Item 1. Business
Overview
At Domo, we believe people and data are an organization's most valuable assets in the cloud era. Our cloud-based platform is a modern business intelligence software platform that enables processes that are critically dependent on business intelligence data – which historically could take weeks, months or longer – to be done on-the-fly, in as fast as minutes or seconds, at scale. From marketing to operations, HR to finance, IT to product development, supply chain to sales, Domo's platform is designed to change the way organizations are managed and empower our customers to multiply their impact on the business.
Through the Domo platform, data from across the business is collected, stored, prepared, organized, analyzed, visualized, and shared. Artificial intelligence algorithms and machine learning can be applied to the data that allow alerts to be triggered and actions invited. Users can receive these notifications on any device and immediately act on the invitation, after which the system can write back to the original system of record. Because Domo can digitally connect any organization and empower each of its employees, we believe our market potential is every working person with a mobile device. Because we leverage the power of the cloud, our platform can process extremely large volumes of quantitative and qualitative data while maintaining high performance levels. On a typical business day, our customers in the aggregate typically query several hundred trillion rows from uncached queries. Even with this volume of data, we maintain a subsecond average query response time.
We have made significant investments to build an enterprise-grade platform with the scale, speed and security to support the world's largest organizations, regardless of where they are in their digital transformation journey. In many ways, building Domo was like building seven start-ups in one to solve gaps in data strategy, which include the typical functions of connecting and transforming data, visualizing and analyzing it, and building apps and extending that data to teams, entire organizations, partners and customers. That's why Domo is more than just a business intelligence, data warehouse, data discovery, analytics, collaboration, dashboarding, visualization or reporting tool. These tools and technologies are typically provided by separate vendors today. Domo combines all of them in a single platform that can augment a customer's existing infrastructure with the following:
•Connectors: Domo offers more than 1,000 powerful, first-class connectors which we define as read/write, API and standards based connectors that are available in the Domo Appstore, as well as a library of very flexible universal connectors, enabling all users, regardless of technical ability, to connect to data across a broad range of sources and facilitate initiation of business processes. These connectors enable data to be continuously synchronized in real time, fostering visibility and interoperability across a broad range of data sources.
•Data Warehouse: Our data warehouse, Adrenaline, stores massive amounts of data from across the business, organizes that data across many factors or variables and employs a massive number of processors to query that data in parallel, enabling employees across the organization to simultaneously access the same data for their various needs with sub second response times on average. Domo's federated query functionality supports several top cloud data warehouse engines and allows customers to query and visualize data that lives in their data warehouses without duplicating it. Domo Cloud Amplifier extends the native integrations to all functionality in Domo allowing users to leverage alerting, Magic ETL transformation, Domo AI and more while data remains at rest within a source cloud. Cloud Amplifier is currently available for Snowflake (including Snowflake on Azure), Databricks (including Databricks on Azure), Google Big Query, AWS Redshift and Dremio.
•Domo Magic ETL: Magic ETL is Domo's low code data transformation tool enabling customers to combine and enrich data so it can drive business impact. Magic includes basic transformation tiles but also allows more advanced users to leverage SQL and Python/R scripts. Data can be blended from multiple clouds as well as Excel files or other data sources loaded to Domo.
•Data Analysis and Visualization: The Domo analytics suite allows users to analyze, display, share and interact with data through pixel-perfect visualizations. Domo visualizations seamlessly work on mobile as well as on wall monitors in executive offices or manufacturing facility floors. Domo Bricks allows users to extend to unlimited visualization options including viz libraries such as D3, Plotly, MapBox, Chart.js and more. Domo alerts allow for proactive monitoring of data based on specific thresholds and security settings. Domo's App Studio provides low
code tooling for developing next level visualizations and apps including custom themes, bespoke navigation, forms for data collection and more. More experienced developers can use the Domo App Dev Framework to create custom apps built on top of the data and governance of Domo.
•Embedded Analytics: Domo Everywhere is a set of embedded analytics tools that enable organizations to easily and securely deliver data experiences to customers, partners and vendors. Content can be shared in portals, web properties, or inside applications. Customers can also provision full Domo instances for their partners/customers seeded with content and data from them.
•Collaboration: Buzz is our standalone collaboration and productivity suite that integrates seamlessly with Domo's other features. Chat, sharing, organizational charts, profiles, and project management all help foster an engaged and curious workforce, so that anyone in an organization can participate in improving the business. Domo also provides integration points with both Microsoft Teams and Slack.
•Domo AI: Domo AI provides a comprehensive AI and machine learning infrastructure including a Jupyter workspace integration and AutoML capabilities for building models in Domo. Domo AI Model Management allows for the hosting, deployment, and training of models both built in Domo or hosted by third parties including Open AI, Amazon Bedrock, Databricks and Hugging Face. These models can be accessed via inference end points or used in Magic ETL, workflows and apps. Domo's AI service layer provides an abstraction layer for specific AI driven tasks throughout Domo including text generation, text to SQL, text summarization and more. The Domo AI foundation supports an ever expanding group of features in Domo making data more discoverable (via Chat and other tools) and enabling any user to build like a seasoned analyst.
•Automation: Domo Workflow engine allows for the automation of key business processes both within Domo and in external systems. Workflows can leverage data in Domo to drive actions and custom code (via Code Engine) to take action in external systems such as CRM, support ticket systems and e-mail systems. Workflows includes a Forms feature for collecting key data needed to run a workflow and a Queue feature for managing approvals before going to the next step in an automation. The Domo Task Center app is available in iOS and Android stores to allow for review of workflow queues from anywhere.
•Partner Ecosystem: Domo's partner program is focused on four key initiatives to drive meaningful business outcomes: Platform partners — relationships with technology platforms for seamless integrations and enhanced services for joint customers; Data partners — leveraging Domo Everywhere to help customers develop solutions that benefit their own customer base; App partners — growing Domo's extensive App ecosystem with a diverse range of app developers; and, Channel partners — broad market reach and customer engagement with channel partners.
As of January 31, 2024, we had more than 2,600 organizations as customers. We employ a land, expand, and retain business model and typically enter into enterprises within a specific division or for a specific use case. As our users see the value of our platform and user engagement increases, we expand our footprint within their organization. Our annual recurring revenue (ARR) net retention rate, which compares the ARR as of the measurement date to ARR from the same cohort as of the same period in consecutive fiscal years (excluding customers from the cohort who canceled during the initial period), was an average of 109%, 106%, and 96% for the years ended January 31, 2022, 2023 and 2024, respectively.
For the years ended January 31, 2022, 2023 and 2024, we had total revenue of $258.0 million, $308.6 million and $319.0 million, respectively, representing year-over-year growth of 20% and 3%, respectively. For the years ended January 31, 2022, 2023 and 2024, our net loss was $102.1 million, $105.6 million and $75.6 million, respectively.
The Domo Solution
We believe business technology must be as easy-to-use and intuitive as mobile consumer applications, while providing enterprise-grade scalability and security features. Everyone, from a CEO to a front-line employee, benefits from the functionality that Domo provides. Our Business Cloud platform fosters collaboration, efficient decision making, increased organizational productivity, and generates improved business results. The platform also is designed to help IT leaders deliver value rapidly to the business by seamlessly complementing their existing systems and infrastructure and unlocking value from their fragmented data and systems. While developing our platform, we have been focused on four key pillars as described below.
All of Your People
Our platform enables every type of employee to connect to, analyze, and leverage data from their smartphone. When everyone can use data, the value of the data increases significantly and everyone is equipped with a common set of facts across all levels of an organization. As a result, data-driven knowledge proliferates throughout an organization as more employees become capable of contributing to shared, collaborative analysis. When freed from the constraints of traditional business intelligence tools, these employees tend to not only become increasingly productive, but also feel more connected to the broader organization.
All of Your Data in Real Time
Our platform provides real-time access to quantitative and qualitative data, including through more than 1,000 powerful first-class connectors as well as a library of very flexible universal connectors. In addition, through Domo Workbench, organizations can connect to proprietary data sources regardless of where those data sources reside within an organization. This comprehensive approach enables every type of employee to design customized, real-time views of data and data trends. For example, a marketer can design a visualization that includes real-time data of the click-through rates of the online advertisements, the impact of regional marketing campaigns, and the benchmarks of his organization's campaigns across the years.
Intelligence that Invites Actions
Our platform leverages artificial intelligence, including machine learning algorithms and predictive analytics, to continuously power more advanced insights, recommendations and alerts. We thereby enable employees to be aware of what is happening on a real-time basis, and take appropriate action where necessary. As more organizations and users adopt our platform, we have access to more data, and our indices become more powerful, resulting in more effective benchmarking. Our platform, based on ongoing variance analysis, is capable of providing personalized, proactive alerts and recommended actions to every employee and writing back to source applications based on predetermined actions triggered after certain thresholds or behavior has occurred. In the case of a bakery, for example, our platform can alert the owner that she does not have enough flour to meet tomorrow’s demand and recommend a supply schedule to prevent future stock-outs.
Domo Apps and Appstore
We, our development partners, and our users have built intelligent applications to create custom solutions for unique business needs. The goal of these applications is to put data to work for everyone in an organization. Our data applications present data for a specific purpose and are meant to drive prescriptive behavior to achieve a business outcome. These applications range from a real-time social index to evaluate an organization's engagement across various social media platforms to a predictive analytics toolkit that allows users to analyze "what if" scenarios and forecast the direction of key business metrics to an aggregator for an organization’s relevant mobile application statistics. Our platform enables applications to keep data in sync by updating source systems when users take action. To date, these applications have been adopted across a broad range of industries. Many users are able to build applications with limited training and no or limited IT involvement. Additionally, through the Domo Appstore, users have the option to make their applications available to all Domo users. This application ecosystem generates a powerful network for our platform — as users build, adopt and use additional applications, usage increases within an organization, which enables our platform to deliver even more powerful insights to those users.
Through the power of Domo’s comprehensive cloud-based platform, organizations can finally provide all of their data, to all of their employees, all of the time.
Key Benefits of Our Solution
Domo is more than just a business intelligence, data connection, data warehouse, data transformation or ETL, data discovery, analytics, collaboration, dashboarding, visualization or reporting tool. These tools and technologies are typically provided by separate vendors today. Domo's Business Cloud brings all of them together to help companies leverage their business intelligence across various processes, at scale, in as fast as minutes or seconds.
The Domo platform delivers six core benefits, and from the combination of these six, customers benefit from a seventh; a virtuous cycle of optimization.
Executive and Outcome Focused Mobile Solution
From the beginning, we targeted CEOs as key users of our platform. That concept has fundamentally influenced every aspect of the Domo platform from architecture to user experience. CEOs have huge demands on their time, are constantly on the move, do not have time or desire to learn complex software, need answers that quickly drive decisions, need to create alignment within their organization, need to focus on the exceptional items that should bubble up in their business instead of turning over every stone to see if something is off, and hunger for as much collaborative and correlative signal as they can get. Our platform was designed to meet each of these needs.
Our native mobile application enables all employees, not just CEOs, to effectively manage their businesses and responsibilities using any device. Employees can see current status of business operations and receive automatic alerts for when they need to take action, delivered directly to their smartphone. Anyone can edit and interact with data and share it with colleagues in real time directly from their smartphone. While Domo was designed with mobile users first in mind, it is automatically accessible across laptops, TV screens, monitors, tablets and smartphones, via different browsers and visualization engines, which is a competitive differentiator.
Universal Data Model — Data Platform and Transformation
Domo is changing the way people think about data. Data is no longer a currency only to be banked, but is the fuel that drives the business. Domo puts data to work, all of the data, together in an integrated, robust system, for all of the business’s employees. To accomplish this, Domo created a distributed data platform that was engineered to ingest, process, clean, prepare and make queryable all of a business’s available data, and serve it back with a subsecond average query response time, not just from a couple of databases or a single warehouse, or a few external cloud apps, but from all of the data, including systems that come online outside of IT’s influence like the myriad of cloud software providers each department might be leveraging. We believe that all of a business’s quantitative and qualitative data must be brought together, in one system, in order to deliver the types of encompassing views and timely insights today’s leaders must have. Our portfolio of connectors and cloud-based data warehouse provides a massively scalable solution to enable businesses to connect to their data systems. Our cloud-based ETL suite allows all of that data to be transformed and prepared together in a universal data format, enabling users to easily incorporate, change or discontinue different data sources without disruption. Our fast query engine searches the data, enabling insights to be generated. Now business leaders can have fully comprehensive views of what is happening, across all departments and across all systems.
Digitally Connected Organization — Interconnecting and Orchestrating across Disparate Systems
Businesses use many separate software systems to facilitate core elements of managing their business. This means there is no natural opportunity to leverage a broader, more holistic view of the state of the business or to take broadly informed actions and decision paths. It is very difficult to create alignment across the disparate organizations that use the siloed systems. This often creates walled gardens of data inside the business and blocks departments and teams from being able to effectively work full life cycle problems with each other. It also cripples the C-suite from being able to truly understand the nature of a problem or opportunity. Our comprehensive, cloud-based platform weaves seven critical platform components together to exploit this opportunity to increase alignment, accuracy and effectiveness of business leaders: data connections, data warehouse, data management, data analysis and visualization, artificial intelligence algorithms, and our partner ecosystem. An action in one system can have its influence measured in another, combined together in the same view, such as when marketing automation affects sales revenue generation, which in turn affects financial performance, to truly understand how best to guide the business.
Productivity — Fosters Getting Work Done Together
Our platform enables all employees to engage with each other with real-time data and business results at the center of the conversation. Employees can easily find others in their organization who access similar data and invite them and others with the appropriate permissions to engage in richer conversations to achieve business results. With Domo, users collaborate where the data lives, increasing everyone’s productivity and ability to act on the data. Our platform also enables organizations to share their data and collaborate with customers, suppliers and other partners outside of the organization. Additionally, any user can schedule critical insights to be delivered to the right inboxes, ensuring the right stakeholders are being kept up-to-date on relevant developments.
Enterprise Security, Scalability and Compliance
We have invested significantly to build security features in our platform that have enabled us to expand our presence within the enterprise. Because we connect directly to data sources that hold companies’ CRM, HCM, ERP and other sensitive data in our system, we must maintain enterprise-grade security standards for data access, privacy and administration. Our security protocols have enabled us to attract enterprise customers across a wide array of industries, including many in highly regulated industries such as financial services and healthcare. Our security features, such as customer-controlled encryption key management, provide much needed confidence that the data on our platform is secure.
Our native multi-tenant, web-scale, massive parallel processing capabilities and multi-dimensional architecture manage extremely large volumes of data and deliver real-time analysis at scale. On a typical business day, our customers in the aggregate typically query several hundred trillion rows from uncached queries. Even with this volume of data, we maintain a subsecond average query response time. We leverage an organization’s existing data systems, meaning IT does not have to re-architect what has already been built and does not have to invest in new infrastructure to implement our platform.
We also provide IT departments with centralized governance and administration capabilities. Our platform enables IT departments to not only monitor the health of all data within an organization, but also actively control who has access to that data on a real-time, continuous basis. Our platform provides robust controls down to row level security that enable leaders to tailor data access based on a variety of categories, including role, geography or department. We provide the assurance of leading security and compliance certifications, including those relating to SOC 1, SOC 2, HITRUST, HIPAA and more.
We have people, process and technology in place for assessing, identifying, and managing material risks from potential unauthorized activities in our environment/systems that could adversely affect the confidentiality, integrity, or availability of our systems, our data, or our customer’s data residing on those systems. These include a wide variety of controls, technologies, tools, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. We have also designed and implemented a combination of people, process and technology to reduce the impact of a security incident at a third-party vendor, business partner, or customer.
As part of our security program, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans, backup and recovery plans and business continuity/disaster recovery plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.
We have a unified and centrally-coordinated team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in in close coordination with executive leadership team including CEO, CTO, CFO, CLO, CHRO, and other members of the senior leadership team. Reporting to our chief information security officer are a number of experienced security, governance, risk and compliance professionals. In addition to our in-house cybersecurity capabilities, we also engage with external assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.
Our cybersecurity risks and risk management activities are evaluated as part of our enterprise risk assessments which are also reviewed by the Audit Committee. In addition, we have established a Security Steering Committee, which is comprised of executives and senior leaders from the Product and Infrastructure organizations, in addition to the Information Security and Product Security organization leaders. The Security Steering Committee meets monthly to evaluate cybersecurity related risks and mitigations, including prioritization of efforts to reduce the overall cybersecurity risk for the company from the engineering and product development perspective.
Benchmarks and Applications — Ecosystem
We built the Domo platform with the explicit goal that it be extended and leveraged by a rich ecosystem of partners, developers, business experts and entrepreneurs. Each of the core pieces of the Domo platform has been engineered from the ground up to be extensible and accessible through APIs and SDKs. We have also created the Domo Appstore, a marketplace for the distribution of additive capabilities and pre-built content from the Domo ecosystem, such as a new data connector, a best-practice dashboard, or a fully functioning custom solution, to extend their Domo experience. Third parties are able to rapidly develop rich applications that leverage the collective power of the Domo platform. Each of the core tenets of the
platform are offered as services and functionality used to build the types of products that typically would be expensive and time-consuming to replicate.
Virtuous Cycle of Optimization
The combination of these six core benefits drives a seventh factor, a virtuous cycle of optimization. A digitally connected organization is able to leverage all of the data, people, systems, behaviors, automation, write-back, predictive analytics, machine learning, natural language processing and workflows to achieve its goals and improve the entire business. Customers get more value from their workforce, and get more value from their data. We believe this is only the beginning; the network effect of digitizing complex workflows, automating well known outcomes, suggesting courses of action, unlocking crowd wisdom effects within the business and anomaly detection across the entire organization will continue to improve as more of an organization's people, data and systems are connected to the Domo platform.
Competitive Strengths
Our key competitive strengths include:
•Mobile Functionality. We designed Domo with mobile functionality front of mind. Domo’s native mobile applications unlock users’ ability to access data and collaborate in real time, from anywhere. When data is in Domo, it is immediately available for consumption on smartphones and other mobile devices without requiring separate versions or visualizations.
•Functionality That Can Be Used by Everyone. Employees can easily connect to relevant data sources, create powerful data transformations, analyze data, build reports and applications, configure alerts, and collaborate through our desktop or mobile application. Employees without technical expertise can use all of the features of our platform without involving a business analyst.
•Easy to Adopt. Employees can begin using our platform within minutes, without the need for heavy IT involvement to procure and implement. We offer a free trial, through our website, in addition to traditional inside and field sales models for broad company deployments.
•Scale. Domo has been natively built on a cloud-based architecture that is capable of massive scale. The Domo data warehouse and our connector strategy allows our platform to connect, house and make accessible all of the data within an organization and have a system that can make recommendations.
•Proven Economic Value. The comprehensive capabilities of our solution enable organizations to benefit from cost savings that result from their ability to remove previously deployed, limited systems. Also, because our solution enables employees to spend less time tracking down data or preparing presentations for meetings, employees are able to dedicate more time to value added activities. As a result, in addition to cost savings, organizations that deploy our solution are often able to generate incremental revenue.
•Proven Enterprise Readiness. We have invested significantly to broaden our platform capabilities and enhance security and scalability requirements for the enterprise.
•Continuous Product Innovation. From inception through January 31, 2024, we have invested $824.1 million in research and development to create our comprehensive platform. These investments allowed us to create more than 1,000 first-class connectors as well as a library of very flexible universal connectors, which enable everyone to connect and use all of the data within their organization in real time, through our data explorer and ETL engine. We invested in creating our native mobile application, which empowers all employees to effectively manage their responsibilities using their mobile device. We also invested in developing collaboration capabilities, resulting in our solution being able to aggregate all collaboration activity within an organization in a context-sensitive, easily navigable view. These investments have also enabled us to build a comprehensive cloud-based platform with enterprise-grade features and to develop machine learning algorithms that invite all employees to action, based on the real-time data that is accessible within our platform. We developed the Domo Appstore on top of that, which offers hundreds of applications, developed internally and by an open ecosystem of partners, providing expertise across a variety of industries. Developer tools and programmatic APIs enable the rapid development and delivery of custom apps leveraging the Domo platform and services. Additionally, we believe that our significant investments in research and development will provide tremendous leverage in our financial model as our business continues to scale.
•Strong Industry Recognition. Our brand is synonymous with the next generation of cloud-native, mobile-first data solutions. We have attracted and retained top talent in our industry and have become a top choice for organizations looking for better ways to use data to run their businesses. We have received multiple innovation awards and top-ranked recognition for ease-of-use and business value based on customer-based research from organizations such as Dresner Advisory Services, Gartner and Ventana Research. In addition, Domo was named the BI and Analytics category winner in the 2021 Cloud Awards and received the 2020 DEVIES Award for Best Innovation in IoT. We've also been recognized with workplace and growth awards including the Deloitte Technology Fast 500, Great Places to Work, Utah Business Best Places to Work (nine consecutive years). Additionally, our annual conference, Domopalooza, attracts thousands of prospects and users.
•Expanding Third Party Ecosystem with Strong Network Effects. We have developed pre-built applications for specific use cases and provide everyone with the necessary tools to build applications that run on our platform. These applications can be tailored to the specific needs of a specific role, organization or industry and leverage all the benefits of our solution to enable everyone to improve decision making, business outcomes and financial results. Once built, users can share these applications within their organization, but can also elect to open the application to all our users, across industries and geographies.
Growth Strategies
Key components of our growth strategy include:
•Increasing Our Overall Customer Base. The market for our platform is large and underpenetrated, as any organization of any size and in any industry is a potential customer of Domo. We believe there is substantial opportunity to add additional customers both in the United States and internationally as the need for all employees to access actionable, real-time data continues to drive market adoption of our platform. We are committed to further penetrating international markets such as Japan, Asia Pacific and EMEA.
•Accelerate Expansion within Existing Customers. We employ a land, expand, and retain business model and typically enter into enterprises either within a specific division or for a specific use case. As our users see the value of our platform and user engagement increases, we expand our footprint within the enterprise. We are focused on helping our users quickly realize the value of our platform. We have substantial growth potential within our existing customer base. We will continue to focus on showcasing the value of our platform to expand our footprint within our existing customers.
•Extend Platform Functionality and Value Proposition. Our goal is to continue to enhance and broaden the capabilities of our platform to address our users’ evolving needs. To that end, we plan to continue to invest in enhancing the ease of use and self-service capabilities, scalability, security and performance of our platform and expanding the IoT, artificial intelligence and data management functionality of our platform. We will also continue to invest in additional features and capabilities.
•Expand the Domo Ecosystem. The ecosystem for our platform includes customer influencers, which share valuable best practices for and serve as proof points for other customers, strategic partners, which efficiently expand our reach, and third-party developers that create customized applications tailored for specific customer use cases. We will continue to invest in establishing and strengthening these relationships to broaden this ecosystem.
•Leverage the Data. The Domo platform is uniquely positioned to generate performance benchmarks and indices across a wide array of organizations and disciplines, and in time we plan to capitalize on that position to attract additional customers and broaden and deepen our relationships with them. Although no customer will have access to the data of another, given that customers bring their data into the same cloud-based platform, we could enable performance comparisons based on index derived from similarly-situated organizations.
Our Technology
Our solution is comprised of nine core elements:
•connectors;
•data warehouse and fast query engine;
•Domo Magic ETL;
•data analysis and visualization tools;
•embedded analytics;
•collaboration tools;
•Domo AI;
•automation workflows; and
•apps and partner ecosystem.
These core elements were developed with two foundational considerations in mind:
•accessibility for all users, with a heavy emphasis on mobile-first functionality; and
•access, and applicability to business of all sizes, including those requiring enterprise-grade governance and security.
Connectors
The foundation of our technology is the ability to connect all of an organization’s relevant business data and then combine, cleanse and transform that data into formats that can be easily visualized and analyzed.
Our platform provides real-time access to data through a broad and flexible set of connection options, including through more than 1,000 first-class connectors, which we define as read/write, API and standards-based connectors that are available in the Domo Appstore, as well as a library of very flexible universal connectors. We also provide users an intuitive web-based toolkit, Connector Dev Studio, which allows users to build their own connectors.
Our platform allows organizations to integrate directly with almost any source of data required to answer key business questions. Whether the necessary data is located in other third-party systems, on-premise data stores, or even local machines, Domo provides easy access across all platforms with no coding necessary in most cases. Since Domo has built and maintains a large library of connectors, organizations no longer need to directly deal with the confusing and constantly changing ecosystem. Typically, all that is necessary are the security credentials required to access the data. Additionally, the cloud-based nature of Domo means that not only is it simple for an organization to import data, but such data will also be continually imported and updated creating a “living,” real-time dataset with no hardware investment by the customer. For organizations with on-premises data solutions, or bespoke or legacy applications, we have developed Workbench, our secure data acquisition tool designed to easily and securely connect on-premises data to our platform. We thereby enable organizations to connect to real-time proprietary data sources regardless of where those data sources sit within the organization. QuickStart Apps help users load relevant data into a usable format with the click of a button. With a growing library of popular data sources that draw from years of role and industry experience, Domo guides users on what KPIs they should be measuring from the day they connect.
Data Warehouse and Fast Query Engine
Adrenaline, the Domo data warehouse, stores massive amounts of data connected from across the business, enabling anyone to quickly access the data they need.
After data has been imported into Domo, it is important that it is safe, secure, and available. Adrenaline uses industry-leading technologies to ensure that customer data is secure and encrypted while stored in the system. It is also stored in redundant systems to provide a safe and reliable retrieval. In the case of frequently changing, or updated data, Domo additionally stores historical versions of past data available for catastrophic recovery.
Availability of the data is handled through Domo’s fast query layer. All data is prepared and available for querying through this feature. Adrenaline organizes the data across any number of factors or variables and employs a massive number of processors to query that data in parallel. This service supports queries while building simple cards as well as complex, custom queries and dataset joins on datasets comprised of billions of records. Our fast query layer eliminates the need for IT to perform time-consuming data summarizations or other complex processes in order to maintain high query performance. On top of the flexibility, it provides subsecond average query response time, enabling real-time consumption of information. The speed and flexibility at this layer differentiate between Domo from traditional solutions offered by our competitors.
Domo's federated query functionality supports several top cloud data warehouse engines and allows customers to query and visualize data that lives in their data warehouses without duplicating it. In addition to federated query, Domo Cloud Amplifier capabilities allow for a native integration with Snowflake, Google Big Query, Databricks, AWS Redshift and Dremio. Cloud Amplifier goes beyond direct query for data visualizations to include the ability to write back data to the selected cloud service. This write portion allows for the hydration of data via both Domo connectors and Domo Magic ETL. Cloud Amplifier also can integrate with OAuth security setup for the host cloud service allowing for seamless integration with existing data security rules.
Domo Magic ETL: Data Transformation
Our self-service ETL toolset, Fusion, enables users to easily join, aggregate and cleanse data from multiple sources. Unlike some solutions that require separate tools to extract, transform and load, or ETL, data, Fusion permits users of all skill levels to clean and combine data within our platform.
With an intuitive, drag-and-drop interface, users with little or no expertise can easily combine all their data and transform it into a format that can be easily manipulated, visualized and analyzed. For data analysts, our platform includes SQL-based dataflows, which allow more technical users to combine and transform raw data sources for other users. Fusion also includes a variety of machine learning algorithm and predictive analytics tools to allow everyone to add intelligence to any dataset, enabling a range of data science analysis, including:
•cluster analysis to perform cohort analysis and discover relationships to understand complex data;
•predictive models built on a suite of regression algorithms to better understand core drivers and influencers of key business metrics;
•forecasting models using common forecasting methods;
•Scripting tiles for running custom R and Python scripts;
•Deployment of AI Models hosted in Domo or other third party Data Science/Machine Learning platforms;
•time-series, multivariate, parametric and non-parametric algorithms to reveal abnormal or “interesting” data in any dataset; and
•intelligent models built on machine learning algorithms.
All algorithms can be implemented using a simple wizard for configuration.
Analysis and Visualization
Our Explorer analytics suite, consisting of Domo Analyzer, Domo Pages and Collections, Domo Stories, Publication Groups and Domo Everywhere, allows users to analyze, display, share and interact with data through pixel-perfect visualizations.
Domo Analyzer allows users to analyze, display, share and interact with data across mobile devices and personal computers. Domo Analyzer combines an intuitive simplicity that allows business users to find quick insights and advanced capabilities analysts expect. Analyzer allows users to create their own workspace:
•over 300 chart types and a robust mapping engine that enable users to immediately visualize area-specific data, even suggesting charts based on the data input so users never start with a blank slate;
•the ability to see and manipulate the data in all columns that are applied to charts, along with any other unused columns that should be shown;
•out-of-the-box visualizations that make it easy to review numerous time periods to see trends and comparisons;
•pre-defined filters for any visualization, making it easy for viewers to explore the data and see results in specific areas;
•the ability to change options, colors, series, and even chart types on the fly and get instant feedback; and
•tools to allow users to verify that data is flowing correctly and on time.
Domo provides a vast library of illustrative forms (including ISOTYPEs) out of the box. For example, Domo's catalog of shape includes 50+ types with configuration rules to specify color, shape, and value. Domo Bricks has greatly expanded the library of illustrative forms by providing the ability to copy and paste snippets of code and then further customize the illustration within the brick's edit box. Or, users can choose from a collection of out-of-the-box Domo Bricks that can be customized to meet precise visualization needs. Domo also supports custom SVGs as reusable infographic components. Users can import vector art created in illustration software into Domo and use as live data-powered components in any data Story.
Domo Dashboards and the new App Studio tool enhance the creation of complete visual compositions. Customers can use a drag-and-drop interface to create highly stylized infographic data stories that include:
•customized interactive filtering relationships between selected elements in a story;
•image usage and color rules to enforce design consistency and branding;
•dynamic, rich text blocks that can have portions dynamically inserted from live data;
•background images for an entire story canvas;
•embedded live videos that play in place; and
•apply a single theme with colors and design elements across all objects in App Studio (multiple dashboards and visualizations).
Domo also supports (out of the box) fine-grained control over presentation on a small mobile screen.
Embedded Analysis
Domo Everywhere is a set of embedded analytics tools that enable organizations to easily and securely deliver data experiences to customers, partners and vendors, without having to recreate new or special datasets. Content can be shared in portals, or web properties or even inside applications. Once embedded, any parameters applied to a card can be reflected in the embedded report. In addition, user access can be controlled by using Single Sign On and personal data permissions (PDPs) to pass parameters back to Domo. Customers and partners have the power to edit and create content within the embedded environment using an intuitive, drag-and-drop interface that requires no coding or technical expertise. They can also connect to their own proprietary data and utilize Domo's transformation layer to augment the data being shared.
Real-time Collaboration
Domo connects all employees across an organization, while also allowing everyone to customize and create personalized experiences to help them learn and invite action on those items that are uniquely important to them.
Our Org Explorer and Profiles features bring a social component and transparency to an organization, allowing all employees to see other employees’ role within the organization, find their contact information and learn how they contribute to the organization. Everyone can see what cards their coworkers are following, and then follow the same information, or share their own data with them proactively.
Once connected with the right people, Buzz aggregates all collaboration activity, in a single context-sensitive, easily navigable view. This allows an entire organization to share and discuss data in real time, to make better decisions more quickly. With Buzz, users can:
•chat with individuals and teams around real-time data through both public and private channels and direct messages;
•share alerts with other users; and
•search for and share attachments with an easy-to-use drag-and-drop interface.
Other features to promote collaboration are included throughout our platform, including:
•Report Scheduler, which allows users to schedule delivery of a card or page to anyone;
•Snapshot Annotation, which allows users to call out a specific spike or trends in data, annotate on any card to highlight it for others and initiate a conversation from any device;
•Projects and Tasks, which help users quickly take action with simple planning and assignment tools, including creating a task directly from a Buzz thread; and
•Alerts, which prompt timely collaboration and action.
Domo AI
Domo AI brings the value of AI to business users and includes two foundational elements: AI Model Management and the AI Service Layer.
Domo AI Model Management allows for the deployment, training and refactoring of AI Models whether hosted by Domo or by a third party. Domo Hosted models leverage either AutoML or Domo Jupyter Workspaces to develop the model. Third party models (including LLM) can be hosted by Open AI, Data Bricks, Amazon Bedrock and Hugging Face. Whether hosted internal or external to Domo, the AI Model is exposed via an inference end point which can be accessed via Domo Magic ETL, Dashboards, Apps and Workflow engine or from external systems with appropriate access.
Domo AI Service Layer provides specific and tuned internal services powered by Domo AI Models (Domo provides default models but allows the flexibility to change which model is being used for each services based on customer policy and needs). Current AI Services include text-to-sql, text-to-beastmode (calculated fields), text-generation and text-summarization. Domo will also be adding Universal Model services for such tasks as forecasting, outlier analysis, sentiment analytics, PII detection and more.
These AI models and services can be applied towards data preparation via Domo Magic ETL and Domo Workflows. In Magic ETL, a model inference endpoint can be used to run data through a specific model. In Workflows, in addition to running a model or AI Service, the Workflow can also allow for a "human in the loop" component where in some scenarios human approval or update is required."
Additional AI/ML functions with Domo include:
•Data Science tiles in Magic ETL: A user can easily deploy a multiple algorithms with no code. Customers can simply drag and drop a data science tile (a pre-packaged action/calculation/algorithm/or other data transformation action including clustering, forecasting and outlier detection) in Magic ETL that performs a clustering algorithm (including both k-means and k-medians algorithms) on the dataset. This can be achieved through a few clicks and no code.
•Scripting tiles for R and Python: Advanced customers can employ our data science scripting tiles (R or Python) to use their own custom code for AI and machine learning functions. Once a customer's custom-coded data science tile is deployed, data can be fed into this algorithm. If more specificity is needed, a user can configure a Python script to code up any advanced clustering methodology or unsupervised approach they prefer. Customers can also use Jupyter notebooks to find clusters in a dataset.
•Jupyter Notebooks Integration: Jupyter Notebooks are tightly integrated with Domo to allow users to easily explore their Domo DataSets, leverage instantaneous code execution to develop pipelines for data science and machine learning, document their processes, create custom visualizations, and write transformed data back into Domo.
•Domo's AutoML (built on AWS Sagemaker) capability can automatically identify key drivers in a dataset. AutoML automatically generates a feature importance dataset for the customer that helps them explore and visualize the data to understand how each attribute in the data contributes to the predicted result. The higher the score on a feature, the more the feature impacts the model’s predictions. From a business perspective, this helps users understand which drivers impact the outcome they care about the most. It also speeds up the ML workflow by helping users prioritize data improvements for features that will have the most impact on the model's predictions. Domo's augmented Data Profiler automatically recommends cleaning actions and calculates correlations and distributions to help business users identify the most important attributes of their data.
Partner Ecosystem: App Development Platform and Appstore
The Domo Appstore offers hundreds of apps, developed internally and by an open ecosystem of partners, providing expertise across a variety of industries. Developer tools and programmatic APIs enable the rapid development and delivery of custom apps leveraging the Domo platform and services.
Domo’s developer portal provides all of the tools and documentation needed to build custom apps leveraging our platform. Our App Design Studio lets non-technical users harness the power of Adobe Illustrator to build real-time infographics, and our App Dev Studio allows users to gain ultimate flexibility and develop customer visualizations using HTML, CSS, JavaScript, and just about any web technology.
Underlying our technology approach are two key considerations:
•accessibility for all users, which includes a heavy emphasis on mobile; and
•applicability to business of all sizes, requiring enterprise-grade governance.
Mobile-First Functionality
Domo’s native mobile applications for iOS and Android, and also mobile web browsers, enable employees to effectively manage their responsibilities using their mobile device. Domo Mobile unlocks the ability for users to access their data and collaborate with their teams in real time, from anywhere.
•Build Once and Done. When data is loaded or content created in Domo, it is immediately available for consumption on mobile devices, tablets, and more. There is no need to maintain separate mobile versions of visualizations.
•Powerful Visualization Exploration. Domo’s powerful page filters tool is also available on mobile. Whether it’s an executive walking into a retail store or a manufacturing manager looking at a specific product line, individuals can quickly filter a page to find the story they are interested in.
•Collaborate on the Go. Just because users are out of the office doesn’t mean they can’t collaborate with their team around business. All the benefits of Buzz, Domo’s powerful chat and collaboration platform, are available on any mobile device.
•Share Key Metrics Internally and Externally. Data owners can share important information with internal or external collaborators while limiting their access to sensitive or irrelevant data. Snapshot Annotations also help you make visuals clearer to your audience on mobile devices.
•Browse Your Organization. As a platform for business management, understanding organizational structure is key. With Domo, an organization's contact list and organizational chart are on any mobile device, for access to the people in the organization from anywhere, anytime.
Data Management, Governance, Security and Access Control
The Domo platform is designed to meet the enterprise security, compliance and privacy requirements of our customers, particularly in highly regulated industries, such as financial services, government, health care, pharmaceuticals, energy and technology.
In addition to advanced internal security controls, Domo provides extensive self-service features that enable administrators to stay in control of and have full transparency into data at all times. These features include access management, data governance and logging and monitoring tools.
Access Management
Creating users and granting access rights in Domo is the first layer in maintaining information security. Personalized Data Permissions (PDPs) allow users to create robust entitlement policies that govern access to specific data, increasing data usage while simultaneously helping to ensure that sensitive or irrelevant information remains secure. Pre-defined security profile options are included to allow organizations to easily deploy our platform. Each profile contains clearly defined access privileges, which can be turned on or off by default, and privileges and roles can be fully tailored to align with an organization’s unique policy. The Domo Governance Toolkit allows users to automate key governance functions such as PDP policies, group management, tagging of objects in Domo, copying of key data, backup of data and more.
Logging and Monitoring
Administrators can easily monitor global activity across Domo with our Activity Logs console. Authorized users can quickly access usage metrics like login attempts, card views, card creation and card edits. The console also provides the times those events took place and by which user. Admins can filter and sort this data, and export to an Excel spreadsheet or CSV
file. The activity log can also be written to an external streaming service (such as kafka) so that existing enterprise monitors are fully aware of activity with Domo.
Data Governance
Once data is connected to Domo, the platform provides capabilities and tools to manage it across its lifecycle. The Domo Data Warehouse is a dynamic 3D management console that enables IT professionals to interact with and curate every data source in Domo. Administrators can see which data sources are updating, identify potential problems, understand existing data relationships, and gauge the size of each data source, all in one visually engaging platform.
Domo Bring Your Own Key, or BYOK, provides the ability to rotate encryption keys numerous times a day. Through this user-controlled encryption, organizations can revoke encryption keys at any time, nullifying all data in the Domo platform and preventing access to their sensitive customer data.
Domo Sandbox enables the creation of new content without upsetting day-to-day operations. Using Sandbox, users can build and test new visualizations in a separate testing environment and easily promote content once it’s ready for consumption, thereby avoiding disruptive downtime and maintenance.
Customers
As of January 31, 2024, we had over 2,600 customers. We have customers in a wide variety of industries, geographies, and sizes, ranging from small organizations to large enterprises. We derived 79% of our revenue for the year ended January 31, 2024 from customers in the United States. We define a customer at the end of any particular quarter as an entity that generated revenue greater than $2,500 during that quarter. In situations where an organization has multiple subsidiaries or divisions, each entity that is invoiced at a separate billing address is treated as a separate customer. In cases where customers purchase through a reseller, each end customer is counted separately. For the fiscal years ended January 31, 2022, 2023 and 2024, no single customer represented more than 10% of our revenue, nor did any single organization when accounting for multiple subsidiaries or divisions which may have been invoiced separately.
We have invested in platform capabilities and online support resources that allow our customers to expand the use of our platform in a self-guided manner. Our professional services, customer support and customer success functions also support our sales force by helping customers to successfully deploy our platform and implement additional use cases. We work closely with our customers to drive increased engagement with our platform by identifying new use cases through our customer success teams, as well as in-platform, self-guided experiences. We actively engage with our customers to assess whether they are satisfied and fully realizing the benefits of our platform. While these efforts often require a substantial commitment and upfront costs, we believe our investment in product, customer support, customer success and professional services will create opportunities to expand our customer relationships over time.
Sales and Marketing
We typically offer our platform to our customers as a subscription-based service. Subscription fees are based upon the chosen Domo package which includes tier-based platform capabilities, or usage. Business leaders, department heads and managers are the typical initial subscribers to our platform, deploying Domo to solve a business problem or to enable departmental access to critical data. Over time, as customers recognize the value of our platform, we increasingly engage with CIOs and other executives to facilitate broad enterprise adoption.
We recently began offering our platform as a consumption-based service. Customers have an annual purchase commitment, utilizing a tiered pricing structure, which is paid upfront, and is based on an estimated volume of usage. We believe this model could increase customer adoption and allow us to better land, expand, and retain customers over the long term, and thereby have a positive impact on sales and marketing productivity. We believe this has potential to remove many of the barriers to adoption and better align our pricing to the value delivered to our customers. We expect an increase in the number of consumption-based agreements in future periods. However, we have limited experience with consumption-based agreements and changes in our pricing and subscription models subject us to a number of uncertainties.
As of January 31, 2024, 66% of our customers were under multi-year contracts on a dollar-weighted basis, compared to 65% and 62% of customers as of January 31, 2023 and 2022, respectively. The high percentage revenue from multi-year contracts, among both new and existing customers, has enhanced the predictability of our subscription revenue. We typically invoice our customers annually in advance for subscriptions to our platform. Our one-year and multi-year contracts generally automatically renew for additional one-year terms, with each party having the option to elect not to renew, and generally may
not be canceled absent material breach by us or the customer. Approximately 60% of our annual recurring revenue is up for renewal during the fiscal year ending January 31, 2025.
We primarily generate sales through our direct sales team, which includes both inside sales and field sales personnel. Most all of our sales and professional services activities are conducted remotely. We also updated our freemium offering. Domo Free, making it easy for users and organizations to sign up for free trials on our website. With our new freemium offering in conjunction with our consumption-based pricing model, Domo Free customers can access our complete platform and pay solely for the services they utilize beyond the allotment of credits offered through Domo Free.
We generate customer leads, accelerate sales opportunities and build brand awareness through our marketing programs. Our marketing programs target C-level, and senior line of business leaders spanning all functional areas of a business, including sales, marketing, finance, human resources and information technology. We also host Domopalooza, our annual user conference for current customers and prospects.
We have also developed go-to-market partnerships with a number of key technology, system integrator and consultant partners both domestically and internationally to help customers and potential customers validate our solutions and provide introductions to potential customers, and in some cases to resell or provide professional services related to our platform. We anticipate that we will continue to develop a select number of third-party relationships to help grow our business.
In response to the macroeconomic uncertainty, existing and potential customers may choose to reduce or delay technology spending or attempt to renegotiate contracts and obtain concessions.
Competition
Historically, software companies have not offered solutions that meet the needs of an organization with respect to providing real-time intelligence on business operations to all users, from the CEO to the frontline. In many cases, organizations do not have any solution or otherwise rely on manual business processes such as spreadsheets and reports, or combinations of single solution software. Certain features of our platform compete with products offered by various companies including those that fall into the following categories:
•large software companies, including suppliers of traditional business intelligence products that provide one or more capabilities that are competitive with our products, such as Microsoft Corporation, Oracle Corporation, SAP AG, salesforce.com, inc., and IBM;
•business analytics software companies, such as Tableau Software, Inc. (acquired by salesforce.com, inc.), Qlik Technologies, Looker Data Sciences, Inc. (acquired by Alphabet, Inc.), MicroStrategy, ThoughtSpot, Sisense, Inc., and Tibco Software, Inc.; and
•SaaS-based products or cloud-based analytics providers such as salesforce.com, inc. and Infor, Inc.
We believe that the principal competitive factors in our markets include the following:
•user-centric design;
•ease of adoption and use;
•rapid time to value;
•features and platform experience;
•enterprise-grade performance, including scalability, reliability and query response time;
•brand;
•security, governance and privacy;
•accessibility across mobile devices, operating systems, and applications;
•breadth of data source connectivity through third-party integration;
•customer support;
•continued innovation; and
•pricing.
We believe that we compete effectively on each of the factors listed above; however, we expect competition to intensify in the future. It is possible that the large software vendors who currently do not have a competitive offering, some of which operate in adjacent product categories today, may in the future bring such a solution to market through product development, acquisitions or other means. In addition, several of our competitors have greater name recognition, much longer operating histories, more and better-established customer relationships, larger sales forces, larger marketing and software development budgets and significantly greater resources than we do. Therefore, it is possible that we may not compete favorably with respect to certain of the foregoing factors.
Current and future competitors may also continue to make strategic acquisitions or establish cooperative relationships among themselves or with others. By doing so, these competitors may increase their ability to meet the needs of customers. These relationships may limit our ability to sell or certify our platform through specific distributors, technology providers, database companies and distribution channels and allow competitors to rapidly gain significant market share. These developments could limit our ability to obtain revenue from existing and new customers. If we are unable to compete successfully against competitors, our business, operating results and financial condition would be harmed.
Data Center Operations
We rely heavily on data centers and other technologies and services provided by third parties in order to operate critical functions of our business. We serve our customers from multiple data centers in the following geographies: North America, Western Europe, Canada, Australia, and Japan. The data centers we use are designed to host mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Our platform runs within third-party data centers. As of January 31, 2024, we used Amazon Web Services, or AWS, data center facilities located in Western Europe, North America and Australia. We committed to spend an aggregate of $106.0 million between October 2022 and September 2027 pursuant to our agreement with AWS. If we fail to meet the minimum purchase commitment during any year, we are required to pay the difference. AWS may terminate the agreement upon written notice to us for cause, including any material breach by us. We also use Microsoft Azure data centers in the United States to host customer data.
We and our third-party data center providers maintain a formal and comprehensive security program designed to ensure the security and integrity of customer data, protect against security threats or data breaches, and prevent unauthorized access to the data of our customers. We and our third-party data center providers strictly regulate and limit all access to on-demand servers and networks at our production and remote backup facilities.
We apply a wide variety of strategies to achieve better than 99.9% systems availability for our subscription services, excluding scheduled maintenance. Our systems are continually monitored for any signs of problems, and we strive to take preemptive action when necessary. Our data center facilities and the third-party data centers employ advanced measures designed to ensure physical integrity, including redundant power and cooling systems, and advanced fire and flood prevention.
Research and Development
We focus our efforts on anticipating customer demand to remain competitive in the marketplace. Our ability to compete depends in large part on our continuous commitment to research and development and our ability to introduce new platform enhancements, applications, technologies, features and capabilities in a timely manner. Our research and development organization is responsible for design, development, testing, release and maintenance. Our efforts are focused on developing new platform enhancements, use cases, and features and further enhancing the functionality, reliability, performance and flexibility of existing solutions.
Research and development expenses were $81.0 million, $95.1 million and $85.0 million for the fiscal years ended January 31, 2022, 2023 and 2024, respectively.
Intellectual Property
We rely on a combination of trade secret, copyright, trademark, patent and other intellectual property laws, contractual arrangements, such as assignment, confidentiality and non-disclosure agreements, and confidentiality procedures and
technical measures to gain rights to and protect the technology and intellectual property used in our business. We actively pursue registration of our trademarks and service marks in the United States and abroad.
As of January 31, 2024, we owned 115 issued U.S. patents and four pending U.S. patent applications. We also owned ten patents in the European Union, three patents in Great Britain, five patents in Canada and one patent in Japan. The issued U.S. patents that we own have expiration dates ranging from April 2024 to September 2041. We have sole ownership of all of our U.S. patents and pending U.S. patent applications.
Our applications use “open source” software. Open source software is made available to the general public in source code form for use, modification and redistribution on an “as-is” basis under the terms of a non-negotiable license. We also rely on other technology that we license from third parties. Though such third-party technology may not continue to be available to us on commercially reasonable terms, we believe that alternative technology would be available to us.
Our policy is to require employees and independent contractors to sign agreements assigning to us any inventions, trade secrets, works of authorship, and other technology and intellectual property created by them on our behalf and agreeing to protect our confidential information, and all of our key employees and independent contractors have done so. In addition, we generally enter into confidentiality agreements with our vendors and customers. We also control and monitor access to our software, source code and other proprietary information.
Regulatory Matters
Data privacy, information security and data protection with respect to the collection, storage, and other processing of personal data continue to be focuses of worldwide legislation and regulation. We are subject to data privacy, data protection and information security regulation by data protection authorities in the United States (including the states in which we conduct our business) and in other countries where we conduct our business. These regulations include laws requiring holders of personal data to maintain safeguards and to take certain actions in response to a data breach. In the European Union, the General Data Protection Regulation requires comprehensive information privacy and security protections for natural persons with respect to personal data collected about them, and in the United Kingdom, the Data Protection Act and UK GDPR require similar protections. Each of these regimes provides for substantial potential fines in the event of noncompliance. We post on our website a privacy policy concerning the processing, use and disclosure of personal data, and certify adherence to and compliance with the U.S. Department of Commerce’s Privacy Shield Principles and the E.U.-U.S. and Swiss-U.S. Privacy Shield Frameworks. Our publication of our Privacy Shield certification, our privacy policy, and other statements we publish regarding privacy, data protection and information security may subject us to potential governmental action if they are found to be deceptive or misrepresentative of our practices or in violation of applicable privacy law. We also may be bound from time to time by contractual obligations, including model contract provisions approved by the European Commission, that impose additional restrictions on our handling of personal data.
The legal environment of internet-based businesses is evolving rapidly in the United States, the European Union and elsewhere. The manner in which existing laws and regulations are applied in this environment, and how they will relate to our business in particular, both in the United States and internationally, is often unclear. For example, we sometimes cannot be certain which laws will be deemed applicable to us given the global nature of our business, including with respect to such topics as data privacy and security, pricing, advertising, taxation, content regulation, and intellectual property ownership and infringement or other violations of intellectual property rights. In particular, the various privacy, data protection and data security legal obligations that apply to us may evolve in a manner that relates to our practices or the features of our applications or platform, and we may need to take additional measures to comply with such changes in legal obligations and to maintain and improve our information security posture in an effort to avoid information security incidents or breaches affecting personal data or other sensitive or proprietary information.
Data Security
Domo is designed to meet enterprise security, compliance and privacy requirements of our customers, particularly in highly regulated industries, such as financial services, health care, pharmaceuticals, energy and technology. Our architecture is designed to allow customers to maintain control of their data through various means including: multiple logical and physical security layers; least privilege and separation of duties access model; threat assessments of each new feature; transport layer encryption and encryption at rest that allows customers to manage their own encryption keys using Domo’s Bring Your Own Key, or BYOK; several self-service security controls offered within the Domo platform for customers to implement their own security policies, and extensive logging and monitoring of network, system and application events.
We voluntarily engage independent third-party security auditors to test our systems and controls at least annually against several widely recognized security standards and regulations.
We have completed a SOC 1 and SOC 2, and HITRUST risk-based attestation. Service Organization Controls, or SOC, are standards established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We have also been certified as compliant with ISO 27001 and ISO 27018 standards. The ISO 27001 security standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization’s overall business risks. This standard addresses confidentiality, access control, vulnerability and risk assessment. ISO 27018 establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information in accordance with the privacy principles in ISO/IEC 29100 for a cloud computing environment. Furthermore, we have completed our annual third party validation of HIPAA Security and Privacy Risk Analysis. We sign business associate agreements with our customers who require them in support of compliance with the Health Insurance Portability and Accountability Act, or HIPAA, and the Health Information Technology for Economic and Clinical Health Act, or HITECH.
We have also completed our annual audits to evaluate our compliance with GDPR and CCPA requirements. Our cloud hosting providers and services providers also regularly undergo ISO 27001 or SOC 1 or SOC 2 audits and numerous other audits to verify their security practices.
We complete the two industry-leading information security questionnaires. This includes the Shared Assessments Standardized Information Gathering, or SIG, questionnaire, as well as the Cloud Security Alliance Consensus Assessments Initiative Questionnaire, or CSA CAIQ. The SIG is composed of approximately 1,400 security questions spanning 17 domains. The CSA CAIQ is a set of security questions focused on cloud security controls, and it is mapped to numerous industry programs and standards including ISO 27001, NIST SP 800-53, and COBIT, amongst others. Both of these information security industry questionnaires assist organizations in evaluating a cloud provider's operations and processes.
Employees
As of January 31, 2024, we had 958 employees, of which 740 work in the United States. None of our employees are represented by a labor union, and we believe our employee relations are good.
Corporate Information
We were originally incorporated in Delaware in September 2010 under the corporate name "Shacho, Inc." We changed our name to "Domo, Inc." in December 2011. Our principal executive offices are located at 802 East 1050 South, American Fork, UT 84003, and our telephone number is (801) 899-1000. Our website address is www.domo.com. Information contained on, or that can be accessed through, our website does not constitute part of this Annual Report on Form 10-K.
Available Information
The following filings are available through our investor relations website after we file them with the Securities and Exchange Commission (SEC): Annual Report on Form 10-K, Quarterly Reports on Form 10-Q and our Proxy Statement for our annual meeting of stockholders. These filings are also available for download free of charge on our investor relations website. Our investor relations website is located at www.domo.com/ir. The SEC also maintains an Internet website that contains reports, proxy statements and other information about issuers, like us, that file electronically with the SEC. The address of that website is http://www.sec.gov.
We webcast our earnings calls and certain events we participate in or host with members of the investment community on our investor relations website. Additionally, we provide notifications of news or announcements regarding our financial performance, including SEC filings, investor events, and press and earnings releases as part of our investor relations website. Further corporate governance information, including our corporate governance guidelines and code of conduct, is also available on our investor relations website under the heading "Governance." The contents of our websites are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.
Item 1A. Risk Factors
You should carefully consider the following risk factors, in addition to the other information contained in this report, including the section of this report captioned “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and related notes. If any of the events described in the following risk factors or the risks described elsewhere in this report occurs, our business, operating results and financial condition could be seriously harmed. This report also contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those anticipated in the forward-looking statements as a result of factors that are described below and elsewhere in this report.
Risks Related to Our Financial Position and Capital Needs
We have a history of losses, and we may not be able to generate sufficient revenue to achieve or maintain profitability in the future.
We incurred net losses of $102.1 million, $105.6 million and $75.6 million for the years ended January 31, 2022, 2023 and 2024, respectively, and had an accumulated deficit of $1,405.6 million at January 31, 2024. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:
•sales and marketing, including any expansion of our direct sales organization, which will require time before these investments generate sales results;
•technology and data center infrastructure, enhancements to cloud architecture, improved disaster recovery protection, increasing data security, compliance and operations expenses;
•data center costs as customers increase the amount of data that is available to our platform and usage on our platform;
•other software development, including enhancements and modifications related to our platform;
•international expansion in an effort to increase our customer base and sales;
•general and administration, including significantly increasing expenses in accounting and legal related to the increase in the sophistication and resources required for public company compliance and other work arising from the growth and maturity of the company;
•competing with other companies, custom development efforts and open source initiatives that are currently in, or may in the future enter, the markets in which we compete;
•maintaining high customer satisfaction and ensuring quality and timely releases of platform enhancements and applications;
•developing our indirect sales channels and strategic partner network;
•maintaining the quality of our cloud and data center infrastructure to minimize latency when using our platform;
•increasing market awareness of our platform and enhancing our brand;
•maintaining compliance with applicable governmental regulations and other legal obligations, including those related to intellectual property and international sales; and
•attracting and retaining top talent in a competitive market.
These expenditures may not result in additional revenue or the growth of our business. If we fail to continue to grow revenue or to achieve or sustain profitability, the market price of our Class B common stock could be adversely affected.
We have been growing and expect to continue to invest in our growth for the foreseeable future. If we fail to manage this growth effectively, our business and operating results will be adversely affected.
We intend to continue to grow our business. If we cannot adequately train new employees, including our direct sales force, or if new employees are not as productive as quickly as we would like, sales may decrease or customers may lose confidence in the knowledge and capability of our employees. In addition, we may make direct investments in our international business, and increase the number of employees outside the United States. We must successfully manage growth to achieve our objectives. Although our business has experienced significant growth in the past, we cannot provide any assurance that our business will continue to grow at any particular rate, or at all.
Our ability to effectively manage the growth of our business will depend on a number of factors, including our ability to do the following:
•effectively recruit, integrate, train and motivate new employees and make them productive, including our direct sales force, while retaining existing employees, maintaining the beneficial aspects of our corporate culture and effectively executing our business plan;
•attract new customers, and retain and increase usage by existing customers;
•recruit and successfully leverage channel partners and app developers;
•successfully enhance our platform;
•continue to improve our operational, financial and management controls;
•protect and further develop strategic assets, including intellectual property rights; and
•manage market expectations and other challenges associated with operating as a public company.
These activities will require significant financial resources and allocation of valuable management and employee resources, and growth will continue to place significant demands on management and our operational and financial infrastructure.
Our future financial performance and ability to execute our business plan will depend, in part, on our ability to effectively manage any future growth. There are no guarantees we will be able to do so. In particular, any failure to successfully implement systems enhancements and improvements will likely negatively impact our ability to manage our expected growth, ensure uninterrupted operation of key business systems and comply with the rules and regulations that are applicable to public reporting companies. Moreover, if we do not effectively manage the growth of our business and operations, the quality of our platform could suffer, which could negatively affect our brand, operating results and business.
Our ability to raise capital in the future may be limited, and if we fail to raise capital when needed in the future, we could be prevented from growing or could be forced to delay or eliminate product development efforts or other operations.
Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,405.6 million as of January 31, 2024. We have also experienced negative or close to breakeven cash flows from operating activities, including cash used in operating activities of $10.9 million for the year ended January 31, 2023 and cash provided by operating activities of $0.4 million and $2.6 million for the years ended January 31, 2022 and 2024, respectively. As of January 31, 2024, we had $60.9 million of cash, cash equivalents, and restricted cash which were held for working capital purposes, of which $3.7 million was restricted cash. Additionally, no amounts were available to draw under our credit facility.
We may need to raise additional funds to invest in growth opportunities, to continue product development and sales and marketing efforts, and for other purposes. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to meet our obligations, invest in future growth opportunities, or continue operations at anticipated levels, which could harm our business and operating results. In addition, current and future debt instruments may impose restrictions on our ability to dispose of property, make changes in our business, engage in mergers or acquisitions, incur additional indebtedness, and make investments and distributions. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to
those of our common stock. Because our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of any such future offerings. As a result, stockholders bear the risk that future securities offerings reduce the market price of our Class B common stock and dilute their interest.
Future operating results and key metrics may fluctuate significantly due to a wide range of factors, which makes our future results difficult to predict.
Our operating results and key metrics could vary significantly from quarter to quarter as a result of various factors, some of which are outside of our control, including:
•the expansion of our customer base;
•the size, duration and terms of our contracts with both existing and new customers;
•the introduction of products and product enhancements by competitors, and changes in pricing for products offered by us or our competitors;
•customers delaying purchasing decisions in anticipation of new products or product enhancements by us or our competitors or otherwise;
•changes in customers’ budgets;
•seasonal variations in our sales, which have generally historically been highest in our fourth fiscal quarter and lowest in the first fiscal quarter;
•the timing of satisfying revenue recognition criteria, particularly with regard to large transactions;
•the amount and timing of payment for expenses, including infrastructure costs to deliver our platform, research and development, sales and marketing expenses, employee benefit and stock-based compensation expenses and costs related to Domopalooza, our annual user conference that occurs in our first fiscal quarter;
•costs related to the hiring, training and maintenance of our direct sales force;
•the timing and growth of our business, in particular through the hiring of new employees and international expansion; and
•general economic and political conditions, both domestically and internationally, including the impacts of pandemics or other catastrophic events, military conflicts (including the Russian invasion of Ukraine, and hostilities between Israel and Hamas), inflation, and adverse impacts to the financial service services industry, as well as economic conditions specifically affecting industries in which our customers operate.
Any one of these or other factors discussed elsewhere in this report may result in fluctuations in our operating results, meaning that quarter-to-quarter comparisons may not necessarily be indicative of our future performance.
Because we recognize revenue from subscriptions ratably over the terms of our subscription agreements, near-term changes in sales may not be reflected immediately in our operating results.
We offer our platform primarily through subscription agreements, which typically vary in length between one and three years, and may in many cases be subject to automatic renewal or renewal only at a customer's discretion. We generally invoice our customers in annual installments at the beginning of each year in the subscription period. Amounts that have been invoiced are initially recorded as deferred revenue and are recognized ratably over the subscription period. As a result, most of the revenue that we report in each period is derived from the recognition of deferred revenue relating to subscriptions entered into during previous periods. A decline in new or renewed subscriptions in any one quarter is not likely to have a material impact on results for that quarter. However, declines would negatively affect revenue and deferred revenue balances in future periods, and the effect of significant downturns in sales and market acceptance of our platform, and potential changes in our rate of renewals, may not be fully reflected in our results of operations until future periods. Our subscription model also makes it difficult for us to rapidly increase our total revenue through additional sales in any period, as revenue from new customers is recognized over the applicable subscription term. We may be unable to adjust our cost structure to reflect the changes in revenue. In addition, a significant majority of our costs are expensed as incurred, while revenue is
generally recognized over the life of the customer agreement. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenue in the earlier periods of the terms of our agreements.
The length, cost and uncertainty associated with sales cycles for enterprise customers may result in fluctuations in our operating results and our failure to achieve the expectations of investors.
Our sales efforts to enterprise customers, which we define as companies with over $1 billion in revenue, face long sales cycles, complex customer requirements, substantial upfront sales costs, and a relatively low and difficult to predict volume of sales on a quarter-by-quarter basis. This makes it difficult to predict with certainty our sales and related operating performance in any given period. Our sales cycle for new enterprise customers varies from approximately six months to multiple years. Customers often undertake a prolonged evaluation of our platform, including assessing their own readiness, scoping the professional services involved, and comparing our platform to products offered by competitors and their ability to solve the problem internally. Events may occur during this period that affect the size or timing of a purchase or even cause cancellations, which may lead to greater unpredictability in our business and operating results. Moreover, customers often begin to use our platform on a limited basis with no guarantee that they will expand their use of our platform widely enough across their organization to justify the costs of our sales efforts. We may also face unexpected implementation challenges with enterprise customers or more complicated installations of our platform. It may be difficult to deploy our platform if the customer has unexpected database, hardware or software technology issues.
Adherence to our financial plan in part depends on managing the mix of customers, the rate at which customers increase their use of our platform within their organizations, the number of use cases they employ, and the timing and amount of upsells, all of which affect annual contract value. Our financial performance and the predictability of our quarterly financial results may be harmed by failures to secure the higher value enterprise agreements in a timely manner or at all, or changes in the volume of transactions overall, compared to our forecasts, and depends in large part on the successful execution of our direct sales team. The predictability of billings may be adversely impacted by fluctuations in the proportion of contracts that are not billed annually in advance.
Additionally, our quarterly sales cycles are generally more heavily weighted toward the end of the quarter with an increased volume of sales in the last few weeks and days of the quarter. This impacts the timing of recognized revenue and billings, cash collections and delivery of professional services. Furthermore, the concentration of contract negotiations in the last few weeks and days of the quarter could require us to expend more in the form of compensation for additional sales, legal and finance employees and contractors. Compression of sales activity to the end of the quarter also greatly increases the likelihood that sales cycles will extend beyond the quarter in which they are forecasted to close for some sizeable transactions, which will harm forecasting accuracy and adversely impact billings and new customer acquisition and renewal metrics for the quarter in which they are forecasted to close.
Increased sales to customers outside the United States or paid for in currency other than the U.S. dollar exposes us to potential currency exchange losses.
As our international sales and operations increase, so too will the number and significance of transactions, including intercompany transactions, occurring in currencies other than the U.S. dollar. In addition, our international subsidiaries may accumulate assets and liabilities that are denominated in currencies other than the U.S. dollar, which is the functional reporting currency of these entities. Accordingly, changes in the value of foreign currencies relative to the U.S. dollar can affect our revenue and operating results due to foreign currency gains and losses that are reflected in our earnings. We do not currently maintain a program to hedge transactional exposures in foreign currencies. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.
Our credit facility contains restrictive covenants that may limit our operating flexibility.
Our credit facility contains restrictive covenants that limit our ability to transfer or dispose of assets, merge with other companies or consummate certain changes of control, acquire other companies, open new offices that contain a material amount of assets, pay dividends, incur additional indebtedness and liens and enter into new businesses. We therefore may not be able to engage in any of the foregoing transactions unless we obtain the consent of the lender or terminate the credit facility, which may limit our operating flexibility. In addition, our credit facility is secured by all of our assets, including our intellectual property, and requires us to satisfy certain financial covenants. There is no guarantee that we will be able to
generate sufficient cash flow or sales to meet these financial covenants or pay the principal and interest on any such debt. Furthermore, there is no guarantee that future working capital, borrowings or equity financing will be available to repay or refinance any such debt. Any inability to make scheduled payments or meet the financial covenants on our credit facility would adversely affect our business.
We may be subject to additional obligations to collect and remit sales tax and other taxes, and we may be subject to tax liability for past transactions, which could harm our business.
We do not collect sales and use, value added and similar taxes in all jurisdictions in which we have sales, based on our belief that such taxes are not applicable in certain jurisdictions. State, local and foreign jurisdictions have differing rules and regulations governing sales, use, value added and other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of such taxes on subscriptions to our platform in various jurisdictions is unclear. Further, rules regarding tax nexus are complex and vary significantly across state, local and foreign jurisdictions. As a result, we could face the possibility of audits that could result in tax assessments, including associated interest and penalties. A successful assertion that we should be collecting additional sales, use, value added or other taxes in those jurisdictions where we have not historically done so could result in substantial tax liabilities and related penalties for past transactions, discourage customers from purchasing our application, or otherwise harm our business and operating results. In addition, we are required to withhold and timely remit payroll-related taxes for which we are also subject to the possibility of audits that could result in tax assessments, including associated interest and penalties.
Changes in tax laws or regulations that are applied adversely to us or our customers could increase the costs of our platform and adversely impact our business.
New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. However, recently proposed tax legislation, if enacted, would restore the ability to deduct currently domestic research and development expenditures through 2025 and would retroactively restore this benefit for 2022 and 2023. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.
In addition, taxation of cloud-based software is constantly evolving as many state and local jurisdictions consider the taxability of software services provided remotely. These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines or penalties and interest for past amounts deemed to be due. If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to continue to use or purchase subscriptions to our platform in the future. Additionally, new, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our platform. Any or all of these events could harm our business and operating results.
We are a multinational organization faced with increasingly complex tax issues in many jurisdictions, and we could be obligated to pay additional taxes in various jurisdictions.
As a multinational organization, we are subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain, and significant judgment and estimates are required in determining our provision for income taxes. Our tax expense may be impacted if our intercompany transactions, which are required to be computed on an arm’s-length basis, are challenged and successfully disputed by tax authorities. Our policies governing transfer pricing may be determined to be inadequate and could result in additional tax assessments. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could harm our liquidity and operating results. In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements or other taxes apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries, any of which could adversely affect our operating results.
Further, many countries and the Organization for Economic Cooperation and Development have proposed to reallocate some portion of profits of large multinational companies to markets where sales arise, known as “Pillar One,” as well as enact
a global minimum tax rate of at least 15% for multinationals with global revenue exceeding certain thresholds, known as “Pillar Two,” and many countries have adopted or intend to adopt these proposals. Changes to these and other areas in relation to international tax reform, including future actions taken by foreign governments could increase uncertainty and may adversely affect our tax rate and operating results in future years.
Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.
As of January 31, 2024, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,178.3 million and $1,352.8 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.
In general, under Section 382 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an "ownership change" (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset its future taxable income. An ownership change under Section 382 of the Code could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. We have historically contracted third parties to perform a Section 382 analysis to evaluate limitations on our NOLs due to ownership changes, with the most recent analysis being through January 31, 2023. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities for federal and state tax purposes. For these reasons, we may not be able to utilize a material portion of our NOLs, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.
Adverse events or perceptions affecting the financial services industry could adversely affect our operating results, financial condition and prospects.
Limited liquidity, defaults, non-performance or other adverse developments affecting financial institutions or parties with which we do business, or perceptions regarding these or similar risks, have in the past and may in the future lead to market-wide liquidity problems. Such developments, and their effects on the broader financial system, could result in a variety of material and adverse impacts on our business operations and financial conditions, including, but not limited to:
•delayed access to deposits or other financial assets or the uninsured loss of deposits or other financial assets;
•loss of access to revolving existing credit facilities or other working capital sources or the inability to refund, roll over or extend the maturity of, or enter into new credit facilities or other working capital resources;
•potential or actual breach of obligations, including U.S. federal and state wage laws and contracts that may require us to maintain letters or credit or other credit support arrangements; and
•termination of cash management arrangements or delays in accessing or actual loss of funds subject to cash management arrangements.
For example, on March 10, 2023, Silicon Valley Bank (SVB) was closed and placed in receivership and subsequently, additional financial institutions have been placed into receivership. Prior to SVB’s closure, we had approximately $12.4 million in deposit accounts with SVB and an additional $18.3 million subject to SVB sweep account arrangements (with amounts held in custodial accounts with third-party financial institutions). As a result of U.S. government intervention, we subsequently regained access to our accounts at SVB, and Silicon Valley Bridge Bank has assumed SVB’s obligations to honor our standby letter of credit. However, there remains significant uncertainty surrounding the impact of these bank closures on the broader financial system. Moreover, there is no guarantee that the U.S. government will intervene to provide access to uninsured funds in the future in the event of the failure of other financial institutions, or that they would do so in a timely fashion. In such an event, parties with which we have commercial agreements, including customers and suppliers, may be unable to satisfy their obligations to, or enter into new commercial arrangements with us.
Concerns regarding the U.S. or international financial systems could impact the availability and cost of financing, thereby making it more difficult for us to acquire financing on acceptable terms or at all. In addition, instability in the financial services industry could spur a deterioration in the macroeconomic environment and dampen demand for our products.
Any of these risks could materially impact our operating results, liquidity, financial condition and prospects.
Risks Related to Our Relationships with Customers and Third Parties
If we are unable to attract new customers in a manner that is cost-effective, our revenue growth could be slower than we expect and our business may be harmed.
To increase our revenue, we must add new customers. Demand for our platform is affected by a number of factors, many of which are beyond our control, such as continued market acceptance of our platform for existing and new use cases, the timing of development and release of new applications and features, technological change, growth or contraction in our addressable market, and accessibility across mobile devices, operating systems, and applications, and macroeconomic changes, including the impact of public health epidemics or pandemics on the demand for technology solutions like ours. In addition, if competitors introduce lower cost or differentiated products or services that are perceived to compete with our features, our ability to sell our features based on factors such as pricing, technology and functionality could be impaired. As a result, we may be unable to attract new customers at rates or on terms that would be favorable or comparable to prior periods, which could negatively affect the growth of our revenue.
Even if we do attract customers, the cost of new customer acquisition may prove so high as to prevent us from achieving or sustaining profitability. We recognize subscription revenue ratably over the term of the subscription period. In general, customer acquisition costs and other upfront costs associated with new customers are much higher in the first year than the aggregate revenue we recognize from those new customers in the first year. As a result, the profitability of a customer to our business in any particular period depends in part upon how long a customer has been a subscriber and the degree to which it has expanded its usage of our platform. Additionally, we intend to continue to hire additional sales personnel to grow our domestic and international operations. If our sales and marketing efforts do not result in substantial increases in revenue, our business, results of operations, and financial condition may be adversely affected.
If customers do not renew their contracts with us or reduce their use of our platform, our revenue will decline and our operating results and financial condition may be adversely affected.
The initial terms of our customer contracts typically vary in length between one and three years, and our customers have no obligation to renew their subscriptions after the expiration of their initial subscription periods. In some cases, the contracts automatically renew (with each party having the option to elect not to renew), but in circumstances where that is not the case, our customers may unilaterally elect not to renew, may seek to renew for lower subscription amounts or for shorter contract lengths, or may choose to renew for the same or fewer applications over time. A majority of our annual recurring revenue is up for renewal during the fiscal year ending January 31, 2025. Our renewal rates may decline or fluctuate as a result of a number of factors, including leadership changes within our customers resulting in loss of sponsorship, limited customer resources, pricing changes by us or competitors, customer satisfaction with our platform and related applications, the acquisition of customers by other companies, procurement or budgetary decisions, and deteriorating general economic conditions, including as a result of public health epidemics or pandemics. To the extent our customer base continues to grow, renewals and additional subscriptions by renewing customers will become an increasingly important part of our results. If our customers do not renew their subscriptions, or decrease the amount they spend with us, revenue will decline and our business will be harmed.
If customers do not expand their use of our platform or adopt additional use cases, our growth prospects, operating results and financial condition may be adversely affected.
Our future success depends on our ability to increase the deployment of our platform within and across our existing customers and future customers. Many of our customers initially deploy our platform to specific groups or departments within their organization or for a limited number of use cases. Our growth prospects depend on our ability to persuade customers to expand their use of our platform to additional groups, departments and use cases across their organization. Historically, we have made significant investments in research and development to build our platform and to offer enterprise customers the features and functionality that they require.
If our future operating results are significantly below the expectations of investors, it could harm the market price of our Class B common stock.
The loss of one or more of our key customers, or a failure to renew our subscription agreements with one or more of our key customers, could negatively affect our ability to market our platform.
We rely on our reputation and recommendations from key customers in order to promote subscriptions to our platform. The loss of, or failure to renew by, any of our key customers could have a significant effect on our revenue, reputation and our ability to obtain new customers. In addition, acquisitions of our customers could lead to cancellation of such customers’ contracts, thereby reducing the number of our existing and potential customers.
If we are unable to develop and maintain successful relationships with channel partners, our business, operating results, and financial condition could be adversely affected.
To date, we have been primarily dependent on our direct sales force to sell subscriptions to our platform. Although we have developed relationships with some channel partners, such as referral partners, resellers, and integration partners, these channels have resulted in limited revenue historically. We believe that continued growth in our business is dependent upon identifying, developing, and maintaining strategic relationships with additional channel partners that can drive substantial revenue. If we fail to identify additional channel partners in a timely and cost-effective manner, or at all, or are unable to assist our current and future channel partners in independently selling and deploying our products, our business, results of operations, and financial condition could be adversely affected. Typically, agreements with channel partners are non-exclusive, meaning our channel partners may offer customers the products of several different companies, including products that compete with our platform. They may also cease marketing our platform with limited or no notice and with little or no penalty. Additionally, customer retention and expansion attributable to customers acquired through our channel partners may differ significantly from customers acquired through our direct sales efforts. If our channel partners do not effectively market and sell our products, or fail to meet the needs of our customers, our reputation and ability to grow our business may also be adversely affected.
Sales by channel partners are more likely than direct sales to involve collectability concerns. In particular, sales by our channel partners into developing markets, and accordingly, variations in the mix between revenue attributable to sales by channel partners and revenue attributable to direct sales, may result in fluctuations in our operating results.
We rely upon data centers and other systems and technologies provided by third parties, and technology systems and electronic networks supplied and managed by third parties, to operate our business and interruptions or performance problems with these systems, technologies and networks may adversely affect our business and operating results.
We rely on data centers and other technologies and services provided by third parties in order to manage our cloud-based infrastructure and operate our business. If any of these services becomes unavailable or otherwise is unable to serve our requirements due to extended outages, interruptions, facility closure, or because it is no longer available on commercially reasonable terms, expenses could increase, our ability to manage finances could be interrupted and our operations otherwise could be disrupted or otherwise impacted until appropriate substitute services, if available, are identified, obtained, and implemented.
We do not control, or in some cases have limited control over, the operation of the data center facilities we use, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions of new capabilities, technology errors, infrastructure changes, distributed denial of service attacks, or other security related incidents. For instance, in December 2017, researchers identified significant CPU architecture vulnerabilities commonly known as “Spectre” and “Meltdown” that have required software updates and patches, including for providers of public cloud services, to mitigate such vulnerabilities and such updates and patches have required servers to be offline and potentially slow their performance. We may not be able to rapidly switch to new data centers or move customers from one data center to another in the event of any adverse event. Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in lengthy interruptions in our service and the loss or corruption of, or unauthorized access to or acquisition of, customer data.
In addition, if we do not accurately predict our infrastructure capacity requirements, customers could experience service shortfalls. The provisioning of additional cloud hosting capacity and data center infrastructure requires lead time. As we continue to add data centers, restructure our data management plans, and increase capacity in existing and future data centers, we may be required to move or transfer our data and customers’ data. Despite precautions taken during such processes and procedures, any unsuccessful data transfers may impair customers’ use of our platform, and we may experience costs or
downtime in connection with the transfer of data to other facilities, which may lead to, among other things, customer dissatisfaction and non-renewals. The owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If we are unable to renew these agreements on commercially reasonable terms, we may be required to transfer to new data center facilities, and we may incur significant costs and possible service interruption in connection with doing so.
Our ability to provide services and solutions to customers also depends on our ability to communicate with customers through the public internet and electronic networks that are owned and operated by third parties. In addition, in order to provide services on-demand and promptly, our computer equipment and network servers must be functional 24 hours per day, which requires access to telecommunications facilities managed by third parties and the availability of electricity, which we do not control. A severe disruption of one or more of these networks or facilities, including as a result of utility or third-party system interruptions, could impair our ability to process information and provide services to our customers.
Any unavailability of, or failure to meet our requirements by, third-party data centers or other third-party technologies or services, or any disruption of the internet or the third-party networks or facilities that we rely upon, could impede our ability to provide services to customers, harm our reputation, result in a loss of customers, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, and adversely affect our renewal rates. Any of these circumstances could adversely affect our business and operating results.
Contractual disputes with our customers could be costly, time-consuming and harm our reputation.
Our business is contract intensive and we are party to contracts with our customers all over the world. Our contracts can contain a variety of terms, including service levels, security obligations, indemnification and regulatory requirements. Contract terms may not always be standardized across our customers and can be subject to differing interpretations, which could result in disputes with our customers from time to time. If our customers notify us of an alleged contract breach or otherwise dispute any provision under our contracts, the resolution of such disputes in a manner adverse to our interests could negatively affect our operating results.
Additionally, if customers fail to pay us under the terms of our agreements, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts, including litigation. The risk of such negative effects increases with the term length of our customer arrangements. Furthermore, some of our customers may seek bankruptcy protection or other similar relief and fail to pay amounts due to us, or pay those amounts more slowly, either of which could adversely affect our operating results, financial position and cash flow.
Risks Related to Our Products and Solutions
We face intense competition, and we may not be able to compete effectively, which could reduce demand for our platform and adversely affect our business, growth, revenue and market share.
The market for our platform is intensely and increasingly competitive and subject to rapidly changing technology and evolving standards. In addition, many companies in our target market are offering, or may soon offer, products and services that may compete with our platform. Furthermore, many potential customers have made significant investments in legacy software systems and may be unwilling to invest in new solutions.
Our current primary competitors generally fall into the following categories:
•large software companies, including suppliers of traditional business intelligence products that provide one or more capabilities that are competitive with our products, such as Microsoft Corporation, Oracle Corporation, SAP AG and IBM;
•business analytics software companies, such as Tableau Software, Inc., Qlik Technologies, Looker Data Sciences, Inc., Sisense, Inc., and Tibco Software, Inc.; and
•SaaS-based products or cloud-based analytics providers such as salesforce.com, Inc. and Infor, Inc.
We expect competition to increase as other established and emerging companies enter the markets in which we compete, as customer requirements evolve and as new products and technologies are introduced. For example, salesforce.com, inc. acquired Tableau Software, Inc. in August 2019 and Alphabet Inc. acquired Looker Data Sciences, Inc. in February 2020.
Many competitors, particularly the large software companies named above, have longer operating histories, significantly greater financial, technical, research and development, marketing, distribution, professional services or other resources and greater name recognition than we do. In addition, many competitors have strong relationships with current and potential customers, channel partners and development partners and extensive knowledge of markets in which we compete. As a result, they may be able to respond more quickly to new or emerging technologies and changes in customer requirements, for example by devoting greater resources to the development, promotion and sale of their products than we do.
Moreover, many of these competitors may bundle their data management and analytics products into larger deals or maintenance renewals, often at significant discounts or at no charge. Increased competition may lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, fewer customer orders, reduced gross margins, longer sales cycles and loss of market share. We may not be able to compete successfully against current and future competitors, and our business, operating results and financial condition will be harmed if we fail to meet these competitive pressures. Even if we are successful in acquiring and retaining customers, those customers may continue to use our competitors' products in addition to our products.
Our ability to compete successfully depends on a number of factors, both within and outside of our control. Some of these factors include ease and speed of platform deployment and use, accessibility across mobile devices, operating systems, and applications, discovery and visualization capabilities, analytical and statistical capabilities, performance and scalability, the quality of our data security infrastructure, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to compete successfully in any one of these or other areas may reduce the demand for our platform, as well as adversely affect our business, operating results and financial condition.
Moreover, current and future competitors may also make strategic acquisitions or establish cooperative relationships among themselves or with others. By doing so, these competitors may increase their ability to meet the needs of customers. These relationships may limit our ability to sell or certify our platform through specific distributors, technology providers, database companies and distribution channels and allow competitors to rapidly gain significant market share. These developments could limit our ability to obtain revenue from existing and new customers. If we are unable to compete successfully against competitors, our business, operating results and financial condition would be harmed.
We continue to evolve our subscription and pricing models and changes could adversely affect our operating results.
Our pricing and subscription models have evolved over time, and will continue to evolve in the future. We have started to introduce consumption-based pricing, which is pricing based upon the use of our platform, for certain of our customers. We have limited experience with determining the optimal pricing for our consumption-based contracts. Revenue recognized for certain customers may be negatively impacted due to our new consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.
As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally. In addition, if the mix of features we sell changes, then we may need to, or choose to, revise our pricing. As a result, in the future we may be required to reduce our prices or offer shorter contract durations, which could adversely affect our revenue, gross margin, profitability, financial condition and cash flow.
In addition, our competitors may offer different subscription or pricing models, which may be more attractive to potential customers. We may be required to adjust our subscription or pricing models in response to these changes, which could adversely affect our financial performance.
If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards and changing customer needs or requirements, our solutions may become less competitive.
Our success depends on our customers' willingness to adopt and use our platform, including on their smartphone or mobile device, as well as our ability to adapt and enhance our platform. To attract new customers and increase revenue from existing customers, we need to continue to enhance and improve our platform, to meet customer needs at prices that customers are willing to pay. Such efforts will require adding new features, expanding related applications and responding to technological advancements, which will increase our research and development costs. If we are unable to develop solutions that address customers’ needs, or enhance and improve our platform in a timely manner, we may not be able to increase or maintain market acceptance of our platform.
Further, we may make changes to our platform that customers do not find useful. We may also discontinue certain features, begin to charge for certain features that are currently free or increase fees for any features or usage of our platform. We may also face unexpected problems or challenges in connection with new applications or feature introductions. Enhancements and changes to our platform could fail to attain sufficient market acceptance for many reasons, including:
•failure to predict market demand accurately in terms of platform functionality and capability or to supply features that meets this demand in a timely fashion;
•inability to operate effectively with the technologies, systems or applications of existing or potential customers;
•defects, errors or failures;
•negative publicity about their performance or effectiveness;
•delays in releasing new enhancements and additional features to our platform to the market;
•the introduction or anticipated introduction of competing products;
•an ineffective sales force;
•poor business conditions for our end-customers, causing them to delay purchases;
•challenges with customer adoption and use of our platform on mobile devices or problems encountered in developing or supporting enhancements to our mobile applications; and
•the reluctance of customers to purchase subscriptions to software incorporating open source software.
Because our platform is designed to operate on and with a variety of systems, we will need to continuously modify and enhance our platform to keep pace with changes in technology, and we may fail to do so.
In addition, issues in the use of artificial intelligence in our platform may result in reputational harm or liability. Domo’s suite of data science leverages machine learning algorithms, predictive analytics, and other artificial intelligence technologies to identify trends, anomalies and correlations, provide alerts and initiate business processes. Artificial intelligence presents risks and challenges that could affect its adoption, and therefore our business. Artificial intelligence algorithms may be flawed. Datasets may be insufficient or contain biased information. Artificial intelligence technologies that we make use of may produce or create outputs that appear correct but are factually inaccurate or otherwise flawed. Inappropriate or controversial data practices by us or others could impair the acceptance of artificial intelligence solutions. These deficiencies could undermine the decisions, predictions, or analysis artificial intelligence applications produce, subjecting us to competitive harm, legal liability, and brand or reputational harm. Additionally, artificial intelligence technologies are complex and rapidly evolving, and we face significant competition from other companies as well as evolving legal and regulatory landscapes. Laws and regulations applicable to artificial intelligence continue to develop and may be inconsistent from jurisdiction to jurisdiction. For example, the E.U. has proposed an Artificial Intelligence Act that, if finalized, would prohibit certain artificial intelligence applications and systems and impose additional requirements on the use of certain applications or systems. The use of artificial intelligence technologies in our platform may result in new or enhanced governmental or regulatory scrutiny, new or modified laws or regulations, claims, demands, and litigation, confidentiality, privacy, data protection, or security risks, ethical concerns, or other complications that could adversely affect our business, financial condition, results of operations and prospects. Uncertainty around new and emerging artificial intelligence technologies may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training
data, and development of appropriate protections, safeguards, and policies for handling the processing of data with artificial intelligence technologies, which may be costly and could impact our expenses.
Our platform also provides real-time write-back capabilities to customer environments, including to IoT products and services. The development of the internet of things (IoT) presents security, privacy and execution risks. Many IoT devices have limited interfaces and ability to be updated or patched. IoT solutions may collect large amounts of data, and our handling of IoT data may not satisfy customers or regulatory requirements. IoT scenarios may increasingly affect personal health and safety. If IoT solutions that include our technologies do not work as intended, violate the law, or harm individuals or businesses, we may be subject to legal claims or enforcement actions. These risks, if realized, may increase our costs, damage our reputation or brand, or negatively impact our business and operating results.
Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risk of future disruptive technologies. If new technologies emerge that are able to deliver business intelligence solutions at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.
We may not timely and effectively scale our existing technology, including our computing architecture, to meet the performance and other requirements placed on our systems, which could increase expenditures unexpectedly and create risk of outages and other performance and quality of service issues for our customers.
Our future growth and renewal rates depend on our ability to meet customers’ expectations with respect to the speed, reliability and other performance attributes of our platform, and to meet the expanding needs of customers as their use of our platform grows. The number of users, the amount and complexity of data ingested, created, transferred, processed and stored by us, the number of locations where our platform is being accessed, and the number of processes and systems managed by us on behalf of these customers, among other factors, separately and combined, can have an effect on the performance of our platform. In order to ensure that we meet the performance and other requirements of customers, we continue to make significant investments to develop and implement new technologies in our platform and infrastructure operations. These technologies, which include database, application and server advancements, revised network and hosting strategies, and automation, are often advanced, complex, and sometimes broad in scope and untested through industry-wide usage. We may not be successful in developing or implementing these technologies. To the extent that we do not develop offerings and scale our operations in a manner that maintains performance as our customers expand their use, our business and operating results may be harmed.
We may not accurately assess the capital and operational expenditures required to successfully fulfill our objectives and our financial performance may be harmed as a result. Further, we may make mistakes in the technical execution of these efforts to improve our platform, which may affect our customers. Issues that may arise include performance, data loss or corruption, outages, and other issues that could give rise to customer satisfaction issues, loss of business, and harm to our reputation. If any of these were to occur there would be a negative and potentially significant impact to our financial performance. Lastly, our ability to generate new applications, and improve our current solutions may be limited if and to the extent resources are necessarily allocated to address issues related to the performance of existing solutions.
If we fail to meet our service level commitments, our business, results of operations and financial condition could be adversely affected.
Our subscription agreements with many of our customers, including most of our top customers, provide certain service level commitments. If we are unable to meet the stated service level commitments or suffer extended periods of downtime that exceed the periods allowed under our subscription agreements, we may be obligated to provide these customers with service credits, or we could face subscription terminations, which could significantly impact our revenue. Any extended service outages could also adversely affect our reputation, which would also impact our future revenue and operating results.
Our customers depend on our customer support organization to resolve technical issues relating to our platform. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. Increased customer demand for these services, without corresponding revenue, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the ease of use of our services, on our reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality customer support, or a
market perception that we do not maintain high-quality support, could adversely affect our reputation and our ability to sell our services to existing and prospective customers.
If our or our customers' access to data becomes limited, our business, results of operations and financial condition may be adversely affected.
The success of our platform is dependent in large part on our customers’ ability to access data maintained on third party software and service platforms. Generally, we do not have agreements in place with these third parties that guarantee access to their platforms, and any agreements that we do have in place with these third parties are typically terminable for convenience by the third party. If these third parties restrict or prevent our ability to integrate our platform with their software or platform, including but not limited to, by limiting the functionality of our data connectors, our ability to access the data maintained on their systems or the speed at which such data is delivered, customers’ ability to access their relevant data in a timely manner may be limited, and our business and operating results may be adversely affected.
Our business depends on continued and unimpeded access to the internet and mobile networks.
Our customers who access our platform and services through mobile devices, such as smartphones, laptops and tablet computers, must have a high-speed internet connection to use our services. Currently, this access is provided by telecommunications companies and internet access service providers that have significant and increasing market power in the broadband and internet access marketplace. In the absence of government regulation, these providers could take measures that affect their customers’ ability to use our products and services, such as degrading the quality of the data packets we transmit over their lines, giving our packets low priority, giving other packets higher priority than ours, blocking our packets entirely, or attempting to charge their customers more for using our platform and services. To the extent that internet service providers implement usage-based pricing, including meaningful bandwidth caps, or otherwise try to monetize access to their networks, we could incur greater operating expenses and customer acquisition and retention could be negatively impacted. Furthermore, to the extent network operators were to create tiers of internet access service and either charge us for or prohibit our services from being available to our customers through these tiers, our business could be negatively impacted.
On February 26, 2015, the Federal Communications Commission (the FCC) reclassified broadband internet access services in the United States as a telecommunications service subject to some elements of common carrier regulation, including the obligation to provide service on just and reasonable terms, and adopted specific net neutrality rules prohibiting the blocking, throttling or “paid prioritization” of content or services. However, in December 2017, the FCC once again classified broadband internet access service as an unregulated information service and repealed the specific rules against blocking, throttling or “paid prioritization” of content or services. It retained a rule requiring internet service providers to disclose their practices to consumers, entrepreneurs and the FCC. A number of parties have already stated they would appeal this order and it is possible Congress may adopt legislation restoring some net neutrality requirements. The elimination of net neutrality rules and any changes to the rules could affect the market for broadband internet access service in a way that impacts our business, for example, if internet access providers begin to limit the bandwidth and speed for the transmission of data from independent software vendors.
Incorrect or improper implementation or use of our platform could result in customer dissatisfaction and negatively affect our business, results of operations, financial condition, and growth prospects.
Our platform is deployed in a wide variety of technology environments. Increasingly, our platform has been deployed in large scale, complex technology environments, and we believe our future success will depend on our ability to increase sales of our platform for use in such deployments. We must often assist our customers in achieving successful implementations of our platform, which we do through our professional services organization. The time required to implement our platform can vary. For complex deployments, implementation can take multiple months. If our customers are unable to implement our platform successfully, or unable to do so in a timely manner, customer perceptions of our platform may be harmed, our reputation and brand may suffer, and customers may choose to cease usage of our platform or not expand their use of our platform. Our customers and third-party partners may need training in the proper use of and the variety of benefits that can be derived from our platform to maximize its benefits. If our platform is not effectively implemented or used correctly or as intended, or if we fail to adequately train customers on how to efficiently and effectively use our platform, our customers may not be able to achieve satisfactory outcomes. This could result in negative publicity and legal claims against us, which may cause us to generate fewer sales to new customers and reductions in renewals or expansions of the use of our platform with existing customers, any of which would harm our business and results of operations.
Our use of “open source” software could negatively affect our ability to offer our platform and subject us to possible litigation.
Our platform uses “open source” software that we, in some cases, have obtained from third parties. Open source software is generally freely accessible, usable and modifiable, and is made available to the general public on an “as-is” basis under the terms of a non-negotiable license. Use and distribution of open source software may entail greater risks than use of third-party commercial software. Open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or other claims relating to violation of intellectual property rights or the quality of the software. In addition, certain open source licenses, like the GNU Affero General Public License may require us to offer for no cost the components of our platform that incorporate the open source software, to make available source code for modifications or derivative works we create by incorporating or using the open source software, or to license our modifications or derivative works under the terms of the particular open source license. If we are required, under the terms of an open source license, to release our proprietary source code to the public, competitors could create similar products with lower development effort and time, which ultimately could result in a loss of sales for us.
We may also face claims alleging noncompliance with open source license terms or infringement, misappropriation or other violation of open source technology. These claims could result in litigation or require us to purchase a costly license, devote additional research and development resources to re-engineer our platform, discontinue the sale of our products if re-engineering could not be accomplished on a timely or cost-effective basis, or make generally available our proprietary code in source code form, any of which would have a negative effect on our business and operating results, including being enjoined from the offering of the components of our platform that contained the open source software. We could also be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition and require us to devote additional research and development resources to re-engineer our platform.
Although we monitor our use of open source software and try to ensure that none is used in a manner that would subject our platform to unintended conditions, few courts have interpreted open source licenses, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our platform. We cannot guarantee that we have incorporated open source software in our platform in a manner that will not subject us to liability, or in a manner that is consistent with our current policies and procedures.
Risks Related to Our Personnel and Operations
If we fail to effectively align, develop and expand our sales and marketing capabilities with our new pricing structure and increase sales efficiency, our ability to increase our customer base and increase acceptance of our platform could be harmed.
To increase the number of customers and increase the market acceptance of our platform, we will need to align and expand our sales and marketing operations, including our domestic and international sales force, with our new pricing structure and increase sales efficiency. We are aligning our cost structure to better reflect significant product and business model innovation with the expectation that go-to-market operations in our new consumption-based business model will be more efficient and require less investment. We will continue to dedicate significant resources to sales and marketing programs. We believe that there is significant competition for direct sales personnel with the sales skills and technical knowledge that we require. Our ability to achieve significant revenue growth in the future will depend, in large part, on our success in recruiting, training and retaining a sufficient number of direct sales personnel and sales leadership. New hires require significant training and time before they achieve full productivity, particularly in new sales territories. Recent hires and planned hires may not become as productive as quickly as we would like, changes in sales leadership could adversely affect our existing sales personnel, and we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the markets where we do business. The effectiveness of our sales and marketing has also varied over time and, together with the effectiveness of any partners or resellers we may engage, may vary in the future. Our business and operating results may be harmed if our efforts do not generate a correspondingly significant increase in revenue. We may not achieve revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective. In particular, we may in the future need to further adjust our go-to-market cost structure and target metrics, particularly as they relate to how we structure, effect, and compensate our direct sales personnel to become more efficient and effective at selling under a consumption-based business model. Any adjustments in compensation structure could negatively affect the productivity of our direct sales personnel, and there is no assurance that
we will be able to successfully implement the adjustments in a timely or cost-effective manner, or that we will be able to realize all or any of the expected benefits from such adjustments.
We may be subject to litigation in the future, which will require significant management attention, could result in significant legal expenses and may result in unfavorable outcomes, all or any of which could adversely affect our operating results, harm our reputation or otherwise negatively impact our business.
We may in the future become subject to litigation or claims arising in or outside the ordinary course of business that could negatively affect our business operations and financial condition, including securities class actions and shareholder derivative actions, both of which are typically expensive to defend.
The outcome of any litigation, regardless of its merits, is inherently uncertain. Any claims and lawsuits, and the disposition of such claims and lawsuits, could be time-consuming and expensive to resolve, divert management attention and resources, and lead to attempts on the part of other parties to pursue similar claims. Any adverse determination related to litigation could adversely affect our operating results, harm our reputation or otherwise negatively impact our business. In addition, depending on the nature and timing of any such dispute, a resolution of a legal matter could materially affect our future operating results, our cash flows or both.
We have experienced management and board turnover, which creates uncertainties and could harm our business.
In March 2023, we announced John Mellor's resignation and the re-appointment of Joshua G. James as our chief executive officer. In December 2022, we announced the resignation of Bruce Felt as our chief financial officer and, in March 2023, the appointment of David Jolley to replace Mr. Felt. In January 2023, we announced the resignation of Catherine Wong as our chief operating officer and executive vice president of engineering and the appointment of Daren Thayne to succeed Ms. Wong as executive vice president of engineering. Mr. Thayne assumed the responsibilities of Ms. Wong in addition to his previous responsibilities. In addition, we recently have experienced significant changes in the composition of our board of directors, and more could occur in the future. In February 2023, we announced the resignation of Laurence “Jay” Brown, Jr., Dana Evan and Joy Driscoll Durling as our directors. In March 2023, we announced the appointment of Dan Strong and Renée Soto to our board of directors to fill the open vacancies. Changes to strategic or operating goals, which can often times occur with the appointment of new executives and directors, can create uncertainty, may negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as the new executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board turnover inherently causes some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience additional management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.
If we are unable to attract, integrate and retain additional qualified personnel, including top technical talent, our business could be adversely affected.
Future success depends in part on our ability to identify, attract, integrate and retain highly skilled technical, managerial, sales and other personnel. We face intense competition for qualified individuals from numerous other companies, including other software and technology companies, many of whom have greater financial and other resources than we do. These companies also may provide more diverse opportunities and better chances for career advancement. Some of these characteristics may be more appealing to high-quality candidates than those we have to offer. In addition, new hires often require significant training and, in many cases, take significant time before they achieve full productivity. We may incur significant costs to attract and retain qualified personnel, including significant expenditures related to salaries and benefits and compensation expenses related to equity awards, and we may lose new employees to competitors or other companies before we realize the benefit of our investment in recruiting and training them. Moreover, new employees may not be or become as productive as we expect, as we may face challenges in adequately or appropriately integrating them into our workforce and culture. As we move into new geographies, we will need to attract and recruit skilled personnel in those areas and may face additional challenges in attracting, integrating and retaining international employees. If we are unable to attract, integrate and retain suitably qualified individuals who are capable of meeting our growing technical, operational and managerial requirements, on a timely basis or at all, our business will be adversely affected.
Volatility or lack of positive performance in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their vested options have significantly appreciated in value relative to the original purchase prices of the shares or the exercise prices of the options, or, conversely, if the exercise prices of the options that they hold are significantly above the market price of our
common stock. If we are unable to appropriately incentivize and retain our employees through equity compensation, or if we need to increase our compensation expenses in order to appropriately incentivize and retain our employees, our business, operating results, financial condition and cash flows would be adversely affected and the ownership of existing shareholders would be diluted.
If we fail to offer high-quality professional services and support, our business and reputation may suffer.
High-quality professional services and support, including training, implementation and consulting services, are important for the successful marketing, sale and use of our platform and for the renewal of subscriptions by existing customers. Professional services may be provided by us or by a third-party partner. The importance of high-quality professional services and support will increase as we expand our business and pursue new customers. If we or our third-party partners do not provide effective ongoing support, our ability to retain and expand use of our platform and related applications to existing customers may suffer, and our reputation with existing or potential customers may be harmed.
We continue to pursue strategies to reduce the amount of professional services required for a customer to begin to use and gain value from our platform, lower the overall costs of professional service fees to our customers, and improve the gross margin of our professional services business. If we are unable to successfully accomplish these objectives, our operating results, including our profit margins, may be harmed.
Catastrophic events may disrupt our business and impair our ability to provide our platform to customers, resulting in costs for remediation, customer dissatisfaction, and other business or financial losses.
Our operations depend, in part, on our ability to protect our facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts and similar events. Despite precautions taken at our facilities, the occurrence of a natural disaster, epidemic or pandemic (such as the COVID-19 pandemic), an act of terrorism, vandalism or sabotage, spikes in usage volume or other unanticipated problems at a facility could result in lengthy interruptions in the availability of our platform. Even with current and planned disaster recovery arrangements, our business could be harmed. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce revenue, subject us to liability and cause us to issue credits or cause customers to fail to renew their subscriptions, any of which could harm our business.
Our long-term growth depends in part on being able to expand internationally on a profitable basis.
Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 78%, and 79% of our total revenue for the years ended January 31, 2023 and 2024, respectively, was derived from sales within the United States. We have begun to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:
•the need to make significant investments in people, solutions and infrastructure, typically well in advance of revenue generation;
•the need to localize and adapt our application for specific countries, including translation into foreign languages and associated expenses;
•potential changes in public or customer sentiment regarding cloud-based services or the ability of non-local enterprises to provide adequate data protection, particularly in the European Union (the E.U.);
•technical or latency issues in delivering our platform;
•dependence on certain third parties, including resellers with whom we do not have extensive experience;
•the lack of reference customers and other marketing assets in regional markets that are new or developing for us, as well as other adaptations in our market generation efforts that we may be slow to identify and implement;
•unexpected changes in regulatory requirements, taxes or trade laws;
•differing labor regulations, especially in the E.U., where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations;
•challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits and compliance programs;
•difficulties in maintaining our company culture with a dispersed and distant workforce;
•difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems and regulatory systems;
•currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we choose to do so in the future;
•limitations on our ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries;
•limited or insufficient intellectual property protection, or the risk that our products may conflict with, infringe or otherwise violate foreign intellectual property;
•political instability, terrorist activities or military conflicts (including the Russian invasion of Ukraine and hostilities between Israel and Hamas);
•requirements to comply with foreign privacy, information security, and data protection laws and regulations and the risks and costs of non-compliance;
•likelihood of potential or actual violations of domestic and international anticorruption laws, such as the U.S. Foreign Corrupt Practices Act (the FCPA), and the U.K. Bribery Act, or of U.S. and international export control and sanctions regulations, which likelihood may increase with an increase of sales or operations in foreign jurisdictions and operations in certain industries;
•requirements to comply with U.S. export control and economic sanctions laws and regulations and other restrictions on international trade;
•likelihood that the United States and other governments and their agencies impose sanctions and embargoes on certain countries, their governments and designated parties, which may prohibit the export of certain technology, products, and services to such persons;
•adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash should we desire to do so; and
•our ability to recruit and engage local channel and implementation partners.
Any of these risks could adversely affect our international operations, reduce our international revenue or increase our operating costs, adversely affecting our business, operating results and financial condition and growth prospects. Our limited experience operating our business in certain geographies outside of the United States increases the risk that recent and any potential future expansion efforts will not be successful. If substantial time and resources invested to expand our international operations do not result in a successful outcome, our operating results and business will suffer.
In addition, compliance with laws and regulations applicable to our international operations increases the cost of doing business in foreign jurisdictions. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could have adverse effects on our business. In addition, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. laws and regulations applicable to us. There can be no assurance that all of our employees, contractors, and agents will comply with the formal policies we will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties, or the prohibition of the importation or exportation of our software and services and could have a material adverse effect on our business and operating results.
Some of our business partners also have international operations and are subject to the risks described above. Even if we are able to successfully manage the risks of international operations, our business may be adversely affected if our business partners are not able to successfully manage these risks.
Future changes in the regulations and laws of the United States, or those of the international markets in which we do business, could harm our business.
We are subject to general business regulations and laws, as well as regulations and laws specifically governing the internet and software, in the United States as well as the international markets in which we do business. These regulations and laws may cover employment, taxation, privacy, data security, data protection, pricing, content, copyrights and other intellectual property, mobile communications, electronic contracts and other communications, consumer protection, unencumbered internet access to our services, the design and operation of websites, and the characteristics and quality of software and services. It is possible changes to these regulations and laws, as well as compliance challenges related to the complexity of multiple, conflicting and changing sets of applicable regulations and laws, may impact our sales, operations, and future growth.
Future acquisitions could disrupt our business and adversely affect our operating results, financial condition and cash flows.
We may make acquisitions that could be material to our business, operating results, financial condition and cash flows. Our ability as an organization to successfully acquire and integrate technologies or businesses is unproven. Acquisitions involve many risks, including the following:
•an acquisition may negatively affect our operating results, financial condition or cash flows because it may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to the acquisition;
•we may encounter difficulties or unforeseen expenditures in integrating the business, technologies, products, personnel or operations of any company that we acquire, particularly if key personnel of the acquired company decide not to work for us;
•an acquisition may disrupt our ongoing business, divert resources, increase our expenses and distract our management;
•an acquisition may result in a delay or reduction of customer purchases for both us and the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;
•we may encounter difficulties in, or may be unable to, successfully sell any acquired products;
•an acquisition may involve the entry into geographic or business markets in which we have little or no prior experience or where competitors have stronger market positions;
•the potential strain on our financial and managerial controls and reporting systems and procedures;
•potential known and unknown liabilities associated with an acquired company;
•if we incur debt to fund such acquisitions, such debt may subject us to material restrictions on our ability to conduct our business as well as financial maintenance covenants;
•the risk of impairment charges related to potential write-downs of acquired assets or goodwill in future acquisitions;
•to the extent that we issue a significant amount of equity or convertible debt securities in connection with future acquisitions, existing stockholders may be diluted and earnings per share may decrease; and
•managing the varying intellectual property protection strategies and other activities of an acquired company.
We may not succeed in addressing these or other risks or any other problems encountered in connection with the integration of any acquired business. The inability to integrate successfully the business, technologies, products, personnel or operations of any acquired business, or any significant delay in achieving integration, could have a material adverse effect on our business, operating results, financial condition and cash flows.
Governmental export or import controls could limit our ability to compete in foreign markets and subject us to liability if we violate them.
Our software is subject to U.S. export controls, and we incorporate encryption technology into our platform. These products and the underlying technology may be exported only with the required export authorizations, including by license, a license exception or other appropriate government authorizations. U.S. export controls may require submission of a product classification and annual or semi-annual reports. Governmental regulation of encryption technology and regulation of imports or exports of encryption products, or our failure to obtain required import or export authorization for our platform, when applicable, could harm our international sales and adversely affect our revenue. Compliance with applicable regulatory requirements regarding the export of our platform, including with respect to new releases of our platform, may create delays in the introduction of our product releases in international markets, prevent customers with international operations from deploying our platform or, in some cases, prevent the export of our platform to some countries altogether. Furthermore, U.S. export control laws and economic sanctions prohibit the shipment of certain products and services to countries, governments and persons targeted by U.S. sanctions. If we fail to comply with export and import regulations and such economic sanctions, we may be fined or other penalties could be imposed, including a denial of certain export privileges. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our platform by, or in our decreased ability to export or sell subscriptions to our platform to, existing or potential customers with international operations. Any decreased use of our platform or limitation on our ability to export or sell subscriptions to our platform would likely adversely affect our business, financial condition and operating results.
Failure to comply with anti-bribery, anti-corruption, and anti-money laundering laws could subject us to penalties and other adverse consequences.
We are subject to the FCPA, the U.K. Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions both domestic and abroad. Anti-corruption, anti-bribery, and anti-money laundering laws have been enforced aggressively in recent years and are interpreted broadly and generally prohibit companies and their directors, officers, employees and agents from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the private sector. Such laws apply to our agents/third parties, and we leverage third parties, including channel partners, to sell subscriptions to our platform and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, and agents, even if we do not explicitly authorize such activities. While we have policies and procedures to address compliance with such laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. Any violation of the FCPA or other applicable anti-bribery, anti-corruption laws, and anti-money laundering laws could result in whistleblower complaints, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, a significant diversion of management's resources and attention or suspension or debarment from U.S. government contracts, all of which may have a material adverse effect on our reputation, business, operating results and prospects.
Risks Related to Privacy and Cybersecurity
We are subject to governmental laws, regulation and other legal obligations, particularly those related to privacy, data protection and information security, and any actual or perceived failure to comply with such obligations could impair our efforts to maintain and expand our customer base, causing our growth to be limited and harming our business.
We receive, store, and otherwise process personal information and other data from and about customers and other individuals in addition to our employees and service providers. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (FTC) and various state, local, and foreign agencies. Our data handling also is subject to contractual obligations and may be alleged or deemed to be subject to industry standards, including certain industry standards that we undertake to comply with.
In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating
levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in the November 3, 2020 election. The CPRA amends and expands the CCPA in numerous respects, including by expanding the CCPA’s private right of action. The CPRA created additional obligations relating to consumer data beginning on January 1, 2022, and became effective January 1, 2023. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that will become effective in 2024, Delaware, Iowa and Tennessee have adopted such legislation that will become effective in 2025, and Indiana has adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and information security, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and information security on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.
In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, the People’s Republic of China (the PRC), India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for non-compliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged non-compliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.
Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed after four years, however, and may be modified or revoked in the interim. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.
We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds in September 2020. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), which would permit transfers of personal data from the E.U. to the U.S., by participating entities. The European
Commission adopted an adequacy decision with respect to the DPF in July 2023, allowing for the DPF to be implemented and available for companies to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF and to the Swiss-U.S. Data Privacy Framework (the Swiss DPF). Each of these frameworks may be subject to legal challenge. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, and the United Kingdom to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland and the United Kingdom to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, and the United Kingdom to the U.S. We and our customers may face a risk of enforcement actions by data protection authorities in the E.U. and other jurisdictions relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance or refusal of European or multi-national customers to use our solutions and being subject to regulatory action or incurring penalties. Any of these developments may have an adverse effect on our business.
Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and information security, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the PRC was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.
Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.
We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.
Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or information security may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, information security, marketing, or consumer communications may result in governmental investigations and
enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and information security proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.
In addition to the privacy regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as AICPA’s SOC 1 and SOC 2; International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF; and Texas Department of Information Resources’ TX-RAMP certification. Annually, we also perform an internal/self-analysis of our adherence to the requirements stated in Australian Cyber Security Center (ASCS)’s IRAP framework and UK’s National Cyber Security Centre’s Cyber Essentials. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and information security may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition.
If our network, application, or computer systems are breached or unauthorized access to customer data or other sensitive data is otherwise obtained, our platform may be perceived as insecure and we may lose existing customers or fail to attract new customers, operations may be disrupted if systems or data become unavailable, our reputation may be damaged and we may incur significant remediation costs or liabilities, including regulatory fines for violation of compliance requirements.
As a provider of cloud services, our operations involve the storage and transmission of our customers’ sensitive and proprietary information, and we also collect, store, transmit, and otherwise process large amounts of sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally, and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional data security risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, modify, or access without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to company data as well as customer personal information and/or customer data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third party cloud hosting services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals.
We engage third-party service providers to store and otherwise process some of our and our customers’ data, including personal, confidential, sensitive, and other information relating to individuals. Our service providers may also be the targets of cyberattacks and other malicious activity. While we have established a formal third party security risk assessment process
to address security risks for our company relating to our key third party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties may be able to circumvent those security measures or our own security measures, resulting in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. We also use and rely on several open source libraries and packages, and certain libraries and packages while developing our product and if such libraries or packages are vulnerable and are exploited, our ability to address such vulnerabilities in a timely manner may be limited and may result in disruptions to our platform or operations and in unavailability of or unauthorized access to, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. Occasionally, we also deploy code generated by Artificial Intelligence (AI) tools and improper or inadequate vetting of AI-generated code for any security related vulnerabilities may result in exploitation of such vulnerabilities leading to disruption, unauthorized access to our infrastructure, our confidential data or our customers' data.
Additionally, there have been and may continue to be significant supply chain cyber-attacks generally, and our third-party service providers (and business partners) may be targeted or impacted by such attacks. We cannot guarantee that our systems and networks or those of our vendors or service providers have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach or compromise of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Malicious actors may be able to circumvent those security measures, resulting in unavailability of, unauthorized access to, misuse, disclosure, loss, unavailability, destruction, or other processing of our and our customers’ data, including sensitive and personal information. We and our service providers may also face difficulties or delays in identifying, remediating, and otherwise responding to cyberattacks and other security breaches and incidents. Because the techniques used and vulnerabilities exploited to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or vulnerabilities or implement adequate preventative measures. We may also experience security breaches and incidents that remain undetected for an extended period.
Enterprise use of generative artificial intelligence (GenAI) technologies may result in access to and processing of sensitive information, intellectual property, source code, trade secrets, and other data, through direct user input or the API, including customer or private information and confidential information. Sending confidential and private data outside of our own servers could trigger legal and compliance exposure, as well as risks of information exposure, including unauthorized acquisition, use, or other processing. Such exposure can result from contractual (for example, with customers) or regulatory obligations (such as CCPA, GDPR, HIPAA). Furthermore, if the GenAI platform’s own systems and infrastructure are not secure, data breaches or incidents may occur and lead to the exposure of sensitive information such as customer data, financial information, and proprietary business information, or it may be believed or asserted that one or more of these has occurred. Threat actors could also use GenAI for malicious purposes, increasing the frequency of their attacks and the complexity level some are currently capable of, e.g. phishing attacks, fraud, social engineering, and other possible malicious use, such as with writing malware. Code generated by GenAI could potentially be used and deployed without a proper security audit or code review to find vulnerable or malicious components. This could cause widespread deployment of vulnerable code within the organization systems.
In addition, insider threats pose significant risks to our business, potentially compromising the confidentiality, integrity, and availability of customer data and the overall reputation of the organization. As employees or trusted individuals have authorized access to sensitive systems and customer information, malicious insiders may intentionally abuse their privileges, leading to actual or perceived data breaches or incidents, intellectual property theft or misappropriation, or unauthorized access to, or use of, systems or data. Additionally, insiders may inadvertently access, use, expose, or otherwise process confidential, personal, or otherwise critical information, or engage in unauthorized access to or use of company devices, networks, systems, or other resources, due to error, negligence, lack of awareness, or otherwise. We have suffered certain of these incidents in the past and expect that they will occur in the future.
From time to time, third parties have published, and may publish, unauthorized websites that give a false impression of being official Domo websites. Purveyors of these unauthorized websites may deceive job applicants, potential customers, and other third parties into believing they are interacting with us and may, among other things, collect and misuse their personal information or purport to charge them money in connection with submitting a job application, or performing a task pertaining to the Domo application, such as testing the application to optimize performance. These activities may disrupt our sales, human resources, and other functions, significantly harm our brand, reputation and market position, and result in claims, demands, inquiries, and potential liabilities.
Any security breach, security incident, or similar event impacting our platform, our networks or systems, or any systems or networks of our service providers, whether as a result of third-party action, insider attacks, employee or service provider error or malfeasance, phishing or smishing attacks, ransomware or other malware, social engineering, or otherwise, could result in unauthorized access to or use of our platform, disruptions to our platform or other aspects of our operations, the loss, alteration or unavailability of, or unauthorized access to or acquisition or other processing of, data or intellectual property of ourselves or our customers. Additionally, any such breach or incident, or unauthorized use of company resources, or any perception that any such event has occurred, may result in a loss of business, severe reputational or brand damage adversely affecting customer, partner, or investor confidence, regulatory investigations, demands, and orders, litigation or other claims, demands, or proceedings by governmental authorities or private parties, indemnity obligations, damages for contract breach, penalties for violation of applicable laws, regulations, or contractual obligations, and significant costs for remediation that may include liability for stolen assets or information and repair of system damage that may have been caused, incentives offered to customers or other business partners in an effort to maintain business relationships after a breach, incident, or other event, and other liabilities, as well as harm to our sales efforts and expansion into existing and new markets.
We could be required to expend significant capital and other resources to alleviate problems caused by such actual or perceived security breaches, incidents, or other events and to remediate our systems, we could be exposed to a risk of loss, litigation or regulatory action and possible liability, and our ability to operate our business may be impaired. Additionally, actual, potential, or anticipated attacks, security breaches or incidents, or other events, may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants.
Due to political and macroeconomic uncertainty and military actions associated with geopolitical events such as Russia’s invasion of Ukraine and hostilities between Israel and Hamas, we and our third-party service providers may be vulnerable to a heightened risk of cybersecurity attacks, phishing attacks, viruses, malware, ransomware, hacking, distributed denial of service, or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our systems, operations, and platform. In addition, if the security measures of our customers are compromised, even without any actual compromise of our platform or systems or any networks or systems of our service providers, we may face negative publicity or reputational harm if customers or others incorrectly attribute the blame for such security breaches or other incidents to us, our platform, our systems or networks, or those of our service providers. Similarly, we may face reputational harm if any security breach or incident is caused by or otherwise attributed to our employees, vendors, or service providers as a result of inadvertent error, malfeasance, an insider attack, or otherwise. If customers or partners believe that our platform does not provide adequate security for the storage of personal or other sensitive information or its transmission over the internet, our business will be harmed. Customers’ concerns about security or privacy may deter them from using our platform for activities that involve personal or other sensitive information.
Our insurance covering certain security and privacy damages and claim expenses may not be sufficient to compensate for all liability. Although we maintain insurance for liabilities incurred as a result of certain matters relating to privacy and information security, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.
Additionally, with data security a critical competitive factor in our industry, we make public statements in our privacy policies, on our website, and elsewhere describing the security of our platform. Should any of these statements be untrue, become untrue, or be perceived to be untrue, even if through circumstances beyond our reasonable control, we may face claims, including claims of unfair or deceptive trade practices, and related investigations, enforcement actions or other proceedings, brought by the FTC, state, local, or foreign regulators, and private litigants, which may result in fines, penalties, and other liabilities, and which may have a material adverse effect on our business, including our financial condition, operating results, and reputation.
Real or perceived errors, failures, or bugs in our platform could adversely affect our operating results and growth prospects.
We update our platform on a frequent basis. Despite efforts to test our updates, errors, failures or bugs may not be found in our platform until after it is deployed to our customers. We have discovered and expect we will continue to discover errors,
failures and bugs in our platform and anticipate that certain of these errors, failures and bugs will only be discovered and remediated after deployment to customers. Real or perceived errors, failures or bugs in our platform could result in negative publicity, government inquiries, loss of or delay in market acceptance of our platform, loss of competitive position, or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem.
We implement bug fixes and upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes and upgrades in a timely manner, any history of inaccuracies in the data we collect for our customers, or the loss, damage, unauthorized access to or acquisition of, or inadvertent release or exposure of confidential or other sensitive data could cause our reputation to be harmed and result in claims against us, and customers may elect not to purchase or renew their agreements with us or we may incur increased insurance costs. The costs associated with any material defects or errors in our software or other performance problems may be substantial and could harm our operating results.
Interruptions or performance problems associated with our technology and infrastructure may adversely affect our business and operating results.
Our continued growth depends in part on the ability of existing and potential customers to access our platform at any time. We have experienced, and may in the future experience, disruptions, outages, and other performance problems due to a variety of factors, including infrastructure changes, introductions of new capabilities, human or technology errors, distributed denial of service attacks, or other security related incidents. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It may become increasingly difficult to maintain and improve our performance, especially during peak usage times and as our platform becomes more complex and user traffic increases. If our platform is unavailable or if users are unable to access our platform within a reasonable amount of time, or at all, our business will be harmed.
We also rely on SaaS and other technologies from third parties in order to operate critical functions of our business. To the extent that our third-party service providers experience outages, disruptions, or other performance problems, or to the extent we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business and operating results may be adversely affected. In addition, if our agreements with third-party software or services vendors are not renewed or the third-party software or services become obsolete, fail to function properly, are incompatible with future versions of our products or services, are defective or otherwise fail to address our needs, there is no assurance that we would be able to replace the functionality provided by the third-party software or services with software or services from alternative providers.
We have taken steps to increase redundancy in our platform and infrastructure and have plans in place to mitigate events that could disrupt our platform's service. However, there can be no assurance that these efforts would protect against interruptions or performance problems.
Risks Related to Our Intellectual Property
Our business is highly dependent upon our brand recognition and reputation, and the failure to maintain or enhance our brand recognition or reputation would likely adversely affect our business and operating results.
We believe that maintaining and enhancing the Domo brand identity and our reputation are critical to our relationships with customers and channel partners and to our ability to attract new customers and channel partners. We also believe that the importance of our brand recognition and reputation will continue to increase as competition in our market continues to develop. Our success in this area will depend on a wide range of factors, some of which are beyond our control, including the following:
•the efficacy of our marketing efforts;
•our ability to maintain a high-quality, innovative and error- and bug-free platform;
•our ability to obtain new customers and retain and increase usage by existing customers;
•our ability to maintain high customer satisfaction;
•the quality and perceived value of our platform;
•our ability to obtain, maintain and enforce trademarks and other indicia of origin that are valuable to our brand;
•our ability to successfully differentiate our platform from competitors’ products;
•actions of competitors and other third parties;
•our ability to provide customer support and professional services;
•any actual or perceived security breach or data loss, or misuse or perceived misuse of our platform;
•positive or negative publicity;
•interruptions, delays or attacks on our platform;
•challenges with customer adoption and use of our platform on mobile devices or problems encountered in developing or supporting enhancements to our mobile applications; and
•litigation or regulatory related developments.
If our brand promotion activities are not successful, our operating results and growth may be harmed.
Independent industry analysts often provide reviews of our platform, as well as competitors’ products, and perception of our platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of competitors’ products and services, our brand may be adversely affected.
Furthermore, negative publicity, whether or not justified, relating to events or activities attributed to us, our current or former employees, partners or others associated with any of these parties, may tarnish our reputation and reduce the value of our brand. Damage to our reputation and loss of brand equity may reduce demand for our platform, make it difficult for us to attract and retain employees, and have an adverse effect on our business, operating results and financial condition. Moreover, any attempts to rebuild our reputation and restore the value of our brand may be costly and time consuming, and such efforts may not ultimately be successful.
Third-party claims that we are infringing or otherwise violating the intellectual property rights of others, whether successful or not, could subject us to costly and time-consuming litigation or require us to obtain expensive licenses, and our business could be harmed.
The technology industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual property rights. Companies in the technology industry must often defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. Third parties, including our competitors, may own patents or other intellectual property rights that cover aspects of our technology or business methods and may assert patent or other intellectual property rights against us and others in the industry. Moreover, in recent years, individuals and groups that are non-practicing entities, commonly referred to as “patent trolls,” have purchased patents and other intellectual property assets for the purpose of making claims of infringement or other violation of intellectual property rights in order to extract settlements. From time to time, we have received and may receive in the future threatening letters, notices or “invitations to license,” or may be the subject of claims that our technology and business operations infringe or otherwise violate the intellectual property rights of others. Responding to such claims, regardless of their merit, can be time consuming, costly to defend in litigation, divert management’s attention and resources, damage our reputation and brand and cause us to incur significant expenses. Claims of intellectual property infringement or other violations of intellectual property rights might require us to stop using technology found to infringe or violate a third party’s rights, redesign our platform, which could require significant effort and expense and cause delays of releases, enter into costly settlement or license agreements or pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our platform. If we cannot or do not license the infringed or otherwise violated technology on commercially reasonable terms or at all, or substitute similar technology from another source, we could be forced to limit or stop selling our platform, we may not be able to meet our obligations to customers under our customer contracts, revenue and operating results could be adversely impacted, and we may be unable to compete effectively. Even if we are successful in defending against allegations of intellectual property infringement, litigation may be costly and may divert the time and other resources of our management. Additionally, customers may not purchase our platform if they are concerned that they may infringe or otherwise violate third-party intellectual property rights. The occurrence of any of these events may harm our business.
Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.
Our agreements with customers and other third parties may include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement or other violations of intellectual property rights, damages caused by us to property or persons, or other liabilities relating to or arising from our software, services or other contractual obligations. Large indemnity payments could harm our business, results of operations and financial condition. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business and results of operations.
The success of our business depends in part on our ability to protect and enforce our intellectual property rights.
Our success is dependent, in part, upon protecting our proprietary technology. As of January 31, 2024, we had 115 issued U.S. patents covering our technology and four patent applications pending for examination in the United States. Our issued patents, and any patents issued in the future, may not provide us with any competitive advantages or may be challenged by third parties, and our patent applications may never be granted. Additionally, the process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner. Even if issued, there can be no assurance that these patents will adequately protect our intellectual property, as the legal standards relating to the validity, enforceability and scope of protection of patent and other intellectual property rights are uncertain.
Any patents that are issued may subsequently be invalidated or otherwise limited, allowing other companies to develop offerings that compete with ours, which could adversely affect our competitive business position, business prospects and financial condition. In addition, issuance of a patent does not guarantee that we have a right to practice the patented invention. Patent applications in the United States are typically not published until 18 months after filing or, in some cases, not at all, and publications of discoveries in industry-related literature lag behind actual discoveries. We cannot be certain that we were the first to use the inventions claimed in our issued patents or pending patent applications or otherwise used in our platform, that we were the first to file for protection in our patent applications, or that third parties do not have blocking patents that could be used to prevent us from marketing or practicing our patented technology. Effective patent, trademark, copyright and trade secret protection may not be available to us in every country in which our platform is available. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States (in particular, some foreign jurisdictions do not permit patent protection for software), and mechanisms for enforcement of intellectual property rights may be inadequate. Additional uncertainty may result from changes to intellectual property legislation enacted in the United States, including the America Invents Act, and other national governments and from interpretations of the intellectual property laws of the United States and other countries by applicable courts and agencies. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property.
Although we generally enter into confidentiality and invention assignment agreements with our employees and consultants that have access to material confidential information and enter into confidentiality agreements with our customers and the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our platform and propriety information or prevent reverse engineering. Further, these agreements may not prevent competitors from independently developing technologies that are substantially equivalent or superior to our platform, and we may be unable to prevent this competition.
Unauthorized use of our intellectual property may have already occurred or may occur in the future. We may be required to spend significant resources to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. We may not prevail in any lawsuits that we initiate. Any litigation, whether or not resolved in our favor, could subject us to substantial costs, divert resources and the attention of management and technical personnel from our business and adversely affect our business. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation, could delay further sales or the implementation of our platform, impair the functionality of our platform, delay introductions of new features or enhancements, result in our substituting inferior or more costly technologies into our platform, or injure our reputation.
We may initiate claims or litigation against third parties for infringement or other violation of our proprietary rights or to establish the validity of our proprietary rights. Litigation also puts our patents at risk of being invalidated or interpreted narrowly and our patent applications at risk of not issuing. Additionally, we may provoke third parties to assert counterclaims against us. We may not prevail in any lawsuits that we initiate, and the damages or other remedies awarded, if any, may not be commercially viable. Any litigation, whether or not it is resolved in our favor, could result in significant expense to us and divert the efforts of our technical and management personnel, which may adversely affect our business, operating results, financial condition and cash flows.
Risks Related to Our Corporate Governance
The dual class structure of our common stock has the effect of concentrating voting control with Joshua G. James, our founder and chief executive officer, which will limit your ability to influence the outcome of important transactions, including a change in control.
Our Class A common stock has 40 votes per share, and our Class B common stock has one vote per share. Joshua G. James, our founder and chief executive officer, beneficially owns all of our outstanding shares of Class A common stock through Cocolalla, LLC, of which he is the managing member, and as of January 31, 2024, beneficially controlled approximately 80% of the voting power of our outstanding capital stock and therefore is able to control all matters submitted to our stockholders for approval. Mr. James may have interests that differ from yours and may vote in a way with which you disagree and which may be adverse to your interests. This concentrated control may have the effect of delaying, preventing or deterring a change in control of our company, could deprive our stockholders of an opportunity to receive a premium for their capital stock as part of a sale of our company and might ultimately affect the market price of our Class B common stock.
Future transfers by the holder of Class A common stock will generally result in those shares converting into shares of Class B common stock, subject to limited exceptions, such as certain transfers effected for estate planning or charitable purposes. Mr. James has informed us he and Cocolalla, LLC have entered into arrangements under which he has pledged all of such shares to secure a loan with a financial institution. If these shares were to be sold or otherwise transferred upon default of the underlying loan, the market price of our Class B common stock could decline or be volatile. For additional information, see the section of this report captioned “—Other Risks Related to Ownership of Our Class B Common Stock—Future sales of our Class B common stock in the public market could cause our stock price to fall.”
We are a "controlled company" within the meaning of Nasdaq rules, and as a result may choose to rely on exemptions from certain corporate governance requirements.
We qualify as a “controlled company” under the corporate governance rules of The Nasdaq Stock Market because our founder and chief executive officer, and entities beneficially owned by him, control more than fifty percent of the voting power of our outstanding common stock. Although, as of the date of this report, the composition of our board of directors and its committees currently complies with applicable corporate governance rules of The Nasdaq Stock Market, we have previously, and may in the future rely, on the foregoing exemptions provided to controlled companies under the corporate governance rules of The Nasdaq Stock Market. If we, in the future, rely on these “controlled company” exemptions, we may not have a majority of independent directors on our board of directors, an entirely independent nominating and corporate governance committee, an entirely independent compensation committee or perform annual performance evaluations of the nominating and corporate governance and compensation committees unless and until such time as we are required to do so. Accordingly, you may not have the same protections afforded to stockholders of companies that are subject to all of these corporate governance requirements. If we cease to be a “controlled company” and our shares continue to be listed on The Nasdaq Global Market, we will be required to comply with these provisions within the applicable transition periods.
We cannot predict the impact our dual class structure may have on our stock price or our business.
We cannot predict whether our dual class structure, combined with the concentrated control of our stockholders who held our capital stock prior to the completion of our initial public offering, including our executive officers, employees and directors and their affiliates, will result in a lower or more volatile market price of our Class B common stock or in adverse publicity or other adverse consequences. For example, certain index providers have announced restrictions on including companies with multiple-class share structures in certain of their indexes. In July 2017, FTSE Russell announced that it plans to require new constituents of its indexes to have greater than 5% of the company's voting rights in the hands of public stockholders, and S&P Dow Jones announced that it will no longer admit companies with multiple-class share structures to certain of its indexes. Because of our dual class structure, we will likely be excluded from these indexes and we cannot assure you that other stock indexes will not take similar actions. Given the sustained flow of investment funds into passive strategies
that seek to track certain indexes, exclusion from stock indexes would likely preclude investment by many of these funds and could make our Class B common stock less attractive to other investors. As a result, the market price of our Class B common stock could be adversely affected.
Risks Related to Our Financial Reporting and Disclosure
Our reported financial results may be harmed by changes in the accounting principles generally accepted in the United States.
Generally accepted accounting principles in the United States are subject to interpretation by the Financial Accounting Standards Board, the Securities and Exchange Commission (SEC) and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results, and may even affect the reporting of transactions completed before the announcement or effectiveness of a change. Other companies in our industry may apply these accounting principles differently than we do, adversely affecting the comparability of our financial statements.
We have incurred and will continue to incur increased costs by being a public company, including costs to maintain adequate internal control over our financial and management systems.
As a public company, we have incurred and will continue to incur significant legal, accounting and other expenses that we did not incur as a private company, including costs associated with public company reporting requirements.
We have also incurred and will continue to incur costs associated with corporate governance requirements, including requirements of the SEC and The Nasdaq Stock Market. We expect these rules and regulations to increase our legal and financial compliance costs and to make some activities more time-consuming and costly. We also expect these rules and regulations may make it more difficult and more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. As a result, we may have more difficulty attracting and retaining qualified individuals to serve on our board of directors or as executive officers. We are currently evaluating and monitoring developments with respect to these rules, and we cannot predict or estimate the additional costs we may incur or the timing of such costs.
The Sarbanes-Oxley Act requires, among other things, that we assess the effectiveness of our internal control over financial reporting annually and the effectiveness of our disclosure controls and procedures quarterly. In particular, Section 404 of the Sarbanes-Oxley Act (Section 404) requires us to perform system and process evaluation and testing of our internal controls over financial reporting to allow management to report on, and our independent registered public accounting firm potentially to attest to, the effectiveness of our internal controls over financial reporting. Our compliance with applicable provisions of Section 404 will require that we incur substantial accounting expense and expend significant management time on compliance-related issues as we implement additional corporate governance practices and comply with reporting requirements. Moreover, if we are not able to comply with the requirements of Section 404 applicable to us in a timely manner, or if we or our independent registered public accounting firm identifies deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, the market price of our stock could decline and we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources.
Other Risks Related to Ownership of Our Class B Common Stock
The market price of our Class B common stock may be volatile, and the value of your investment could decline significantly.
The trading price of our Class B common stock may be highly volatile and could be subject to wide fluctuations in response to various factors, some of which are beyond our control. The following factors, in addition to other risks described in this report, may have a significant effect on our Class B common stock price:
•actual or anticipated fluctuations in revenue and other operating results, including as a result of the addition or loss of any number of customers;
•announcements by us or competitors of significant technical innovations, acquisitions, strategic partnerships, joint ventures or capital commitments;
•the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;
•failure of securities analysts to initiate or maintain coverage of us, changes in ratings, key metrics and financial estimates and the publication of other news by any securities analysts who follow our company, or our failure to meet these analyst estimates or the expectations of investors;
•changes in operating performance and stock market valuations of cloud-based software or other technology companies, or those in our industry in particular;
•the size of our public float;
•price and volume fluctuations in the trading of our Class B common stock and in the overall stock market, including as a result of trends in the economy as a whole or in the technology industry;
•new laws or regulations or new interpretations of existing laws or regulations applicable to our business or industry, including those relating to data privacy and data security;
•lawsuits threatened or filed against us for claims relating to intellectual property, employment issues or otherwise;
•actual or perceived data breach or data loss, or misuse or perceived misuse of our platform;
•changes in our board of directors or management;
•short sales, hedging and other derivative transactions involving our Class B common stock;
•sales of large blocks of our common stock including sales by our executive officers, directors and significant stockholders; and
•other events or factors, including those resulting from war, incidents of terrorism, public health epidemics or pandemics, bank failures, changes in general economic, industry and market conditions and trends, natural disasters, or responses to any of these events or factors that may affect our operations.
In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect our stock price, regardless of our actual operating performance. In addition, in the past, securities class action litigation has often been instituted against companies whose stock prices have declined, especially following periods of volatility in the overall market. Securities class action litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.
If securities or industry analysts do not publish research reports about our business, or if they issue an adverse opinion about our business, our stock price and trading volume could decline.
The trading market for our Class B common stock and customer demand for our platform is influenced by the research and reports that securities and industry analysts publish about us or our business. If one or more of the analysts who cover us do not publish positive reports about our company, platform and value proposition, do not view us as a market leader, or cease or fail to regularly publish reports on us, our stock price or trading volume would likely decline. In addition, industry analysts may influence current and potential customers; if any of the foregoing were to occur, customer demand for our platform, operating results and prospects may be adversely impacted. Further, we are transitioning to a consumption-based business model and to the extent that analysts fail to appreciate the benefits of such a model, misinterpret key performance indicators associated with such a model or continue to focus on metrics unduly associated with a subscription-based model, our stock price and trading volume may decline or our business may suffer.
Future sales of our Class B common stock in the public market could cause our stock price to fall.
Our stock price could decline as a result of sales of a large number of shares or the perception that these sales could occur. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate.
We register the offer and sale of all shares of common stock that we may issue under our equity compensation plans; as a result, these shares can generally be freely sold in the public market upon issuance, subject to compliance with applicable
securities laws. Additionally, “sell-to-cover” transactions are utilized in connection with the vesting and settlement of restricted stock units so that shares of our common stock are sold on behalf of our employees in an amount sufficient to cover the tax withholding obligations associated with these awards. As a result of these transactions, a significant number of shares of our stock may be sold over a limited time period in connection with significant vesting events.
Further, we have been advised that Mr. James has pledged the shares of Class A common stock and Class B common stock beneficially owned by him to secure a loan with a financial institution, which loan has or will have various requirements to repay all or a portion of the loan upon the occurrence of various events, including when the price of the Class B common stock goes below certain specified levels. Mr. James has indicated that (1) he has substantial assets other than shares of our common stock and (2) if repayment of the loan is triggered there is a cure period to sell assets or restructure the loan. Although Mr. James has indicated his intention to sell other assets if necessary, shares of our common stock may need to be sold to meet these repayment requirements. Upon a default under such loan following any applicable cure period, the lender could sell the pledged shares into the market without limitation on volume or manner of sale. Sales of such shares to reduce the loan balance or by the lender upon foreclosure are likely to adversely affect our stock price. Mr. James has also indicated to us that he may in the future from time to time refinance such indebtedness, enter into derivative transactions based on the value of our Class B common stock, dispose of shares of common stock, otherwise monetize shares of his common stock and/or engage in other transactions relating to shares of our common stock and/or other securities of the company. Any of these activities may adversely affect the price of our common stock. Mr. James has also indicated that he intends to (1) continue to beneficially own a majority of the Class A common stock that he currently beneficially owns and (2) continue to control at least a majority of the voting power of our company.
In addition, in the future, we may issue additional shares of Class B common stock or other equity or debt securities convertible into common stock in connection with a financing, acquisition, litigation settlement, employee arrangement or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and could cause our stock price to decline.
Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us difficult, limit attempts by our stockholders to replace or remove our current management and limit our stock price.
Provisions of our certificate of incorporation and bylaws may delay or discourage transactions involving an actual or potential change in our control or change in our management, including transactions in which stockholders might otherwise receive a premium for their shares, or transactions that our stockholders might otherwise deem to be in their best interests. These provisions include the following:
•our dual-class common stock structure, which provides our holders of Class A common stock with the ability to significantly influence the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the shares of our outstanding Class A common stock and Class B common stock;
•when the outstanding shares of Class A common stock represent less than a majority of the total combined voting power of our Class A and Class B common stock, or the voting threshold date, our board of directors will be classified into three classes of directors with staggered three-year terms, and directors will only be able to be removed from office for cause;
•our amended and restated bylaws provide that, following the voting threshold date, approval of stockholders holding two-thirds of our outstanding voting power voting as a single class will be required for stockholders to amend or adopt any provision of our bylaws;
•our stockholders are able to take action by written consent for any matter until the voting threshold date;
•following the voting threshold date, vacancies on our board of directors will be able to be filled only by our board of directors and not by stockholders;
•only the chairman of our board of directors, chief executive officer, a majority of our board of directors or, until the voting threshold date, a stockholder (or group of stockholders) holding at least 50% of the combined voting power of our Class A and Class B common stock are authorized to call a special meeting of stockholders;
•certain litigation against us can only be brought in Delaware;
•our amended and restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established and shares of which may be issued, without the approval of the holders of common stock; and
•advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders.
In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder.
Our amended and restated bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.
Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers, or other employees to us or our stockholders, (3) any action arising pursuant to any provision of the Delaware General Corporation Law, or the certificate of incorporation or the amended and restated bylaws, (4) any action to interpret, apply, enforce, or determine the validity of our certificate of incorporation or bylaws or (5) other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, another state court in Delaware or the federal district court for the District of Delaware), in all cases subject to the court having jurisdiction over indispensable parties named as defendants.
Any person or entity purchasing, holding or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. This exclusive-forum provision may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. If a court were to find this exclusive-forum provision in our amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.
General Risk Factors
Economic uncertainties or downturns could materially adversely affect our business.
Current or future economic uncertainties or downturns could adversely affect our business and operating results. Negative general macroeconomic conditions in both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, rising inflation, a recession, political deadlock, natural catastrophes, pandemics, military conflict (including the Russian invasion of Ukraine and hostilities between Israel and Hamas) and terrorist attacks, whether in the United States, Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including corporate spending on business intelligence software in general and negatively affect the rate of growth of our business.
General worldwide economic conditions may experience significant downturns and may be unstable. These conditions make it extremely difficult for our customers and us to forecast and plan future business activities accurately, and they could cause customers to reevaluate their decisions to subscribe to our platform, which could delay and lengthen our sales cycles or result in cancellations of planned purchases. Furthermore, during challenging economic times customers may tighten their budgets and face issues in gaining timely access to sufficient credit, which could result in an impairment of their ability to make timely payments to us. In turn, we may be required to increase our allowance for doubtful accounts, which would adversely affect our financial results.
For example, during 2021, the United States experienced an inflation rate of over 7%, according to data from the U.S. Department of Labor, significantly higher than recent norms. If inflation rates remain elevated or increase further, our expenses and operating costs are likely to increase. Inflation may also result in higher interest rates and otherwise adversely impact the macroeconomic environment, which in turn could adversely impact our customers and their ability or willingness to spend on our platform. Additionally, in recent periods the U.S. has experienced a labor shortage, which has contributed to an environment of escalating wages and salaries, which may also adversely affect our expenses and operating costs.
To the extent subscriptions to our platform are perceived by customers and potential customers to be discretionary, our revenue may be disproportionately affected by delays or reductions in general information technology spending. Also, customers may choose to develop in-house software as an alternative to using our platform. Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our platform.
We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or industries in which we operate do not improve, or worsen from present levels, our business, operating results, financial condition and cash flows could be adversely affected.