$LAW Risk Factor changes from 00/02/24/23/2023 to 00/02/22/24/2024

Item 1A. Risk FactorsOur operations and financial results are subject to various risks and uncertainties, including those described below.

You should carefully consider the risks described below, together with the financial and other information contained in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our audited consolidated financial statements and related notes. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. If any of the following risks or others not specified below materialize, our business, financial condition, results of operations and prospects could be materially and adversely affected. Unless otherwise indicated, references in these risk factors to our business being harmed will include harm to our business, reputation, brand, financial condition, results of operations and prospects. As a result, the trading price of our common stock could decline. Our historical growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.We have experienced substantial growth in our business, including significant growth in headcount, our number of customers, usage, and amount of data delivered across our product offerings, since inception. For example, our revenue was $138.2 million for the years ended December 31, 2023 and 2022, respectively. Although our revenues increased from 2022 to 2023, our rate of revenue growth has declined from prior periods and our quarterly revenue within individual product offerings has fluctuated. Our revenue growth rate may continue to decline, and our revenue may decline, in the future as a result of a variety of factors, including the maturation of our business, increased competition, negative media or industry or financial analyst commentary regarding us or our product offerings, changes in personnel, changes to technology, a decrease or periodic fluctuations in the growth of our overall market, changes in the volume of legal matters and other organizational changes affecting our customer base and resulting in litigation, or our failure, for any reason, to continue to take advantage of growth opportunities.We may not successfully accomplish any of these objectives, and as a result, it is difficult for us to forecast our future results of operations. If the assumptions that we use to plan our business are incorrect or change in reaction to changes in the markets in which we operate, or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.These investments may not be successful on the timeline we anticipate or at all and may not result in increased revenue growth. If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability over the long term. Additionally, we have encountered, and may in the future encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as unforeseen operating expenses, difficulties, complications, delays and other known or unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, our business, financial position and results of operations may be harmed, and we may not achieve or maintain profitability in the future. We may not be able to successfully manage our growth and, if we are not able to grow efficiently, our business, financial condition and results of operations could be harmed. The rapid growth we have experienced in our business places significant demands on our operational infrastructure. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support and professional services, to serve our growing customer base. Any failure of or delay in these efforts could lead to impaired system performance and reduced customer satisfaction, resulting in decreased sales to customers, lower dollar-based net retention rates, the issuance of service credits or requested refunds, which would hurt our revenue growth and our reputation. Even if we are successful in our expansion efforts, they will be expensive and complex, and require the dedication of significant management time and attention. We could also face inefficiencies or service disruptions as a result of our efforts to scale our internal infrastructure. We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition and results of operations. Our limited operating history and our history of operating losses makes it difficult to evaluate our current business and prospects and may increase the risks associated with your investment. We launched our business in 2013 and have experienced net losses in each fiscal year since inception. We incurred net losses of $42.8 million for the years ended December 31, 2023 and 2022, respectively. As of December 31, 2023, we had an accumulated deficit of $240. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable. Even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We will also face increased compliance costs associated with growth and expansion of our customer base. These increased expenditures will make it harder for us to achieve or sustain profitability. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our common stock could decline and our business may be harmed. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in constantly evolving industries, including the risks described herein. If we do not address these risks successfully, our business may be harmed. We have funded our operations since inception primarily through payments received from our customers, sales of equity securities, including our IPO in July 2021, and borrowings under our former credit facility. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. We evaluate financing opportunities from time to time and our ability to obtain financing will depend, among other things, on our development efforts, business plans, operating performance and condition of the capital markets at the time we seek financing. Additional financing may not be available on favorable terms, if at all. Weakness and volatility in the capital markets and the economy in general could limit our access to capital markets and increase our costs of borrowing. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests. Our issuance of additional capital stock in connection with financings, acquisitions, investments, our equity incentive plans or otherwise will dilute all other stockholders. We may issue additional capital stock in the future that will result in dilution to all other stockholders. We expect to grant equity awards to employees, directors and consultants under our equity incentive plans. We may also raise capital through equity financings in the future. As part of our business strategy, we may acquire or make investments in companies and issue equity securities to pay for any such acquisition or investment. Any such issuances of additional capital stock may cause stockholders to experience significant dilution of their ownership interests and the per share value of our common stock to decline. Our ability to grow and generate incremental revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and to have them increase their usage of our product offerings. Most of our customers do not have long-term contractual financial commitments to us and, therefore, most of our customers may reduce or cease their use of our product offerings at any time. Customers under usage-based contracts can cancel their contracts or reduce their usage at any time. For example, we developed a new ediscovery chatbot, Cecilia, which we released publicly in the fourth quarter of 2023 in the United States, and intend to offer our customers access to sources of primary law, which we acquired through our Fastcase license and intend to launch in 2024. If our efforts to increase usage and develop and sell additional offerings to our customers are not successful, or the development of additional features is delayed, our business may be harmed. We have derived and expect to continue to derive substantially all of our revenue from usage of our product offerings. If we are unable to attract new customers and retain existing customers, our business, financial condition and results of operations will be adversely affected. We must attract new customers and retain existing customers to continue to grow our business. Our customers include law firms and other legal services providers, legal departments of corporate enterprises and organizations and governmental entities. We must convince potential customers of the value of our cloud software platform and that our technologies can automate and simplify legal services more accurately, efficiently and securely than lawyers and their staff and the products of our competitors. This may require significant and costly sales efforts that are targeted at law firms and legal departments of corporate enterprises and organizations and the senior management of these potential customers. In addition, our ability to attract new customers depends in part on our partner ecosystem, consisting of law firms and other legal services providers who resell our product offerings. As a result of these and other factors, we may be unable to attract new customers or retain existing customers, which would adversely affect our business, financial condition and results of operations. If our platform fails to perform properly due to defects, interruptions, delays in performance or similar problems and if we fail to resolve any defect, interruption, delay or other problem, we could lose customers, become subject to service performance or warranty claims or incur significant costs. Our operations are dependent upon our ability to prevent system interruption. These defects or errors could also be found in third-party applications on which we rely. We may not be able to detect and correct defects or errors before a customer begins using our platform. In addition, we may experience system slowdowns and interruptions from time to time. If there is a substantial increase in the volume of usage on our platform, we will be required to further expand and upgrade our technology and infrastructure. In order to remain competitive, we must continue to enhance and improve the responsiveness, functionality and features of our product offerings. Our response to such slowdowns or interruptions may not be sufficient to address all aspects or any unanticipated consequence or incidents and our insurance may not be sufficient to compensate us for the losses that could occur. Also, as we continue to expand our customer base, any actual or perceived failure by us to properly provide these services will likely result in lost opportunities for follow-on sales of our related services. We rely upon third-party providers of cloud-based infrastructure to host our cloud-based platform. Any disruption in the operations of these third-party providers, limitations on capacity, or interference with our use could adversely affect our business, financial condition and results of operations. Our continued growth depends in part on the ability of our existing and potential customers to continue to adopt and utilize our cloud-based platform. Our cloud-based platform depends on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any disruption as a result of cyber-attacks or similar issues, or any limitation on the capacity of our third-party hosting services, could impede our ability to onboard new customers or expand the usage of our existing customers or otherwise adversely affect our business, which could adversely affect our financial condition and results of operations. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, outbreaks of contagious diseases, terrorist or other attacks and other similar events beyond our control could negatively affect our cloud-based platform. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use. As our business grows, we may need to engage additional providers of cloud computing infrastructure to support our operations. Adequate additional support may not be available to us on acceptable terms, or at all. Furthermore, certain customers may require that we use or avoid specific providers of cloud computing infrastructure. In addition, in the event that our service agreements with our third-party hosting services are terminated, or there is a lapse of service, elimination of services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our cloud-based platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our cloud-based platform for deployment on a different cloud infrastructure service provider, which could adversely affect our business, financial condition and results of operations. We do not control the operations of AWS’s facilities. AWS’s facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events or could be subject to break-ins, computer viruses, sabotage, intentional acts of vandalism and other misconduct. The occurrence of any of these events, a decision to close the facilities or cease or limit providing services to us without adequate notice or other unanticipated problems could result in interruptions to our product offerings, which may be lengthy. Moreover, negative publicity from disruptions could damage our reputation. AWS does not have an obligation to renew its agreements with us on commercially reasonable terms, or at all. If we cannot renew our agreement or are unable to renew on commercially reasonable terms, we may experience costs or downtime in connection with the transfer to, or the addition of, new cloud infrastructure or other data centers. Upon expiration or termination of our agreement with AWS, we may not be able to replace the services provided to us in a timely manner or on terms and conditions, including service levels and cost, that are favorable to us, and a transition from one vendor to another vendor could subject us to operational delays and inefficiencies until the transition is complete. Switching our operations from AWS to another cloud or other data center provider would also be technically difficult, expensive and time consuming. We expect fluctuations in our financial results, which may cause period-to-period comparisons not to be meaningful. Our business model is usage-based and there is inherent unpredictability in the timing, duration and scope of our customers’ legal matters requiring use of our product offerings. Our operating results have fluctuated in the past and are expected to fluctuate in the future due to a variety of factors, many of which are outside of our control. As a result, our results of operations, including the levels of our revenues, working capital and cash flows, may vary significantly in the future, such that period-to-period comparisons of our results of operations may not be meaningful.Any one or more of the factors above may result in significant fluctuations in our results of operations. In addition, because we were founded in 2013 and have experienced rapid expansion of our business and revenues since such time, we do not have a long history upon which to base forecasts of future revenue and operating results. Accordingly, we may be unable to accurately forecast our revenues. As a result, our past results may not be indicative of our future performance, and the variability and unpredictability of our results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our common stock could decline substantially and we could face lawsuits that are costly and may divert management’s attention, including securities class action suits. If we fail to forecast our revenue accurately or manage our expenditures, or if we fail to meet publicly announced guidance, our operating results could be adversely affected, and our stock price could decline. We cannot accurately predict customers’ usage given the uncertain timing and duration of legal matters and the diversity of our customer base across industries, geographies and size and other factors. Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure and research and development in anticipation of continued growth in our business. If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline. In addition, we release earnings guidance in our quarterly and annual earnings conference calls, quarterly and annual earnings releases, or otherwise, regarding our future performance that represents our management’s estimates as of the date of release. Our actual business results may vary significantly from such guidance or consensus due to a number of factors, many of which are outside of our control, including global economic uncertainty and financial market conditions, which could adversely affect our business and future operating results. Furthermore, we have in the past and may in the future make downward revisions of our previously announced guidance. If we withdraw our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock may decline. The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and regulatory changes, as well as changing customer needs, requirements and preferences. For example, our ediscovery chatbot, Cecilia, was publicly released in the fourth quarter of 2023 in the U.S., and we intend to offer customer access to sources of primary law, which we acquired through our Fastcase license, in 2024. If new technologies emerge that enable our competitors to deliver competitive products, services and applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete. A limited number of customers represent a substantial portion of our revenue. If we fail to retain these customers, our revenue could decline significantly. We derive a substantial portion of our revenue from sales to our top 10% customers. As a result, our revenue could fluctuate materially and could be and has in the past been materially and disproportionately impacted by purchasing decisions of these customers or any other significant future customer. In particular, usage of DISCO Review, our AI-powered document review offering, decreases and increases more significantly with the completion and inception of litigation, investigations and other legal matters than with our other offerings, and as a result can have a material impact on our quarter-to-quarter revenue fluctuations, even though revenues from such offering currently constitute a small proportion of our overall annual revenues. If we do not further diversify our customer base, we will continue to be susceptible to risks associated with customer concentration. Our revenue growth depends in part on the success of our strategic relationships with law firms and other legal services providers, and if we are unable to establish and maintain successful relationships with them, our business, operating results and financial condition could be adversely affected. We seek to grow our partner ecosystem as a way to grow our business. We plan to continue to establish and maintain similar strategic relationships with law firms and other legal services providers and we expect these entities to become an increasingly important aspect of our business. Our future growth in revenue and ability to achieve and sustain profitability depends in part on our ability to identify, establish and retain successful strategic partner relationships in the United States and internationally, which will take significant time and resources and involve significant risk. In order to develop and expand our distribution channel, we must develop and improve our processes for partner introduction and training. If we do not succeed in identifying suitable strategic partners or maintain our relationships with such partners, our business, operating results and financial condition may be adversely affected. Moreover, we cannot be certain that these law firm and other legal services provider partners will prioritize or provide adequate resources to promote or utilize our product offerings. Further, some of our partners also work with our competitors. We cannot assure you that our law firm and other legal services provider partners will continue to cooperate with us. In addition, actions taken or omitted to be taken by such parties may adversely affect us. Even if we are successful in establishing and maintaining these relationships with law firms and other legal services providers, we cannot assure you that these relationships will result in increased customer usage of our product offerings or increased revenue to us. We plan to dedicate significant resources to sales, marketing and demand-generation programs, including various online marketing activities as well as targeted account-based advertising. The effectiveness of our targeted account-based advertising has varied over time and may vary in the future. All of these efforts will require us to invest significant financial and other resources and if they fail to attract additional customers, our business will be harmed. We believe that there is significant competition for sales personnel, including sales representatives, sales managers and sales engineers, with the skills and technical knowledge that we require. Our ability to achieve significant revenue growth will depend in large part on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth. New hires require significant training and may take significant time before they achieve full productivity. Our recent hires may not become productive as quickly as we expect, if at all, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. In addition, particularly if we grow rapidly, new members of our sales force will have relatively little experience working with us, our product offerings and our business model. The markets in which we participate are competitive, and if we do not compete effectively, our business will be harmed. The market for technology solutions for law firms, private enterprises and government and other organizations is highly fragmented, competitive and constantly evolving. With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. Our competitors include (i) legal services providers, including large dedicated legal services providers such as Consilio LLC, Epiq Systems, Inc. and KLDiscovery Inc., the legal services divisions of large professional firms such as Deloitte & Touche LLP, Ernst and Young LLP, KPMG LLP and PricewaterhouseCoopers LLP, as well as a large number of smaller regional and local services companies and certain law firms providing in-house ediscovery and document review solutions; (ii) legacy on-premise software providers, such as Nuix Limited, Open Text Corporation and Relativity ODA LLC, or Relativity, RELX PLC and Thomson Reuters Corporation; and (iii) cloud software providers, such as Everlaw, Inc., Relativity through its RelativityOne offering, and Reveal Data Corporation (recently acquired Logik Systems, Inc. - d.b.a. Logikcull). Some of our competitors have made or may make acquisitions or be acquired by private equity sponsors, enterprises or special purpose acquisition companies or may enter into commercial relationships or other strategic relationships that may provide more comprehensive offerings than they individually had offered. Such acquisitions or relationships may help competitors achieve greater economies of scale than us. In addition, new entrants not currently considered to be competitors may enter the market through acquisitions, partnerships or strategic relationships.Our competitors vary in size and in the breadth and scope of the products and services offered. Many of our competitors and potential competitors have greater name recognition, greater market penetration, longer operating histories, more established customer relationships and installed customer bases and substantially greater financial, human, technical and other resources than we do and may be able to offer competing solutions to potential customers on more favorable terms than us. While some of our competitors provide a platform with applications to support one or more use cases, many others provide point-solutions that address a single use case. Other potential competitors not currently offering competitive applications may expand their product offerings to compete with our product offerings. Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards and customer requirements. An existing competitor or new entrant could introduce new technology that reduces demand for our product offerings. In addition to application and technology competition, we face pricing competition. Some of our competitors offer their applications or services at a lower price, which has resulted in pricing pressures. Some of our larger competitors have the operating flexibility to bundle competing applications and services with other offerings, including offering them at a lower price or for no additional cost to customers as part of a larger sale of other products.We have estimated the size of our addressable market opportunity based on data published by third parties and on internally generated data and assumptions.

While we believe our market size information is generally reliable, such information is inherently imprecise and relies on our and third parties’ projections, assumptions and estimates within our target market, which are necessarily subject to a high degree of uncertainty and risk due to a variety of factors, including those described in this Annual Report on Form 10-K. Our market is developing and may develop differently than we expect. Market opportunity estimates and growth forecasts that we may make from time to time are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. If such third-party or internally generated data prove to be inaccurate or we make errors in our projections, assumptions or estimates based on that data, including how current customer data and trends may apply to potential future customers and the number and type of potential customers, our addressable target market opportunity and/or our future growth rate may be less than we currently estimate. In addition, these inaccuracies or errors may cause us to misallocate capital and other business resources, which could divert resources from more valuable alternative projects and harm our business. The variables that go into the calculation of our market opportunity are subject to change over time and there is no guarantee that any particular number or percentage of addressable users or companies covered by our addressable target market opportunity estimates will purchase our product offerings at all or generate any particular level of revenue for us. Even if the market in which we compete meets our size estimates and growth forecasts, we may not be successful in capitalizing on such market opportunity and our business could fail to grow for a variety of reasons, including reasons outside of our control, such as competition in our industry. Accordingly, information regarding the size of our addressable market opportunity should not be taken as indicative of our future growth.If we fail to develop, maintain and enhance our brand, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer. We also believe that the importance of brand recognition will increase as competition in our market increases. Additionally, our brand and reputation may be affected if customers do not have a positive experience with our law firm and other legal services provider partners’ services. Our brand promotion activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in building our brand. If we fail to successfully promote and maintain our brand, our business may be harmed. For example, we recently experienced negative publicity following the departure of our former chief executive officer, which negative publicity may affect perception of our brand. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful. We employ a pricing model that subjects us to various challenges, and given our limited history with our pricing model, we may not be able to accurately predict the optimal pricing necessary to attract new customers and retain existing customers. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position and cash flow. Our sales cycles with customers can be long and unpredictable and our sales efforts require considerable time and expense. The timing of our sales with our enterprise customers and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for these customers. The length of our sales cycle for these customers can vary substantially from customer to customer. Our sales efforts involve educating our customers about the use, technical capabilities and benefits of our product offerings. In addition, the size of potential customers may lead to longer sales cycles. During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a completed sale. Additional factors that may influence the length and variability of our sales cycle include: •the effectiveness of our sales force, particularly new salespeople, as we increase the size of our sales force and train our new salespeople to sell to enterprise customers; •the discretionary nature of customers’ purchasing decisions and budget cycles;•customers’ procurement processes, including their evaluation of competing products and services;•economic conditions and other factors affecting customer budgets;•the regulatory environment in which our customers operate;•customers’ familiarity with cloud computing solutions;•evolving customer demands; and•competitive conditions.Given these factors, it is difficult to predict whether and when a customer will switch to our product offerings. We may also face unexpected deployment challenges with such enterprises or more complicated deployment of our product offerings. These enterprises may demand additional features, support services and pricing concessions or require additional security management or control features. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers. In the aftermath of the recent departure of our former chief executive officer and media reporting on the circumstances of his departure, we determined that certain aspects of our corporate culture need to be reassessed. We have begun executing on an action plan to review and, to the extent necessary, take action to strengthen our culture and make all employees feel that we maintain a positive and constructive work environment. Any failure to improve and preserve our culture could negatively affect our ability to retain and recruit personnel and retain and win new customers, both of which are critical to our growth, and to effectively focus on and pursue our corporate objectives. The success of our business depends on our customers’ continued and unimpeded access to our platform on the internet. We have experienced, and may in the future experience, disruptions, outages, defects and other performance and quality problems with the public cloud and internet infrastructure on which our cloud platform relies. As we expand our operations internationally, these problems will be further exacerbated and we will face additional complexity due to our inability to control internet infrastructure outside the United States. Any failure to offer high-quality support and professional services for our customers may harm our relationships with our customers and, consequently, our business. Our ability to provide effective customer support is largely dependent on our ability to attract, train and retain qualified personnel with experience in supporting customers with a cloud platform such as ours and maintaining the same. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for technical support or maintenance assistance. We also may be unable to modify the future, scope and delivery of our maintenance services and technical support to compete with changes in the technical services provided by our competitors. Increased customer demand for support and professional services, without corresponding revenue, could increase costs and negatively affect our operating results. Our ability to attract new customers is highly dependent on our business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality support services, or a market perception that we do not maintain high-quality support services for our customers, would harm our business. We rely on the performance of highly skilled personnel, including our management and other key employees and the loss of one or more of such personnel, or of a significant number of our team members, could harm our business. We also are dependent on the continued service of our existing software engineers because of the complexity of our platform, and our existing salespeople, because of their relationship with our customers. Our senior management and key employees are employed on an at-will basis. In addition, many of our senior management and key employees may be able to receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business. Any change in key personnel could disrupt our business. Mr. Competition for executive officers, software developers, legal professionals, sales and customer support personnel and other key employees in our industry is intense. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing and managing cloud-based software, as well as for legal professionals to support our product offerings and skilled sales and operations professionals. In addition, we believe that the success of our business and corporate culture depends on employing people with a variety of backgrounds and experiences and the competition for such diverse personnel is significant. While the market for such talented personnel is particularly competitive in Austin, Texas, where our headquarters is located, it is also competitive in other markets where we maintain operations and the increased prevalence of remote work has increased competition for employees in all markets. Many of the companies with which we compete for experienced personnel have greater resources than we do and can frequently offer such personnel substantially greater compensation than we can offer. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business would be harmed. Future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of management, disrupt our business and dilute stockholder value. We may not be able to find suitable acquisition candidates and we may not be able to complete acquisitions on favorable terms, if at all. If we do complete acquisitions, we may not ultimately strengthen our competitive position or achieve our goals and any acquisitions we complete could be viewed negatively by customers, developers or investors. In addition, we may not be able to integrate acquired businesses successfully or effectively manage the combined company following an acquisition. If we fail to successfully integrate our acquisitions, or the people or technologies associated with those acquisitions, into our company, the results of operations of the combined company could be adversely affected. Any integration process will require significant time and resources, require significant attention from management and disrupt the ordinary functioning of our business and we may not be able to manage the process successfully, which could harm our business. In addition, we may not successfully evaluate or utilize the acquired technology and accurately forecast the financial impact of an acquisition transaction, including accounting charges. We may have to pay cash, incur debt or issue equity securities to pay for any such acquisition, each of which could affect our financial condition or the value of our capital stock. If we incur more debt, it would result in increased fixed obligations and could also subject us to covenants or other restrictions that would impede our ability to flexibly operate our business. Our current operations are international in scope and we plan on further geographic expansion, creating a variety of operational challenges. A component of our growth strategy involves the further expansion of our operations and customer base internationally. For the year ended December 31, 2023, the percentage of revenue generated from customers outside the United States was less than 10% of our total revenue. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. In connection with such expansion, we may face difficulties, including costs associated with expansion, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycle difficulties in collecting accounts receivable in some countries, increased management, travel, infrastructure and legal compliance costs associated with having operations and developing our business in multiple jurisdictions, different technical standards, existing or future regulatory and certification requirements and required features and functionality, political and economic conditions and uncertainty in each country or region in which we operate and general economic and political conditions and uncertainty around the world, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries and a geographically and culturally diverse workforce and customer base. Furthermore, in certain jurisdictions in which we seek to enter, the rules and regulations governing the practice of law and e-discovery may impose additional obligations or restrictions on our operations. Failure to overcome any of these difficulties could harm our business. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to further expand our international operations and are unable to do so successfully and in a timely manner, our business may be harmed. We are exposed to fluctuations in currency exchange rates. Our sales contracts are primarily denominated in U.S. dollars and therefore substantially all of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. In addition, an increasing portion of our operating expenses are incurred and an increasing portion of our assets are held outside the United States. These operating expenses and assets are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. While we do not currently engage in hedging efforts, if we do not successfully hedge against the risks associated with currency fluctuations as our international operations and customer base grow, our business may be harmed. Risks Related to Socioeconomic Factors Unfavorable conditions in the global economy, including a global or domestic recession or the fear thereof, could cause reductions in legal spending and harm our business. Our results of operations may vary based on the impact of changes in the global economy on us, our industry or our customers and potential customers.S. Moreover, corporate entities may elect to reduce legal spending, both internally and through outside counsel, or be less willing to try alternatives to the traditional legal function. Also, our competitors, many of which are larger and have greater financial resources than we do, may respond to market conditions by lowering prices and attempting to lure away our customers. The increased pace of consolidation in certain industries, in part due to opportunistic acquisitions in a depressed valuation environment, may also 25Table of Contentsresult in reduced overall spending on information technology and legal services. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. Risks Related to Our Intellectual Property Any failure to protect our proprietary technology and intellectual property rights could substantially harm our business and operating results. Our success and ability to compete depends in part on our intellectual property and our other proprietary technology information. We seek to control access to our proprietary information by entering into a combination of confidentiality and proprietary rights agreements, invention assignment agreements and nondisclosure agreements with our employees, consultants and third parties with whom we have relationships.S. granted patents and 16 pending U.S. Any patents that issue from any patent applications may not give us the protection that we seek or may be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be valid and enforceable in actions against alleged infringers. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law, or because of technology developed prior to the inventions we have sought to patent or because of defects in our patent prosecution process. We may in the future be subject to legal proceedings and litigation, including intellectual property disputes, which are costly and may subject us to significant liability and increased costs of doing business. Our business may suffer if it is alleged or determined that our technology infringes the intellectual property rights of others. The software industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual property rights. Companies in the software industry are often required to defend against litigation claims based on allegations of infringement, misappropriation or other violations of intellectual property rights. Our technologies may not be able to withstand any third-party claims or rights against their use. In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights (and may also have greater resources to defend claims that may be brought against them). Any litigation may also involve patent holding companies or other adverse patent owners that have no relevant product revenue and against which our patents may therefore provide little or no deterrence. If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop offering applications impacted by the claim or injunction or cease business activities covered by such intellectual property and may be unable to compete effectively. Any inability to license third-party technology in the future would have an adverse effect on our business or operating results and would adversely affect our ability to compete. We may also be contractually obligated to indemnify our customers in the event of infringement of a third party’s intellectual property rights and any such claims could hurt our business as well. Such claims, regardless of their merit, can be time-consuming, costly to defend in litigation and damaging to our reputation and brand. In addition, although we carry general liability and cyber security insurance, our insurance may not be adequate to indemnify us for all liability that may be imposed or otherwise protect us from liabilities or damages with respect to claims alleging compromises of customer data and any such coverage may not continue to be available to us on acceptable terms or at all. Lawsuits are time-consuming and expensive to resolve, and they divert management’s time and attention and could cause current or potential customers to seek other providers. Although we carry insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed nor the full extent of the harm that we might face. We cannot predict the outcome of lawsuits and the results of any such actions may harm our business. Failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and our brands as well as our competitive advantage. We currently rely on a combination of patent, trademark, copyright and trade secret laws and other intellectual property rights and confidentiality or license agreements with our employees, customers, partners and others, to protect our intellectual property rights. Our success and ability to compete depend, in part, on our ability to protect our intellectual property, including our proprietary technology and our brands. If we are unable to protect our proprietary rights adequately, our competitors could use the intellectual property we have developed to enhance their own products and services, which may harm our business. Furthermore, irrespective of the scope of our intellectual property rights, we may not be able to stop competitors from developing similar technologies or offering similar solutions. We may become involved in lawsuits to protect or enforce our intellectual property, which could be expensive, time-consuming and unsuccessful. Third parties, including our competitors, could be infringing, misappropriating or otherwise violating our intellectual property rights. In order to protect our intellectual property rights, we may be required to spend significant resources to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. An adverse determination of any litigation proceedings could put our intellectual property at risk of being invalidated or interpreted narrowly and could put our related patents, patent applications and trademark filings at risk of being invalidated, not issuing or being cancelled. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential or sensitive information could be compromised by disclosure in the event of litigation. In addition, during the course of litigation there could be public announcements of the results of hearings, motions or other interim proceedings or developments. If securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Any of the foregoing could adversely impact our business, financial condition and results of operations. We may be subject to claims asserting that our employees, consultants or advisors have wrongfully used or disclosed alleged trade secrets of their current or former employers or claims asserting ownership of what we regard as our own intellectual property. Although we try to ensure that our employees, consultants and advisors do not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or these individuals have used or disclosed intellectual property, including trade secrets or other proprietary information, of any such individual’s current or former employer. Litigation may be necessary to defend against these claims. If we fail in defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. Even if we are successful in defending against such claims, litigation could result in substantial costs and be a distraction to management. In addition, while it is our policy to require our employees and contractors who may be involved in the creation or development of intellectual property on our behalf to execute agreements assigning such intellectual property to us, we may be unsuccessful in having all such employees and contractors execute such an agreement. The assignment of intellectual property may not be self-executing or the assignment agreement may be breached and we may be forced to bring claims against third parties or defend claims that they may bring against us to determine the ownership of what we regard as our intellectual property. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations. Provisions in various agreements to which we are party potentially expose us to substantial liability for intellectual property infringement, data protection and other losses. Our agreements with customers and other third parties sometimes include provisions under which we are liable or agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, data protection, damages caused by us to property or persons, or other liabilities relating to or arising from our product offerings, services, or other contractual obligations. Some of these agreements provide for uncapped liability for which we would be responsible, and some provisions survive termination or expiration of the applicable agreement. Large liability payments could harm our business, results of operations and financial condition. Although we normally contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them, and in the case of an intellectual property infringement indemnification claim, we may be required to cease use of certain functions of our product offerings as a result of any such 27Table of Contentsclaims. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business. Even when we have contractual protections against such customer claims, we may choose to honor a customer’s request for indemnification or otherwise seek to maintain customer satisfaction by issuing customer credits, assisting our customer in defending against claims, or in other ways. We are, and may become, subject to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes or employment claims made by our current or former employees. We also are, and may become, subject to securities litigation. For example, in September 2023 and November 2023, purported stockholder class action lawsuits were filed against us and certain of our current and former officers alleging violation of the federal securities laws for allegedly making materially false or misleading statements. While the class action lawsuit filed in November 2023 was dismissed in January 2024, the September 2023 matter is still pending, and we may be the target of additional litigation of this type in the future. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims and might not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, potentially harming our business, financial position and results of operations. We operate in a highly regulated industry and either are or may be subject to a wide range of federal, state and local, as well as foreign, laws, rules and regulations and our failure to comply with these laws and regulations may force us to change our operations or harm our business. The legal industry is and will continue to be subject to extensive and evolving U.S. federal, state and foreign laws, rules and regulations, including the rules and regulations of the organizations and other authorities governing the legal profession in the jurisdictions in which we or our customers operate. These laws, rules and regulations can vary significantly from jurisdiction to jurisdiction. For example, in the United States, each state has adopted laws, regulations and codes of ethics that provide for the licensure of attorneys, generally grant licensed attorneys the exclusive right to practice law in that state and place restrictions upon the activities of licensed lawyers. The practice of law other than by an attorney entitled to practice in the jurisdiction is generally referred to as the unauthorized practice of law. As a company, we are not authorized to practice law. In the United States, we may not provide legal advice to our clients, primarily because we do not meet the ethical and regulatory requirements, present in nearly every U.S. jurisdiction, of being exclusively owned by licensed attorneys. Despite our belief that our operations are not subject to, or are otherwise compliant with, the requirements of the jurisdictions in which we or our customers operate, regulators or other authorities of such jurisdictions could deem that we, our employees or our customers are engaged in the unauthorized practice of law or otherwise determine that we are subject to the relevant rules and regulations governing the conduct of attorneys. In such circumstances, regulators may enjoin our operations, subject us to rules governing conflicts of interests, require registration, seek to impose punitive fines or sanctions or take other disciplinary actions against us, our employees or our customers, any of which may inhibit our ability to do business in those jurisdictions, adversely impact our reputation, increase our operating expenses and adversely affect our financial condition and results of operations. In addition, we are subject to regulations and laws specifically governing the internet and the collection, storage, processing, transfer and other use of personal information and other customer data. We also are subject to laws and regulations involving taxes, privacy and data security, anti-spam, content protection, electronic contracts and communications, mobile communications, unencumbered internet access to our product offerings, the design and operation of websites and internet neutrality. Moreover, if we expand into additional jurisdictions, we will be subject to an increased variety of new and complex laws and regulations. We are subject to anti-corruption, anti-bribery, anti-money laundering and similar laws and noncompliance with such laws can subject us to criminal or civil liability and harm our business, financial condition and results of operations. We are subject to the U.S. Foreign Corrupt Practices Act, or FCPA, U.S. domestic bribery laws, the United Kingdom Bribery Act and other anti-corruption and anti-money laundering laws in the countries in which we conduct activities. Due to the international scope of our operations, we must comply with these laws in each jurisdiction where we operate. Additionally, many anti-bribery and anti-corruption laws, including the FCPA, have long-arm statutes that can expand the applicability of these laws to our operations worldwide. Accordingly, we must incur significant operational costs to support our ongoing compliance with anti-bribery and anti-corruption laws at all levels of our business. If we fail to comply with these laws, we may be subject to significant penalties. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees and their third-party intermediaries from authorizing, offering or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries and our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities. While we have policies and procedures to address compliance with such laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase. Detecting, investigating and resolving actual or alleged violations of anti-corruption laws can require a significant diversion of time, resources and attention from senior management. In addition, noncompliance with anti-corruption, anti-bribery or anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, enforcement actions, fines, damages, other civil or criminal penalties or injunctions, suspension or debarment from contracting with certain persons, reputational harm, adverse media coverage and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal proceeding, our business, financial condition and results of operations could be harmed. In addition, responding to any action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees. Sales to government entities and highly regulated organizations are subject to a number of challenges and risks.S. federal, state and local, as well as foreign, governmental agency customers, as well as to customers in highly regulated industries such as financial services and healthcare. Sales to such customers are subject to a number of challenges and risks. Selling to such customers can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. In addition, Congress and regulatory agencies may impose requirements on third-party vendors generally, or our company in particular, that we may not be able to, or may not choose to, meet. In addition, government customers and customers in these highly regulated industries often have a right to conduct audits of our systems and practices, which can be time-consuming and expensive. In the event that one or more customers determine that some aspect of our business does not meet regulatory requirements, we may be limited in our ability to continue or expand our business and could be subject to audits or investigations by government enforcement personnel. Government contracting requirements may also change and in doing so restrict our ability to sell into the government sector until we have attained the requisite approvals or until our product offerings meet government requirements. Moreover, changes in the underlying statutory and regulatory conditions that affect these types of customers could harm our ability to efficiently provide them access to our product offerings and to grow or maintain our customer base. Further, governmental and highly regulated entities may demand contractual terms that differ from our standard arrangements and are less favorable than terms agreed with private sector customers, including preferential pricing or “most favored nation” terms and conditions or are contract provisions that are otherwise time-consuming and expensive to satisfy and monitor. In the United States, applicable federal contracting regulations change frequently and the President may issue executive orders requiring federal contractors to adhere to new compliance requirements after a contract is signed that could result in the loss of contracts for contractors who do not meet those requirements. If we undertake to meet special standards or requirements and do not meet them, we could be subject to significant liability from our customers or federal and state regulators and enforcement agencies. Such entities may have statutory, contractual or other legal rights to terminate contracts with us or our partners for convenience or for other reasons. Any such termination may adversely affect our ability to contract with other government customers as well as our reputation, business, financial condition and results of operations. We are subject to governmental export and import controls that could impair our ability to compete in international markets or subject us to liability if we violate such controls. Our product offerings are subject to U.S. export controls, including the Export Administration Regulations administered by the U.S. Commerce Department and economic sanctions administered by the Office of Foreign Assets Control, or OFAC, of the U.S. These encryption products and the underlying technology may be exported outside of the United States or accessed by foreign persons within the United States only with the required export authorizations. Furthermore, our activities are subject to U.S. economic sanctions laws and regulations that generally prohibit the direct or indirect exportation or provision of products and services without the required export authorizations to countries, governments and individuals and entities targeted by U.S. embargoes or sanctions, except to the extent authorized by OFAC or exempt from sanctions. Obtaining the necessary export license or other authorization for a particular sale may not always be possible, and, even if the export license is ultimately granted, the process may be time-consuming and may result in the delay or loss of sales opportunities. Violations of U.S. sanctions or export control laws can result in significant fines or penalties and possible incarceration for responsible employees and managers could be imposed for criminal violations of these laws. From time to time, various governmental agencies have proposed additional regulation of encryption products and technology, including the escrow and government recovery of private encryption keys. We license certain software from third parties and incorporate or integrate such components into and with our product offerings. Certain third-party software has become central to the operation and delivery of our product offerings. Any inability to license necessary third-party technology in the future, or maintain sufficient rights or reasonable terms under existing third-party technology that we rely upon, could have an adverse effect on our business or operating results and adversely affect our ability to compete. A large portion of our third-party software license contracts have fixed durations and may be renewed only by mutual consent. There is no assurance that we will be able to renew these contracts as they expire or that such renewals will be on the same or substantially similar terms or on conditions that are commercially reasonable to us. In addition, all of our third-party software licenses are nonexclusive; and therefore, our competitors may obtain the right to license certain of the technology covered by these agreements to compete directly with us. If the cost of licensing or maintaining the third-party intellectual property significantly increases, our operating earnings could significantly decrease. Such open source licenses sometimes require that source code subject to the license be made available to the public and that any modifications or derivative works to open source software continue to be licensed under open source licenses. Few courts have interpreted open source licenses and the manner in which these licenses may be interpreted and enforced is therefore subject to some uncertainty. We rely on multiple software programmers to design our proprietary technologies and we do not exercise complete control over the development efforts of our programmers and we cannot be certain that our programmers have not incorporated open source software into our proprietary product offerings and technologies or that they will not do so in the future. There is a risk that open source licenses could be construed in a manner that imposes unanticipated conditions, restrictions or costs on our ability to provide or distribute our product offerings. To that end, while we try to mitigate the likelihood of such risks, we may from time to time face claims from third parties alleging ownership of, or demanding release or general availability of, the open source software or derivative works that we developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation, which could be costly for us to defend and could adversely affect our core functionality and services. In addition to risks related to license requirements, usage of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of software. In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information, client information, and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party data. We are also subject to the terms of our privacy policies and obligations to third parties (including contractual) related to privacy, data protection and information security. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy and data protection worldwide is unclear and evolving, and is likely to remain uncertain, for the foreseeable future. We expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. There is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to data privacy or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our product offerings. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The EU GDPR also provides individuals with various rights in respect of their personal information, including rights of access, erasure, portability, rectification, restriction and objection and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities (including group actions), seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. The EU GDPR requirements may apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. Furthermore, several jurisdictions have enacted measures related to the use of artificial intelligence and machine learning in products and services. For example, the proposed EU Artificial Intelligence Act (EUAIA) could impose onerous obligations related to the use of AI related systems if passed into law. Such regulations, and others that may be passed in other jurisdictions, may require us to change our business practices, or else be subject to regulatory action and/or fines.Moreover, in the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted data laws requiring data to be localized or limiting the transfer of personal information to other countries. For example, absent appropriate safeguards, the EU GDPR generally restricts the transfer of personal information to countries outside the EEA absent certain safeguards. Laws in Switzerland and the UK similarly restrict personal information transfers outside of those jurisdictions to countries such as the United States of America that do not provide an adequate level of protection for personal information. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. For example, California enacted the California Consumer Privacy Act of 2018, or CCPA, which imposes obligations on businesses to which it applies. The CCPA provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for data breaches that may increase data breach litigation. Twelve other states have also passed comprehensive privacy laws some of which go into effect in 2024 and the coming years. If we become subject to these or other new state or federal data privacy laws, we may have to comply with additional obligations which may increase legal risk and compliance costs for us and third parties upon who we rely. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Although we endeavor to comply with our published information security and privacy policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or vendors do not comply with our published policies, certifications, and documentation. Any failure or perceived failure by us to comply with our policies, certifications and documentation, our data privacy- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to data privacy or information security may result in significant consequences. These consequences may include, but are not limited to, governmental investigations or enforcement actions (e.g., investigations, fines, penalties, audits, inspections), litigation, claims or public statements against us by consumer advocacy groups or others, which could result in significant liability or cause our customers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal information, or orders to destroy or not use personal information, any of which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, documentation, certifications, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our product offerings. Additionally, if third parties we rely upon, such as vendors or developers, violate applicable data privacy or security laws or regulations, certifications, documentation or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business. Our employees and personnel use generative artificial intelligence (AI) technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We use AI and machine learning (ML), to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.We use AI, including generative AI, and ML technologies in our products and services (collectively, AI/ML technologies). The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy, data protection and information security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and 33Table of Contentsconsumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.Our business is reliant on revenue from behavioral, interest-based, or tailored advertising (collectively, “targeted advertising”), but delivering targeted advertisements is becoming increasingly difficult due to changes to our ability to gather information about user behavior through third party platforms, new laws and regulations, and consumer resistance. Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal data for targeted advertising purposes. For example, in 2021, Apple began allowing users to more easily opt-out of activity tracking across devices. In February 2022, Google announced similar plans to adopt additional privacy controls on its Android devices to allow users to limit sharing of their data with third parties and reduce cross-device tracking for advertising purposes.Additionally, Google has announced that it intends to phase out third-party cookies in its Chrome browser, which could make it more difficult for us to target advertisements. Other browsers, such as Firefox and Safari, have already adopted similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control. Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal data to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes. As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.In the ordinary course of business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, processing) potentially highly sensitive and confidential electronic documentation for use by our law firm and non-law firm customers in various legal matters, including litigation and governmental investigations and as a result. we and the third parties upon which we rely face a variety of evolving threats. Due to the nature of our services, and the legal and regulatory context in which our services are utilized by customers, our ability to protect the confidentiality, availability and integrity of our customers’ information is critical to our ability to attract and retain customers, generate revenue and the overall success of our business, and our failure or perceived failure to maintain adequate protections could materially affect our business.Our information technology systems and those of third parties upon whom we rely are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication, electrical failures and security incidents. Other evolving threats to our information systems and data include, but are not limited to, social engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware, denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, and supply-chain attacks. We have and may in the future experience a security incident or significant vulnerability, including without limitation, those resulting from acts, errors or omissions of our personnel (including those caused by our, or our vendors’, employees or contractors), including inadvertent storage or disclosure of personal information, our confidential information, or our customers’ confidential information, or coding errors, defects and bugs, or accidentally providing a customer with access to or copies of another customer’s confidential information. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of data and income, leaks and public disclosures of sensitive information, extortion of our customers, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, our employees are routinely working remotely, which may pose additional data security risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.We rely on third-party service providers and technologies to operate critical business systems to process personal information, confidential information, customer information, intellectual property and other sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data.We take steps designed to detect, mitigate and remediate security vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect and remediate them all on a timely basis. Vulnerabilities could be exploited and result in a security incident. These vulnerabilities, bugs, errors or defects alone, or a combination of them, could pose material risks to our business. Further, the cost to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of customer trust, diminished use of our product offerings as well as other harms to our business and our competitive position. These adverse consequences could force us to spend money, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation.35Table of ContentsIf we, or a third party upon whom we rely, experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, which could include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; breach of our customer contracts, restrictions on processing information (including personal information); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; loss of customers; monetary fund diversions; diversion of management attention; restrict our ability to engage with new customers; interruptions in or the cessation of our operations (including availability of data); financial loss; competitive disadvantage; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Additionally, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages and in some cases our customer agreements do not limit our remediation costs or liability with respect to data breaches.In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive data about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive data of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. We may have contractual and legal obligations under applicable data privacy and security laws to notify relevant stakeholders of security breaches. Our NOLs generated in tax years beginning on or prior to December 31, 2017 are only permitted to be carried forward for 20 years under applicable U.S. tax law. Under current law, our federal NOLs generated in tax years beginning after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs is limited to 80% of current year taxable income. It is uncertain if and to what extent various states will conform to the federal tax law. In addition, under Section 382 of the U.S. Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” is generally subject to limitations on its ability to utilize its pre-change NOLs to offset post-change taxable income. We may have experienced ownership changes in the past and may experience ownership changes in the future as a result of subsequent shifts in our stock ownership (some of which shifts are outside our control). Furthermore, our ability to utilize NOLs of companies that we may acquire in the future may be subject to limitations. Our international operations may subject us to potential adverse tax consequences. We are expanding our international operations and staff to better support our growth into international markets. Our corporate structure and associated transfer pricing policies contemplate future growth into the international markets and consider the functions, risks and assets of the various entities involved in the intercompany transactions. The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities; changes in tax rates; new or revised tax laws or interpretations of existing tax laws and policies; and our ability to operate our business in a manner consistent with our corporate structure and intercompany 36Table of Contentsarrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations. Similarly, a taxing authority could assert that we are subject to tax in a jurisdiction where we believe we have not established a taxable connection, often referred to as a “permanent establishment” under international tax treaties, and such an assertion, if successful, could increase our expected tax liability in one or more jurisdictions. Our financial statements could fail to reflect adequate reserves to cover such a contingency.Our results of operations may be harmed if we are required to collect sales or other related taxes for our subscriptions in jurisdictions where we have not historically done so. We collect and remit sales tax in a number of jurisdictions where we, through our employees, have a presence and where we have determined, based on the U.S. Supreme Court decision in South Dakota v. Wayfair, Inc. The application of indirect taxes (such as sales and use tax, value-added tax, or VAT, goods and services tax, or GST, business tax and gross receipt tax) to businesses that transact online, such as ours, is a complex and evolving area. As a result, it may be necessary to reevaluate whether our activities give rise to sales, use and other indirect taxes as a result of any nexus or transaction thresholds in those states in which we are not currently registered to collect and remit taxes. A successful assertion by a state, country, or other jurisdiction that we should have been or should be collecting additional sales, use, or other taxes could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential customers from subscribing to our product offerings due to the incremental cost of any such sales or other related taxes, or otherwise harm our business. We continue to analyze our exposure for such taxes and liabilities. The application of existing, new or future laws, whether in the United States or internationally, could harm our business. There have been, and will continue to be, substantial ongoing costs associated with complying with the various indirect tax requirements in the numerous markets in which we conduct or will conduct business. Changes in our effective tax rate or tax liability may harm our business. Effective January 1, 2022, legislation enacted in 2017, informally titled the Tax Cuts and Jobs Act, eliminated the option to deduct research and development expenses for tax purposes in the year incurred and requires taxpayers to capitalize and subsequently amortize such expenses over five years for research activities conducted in the United States and over 15 years for research activities conducted outside the United States. Although there have been legislative proposals to repeal or defer the capitalization requirement, there can be no assurance that such requirement will be repealed or otherwise modified. Our effective tax rate could be adversely impacted by several factors, including: •Changes in the relative amounts of income before taxes in the various jurisdictions in which we operate that have differing statutory tax rates;•Changes in tax laws, tax treaties and regulations or the interpretation of them, including federal income tax legislation proposed by Congress (which has not yet been enacted);•Changes to our assessment about our ability to realize our deferred tax assets that are based on estimates of our future results, the prudence and feasibility of possible tax-planning strategies and the economic and political environments in which we do business;•The outcome of current and future tax audits, examinations or administrative appeals; and•Limitations or adverse findings regarding our ability to do business in some jurisdictions.37Table of ContentsShould our effective tax rate rise, our business could be harmed. Our financial results may be adversely affected by changes in accounting principles applicable to us. U.S. GAAP is subject to interpretation by the Financial Accounting Standards Board, the SEC, and other various bodies formed to promulgate and interpret appropriate accounting principles. Changes in these accounting principles could adversely affect our financial results. Any difficulties in implementing these pronouncements could cause us to fail to meet our financial reporting obligations, which could result in regulatory discipline and harm our business. If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected. The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in Note 2, “Summary of Significant Accounting Policies” in the notes to our consolidated financial statements included elsewhere in this Annual Report on Form 10-K. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock. Significant judgments, estimates and assumptions used in preparing our consolidated financial statements include, or may in the future include, those related to revenue recognition, stock-based compensation expense, income taxes, goodwill and intangible assets. Risks Related to Being a Public Company Our management team has limited experience managing a public company. Our management team has limited experience managing a publicly traded company, interacting with public company investors and securities analysts and complying with the increasingly complex laws pertaining to public companies. If we fail to develop and maintain effective internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired. We are required, pursuant to Section 404 of the Sarbanes-Oxley Act, or Section 404, to furnish a report by management on, among other things, the effectiveness of our internal controls over financial reporting. This assessment must include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. In addition, our independent registered public accounting firm will be required to attest to the effectiveness of our internal controls over financial reporting in our first annual report required to be filed with the SEC following the date we are no longer an “emerging growth company.” Our compliance with Section 404 requires that we incur substantial expenses and expend significant management efforts. We have hired, and need to continue to hire, additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and compile the system and process documentation necessary to perform the evaluation needed to comply with Section 404. Management has concluded that our internal control over financial reporting was effective as of December 31, 2023. However, our testing, or the subsequent testing by our independent public accounting firm, may reveal deficiencies in our internal control over financial reporting that are deemed to be material weaknesses. If we or our accounting firm identify deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, it could harm our operating results, adversely affect our reputation, or result in inaccurate financial reporting. Furthermore, should any such deficiencies arise, we could be subject to lawsuits, sanctions or investigations by regulatory authorities, including SEC enforcement actions and we could be required to restate our financial results, any of which would require additional financial and management resources. We need to continue to improve our internal systems, processes and controls to effectively manage our operations and growth. We may not be able to successfully implement and scale improvements to our systems and processes in a timely or efficient manner or in a manner that does not negatively affect our operating results. For example, we may not be able to effectively monitor certain extraordinary contract requirements or provisions that are individually negotiated by our sales force as the number of transactions continues to grow. In addition, our systems and processes may not prevent or detect all errors, omissions or fraud. We are an “emerging growth company,” as defined in the Jumpstart Our Business Startups Act of 2012, or the JOBS Act, and we may take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not “emerging growth companies,” including the auditor attestation requirements of Section 404, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved.Pursuant to Section 107 of the JOBS Act, an emerging growth company may elect to use the extended transition period for complying with new or revised accounting standards until those standards would otherwise apply to private companies. However, we have irrevocably opted not to use the extended transition period for complying with any new or revised financial accounting standards, and as such, we are required to adopt new or revised standards at the same time as other public companies. As a result, our consolidated financial statements may not be comparable to the financial statements of other emerging growth companies that elect to avail themselves of the exemption from new or revised accounting pronouncements as of public company effective dates.We will remain an emerging growth company until the earliest of: (1) December 31, 2026; (2) the last day of the first fiscal year in which our annual gross revenue is $1.235 billion or more; (3) the date on which we have, during the previous rolling three-year period, issued more than $1 billion in non-convertible debt securities; and (4) the last day of the fiscal year in which the market value of our common stock held by non-affiliates exceeds $700 million as of June 30 of such fiscal year. We cannot predict if investors will find our common stock less attractive if we choose to rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile. Risks Related to Ownership of Our Common Stock Insiders have substantial control over us and will be able to influence corporate matters. Based on the number of shares outstanding as of December 31, 2023, our officers, directors and their associated investment funds collectively beneficially owned a majority of our outstanding common stock. As a result, these stockholders are able to exercise significant influence over all matters requiring stockholder approval, including the election of directors and approval of significant corporate transactions, such as a merger or other sale of our company or its assets. This concentration of ownership will limit the ability of other stockholders to influence corporate matters and may cause us to make strategic decisions that could involve risks to you or that may not be aligned with your interests. This control may adversely affect the market price of our common stock. Our stock price may be volatile, and the value of our common stock may decline.The market for technology stocks and the stock market in general have recently experienced significant price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies, including our own. These fluctuations have often been unrelated or disproportionate to the operating performance of these companies. Broad market and industry fluctuations, as well as general economic, political, regulatory and market conditions, may continue to negatively impact investor confidence and the market price of equity securities, including our common stock. In the past, following periods of volatility in the trading price of a company’s securities, securities class action litigation has often been brought against that company. If the market price of our common stock is volatile, we may become the target of securities litigation. Securities litigation could result in substantial costs and divert our management’s attention and resources from our business, and could have an adverse effect on our business, results of operations and financial condition. In the past, following periods of volatility in the trading price of a company’s securities, securities class action litigation has often been brought against that company. For example, in September 2023 and November 2023, purported stockholder class action lawsuits were filed against us and certain of our current and former officers alleging violation of the federal securities laws for allegedly making materially false or misleading statements. While the class action lawsuit filed in November 2023 was dismissed in January 2024, the September 2023 matter remains pending, and we may be the target of additional litigation of this type in the future. Securities litigation could result in substantial costs and divert our management’s attention and resources from our business, and could have an adverse effect on our business, results of operations and financial condition. Sales of our common stock in the public market could cause the market price of our common stock to decline. Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities. Many of our existing equity holders have substantial unrecognized gains on the value of the equity they hold, and therefore they may take steps to sell their shares or otherwise secure the unrecognized gains on those shares. We are unable to predict the timing of or the effect that such sales may have on the prevailing market price of our common stock. In addition, there were 0.5 million shares of common stock issuable upon the exercise of options and 2.5 million shares of common stock issuable upon the vesting and settlement of restricted stock units and performance-based restricted stock units outstanding as of December 31, 2023. We have registered all of the shares of common stock issuable upon the exercise of outstanding options or other equity incentives we may grant in the future, for public resale under the Securities Act. The shares of common stock will become eligible for sale in the public market to the extent such options are exercised.Further, as of December 31, 2023, holders of a substantial number of shares of our capital stock had rights, subject to some conditions, to require us to file registration statements covering the sale of their shares or to include their shares in registration statements that we may file for ourselves or other stockholders. The market price and trading volume of our common stock is heavily influenced by the way analysts interpret our financial information and other disclosures. We do not have control over these analysts. If securities or industry analysts cease coverage of us, our stock price would be negatively affected. If securities or industry analysts do not publish research or reports about our business, downgrade our common stock, or publish negative reports about our business, our stock price would likely decline. If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our common stock could decrease, which might cause our stock price to decline and could decrease the trading volume of our common stock. We do not intend to pay dividends for the foreseeable future and, as a result, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock. We have never declared or paid any cash dividends on our capital stock and we do not intend to pay any cash dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our Board of Directors. Accordingly, holders of our common stock may need to rely on sales of their holdings of common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management. These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our Board of Directors, which is responsible for appointing the members of our management. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally, subject to certain exceptions, prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder. Any of the foregoing provisions could limit the price that investors might be willing to pay in the future for shares of our common stock and they could deter potential acquirers of our company, thereby reducing the likelihood that you would receive a premium for your shares of our common stock in an acquisition. Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware is the exclusive forum for the following types of actions or proceedings under Delaware statutory or common law: •any derivative claim or cause of action brought on our behalf;•any claim or cause of action asserting a breach of fiduciary duty;•any claim or cause of action against us arising under the Delaware General Corporation Law;•any claim or cause of action arising under or seeking to interpret our amended and restated certificate of incorporation or our amended and restated bylaws; and•any claim or cause of action against us that is governed by the internal affairs doctrine.The provisions would not apply to suits brought to enforce a duty or liability created by the Exchange Act. Furthermore, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all such Securities Act actions. Accordingly, both state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation will further provide that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause or causes of action arising under the Securities Act, including all causes of action asserted against any defendant to such complaint. For the avoidance of doubt, this provision is intended to benefit and may be enforced by us, our officers and directors, the underwriters to any offering giving rise to such complaint and any other professional entity whose profession gives authority to a statement made by that person or entity and who has prepared or certified any part of the documents underlying the offering. While the Delaware courts have determined that such choice of forum provisions are facially valid, a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions. In such instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our amended and restated certificate of incorporation. This may require significant additional costs associated with resolving such action in other jurisdictions and there can be no assurance that the provisions will be enforced by a court in those other jurisdictions. These exclusive forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or other employees, which may discourage lawsuits against us and our directors, officers and other employees. If a court were to find either exclusive-forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur further significant additional costs associated with resolving the dispute in other jurisdictions, all of which could seriously harm our business. For example, in September 2023 and November 2023, purported stockholder class action lawsuits were filed against us and certain of our current and former officers alleging violation of the federal securities laws for allegedly making materially false or misleading statements. While the class action lawsuit filed in November 2023 was dismissed in January 2024, the September 2023 matter remains pending, and we may be the target of additional litigation of this type in the future. This risk is especially relevant for us because technology companies have experienced significant stock price volatility in recent years. Volatility in our stock price or other reasons may in the future cause us to become the target of securities litigation or stockholder activism. Securities litigation, including currently ongoing securities litigation against us as well as any future securities litigation, and stockholder activism, including potential proxy contests, could result in substantial 42Table of Contentscosts, including significant legal fees and other expenses, and divert our management and Board of Directors’ attention and resources from our business. Additionally, securities litigation, including currently ongoing securities litigation against us as well as any future securities litigation, and stockholder activism could give rise to perceived uncertainties as to our future, adversely affect our relationships with customers and business partners, adversely affect our reputation, and make it more difficult to attract and retain qualified personnel.Item 1B. Unresolved Staff CommentsNone. CybersecurityRisk management and strategyWe have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical corporate computer networks, third party hosted services and production computing environment utilized to provide our services, and our critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer-related data (“Information Systems and Data”).Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product Officer, Senior Vice President of Engineering and General Counsel), identify, assess and manage the Company’s cybersecurity threats and risks (the “Cybersecurity Function”). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry’s risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, systems monitoring, and access controls.Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the security organization works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, cybersecurity consultants. We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. We conduct a cybersecurity risk assessment for vendors that manage, host or process our Information Systems and Data. Depending on the vendor, the program includes a security assessment questionnaire, a review of existing security assessments or reports related to the vendor and the use of third-party risk assessment services and scoring. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.43Table of ContentsFor a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A.

”GovernanceOur board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors’ Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of management’s assessment and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over eight years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.Various individuals that are part of our Cybersecurity Function are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including various management personnel that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer. Various individuals that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer, work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and full board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
NKE	1 day, 5 hours ago
OPTT	1 day, 5 hours ago
ANGO	1 day, 5 hours ago
CTAS	1 day, 8 hours ago
RPM	1 day, 8 hours ago
CNXA	2 days, 3 hours ago
LW	2 days, 8 hours ago
HUDA	3 days, 4 hours ago
AXR	3 days, 5 hours ago
CALM	3 days, 5 hours ago
BUKS	3 days, 6 hours ago
NRAC	4 days, 2 hours ago
RGP	4 days, 6 hours ago
SING	1 week ago
CSBR	1 week ago
DRI	1 week ago
SCHL	1 week ago
GNLN	1 week, 1 day ago
AIR	1 week, 1 day ago
ABTI	1 week, 2 days ago
SHMP	1 week, 2 days ago
BXXY	1 week, 2 days ago
ACRG	1 week, 3 days ago
CARV	1 week, 3 days ago
FOMC	1 week, 3 days ago
KRFG	1 week, 3 days ago
GHMP	1 week, 3 days ago
GWTI	1 week, 3 days ago
VEII	1 week, 3 days ago
ZEST	1 week, 4 days ago
KITL	1 week, 4 days ago
ADMT	1 week, 4 days ago
ATAK	1 week, 4 days ago
BOTY	1 week, 4 days ago
DPLS	1 week, 4 days ago
FDX	1 week, 4 days ago
ECIA	1 week, 4 days ago
ATXG	1 week, 4 days ago
CRMT	1 week, 4 days ago
ELRE	1 week, 4 days ago
CAG	2 weeks, 1 day ago
KALV	2 weeks, 1 day ago
PAYX	2 weeks, 1 day ago
MEI	2 weeks, 1 day ago
BCRD	2 weeks, 1 day ago
FMHS	2 weeks, 2 days ago
ASPA	2 weeks, 2 days ago
STEK	2 weeks, 2 days ago
LEAI	2 weeks, 4 days ago
AIDG	3 weeks ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - LAW

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$LAW Risk Factor changes from 00/02/24/23/2023 to 00/02/22/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - LAW

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

$LAW Risk Factor changes from 00/02/24/23/2023 to 00/02/22/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing