employee growth in the future.

4 unchanged sentences

If we fail to efficiently scale and manage our infrastructure, or if our customers experience service disruptions or outages, our business, financial condition and operating results may be adversely impacted.

The markets in which we participate are intensely competitive, and if we do not compete effectively, our business, results of operations and financial condition could be harmed.

The current and prospective markets for our products are rapidly evolving, significantly fragmented and highly competitive, with relatively low barriers to entry in some segments.

The principal competitive factors of these markets include completeness of offering, credibility with customers, ability to differentiate our products against competing offerings, global reach, ease of integration and programmability, product features, platform scalability, reliability, deliverability, security and performance, brand awareness and reputation, the strength of sales and marketing efforts, customer support, and the cost of deploying and using products.

Our competitors are primarily (i) CPaaS companies that offer communications products and applications, (ii) other software companies that compete with portions of our communications product line, (iii) regional network service providers that offer limited developer functionality on top of their own physical infrastructure, (iv) customer relationship management and customer experience vendors and (v) standalone customer data platform vendors.

The current and prospective markets for our products are intensely competitive and rapidly evolving, and if we do not compete effectively or if these markets fail to grow as expected, our business, results of operations and financial condition could be harmed.

The current and prospective markets for our products are rapidly evolving, significantly fragmented and highly competitive, in some cases with relatively low barriers to entry, and may fail to grow as expected or decline over time.

Our competitors are primarily (i) CPaaS companies that offer communications products and applications, (ii) regional network service providers that offer limited developer functionality on top of their own physical infrastructure, (iii) customer relationship management and customer experience vendors, (iv) standalone customer data platform vendors and (v) other software companies that compete with portions of our product line.

Some of our competitors and potential competitors are larger and have greater name recognition, longer operating histories, more established customer relationships, larger budgets, lower operating costs, and significantly greater resources than we do.

2 unchanged sentences

Our current and potential competitors have in the past and may in the future develop and market products and services with comparable functionality to our products, and this could lead us to decrease prices in order to remain competitive.

In addition, customers may reduce or delay spending on our products or substitute alternative solutions in response to pricing pressures, budget constraints or changing business priorities.

With the introduction of new products and services and new market entrants, we expect competition to intensify in the future.

Industry developments and evolving technology, such as AI, may also impact our competitive landscape and the factors required to compete effectively in current or prospective markets.

Our ability to grow will depend in part on our success in expanding the scope of our products and entering new markets, and there can be no assurance that the markets will grow or that our products will achieve meaningful adoption within them.

As we expand the scope of our products, we may face additional competition and, in some cases, may find our products in competition with those of our customers, which could cause them to replace our products with competitive offerings.

If one or more of our competitors were to merge or partner with another of our competitors or our suppliers, the change in the

competitive landscape could also adversely affect our ability to compete effectively.

If one or more of our competitors were to merge or partner with another of our competitors or our suppliers, the change in the competitive landscape could also adversely affect our ability to compete effectively.

For example, certain of our competitors have engaged in acquisition activity, and we expect that our competitors will continue to evaluate the acquisition of companies and technologies that could increase competition with our products in the future.

4 unchanged sentences

A loss or reduction in sales of our products through these third parties could adversely affect our revenue and other results of operations.

The markets for our products continue to evolve and may decline or experience limited growth.

The markets for our products continue to evolve, which makes our business and future prospects difficult to evaluate.

If current and prospective customers do not recognize the need for and benefits of our products and platform, they may decide to adopt alternative products and services to satisfy some portion of their business needs.

In order to grow our business and extend our market position, we intend to focus on educating customers about the benefits of our products and platform, expanding and improving the functionality of our products and bringing new technologies to market to increase market acceptance and use of our platform.

Our growth will depend, in part, on our ability to expand the markets that our products address and to enter into new markets.

Our ability to do so depends upon a number of factors, including the cost, performance and perceived value associated with our products and platform.

The markets for our products and platform could fail to grow significantly, or at all, or there could be a reduction in demand for our products as a result of any number of factors, including a lack of customer acceptance, technological challenges, competing products and services, decreases in spending by current and prospective customers, weakening macroeconomic conditions, and other causes.

If these markets do not grow or demand for our products decreases, then our business, results of operations and financial condition could be adversely affected.

We have a history of losses and may not achieve or sustain profitability in the future.

While we achieved net income of $79.7 million in the nine months ended September 30, 2025, we have incurred net losses in each preceding year since our inception, including net losses of $109.4 million and $1.0 billion in the years ended December 31, 2024 and 2023, respectively.

In addition, while we have experienced revenue growth in prior periods, it is not indicative of future revenue growth, and our revenue and revenue growth for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period.

Our financial performance in recent periods may not be indicative of future performance, and we may not be able to maintain profitability in the future.

We achieved net income of $33.8 million in the year ended December 31, 2025.

However, we incurred net losses in each preceding year since our inception.

Our past performance for any quarterly or annual period should not be relied upon as an indication of our performance for any future period.

If we are unable to generate and sustain increased revenue levels and manage our operating expenses, we may not achieve and sustain profitability and, even if we do, we may not be able to increase our level of profitability or achieve our stated profitability goals.

2 unchanged sentences

improvements in security and data protection;

the development of new products, features and functionality and enhancements to our platform;

the development of new products, features and functionality and enhancements to our platform, including computing costs associated with AI;

sales and marketing;

27 unchanged sentences

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

We interconnect with fixed and mobile network service providers around the world to enable our customers to use our products over their networks.

Although we currently hold or are in the process of acquiring authorization in many countries for direct access to phone numbers and for the provision of voice and messaging services on the networks of fixed and mobile network service providers, we expect that we will continue to rely on network service providers for these services.

Where we do not have direct access to phone numbers, our reliance on network service providers has reduced our operating flexibility, ability to make timely service changes and control quality of service.

In addition, the fees that we are charged by network service providers are subject to change and we can be subject to the imposition of additional fees, penalties, or other administrative or technical requirements, and even service interruption, due to regulatory, competitive, or other industry related changes over which we have little to no control.

From time to time, network service providers have instituted additional or increased fees that increase our network costs.

For example, in June 2025, a major U.S.

mobile carrier increased its fees for A2P SMS messages delivered to its subscribers, which will create a modest headwind to our gross margins going forward.

mobile carriers may follow suit and such fees may increase over time.

While we have historically responded to these types of fee increases through a combination of further negotiating efforts with our network service providers, absorbing the increased costs or passing the fees through to customers, there is no guarantee that we will continue to be able to respond in these ways in the future without a material negative impact to our business.

The fees charged by our network service providers are subject to change, in some markets daily or weekly, and we may not change our customers’ pricing as rapidly and, as a result, such fee increases could adversely affect our business and results of operations.

In addition, passing these fees through to our customers typically has the effect of increasing our revenue and cost of revenue, but typically does not impact the gross profit dollars received for sending these messages and, as a result, has a negative impact on our gross margins.

Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the prices we charge our customers.

Furthermore, many of these network service providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice.

If a significant portion of our network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to other network service providers could be time consuming and costly and could adversely affect our business, results of operations and financial condition.

Further, if problems occur with our network service providers, such problems have in the past caused, and may in the future cause, errors, service outages, security incidents, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem.

The occurrence of errors, service outages, security incidents, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Further, in cases where we do not have direct access to network service providers, we access network services through intermediaries.

Although we are in the process of securing additional direct connections with network service providers in many countries, we expect that we will continue to rely on intermediaries for these services for some period of time.

These intermediaries sometimes have offerings that directly compete with our products and may stop providing services to us on a cost-effective basis.

If a significant portion of these intermediaries stop providing services or stop providing services on a cost-effective basis, our business could be adversely affected.

We also interconnect with internet service providers around the world to enable the use of our email products by our customers, and we expect to continue to rely on internet service providers for network connectivity going forward.

Our reliance on internet service providers reduces our control over quality of service and exposes us to potential service outages and rate fluctuations.

The occurrence of poor-quality of service or service outages on our products may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Similarly, if a significant portion of our internet service providers stop providing us with access to their network infrastructure, fail to provide access on a cost-effective basis, cease operations, or otherwise terminate access, the delay caused by qualifying and switching to other internet service providers could be time consuming and costly and could adversely affect our business, results of operations, and financial condition.

We interconnect with fixed and mobile network service providers around the world to deliver our products.

Although we have, or are in the process of acquiring, authorization to provide voice and messaging services and for direct access to phone numbers in many countries, we expect to continue to rely to some extent on network service providers for these services.

Reliance on network service providers subjects us to regulatory, competitive and other industry related changes over which we have little or no control.

In addition, our reliance on network service providers subjects us to fees, penalties, administrative and technical requirements, each of which are subject to change.

Similarly, in some cases, we utilize intermediaries for direct access to networks.

Although we have, or are in the process of securing, direct connections with network service providers in many countries, we expect to continue to rely on intermediaries for these services to some extent.

These intermediaries also charge us changing fees and at times have offerings that compete directly with our products.

We also interconnect with internet service providers around the world to deliver our email products, and expect to continue to rely on such providers.

Reliance on these providers poses risks to the quality of our services, primarily by limiting our control, operating flexibility, and ability to timely identify and respond to necessary service changes, and by subjecting us to service interruptions or outages.

Reliance on such providers in the past has caused, and may in the future cause, errors, service outages, security incidents, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem.

This has in the past, and may in the future, cause harm to our brand, result in lost revenue, and cause us to lose existing and prospective customers.

The fees we pay to these providers also subject us to risks.

We are exposed to significant fluctuations in applicable fees paid to network service providers, intermediaries, and internet service providers.

These fees are outside of our control and we are not able to predict the magnitude or timing of changes to such fees.

Additional or increased fees charged by such providers have resulted, and could in the future result, in increases to our costs and other impacts on our financial results.

For example, recent increases to A2P messaging fees charged by major U.S.

mobile carriers create a headwind on our margins, and such fees may increase further over time.

In some markets, fees charged by our network service providers change daily or weekly.

We may not be able to change our customer pricing as rapidly, and absorbing these costs could adversely affect our business and results of operations.

Further, even when we do pass fee increases through to customers, it typically increases revenue and cost of revenue such that while gross profit dollars are not impacted, it has a negative impact on gross margins.

While historically we have responded to many fee increases through negotiating efforts, absorbing increased costs or passing fees through to customers, we may be unable to respond in these ways in the future without a material negative impact to our business.

Our ability to respond to fee increases may also be constrained by equivalent increases by other providers in a particular market, fees that are disproportionately large compared to underlying prices paid by our customers, or market or other conditions limiting our ability to increase the prices we charge for our products.

We also face risks related to losing access to these services.

Many of these providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice.

We may not be able to replace these services on a cost-effective basis, or at all, and even if we can, replacing providers may be time-consuming, costly and result in delays.

Any of the foregoing consequences of our reliance on network service providers, intermediaries and internet service providers to deliver our products could adversely impact our business, results of operations and financial condition.

Failure to set optimal prices for our products could adversely impact our business, results of operations and financial condition.

For certain of our products, we primarily charge our customers based on their usage of such products.

One of the challenges of this usage-based pricing model is the variability of the fees that we pay to network service providers over whose networks we transmit communications.

Such network fees can vary, in some markets daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict.

This can result in us incurring increased costs that we may be unable or unwilling to pass through to our customers, which could adversely impact our business, results of operations and financial condition.

If we elect to pass through increased fees to our customers, it could adversely affect our relationship with our customers and our customers may look for lower cost alternatives.

We adjust the pricing models for our products from time to time and expect that we will continue to do so.

Many of our usage-based customers enter into contracts with negotiated pricing, and our subscription customers are also subject to negotiated pricing.

As competitors introduce new products or services that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

If we are required or choose to reduce our prices, it could adversely affect our business, results of operations and financial condition.

We face risks associated with optimally pricing our products, particularly given the dynamic nature of our usage-based pricing.

The fees that we pay to network service providers can vary, in some markets daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict.

As a result, we may incur increased costs that we may be unable or unwilling to pass through to our customers.

If we do pass increased fees through to our customers, it could adversely affect customer relationships or cause customers to seek lower-cost alternatives.

We periodically adjust the pricing for our products and expect to continue to.

Many of our usage-based customers have contracts with negotiated pricing, and our subscription contracts also have negotiated pricing.

New products or price reductions by competitors may prevent us from retaining or attracting customers based on our historical pricing, and we may otherwise be required or choose to reduce our pricing.

Any such price reductions, lost customers, or other failure to optimize our pricing could adversely impact our business, results of operations and financial condition.

Our international operations expose us to risks inherent in global operations.

In the nine months ended September 30, 2025 and the years ended December 31, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively.

In the three months ended March 31, 2026 and the years ended December 31, 2025 and 2024, we derived 36%, 36% and 35% of our revenue from customer accounts located outside the United States, respectively.

The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide.

4 unchanged sentences

• implementing and reconciling technical controls to address different technical standards, data privacy, data protection and telecommunications regulations, and registration and certification requirements outside the United States, which could prevent customers from deploying our products or limit their usage;

compliance, including with respect to data privacy, data protection, data localization, cybersecurity, intellectual property rights, environmental and sustainability matters, as well as export controls, sanctions, anti-bribery and anti-corruption matters;

• our ability to comply with laws, regulations, customs and industry standards in countries and other regions in which we operate or do business, and the associated costs and management attention required to support such compliance, including with respect to data privacy, data protection, data localization, cybersecurity, intellectual property rights, environmental and sustainability matters, as well as export controls, sanctions, anti-bribery and anti-corruption matters;

• international tax and trade policies, tariffs, and other non-tariff barriers;

2 unchanged sentences

• restrictions on the transfer of funds;

• political or social unrest, economic instability, conflict or war in a specific country or region in which we, our customers, partners or service providers operate, which could have an adverse impact on our operations in the region or otherwise have a material impact on regional or global economies, any or all of which could adversely affect our business.

region or otherwise have a material impact on regional or global economies, any or all of which could adversely affect our business.

Also, due to costs from our international operations and network service provider fees outside of the United States, which generally are higher than domestic rates, our gross margin for messages terminating internationally is typically lower than our gross margin for messages terminating domestically.

As a result, our gross margin has been, and may continue to be, adversely impacted by our international operations.

Our failure to manage any of these risks successfully could harm our international operations, and adversely affect our business, results of operations and financial condition.

If we, or our international business partners, fail to manage any of these risks successfully, it could harm our international operations and adversely affect our business, results of operations and financial condition.

We may not realize potential benefits from our acquisitions, partnerships and investments because of difficulties related to integration, the achievement of synergies, and other challenges.

1 unchanged sentence

In some circumstances, we may determine to do so through acquisitions, partnerships or investments in businesses and technologies that are complementary to our business.

There can be no assurances that such acquisitions will result in the anticipated benefits, and it is possible that there could be a loss of our key employees and customers, disruption of ongoing businesses or unexpected issues, higher than expected costs, the diversion of management attention and resources from day-to-day business operations and an overall post-completion process that takes longer than originally anticipated.

There can be no assurances that such transactions will result in the anticipated benefits, and it is possible that there could be a loss of our key employees and customers, disruption of ongoing businesses or unexpected issues, higher than expected costs, the diversion of management attention and resources from day-to-day business operations and an overall post-completion process that takes longer than originally anticipated.

In addition, the following issues, among others, may need to be addressed in order to realize the anticipated benefits of any acquisitions, partnerships or investments:

14 unchanged sentences

Risks Related to Cybersecurity, Data Privacy and Intellectual Property

Breaches of or incidents impacting our networks or systems, or those of our third-party service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers and business partners.

We have in the past and will in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (such as phishing), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), attacks facilitated or enhanced by AI, denial-of-service attacks (such as credential stuffing), personnel or service provider misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Individuals or entities have in the past attempted and will in the future attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform.

In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and magnitude, and cloud-based companies have been targeted in the past.

We face various threats from traditional computer hackers, sophisticated organized crime, nation-state and nation-state supported actors, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, fraud, employee theft or misuse, attempts to bribe, extort, or compromise our employees or infiltrate our workforce, password spraying, deep fakes, phishing, smishing, vishing, credential stuffing, denial-of-service attacks, and advanced persistent threat intrusions, which threaten our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process.

Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Geopolitical tensions and events may further heighten risks we and our service providers face from these and other attacks.

Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time.

We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

We depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data.

We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems.

We also have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, which may result in security incidents or otherwise increase cybersecurity risks.

Any security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information and sensitive personal information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other

For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and mobile phone numbers from unknown sources.

The attack identified in August 2022, which involved smishing text messages that purported to be from our IT department, resulted in the threat actor obtaining some of our employees’ credentials and access to certain data of approximately 209 customers out of our total customer base of approximately 270,000 at that time.

We notified and worked with our affected customers.

We also notified appropriate regulators and addressed their questions about the incident.

We took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, running simulated phishing attempts to increase employee security awareness, and increasing the refresh frequency for access to certain internal applications.

Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

We also rely on various third-party service providers for business operations, to operate our platform and deliver our products, including network service providers, internet service providers, telecommunications carriers, and providers of cloud infrastructure and cloud communications, as well as third-party technology and intellectual property.

Our service providers (or their sub-service providers) have in the past experienced, and may in the future experience, security breaches and incidents, including unauthorized access or inadvertent disclosures, that have exposed and may expose or make available to threat actors our data or that of our customers.

Even when our systems are not compromised, if our service providers experience breaches or incidents that impact our data or our customers’ data, or result in interruptions, delays or outages in service and availability, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Furthermore, we are required to comply with laws and regulations that require us to maintain security measures designed to protect personal information and we may have contractual and other obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches.

Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences.

If we or a third party upon whom we rely experiences a security incident or is perceived to have experienced a security incident, we may experience adverse consequences.

Consequences associated with such security incidents may include:

government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities;

additional reporting requirements and/or oversight;

restrictions on processing or transferring data (including personal data);

claims, demands, and litigation (including class claims);

indemnification obligations;

monetary fund diversions;

interruptions in our operations (including availability of data);

financial loss and other similar harms.

Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident.

Accordingly, if our cybersecurity measures or those of our third-party service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

While we maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, we cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or will be available, and in sufficient amounts, to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage as to any future claim.

Breaches of or other incidents impacting our networks or systems, or those of our third-party service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

Moreover, our platform stores, transmits, and otherwise processes our, our customers’ and our partners’ proprietary, confidential, and sensitive data.

We also rely on various third-party service providers – including network service providers, internet service providers, telecommunications carriers, and providers of cloud infrastructure and cloud communications – for business operations, to operate our platform and to deliver our products, as well as third-party technology and intellectual property.

We have been targeted by threat actors seeking unauthorized access to our systems or data, or that of our customers or third-party service providers, or to disrupt our operations or ability to provide our services.

Our third-party service providers have also been targeted.

Our platform and our underlying infrastructure, the information we store and process, and those of our third-party service providers, are subject to evolving threats and have in the past and may in the future be subject to breaches, compromises, disruptions, or other incidents, including as a result of the following:

• fraud, social-engineering attacks (such as phishing) and other third-party attempts to induce our employees, customers or partners to disclose sensitive information to gain access to our customers’ data or systems, or our data or our systems;

• efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including malicious code, ransomware, destructive malware, supply chain attacks and distributed denial-of-service attacks;

• third-party attempts to abuse our marketing, advertising, messaging or products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious;

• attacks on, malfunctions or unavailability of, or other vulnerabilities in, the underlying networks and services that power the internet or that our products otherwise depend on, many of which are not under our control or the control of our customers or partners;

• attacks facilitated or enhanced by AI, including agentic AI and deep fakes;

• employee fraud, misconduct or error, including resulting from efforts to bribe, extort, infiltrate or otherwise compromise our or our service providers’ workforce.

Cyberattacks and other malicious activity continue to become more sophisticated, targeted and inexpensive to conduct, and to increase in frequency and magnitude.

These include ransomware and cyber extortion attacks, which can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments, such as due to applicable laws or regulations prohibiting such payments.

Geopolitical tensions and events may further heighten risks we and our service providers face from breaches and other incidents.

We make, and expect to continue to make, significant investments in processes and controls designed to mitigate risks associated with breaches and other incidents, including to evaluate and respond to known and potential risks.

These investments are, and could increasingly be, costly, and may not be effective or prevent a material incident.

Our ability to effectively mitigate these risks may be impacted by, among other factors:

• the use of AI to rapidly discover and exploit vulnerabilities;

• the rapidly evolving nature of techniques to breach, compromise, or disrupt IT systems and infrastructure, including increasing use of AI technologies, such that we may not be able to recognize such techniques until

launched against a target, or anticipate, prevent, or timely respond to them, increasing the likelihood and magnitude of damage of a breach or other incident;

• the increasing complexity of our internal IT systems, including as we adopt new technologies, including AI solutions, and incorporate and secure IT environments from acquired companies;

• our reliance on third-party technology and service providers;

• our limited control over customers and third-party providers (including those authorized by customers to access their data) and the processing of data by third-party providers, which may prevent us from maintaining the integrity or security of such data.

In the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business.

For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident.

While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents.

Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information.

Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition.

Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences.

Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities.

We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.

Our actual or perceived failure to comply with increasingly stringent laws, regulations and contractual obligations relating to privacy, data protection and cybersecurity could harm our reputation and subject us to significant fines and liability or loss of business.

We and our customers are subject to numerous domestic (for example, the California Consumer Privacy Act (“CCPA”)) and foreign (for example, the General Data Protection Regulation (“GDPR”) in the European Union (“EU”)) privacy, data protection and cybersecurity laws and regulations that restrict the collection, use, disclosure and processing of personal information, including financial and health data.

These laws and regulations are expanding globally, evolving, and being tested in courts, may result in increasing regulatory and public scrutiny of our practices relating to personal information and may increase our exposure to regulatory enforcement action, sanctions and litigation.

The breadth and depth of ongoing changes in data protection obligations will continue to require significant time and resources, including to review our technology, systems and processes against legal and regulatory requirements.

In the United States, the CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information.

CCPA allows for statutory fines for noncompliance.

Numerous other states have enacted or are considering laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action, and laws in several states relating to the provision of individual home address or telephone directory information.

States and the U.S.

federal government have also proposed general privacy legislation.

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity.

For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection impose strict requirements for processing personal information of covered individuals, whether within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”).

For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data retention, security, and international data transfers.

Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data transfers or other processing, require data deletion, and impose significant fines, potentially ranging up to the greater of 4% of a company’s worldwide revenue or 20 million Euros or 17.5 million GBP, respectively.

Individuals also may initiate compensation claims or litigation related to our processing of their personal information.

Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies.

As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No.

13,709/2018) may apply to our operations.

The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to the GDPR.

Additionally, we expect an increase in regulation of the use of AI and ML in products and services.

For example, in Europe, the Artificial Intelligence Act, once effective, will impose onerous obligations related to the development, placement on the market and use of AI-related systems.

A growing number of U.S.

states are enacting legislation regulating aspects of AI or AI generally.

Other countries are also contemplating laws regulating AI and ML.

We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

The interpretation and application of laws and regulations are in many cases uncertain, and our legal and regulatory obligations are subject to frequent and unexpected changes, including the potential for new or additional laws or regulations, rulings that invalidate prior laws or regulations, or significant increases in penalties.

Recent examples include the EU’s Digital Services Act, Digital Markets Act and Data Act effective in 2024, EU member state legislation implementing the EU’s Network and Information Security Directive II and the EU’s Digital Operational Resiliency Act effective in January 2025.

New and changing privacy, data protection or cybersecurity laws and regulations may result in additional obligations, increase the risk of enforcement action against us, and increase the types and numbers of individuals or entities that can initiate actions against us.

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we must comply with privacy laws associated with customer proprietary network information rules in the United States.

In addition, some states have adopted, proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law.

If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

In addition, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and expansion of our offerings.

Certain privacy, data protection and cybersecurity laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

In addition, we support customer workloads that involve the processing of protected health information and are required to sign business associate agreements with customers that subject us to requirements under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, as well as state laws that govern health information.

Our actual or perceived failure to comply with laws, regulations, contractual commitments, or other actual or asserted obligations, including certain industry standards, regarding privacy, data protection and cybersecurity could lead to costly legal action, adverse publicity, significant liability, inability to process data, and decreased demand for our services, which could adversely affect our business, results of operations and financial condition.

As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to potential risks arising from the Court of Justice’s July 2020 ruling in the “Schrems II” case, as well as related guidance from

regulators and enforcement action against Meta by the Irish Data Protection Commission.

For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to many outside jurisdictions, such as the United States.

On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S.

Data Privacy Framework.

Based on this decision, personal information can flow from the EU to U.S.

companies participating in the EU-U.S.

Data Privacy Framework without additional data protection safeguards.

We are certified under the EU-U.S.

Data Privacy Framework, the UK Extension to the EU-U.S.

Data Privacy Framework, and the Swiss-U.S.

Data Privacy Framework.

If we cannot maintain valid mechanisms for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere.

Any inability to transfer personal information to the United States or other jurisdictions could significantly and negatively impact our business operations;

limit our ability to collaborate with parties that are subject to data privacy and security laws;

or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense.

In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin.

If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for relevant data transfers quickly enough, and valid solutions for relevant personal information are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability.

Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes.

We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate.

Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them.

These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information.

We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements.

They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information.

The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity.

Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome.

For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers.

Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies.

Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences.

For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.

We must also comply with increasing laws and regulations relating to data residency, data localization, and the transfer of data across territorial boundaries, arising from the fact that our primary data processing facilities are in the United States.

For example, the GDPR restricts the transfer of personal data from the EU to the United States and other countries that are not deemed to have implemented adequate data protection measures, and other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information to be stored in the jurisdiction of origin.

We use a variety of legal transfer mechanisms to transfer personal data across borders, including standard contractual clauses and the E.U.-U.S.

Data Privacy Framework, whose use is subject to ongoing review and litigation, and we may not be able to continue to rely on these or other transfer mechanisms.

As a result of this uncertainty, we have encountered hesitancy, reluctance or refusal by European and multinational customers to use our services.

If we are unable to maintain valid mechanisms for cross-border data transfer, we and our customers may face increased exposure to regulatory actions, significant fines, or injunctions against processing or transferring personal information from Europe or elsewhere.

Any inability to transfer personal information to the United States or other jurisdictions, or costly restrictions on such transfer, may also limit our ability to collaborate with partners and customers, require us to increase our data processing capabilities in Europe and/or other jurisdictions at significant expense, and/or otherwise negatively impact our business.

Additionally, as a provider of interconnected VoIP service, we must also comply with certain U.S.

federal privacy laws and regulations, including Section 222 of the Communications Act of 1934, as amended, and the FCC’s customer proprietary network information rules.

We are also subject to state rules and obligations that have been proposed or adopted, or may be in the future.

We are also subject to other rapidly changing technology- and industry-specific laws, regulations and obligations.

For example, we expect increased global regulation in the use of AI and ML such as the recent AI Act in Europe, which imposes onerous obligations related to the development, placement on the market and use of AI systems.

Various countries and a growing number of U.S.

states are also enacting legislation regulating aspects of AI or AI generally.

We may need to change our business practices to comply with obligations under these or other new and evolving regimes, and face significant compliance challenges, liability, or other risks.

We also have contractual obligations relating to privacy, data protection and cybersecurity that are increasingly stringent due to related legal and regulatory changes and the expansion of our offerings.

For example, certain laws and regulations, such as the GDPR and CCPA, require our customers to impose contractual restrictions on their service providers.

In addition, we support customer workloads involving the processing of protected health information and are required to sign business associate agreements with customers that subject us to certain requirements under federal and state laws governing health information, such as the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009.

Taken together, evolving legal, regulatory and contractual obligations pertaining to privacy, data protection, cybersecurity and AI may require us to expend resources to modify our practices and products, reduce demand for our platform, increase our costs, restrict our ability to store and process data, inhibit product functionality or the development of new products and features, or impact our ability to operate in certain locations, any of which could impair growth or otherwise harm our business.

Further, any actual or perceived non-compliance with these laws, regulations, contractual commitments, or other actual or asserted obligations, including industry standards, pertaining to privacy, data protection, cybersecurity or AI could subject us to regulatory audits or inquiries, civil and criminal penalties, or significant fines, or lead to costly legal action, breach of contract claims, adverse publicity, significant liability, inability to process data, and decreased demand for our services, any of which could adversely affect our business, results of operations, and financial condition.

We could incur substantial costs in protecting or defending our intellectual property rights, and any failure to protect our intellectual property could adversely affect our business, results of operations and financial condition.

5 unchanged sentences

Further, the laws of some countries do not protect intellectual property or proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of such rights in some foreign countries may be inadequate.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our products and proprietary information may increase.

To the extent we expand our international activities, our exposure

to unauthorized copying and use of our products and proprietary information may increase.

Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property.

5 unchanged sentences

Our efforts to enforce our intellectual property or proprietary rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of such rights.

Our failure to meaningfully

protect our intellectual property and proprietary rights, could have an adverse effect on our business, results of operations and financial condition.

Our failure to meaningfully protect our intellectual property and proprietary rights could have an adverse effect on our business, results of operations and financial condition.

We have been sued and may, in the future, be sued by third parties for alleged infringement of their intellectual or other proprietary rights, which could adversely affect our business, results of operations and financial condition.

9 unchanged sentences

Litigation is inherently unpredictable and we cannot predict the timing, nature, controversy or outcome of disputes brought against us or assure you that the results of any of these actions will not have an adverse effect on our business, results of operations or financial condition.

Our use of open source software could negatively affect our ability to sell our products and subject us to possible litigation.

Our products and platform incorporate open source software, and we expect to continue to incorporate open source software in our products and platform in the future.

Open source software presents certain risks in addition to those of third-party technology and intellectual property generally.

Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products and platform.

Although we have implemented policies to regulate the use and incorporation of open source software into our products and platform, we cannot be certain that we have not incorporated open source software in our products or platform in a manner that is inconsistent with such policies.

If we fail to comply with open source licenses, we may be subject to certain requirements, including requirements that we offer our products that incorporate the open source software for no cost, that we make available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses.

If an author or other third-party that distributes such open source software were to allege that we had not, or have not, complied with the terms and conditions of the license for such open source software, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products.

In any of these events, we and our customers could be required to seek licenses from third parties in order to continue offering our products and platform and to re-engineer our products or platform or discontinue offering our products to customers in the event re-engineering cannot be accomplished on a timely basis.

Any of the foregoing could require us to devote additional research and development resources to re-engineer our products or platform, damage our reputation, give rise to increased scrutiny regarding our use of open source software, result in customer dissatisfaction and may adversely affect our business, results of operations and financial condition.

We rely on technology and intellectual property of third parties, the loss of which could limit the functionality of our products and disrupt our business.

1 unchanged sentence

Licensed technology and intellectual property may not continue to be available on commercially reasonable terms, or at all.

loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform.

The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform.

In addition, if the third-party technology and intellectual property we use has errors, service outages, security vulnerabilities, or otherwise malfunctions, our business operations or the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.

For example, we outsource a substantial majority of our cloud infrastructure to Amazon Web Services (“AWS”), which hosts our products and platform.

Our customers need to be able to reliably access our platform, without material interruption or degradation of performance.

Our customers need to be able to reliably access our platform, without material interruption or

degradation of performance.

AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS.

14 unchanged sentences

Any of the above circumstances or events may harm our reputation, erode customer trust, cause customers to stop using or reduce their usage of our products, discourage customers from renewing their contracts, impair our ability to increase revenue from existing customers, impair our ability to grow our customer base, subject us to financial penalties and liabilities under our service level agreements and otherwise harm our business, results of operations and financial condition.

Our use of open source software could negatively affect our ability to sell our products and subject us to possible litigation.

Our products and platform incorporate open source software, and we expect to continue to incorporate open source software in our products and platform in the future.

Open source software presents certain risks in addition to those of third-party technology and intellectual property generally.

The use of AI technologies in our platform and our business may not produce the desired benefits, and may result in increased liability, reputational harm, or other adverse consequences.

We have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, and these solutions and features may become more important to our operations, future growth or competitiveness over time.

We have deployed, and continue to develop and incorporate, AI solutions and features in our platform and our business, and these solutions and features may become more important to our operations, future growth or competitiveness over time.

We expect to rely on AI solutions and features to help drive future growth and efficiency in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI in a timely or cost-effective manner.

4 unchanged sentences

Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require.

Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject.

The deployment of agentic AI — systems that autonomously execute multi-step tasks — introduces risks that are distinct from those of traditional AI features resulting from unintended or unauthorized actions that disrupt our internal operations and service delivery.

These risks may be difficult to monitor or prevent given the autonomous nature of such systems.

Additionally, our use of AI internally and in our offerings may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, harmful, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject.

Our increasing use of AI internally in the development of our products may also subject us to intellectual property risks arising from limits and uncertainty regarding the protectability of certain outputs we create using generative AI tools.

If we fail to obtain any required permissions to collect, use, or otherwise process data, including personal information, in relation to AI solutions or features, or if we jeopardize the privacy or security of such information, it could adversely affect our business, results of operations and financial condition.

The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations.

Our increasing use of AI internally, including in product development, may also present risks of technical errors, service disruptions or other issues related to flawed or inaccurate AI-generated outputs, as well as security vulnerabilities, which would negatively impact our reputation and our business.

These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, require us to make significant changes to our policies and practices, and necessitate expenditure of significant time, expense, and other resources.

2 unchanged sentences

Certain of our products are subject to telecommunications-related regulations, and future legislative or regulatory actions could adversely affect our business, results of operations and financial condition.

As a provider of communications products and a licensed telecommunications provider, we are subject to evolving federal, state and international regulations relating to privacy, telecommunications, consumer protection and other requirements.

If we do not comply with such requirements, we could be subject to enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products.

Any enforcement action by the FCC or another regulatory authority, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

Certain of our products are subject to a number of regulations and laws that are administered by the FCC and other federal authorities.

Among others, we must comply (in whole or in part) with:

• the Communications Act of 1934, as amended, which regulates communications services and the provision of such services;

• the Telephone Consumer Protection Act of 1991 (“TCPA”), which limits the use of automatic dialing systems for calls and texts, artificial or prerecorded voice messages and fax machines and establishes quiet hours for solicitations;

• the Communications Assistance for Law Enforcement Act, which requires covered entities to assist law enforcement in undertaking electronic surveillance;

• the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (“TRACED”);

• requirements to safeguard the privacy of certain customer information;

• payment of annual FCC regulatory fees and contributions to FCC-administered funds based on our interstate and international revenues, as well as to the Universal Service Fund;

• rules pertaining to access to our services by people with disabilities and contributions to the Telecommunications Relay Services fund.

In addition, Congress and the FCC continue to focus on mitigating the prevalence of robocalls and robotexts, including by requiring providers to implement call authentication technologies such as Signature-based Handling of Asserted Information Using toKENs and Secure Telephone Identity Revisited, which together establish a set of technical standards and protocols that allow for the authentication and verification of caller ID information, adopting stricter Robocall Mitigation Database (“RMD”) filing requirements and increasing the base forfeiture amount for submitting false or inaccurate statements to the RMD.

Combating illegal calls is one of the FCC’s top consumer protection priorities, and the FCC continues to take steps to strengthen, expand and enforce its rules against the origination and carrying of illegal robocalls and robotexts.

We cannot predict whether the FCC will require more or different robocall and robotext mitigation measures than those we have or are planning to implement.

New regulations or requirements that restrict the types of customers allowed to use our platform or impose overly burdensome requirements for our customers could limit the customers that we are able to serve.

In addition, the

extension of telecommunications regulations to our non-interconnected VoIP services or messaging products could result in additional federal and state regulatory obligations and taxes.

Additionally, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations, including laws similar to the TCPA.

New and/or different state-level regulations increase our compliance costs and the risk of enforcement action against us, which in turn could adversely affect our business, results of operations and financial condition.

Internationally, we currently offer our products in more than 180 countries and territories and continue to expand.

When we enter new countries and as our presence and market share in such countries grow, our potential regulatory and licensing obligations and scrutiny increase, which increases our compliance costs and could impact our products and platform, create operational challenges, or prevent us from offering or providing our products in certain countries.

Moreover, the regulation of CPaaS companies continues to evolve internationally and many existing regulations may not fully contemplate the CPaaS business model or how it fits into the communications regulatory framework.

As a result, the application, interpretation or enforcement of regulations often involve significant uncertainties.

In many countries, a number of our products or services are subject to licensing and communications regulatory requirements, which increases the level of scrutiny and enforcement by regulators.

Future legislative, regulatory or judicial actions impacting CPaaS services could also increase the cost and complexity of compliance and expose us to liability.

For example, in some countries, some or all of the services we offer are not considered regulated telecommunications services, while in other countries they are subject to telecommunications regulations, including but not limited to payment into universal service funds, licensing fees, reporting requirements, provision of emergency services, provision of information to support emergency services and number portability as well as requirements to combat scams and fraud.

Failure to comply with these regulations could result in our company being issued remedial directions to undertake independent audits and implement effective systems, processes and practices to ensure compliance, significant fines or being prohibited from providing telecommunications services in a jurisdiction.

In addition, we implement Know-Your-Customer and/or Know-Your-Traffic related processes in the jurisdictions in which we operate.

Related obligations can vary across jurisdictions, and such processes may create onboarding delays and friction for our customers, as well as other operational and compliance challenges requiring management attention, and increase our compliance costs.

Moreover, certain of our products may be used by customers located in countries where voice and other forms of Internet Protocol (“IP”) communications may be illegal or require special licensing or in countries on a U.S.

embargo list.

Users in such countries may continue to use our products in those countries notwithstanding the illegality or embargo, or a local partner that we use to provide services may not comply with applicable governmental regulations, subjecting us to potential penalties or governmental actions that may be costly, harm our business and damage our brand and reputation.

We may be required to incur additional expenses to meet applicable international regulatory requirements or be required to raise the prices of services, or restructure or discontinue those services if required by law or if we cannot or will not meet those requirements.

As a provider of communications products and a licensed telecommunications provider, we are required to comply with many changing federal, state and international regulations, including relating to privacy, security, telecommunications, consumer protection, fraud and scam prevention, Know Your Customer and Know Your Traffic and other requirements and obligations, which often vary across the numerous jurisdictions in which we operate.

Compliance with these requirements involves significant management attention and compliance costs, and can present operational challenges, onboarding delays and friction for our customers, require us to raise prices, restructure or discontinue our products, or limit our ability to expand into certain jurisdictions.

If we do not comply with such requirements, we could face enforcement actions, significant fines, remedial directions to implement audits or new processes, loss of licenses, restrictions or prohibitions on our ability to operate or offer certain of our products, eroded customer trust, and damage to our brand and reputation, and other consequences.

Any of the foregoing could adversely affect our business, results of operations and financial condition.

In the United States, at the federal level, we and/or our customers are required to comply with laws and regulations limiting telemarketing and certain technologies that enable automatic calling and/or messaging and establishing quiet hours for solicitations, such as the Telephone Consumer Protection Act of 1991 (“TCPA”), laws requiring assistance to law enforcement in electronic surveillance, requirements to pay regulatory fees and contributions to various federally administered funds,

requirements to safeguard the privacy of certain customer information, and requirements aimed at mitigating illegal robocalls and robotexts, such as the implementation of call authentication technologies, and other compliance requirements.

At the state level, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations, including laws similar to the TCPA.

We are also subject to varying international licensing obligations and communications regulations, including related to reporting requirements, provision of emergency services and of information to support emergency services, number portability, combatting scam and fraud, payment into universal service funds, and licensing fees, among others.

As we expand into new countries, our potential regulatory and licensing obligations, and related scrutiny, increase.

The international landscape continues to evolve, and in many cases involves significant uncertainties related to how the CPaaS business model fits into the communications regulatory framework.

There is significant variation in requirements across international jurisdictions, including as to whether some or all of the services we offer are considered regulated telecommunications services.

In addition, certain of our products may be used by customers located in countries where voice and other forms of Internet Protocol (“IP”) communications may be illegal or require special licensing or in countries on a U.S.

embargo list, and users in such countries may continue to use our products in those countries notwithstanding the illegality or embargo, or a local partner that we use to provide services may not comply with applicable governmental regulations, subjecting us to potential penalties or governmental actions that may be costly, harm our business and damage our brand and reputation.

Both in the United States and internationally, these requirements continue to change.

For example, new federal, state, or international requirements could impose more or different robocall or robotext mitigation measures, limit the customers we are able to serve, extend telecommunications regulations to our non-interconnected VoIP services or messaging products, subject us to additional registration, reporting or resiliency compliance obligations, or subject us to other fees, taxes or obligations.

The changing nature of these requirements increases the associated compliance costs, operational challenges, possibility of enforcement actions and other associated risks, and new or changed requirements, or interpretations or judicial actions related to them, may also adversely affect our business, results of operations and financial condition.

If we are unable to obtain, assign or retain geographical, mobile, regional, local or toll-free numbers, or to effectively process requests to port such numbers in a timely manner due to industry regulations, our business and results of operations may be adversely affected.

3 unchanged sentences

We have obtained licenses and are in the process of obtaining licenses in various countries in which we do business, but in some countries, the regulatory regime around provisioning of Numbering Resources is unclear, subject to change over time, and sometimes may conflict from jurisdiction to jurisdiction.

These regulations and governments’ approach to their enforcement, as well as our products and services, are evolving and we may be unable to maintain compliance with applicable regulations, or enforce compliance by our customers, on a timely basis or without significant cost or changes in products or business practices that result in reduced

In some countries where our or our customers’ assignment and/or use of Numbering Resources in certain ways may violate applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country.

19 unchanged sentences

The terms of any injunctions, judgments, consent decrees or settlement agreements entered into in connection with enforcement actions or investigations against our company in connection with any of the foregoing laws may also require us to change one or more aspects of the way we operate our business, which could impair our ability to attract and retain customers or could increase our operating costs.

Our customers’ and others’ violation of our policies or other misuse of our platform to transmit unwanted, offensive or illegal messages, spam, phishing scams, links to harmful applications or for other fraudulent or illegal activity could damage our reputation, and we may face a risk of regulatory penalties, litigation and liability for illegal activities on our platform and unauthorized, inaccurate, or fraudulent information distributed via our platform.

The actual or perceived improper sending of text messages or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines.

For example, the TCPA restricts telemarketing and the use of automatic SMS text messages without prior express consent.

Our customers’ and others’ violation of our policies or other misuse of our platform to transmit unwanted, offensive or illegal communications, spam, social engineering scams, links to harmful applications or for other fraudulent or illegal activity could damage our reputation, and we may face a risk of regulatory penalties, litigation and liability for illegal activities on our platform and unauthorized, inaccurate, or fraudulent information distributed via our platform.

The actual or perceived improper sending of text messages, voice calls, or email may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines.

For example, the TCPA restricts telemarketing and the use of text messages without prior express consent.

TCPA violations can result in significant financial penalties, as businesses can incur civil or criminal penalties imposed by the FCC, FTC, state attorneys general or other state actors or through private litigation.

2 unchanged sentences

This has resulted in civil claims against our company and requests for information through third-party subpoenas.

The scope and interpretation of the laws that are or may be applicable to the delivery of text messages or voice calls are continuously evolving and developing.

The scope and interpretation of the laws that are or may be applicable to the delivery of text messages, voice calls, or email are continuously evolving and developing.

If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws, we could face direct liability.

Moreover, certain customers may use our platform to transmit unwanted, offensive or illegal messages, calls, spam, phishing scams, and website links to harmful applications, reproduce and distribute copyrighted material or the trademarks of others without permission, and report inaccurate or fraudulent data or information.

These issues also arise with respect to a portion of those users who use our platform on a free trial basis or upon initial use.

These actions are in violation of our policies and in particular, our Acceptable Use Policy.

Our efforts to defeat spamming attacks, illegal robocalls and other fraudulent activity will not prevent all such attacks and activity.

These attacks and activity are also being facilitated or enhanced by evolving technologies, including AI.

Such use of our platform could damage our reputation and we could face claims for damages, regulatory enforcement, copyright or trademark infringement, defamation, negligence, or fraud.

Furthermore, enacting more stringent controls on our customers’ use of our platform to combat such violations of our Acceptable Use Policy could increase friction for our legitimate customers and decrease their use of our platform.

Moreover, certain customers and others have in the past, and despite our prevention efforts, may in the future, use our platform to transmit unwanted, offensive or illegal communications, spam, social engineering scams, and website links to harmful applications, reproduce and distribute copyrighted material or the trademarks of others without permission, and report inaccurate or fraudulent data or information.

These actions violate our policies.

Our efforts to defeat spamming attacks, illegal robocalls and other fraudulent activity will not prevent all such activity.

Such activity could damage our reputation and the effectiveness of our platform, and we could face claims for damages, regulatory enforcement, copyright or trademark infringement, defamation, negligence, or fraud.

Furthermore, enacting more stringent controls on use of our platform to combat such activity could increase friction for our legitimate customers and decrease their use of our platform.

Similarly, our products may be subject to fraudulent usage, including but not limited to revenue share fraud, domestic traffic pumping, subscription fraud, premium text message scams and other fraudulent schemes, such as phishing.

Although our customers are required to set passwords or personal identification numbers to protect their accounts, third parties have in the past been, and may in the future be, able to access customers’ accounts through fraudulent means and use the accounts for fraudulent activity.

Furthermore, spammers attempt to use our products to send targeted and untargeted spam communications.

We cannot be certain that our efforts to defeat spamming attacks will be successful in eliminating all spam communications from being sent using our platform.

In addition, a security breach of, or security incident impacting, our customers’ systems could result in exposure of their authentication credentials, unauthorized access to their accounts or fraudulent calls on their accounts, any of which could adversely affect our business, results of operations and financial condition.

Our customers’ and other users’ promotion of their products and services through our platform might not comply with federal, state, and foreign laws or of contractual requirements imposed by carriers, such as the CTIA Shortcode Agreement, The Campaign Registry, carrier codes of conduct and similar policies.

4 unchanged sentences

If we are found liable for our customers’ or other users’ activities, we could be required to pay fines or penalties, redesign business methods or otherwise expend resources to remedy any damages caused by such actions and to avoid future liability.

Additionally, our products may be subject to fraudulent usage, including but not limited to revenue share fraud, domestic traffic pumping, subscription fraud, premium text message scams and other fraudulent schemes, such as phishing.

Furthermore, spammers attempt to use our products to send targeted and untargeted spam messages.

We cannot be certain that our efforts to defeat spamming attacks will be successful in eliminating all spam messages from being sent using our platform.

Many of the foregoing activities are increasingly being facilitated or enhanced by AI and other evolving technologies.

AI agents operating through our platform have the potential to facilitate communications and fraudulent schemes with a scale, speed and sophistication that may evade existing fraud and compliance controls or evolve faster than controls can evolve to match, violate carrier policies, or breach applicable law.

Changes in laws and regulations related to the internet or changes in the internet infrastructure itself may diminish the demand for our products, and could adversely affect our business, results of operations and financial condition.

6 unchanged sentences

For example, in January 2025, the U.S.

Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and it is unlikely that similar federal rules will be adopted.

Without federal net neutrality rules, we cannot predict whether internet access service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive

alternative to our competitors’ applications.

Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and the current federal regulatory environment makes the adoption of similar rules unlikely in the near term.

Moreover, several states have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections.

4 unchanged sentences

In addition, the use of the internet as a business tool could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of internet activity, security, reliability, cost, ease-of-use, accessibility and quality of service.

The performance of the internet and its acceptance as a business tool has been adversely affected by “viruses,” “worms,” and similar malicious programs.

The performance of the internet and its acceptance as a business tool has been adversely affected by cyberattacks, malicious software, and other security threats.

If the use of the internet is reduced as a result of these or other issues, then demand for our products could decline, which could adversely affect our business, results of operations and financial condition.

Our global operations subject us to potential liability under export controls, economic sanctions, customs, anti-corruption, and other laws and regulations, and violating these laws could subject us to liability and impair our ability to compete in international markets.

Certain of our products and services may be subject to international trade laws, including the U.S.

Export Administration Regulations, U.S.

customs laws, and U.S.

economic and trade sanctions as well as similar laws and regulations in other countries in which we do business.

Exports and imports of our products and the provision of our services must be made in compliance with these laws.

Certain aspects of our business are subject to international trade laws, including U.S.

export control laws and regulations, U.S.

customs laws and regulations, and U.S.

economic sanctions laws and regulations, as well as other similar laws and regulations in other countries in which we do business.

Exports and imports of our products and the provision of our services must be made in compliance with these laws, which include varying prohibitions on the sale, export, or supply of our products and services to certain sanctioned countries, regions, governments, entities, or individuals.

We take precautions to prevent our products from being imported or exported and our services from being provided in violation of these laws;

17 unchanged sentences

We sometimes leverage third parties to sell our products and conduct our business abroad.

We, our employees, agents, representatives, business partners and third-party intermediaries may have direct or indirect interactions with officials and employees of

government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these employees, agents, representatives, business partners or third-party intermediaries even if we do not explicitly authorize such activities.

We, our employees, agents, representatives, business partners and third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these employees, agents, representatives, business partners or third-party intermediaries even if we do not explicitly authorize such activities.

It is possible that our employees, agents, representatives, business partners or third-party intermediaries could fail to comply with our policies and applicable laws and regulations, for which we may ultimately be held responsible.

Any allegations or violation of the FCPA or other applicable anti-bribery and anti-corruption laws and anti-money laundering laws could result in whistleblower complaints, sanctions, settlements, prosecution, enforcement actions, significant fines and penalties, damages, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from government contracts, all of which may have an adverse effect on our reputation, business, results of operations, and prospects.

results of operations, and prospects.

Responding to any investigation or action would likely result in a materially significant diversion of management’s attention and resources, significant defense costs and other professional fees.

22 unchanged sentences

While we have primarily transacted with customers and business partners in U.S.

dollars, we have also conducted business in currencies other

than the U.S.

dollars, we have also conducted business in currencies other than the U.S.

We expect to expand the number of transactions with customers that are denominated in foreign currencies in the future as we continue to expand our business internationally.

5 unchanged sentences

In addition, our international subsidiaries maintain net assets that are denominated in currencies other than the functional operating currencies of these entities.

As we continue to expand our international operations, we become more exposed to the effects of fluctuations in currency exchange rates.

As we continue to expand our international operations, we become more exposed to the

effects of fluctuations in currency exchange rates.

Accordingly, changes in the value of foreign currencies relative to the U.S.

7 unchanged sentences

We have incurred substantial indebtedness that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

As of September 30, 2025, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

As of March 31, 2026, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

Our indebtedness may:

12 unchanged sentences

In addition, any failure to make payments of interest and principal on our outstanding indebtedness on a timely basis would likely result in a reduction of our credit rating, which could harm our ability to incur additional indebtedness and our financial condition.

In the absence of such cash flows and resources,

we could face substantial liquidity problems and might be required to dispose of material assets or operations to meet our debt service and other obligations.

In the absence of such cash flows and resources, we could face substantial liquidity problems and might be required to dispose of material assets or operations to meet our debt service and other obligations.

We may require additional capital to support our business, and this capital might not be available on acceptable terms, if at all.

We intend to continue to make investments to support our business and may require additional funds.

In particular, we may seek additional funds to develop new products and enhance our platform and existing products, expand our operations, including our sales and marketing organizations and our presence outside of the United States, improve our infrastructure or acquire complementary businesses, technologies, services, products and other assets.

acquire complementary businesses, technologies, services, products and other assets.

In addition, we may use a portion of our cash to satisfy tax withholding and remittance obligations related to outstanding restricted stock units.

5 unchanged sentences

We rely on assumptions and estimates to calculate certain of our business metrics, and real or perceived inaccuracies in such metrics could adversely affect our reputation and our business.

We rely on assumptions and estimates to calculate certain of our business metrics that we disclose in SEC filings, press releases and other materials, including Active Customer Accounts and Dollar-Based Net Expansion Rate.

We rely on assumptions and estimates to calculate certain of our business metrics that we disclose in SEC filings, press releases and other materials, including Dollar-Based Net Expansion Rate.

Our metrics are not based on any standardized industry methodology and are not necessarily calculated in the same manner or comparable to similarly titled measures presented by other companies.

4 unchanged sentences

Further, as our business develops, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance.

For example, beginning in the first quarter of 2026, we discontinued disclosure of Active Customer Accounts as a key metric.

If investors or analysts do not perceive our metrics to be accurate representations of our business, or if they disagree with our methodologies, or if we discover material inaccuracies in our metrics, our reputation, business, results of operations, and financial condition would be harmed.

2 unchanged sentences

generally accepted accounting principles (“GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in Part I, Item 2, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

Assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition and business combinations.

2 unchanged sentences

A change in accounting standards or practices may have a significant effect on our results of operations and may even affect our reporting of transactions completed before the change is effective.

New accounting pronouncements and varying

interpretations of accounting pronouncements have occurred and may occur in the future.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future.

Changes to existing rules or the questioning of current practices may adversely affect our reported financial results or the way we conduct our business.

For example, Accounting Standards Codification (“ASC”) 842, “Leases” that became effective January 1, 2019, had a material impact on our consolidated financial statements as described in detail in Note 2 to the consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2020.

Adoption of these types of accounting standards and any difficulties in implementation of changes in accounting principles, including the ability to modify our accounting systems, could cause us to fail to meet our financial reporting obligations, which result in regulatory discipline and harm investors' confidence in us.

If our goodwill or intangible assets become impaired, we may be required to record a significant charge to earnings.

We review our intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable.

Goodwill is required to be tested for impairment at least annually.

As of September 30, 2025, we carried a net $5.4 billion of goodwill and intangible assets.

An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets.

For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2023.

Any such charges may adversely affect our results of operations.

Adoption of accounting standards and any difficulties in implementation of changes in accounting principles, including the ability to modify our accounting systems, could cause us to fail to meet our financial reporting obligations, which result in regulatory discipline and harm investors' confidence in us.

Events or changes in circumstances may require us to record impairment charges related to our intangible assets, goodwill or investments.

We review our intangible assets, goodwill and equity method investment for impairment in accordance with applicable accounting requirements.

As of March 31, 2026, we carried a net $5.4 billion of goodwill and intangible assets and $275.1 million related to our equity method investment.

An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, have in the past resulted, and could in the future result, in a change to the estimation of fair value resulting in an impairment charge to the underlying asset.

Our results of operations may be adversely affected as a result of any such charges.

For example, during the year ended December 31, 2025, we recorded an impairment of our equity method investment totaling approximately $80.6 million, as described in additional detail in Note 12 to our consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2025.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

17 unchanged sentences

Our state NOLs may also be subject to limitations, including periods during which the use of state NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

For example, in June 2024, California enacted legislation that limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

For example, California legislation limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), and corresponding provisions of state law, a corporation that undergoes an “ownership change” (generally defined as a greater than 50-percentage-point cumulative change (by value) in the equity ownership of certain stockholders over a rolling three-year period) is subject to limitations on its ability to utilize its pre-change NOLs and other pre-change tax attributes to offset post-change taxable income and taxes.

1 unchanged sentence

We may have additional tax liabilities, which could harm our business, results of operations and financial condition.

Significant judgments and estimates are required in determining our provision for income taxes and other tax liabilities.

Our tax expense may be impacted, for example, if tax laws change or are clarified to our detriment or if tax authorities successfully challenge the tax positions that we take, such as, for example, positions relating to the arm’s-length pricing standards for our intercompany transactions and our indirect tax positions.

In determining the adequacy of our provision for income taxes, we assess the likelihood of adverse outcomes that could result if our tax positions were challenged by the Internal Revenue Service (“IRS”), and other tax authorities.

Should the IRS or other tax authorities assess additional taxes as a result of examinations, we may be required to record charges to operations that could adversely affect our results of operations and financial condition.

We conduct operations in many tax jurisdictions throughout the United States and internationally.

In many of these jurisdictions, non-income-based taxes, such as sales tax, value-added tax, goods and services tax, and telecommunications taxes, are assessed on our operations or our sales to customers.

We are subject to indirect taxes, and may be subject to certain other taxes, in some of these jurisdictions.

We collect certain telecommunications-based taxes from our customers in certain jurisdictions, and we expect to continue expanding the number of jurisdictions in which we will collect these taxes in the future.

Many states are also pursuing legislative expansion of the scope of goods and services that are subject to sales and similar taxes as well as the circumstances in which a vendor of goods and services must collect such taxes.

Following the United States Supreme Court decision in South Dakota v.

Wayfair, Inc., states are now free to levy taxes on sales of goods and services based on an “economic nexus,” regardless of whether the seller has a physical presence in the state.

In many of the jurisdictions in which we operate, non-income-based taxes, such as sales tax, value-added tax, goods and services tax, and telecommunications taxes, are assessed on our operations or our sales to customers.

Such tax laws and rates vary by jurisdiction.

One or more states or countries may seek to impose incremental or new indirect tax collection obligations on us.

Any additional fees and taxes levied on our services by any state may adversely impact our results of operations.

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated.

We reserved $43.8 million on our September 30, 2025 balance sheet for these tax payments.

Historically, we have not billed or collected indirect taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated.

We reserved $42.8 million on our March 31, 2026 balance sheet for these tax payments.

These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions.

10 unchanged sentences

If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

Changes in, or interpretations of, tax rules and regulations or our tax positions may materially and adversely affect our income taxes.

We are subject to income taxes in both the United States and numerous international jurisdictions.

Significant judgment is required in determining our worldwide provision for income taxes.

Changes in, or interpretations of, tax rules and regulations or our tax positions may materially and adversely affect our taxes.

We are subject to taxes in both the United States and numerous international jurisdictions.

Significant judgment is required in determining our worldwide provision for taxes.

In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain.

Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, changes in tax laws that could adversely impact our income or non-income taxes or the expiration of or disputes about certain tax agreements in a particular country.

Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, or the expiration of or disputes about certain tax agreements in a particular country.

We are subject to audit by various tax authorities.

For example, the Internal Revenue Service is conducting an examination of our U.S.

federal income tax return for the year ending December 31, 2023.

The outcome of this examination, which is still in its preliminary stages, is uncertain.

In accordance with GAAP, we recognize income tax benefits, net of required valuation allowances and accrual for uncertain tax positions.

Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than that which is reflected in our historical income tax provisions and accruals.

Although we believe our tax estimates are reasonable, the final determination of this examination, other tax audits and any related litigation could be materially different than that which is reflected in our historical income tax provisions and accruals.

Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

Changes in tax laws, including recently enacted U.S.

federal tax legislation commonly referred to as the One Big Beautiful Bill Act (the “OBBB Act”), or tax rulings, or changes in interpretations of existing laws, could cause us to be subject to additional income-based taxes and non-income taxes (such as payroll, sales, use, value-added, digital tax, net worth, property, and goods and services taxes), which in turn could materially affect our financial position and results of operations.

The OBBB Act could potentially increase our effective tax rate as we continue to expand our international operations in the coming years.

Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

As another example, in 2021, the Organization for Economic Co-operation and Development (the “OECD”) announced the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the “Framework”) and released Pillar Two Model Rules defining global minimum tax rules (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies.

In 2022, the European Union (EU) Member States adopted the EU’s Pillar Two Directive, and various other countries have proposed or enacted similar legislation that may increase our taxes in these countries.

On June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two.

However, this statement has not yet been incorporated into the Framework.

Changes to these and other areas in relation to potential U.S.

and international tax reform could increase uncertainty and may adversely affect our tax rate and cash flow in future years.

As another example, the Organization for Economic Co-operation and Development (the “OECD”) has proposed a global minimum tax (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies, and various countries have proposed or enacted implementing legislation.

Notwithstanding the OECD’s side-by-side elective safe harbor announced in January 2026 for U.S.

parented groups, we may still face increased tax rates, compliance complexity and tax provision volatility as a result of Pillar Two.

Risks Related to Ownership of Our Common Stock

27 unchanged sentences

In January 2025, our board of directors authorized the repurchase of up to $2.0 billion of our common stock from time to time through a share repurchase program.

As of September 30, 2025, we had repurchased $656.7 million of outstanding shares of our common stock under this program, such that approximately $1.3 billion remained available for purchase as of such date.

Under our share repurchase program, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws.

As of March 31, 2026, we had repurchased $1.1 billion of outstanding shares of our common stock under this program, such that approximately $892.0 million remained available for purchase as of such date.

Under our share repurchase program, we may make repurchases of stock through a variety of methods, including open market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws.

Our share repurchase program terminates at 11:59 pm Pacific Time on December 31, 2027, does not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice.

45 unchanged sentences

In addition, global climate change could result in certain types of natural disasters occurring more frequently or with more intense effects.

such events may result in users being subject to service disruptions or outages, and we may not be able to recover our technical infrastructure in a timely manner to maintain or resume operations, which may adversely affect our financial results.

Any such events may result in users being subject to service disruptions or outages, and we may not be able to recover our technical infrastructure in a timely manner to maintain or resume operations, which may adversely affect our financial results.

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

There is an increasing focus on ESG matters from governmental authorities, investors, customers and other stakeholders, whose expectations are evolving and may be contradictory.

There has been a focus on ESG matters from governmental authorities, investors, customers and other stakeholders, whose expectations are evolving and may be contradictory.

Our decisions regarding ESG-related initiatives, goals, or commitments, including whether to pursue them, and/or the extent to which we achieve them, may be scrutinized and could negatively impact our reputation, result in reduced customer demand or certain investors not purchasing or holding our stock, harm our ability to attract and retain qualified employees, or otherwise materially harm our business.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors