ITEM 1. BUSINESS
Overview
Our mission is to simplify cloud computing and artificial intelligence (AI) to allow builders to spend more time creating software that changes the world.
DigitalOcean is a leading cloud computing platform, offering simple, scalable and approachable on-demand infrastructure and platform services for developers at growing technology companies. Our platform simplifies cloud computing, enabling our customers to rapidly accelerate innovation and productivity. Our customers include growing technology companies across numerous industry verticals ranging from gaming to fintech to cybersecurity, among many others, and leverage our platform for a wide variety of use cases, such as building and hosting websites, developing new web and mobile applications, integrating AI into their businesses, and building AI products and applications, among many others. We believe that being simple, scalable and approachable are our key differentiators, driving a broad range of customers around the world whose needs are not being fully met by larger cloud providers to build and grow their businesses on our platform.
Our platform is designed to be simple, scalable and approachable by providing a variety of product offerings that were built with the needs of growing technology companies in mind. The simplicity of our platform allows users to focus on building and scaling their business instead of on managing their infrastructure. We offer mission-critical solutions across Infrastructure-as-a-Service (IaaS), including our Droplet virtual machines, storage and networking offerings; Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), including our Managed Hosting, Managed Database, Managed Kubernetes and Marketplace offerings; and artificial intelligence and machine learning (AI/ML), including our GPU Droplets, Notebooks and GenAI Platform offerings. We continue to invest in our platform to further penetrate the growing markets in which we operate. According to International Data Corporation (IDC), the aggregate worldwide IaaS and PaaS markets for individuals and companies with less than 500 employees is estimated to grow from approximately $138 billion in 2025 to $251 billion in 2028, representing a 22% compound annual growth rate. IDC defines the IaaS market as compute, storage and networking, and the PaaS market as database management systems, application platforms, artificial intelligence platforms and other platform services.
We have a highly efficient self-service customer acquisition model, which we complement with a sales force focused on inside sales, targeted outside sales and partnership opportunities to drive revenue growth. The efficiency of our go-to-market model and our focus on the needs of growing technology companies have enabled us to drive organic growth and establish a truly global customer base across a broad range of industries. Our customers rely on us for their critical business needs and we provide all customers, regardless of size, 24/7 customer support. We are committed to making world-class cloud services approachable by providing attentive support to customers and supporting and investing in the broader developer community. We believe our customer support, coupled with our easy-to-use self-help resources and active developer community, has created tremendous brand loyalty amongst our customer base.
Growing our Builders (users that spend more than $50 and less than or equal to $500 in a month), Scalers (users that spend more than $500 and less than or equal to $8,333 in a month) and Scalers+ (users that spend more than $8,333 in a month) is a critical focus for us, and we have successfully increased the number of these customers and their percentage of our total revenue. As of December 31, 2024, we had approximately 165,000 Builders, Scalers and Scalers+ (collectively, our Higher Spend Customers), comprising 87% of our total revenue for the year ended December 31, 2024. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Business Metrics” for more detail on the definition of customer categories and additional information.
Our Solution
DigitalOcean is a simple, scalable and approachable cloud, offering customers solutions that are easy to leverage, reliable and scale along with our growing technology companies. Empowered by an easy-to-use self-service model, intuitive control panel and highly predictable pricing, our customers are able to rapidly accelerate innovation and increase their productivity and agility. The key differentiators of our platform are as follows:
•Simple. Our platform is engineered to take a user from inquiry to deployment within minutes, without any specialized training or heavy implementation. We abstract away the complexity that is generally found across legacy cloud providers to provide a compelling, intuitive interface with click-and-go options. In addition, all
DigitalOcean products come with detailed product and technical documentation to help our customers quickly and seamlessly deploy to our cloud platform.
•Scalable. We offer a comprehensive portfolio of IaaS, PaaS/SaaS and AI/ML products that are specifically designed to address the needs of growing technology companies. Our platform can support a wide range of use cases, including building and hosting websites, developing new web and mobile applications, integrating AI into their businesses, and building AI products and applications, among many others. Customers with any type of use case have the ability to choose from managing their own infrastructure and building their own bespoke solutions using our IaaS or AI/ML offerings, offloading the technical infrastructure entirely through our Managed Hosting offering or delegating certain aspects of management using certain of our other managed PaaS/SaaS offerings or AI/ML offerings. Our scalable platform provides the reliability and security so that our customers can rely on us both today and in the future as their projects and businesses grow and their needs expand.
•Approachable. Creating solutions for cloud and AI is the focus of our business. We offer expert technical support and customer service to all customers free of charge on a 24/7 basis to ensure our customers quickly achieve their objectives and overcome challenges. Customers cite our attentive support as a key driver of their decision to start and grow their businesses on our platform. Our platform is easy to use and we provide extensive guidance on our website through product documentation and numerous high-quality developer tutorials that attract users and reinforce our highly efficient self-service customer acquisition model. In addition, our platform is designed to take advantage of open source technology, which helps customers to more efficiently write their own integrations. We have built one of the world’s largest developer communities to foster opportunities for developers to learn, grow and innovate on our platform. We continue to invest in supporting developers in myriad ways, including through local knowledge-sharing meetings and webinars in cities around the world. We also host large industry-wide events including Hacktoberfest, a global hackathon, and Deploy, a conference for developers, startups and founders. Being approachable also extends into our pricing model, which is transparent and predictable, eliminating surprises for our customers. Like everything we do, we approach billing with a customer-first focus, enabling our customers to spend more time developing and deploying innovative applications rather than interpreting and navigating convoluted invoices.
Our Growth Strategies
We are driving significant growth by executing on the following key strategies:
•Increasing Usage by Our Existing Customers. Our existing customer base represents a significant opportunity for further sales expansion through increased usage of our platform and adoption of additional product offerings. We are highly focused on gaining a better understanding of the needs and growth plans of our existing customers, increasing our feature velocity and shaping our product roadmap around the needs of Higher Spend Customers, and introducing an account management function to provide more direct coverage of our top spending accounts. This deeper relationship with our customers will help us identify opportunities to educate our customer base on ways to utilize the platform more effectively for their individual use cases, as well as provide a feedback loop to inform our product roadmap, in order to build trust with customers and encourage them to run more of their critical cloud workloads on our platform. We closely monitor our net dollar retention (NDR), which reflects our ability to retain and grow revenue from our existing customers. While NDR decreased from 101% in 2023 to 98% in 2024 as we lapped the effects of the 2022 price increases, we expect to increase our revenue in the future from existing customers through the introduction of new products and features tailored to our Higher Spend Customers through expanded customer outreach, and targeted services to support our customers in migrating additional workloads from other cloud providers to DigitalOcean.
•Growing Our Base of Higher Spend Customers. We believe there is a substantial opportunity to further expand our customer base. We are investing in strategies that we believe will drive adoption by new Higher Spend Customers, including new marketing initiatives that further optimize our self-service revenue funnel to identify potential Higher Spend Customers, enhanced research and development to build our product roadmap around the needs of Higher Spend Customers, the creation of a new migration services team to support migration to our platform from other cloud providers, and a dedicated AI sales team with deep AI expertise to help prospective customers understand our offerings and the process to onboard onto our platform.
•Investing in Our Platform and Product Offerings. We have a history of, and will continue to invest significantly in, delivering innovative products, features and functionality for our Higher Spend Customers. Our product strategy is anchored in addressing the needs of our Higher Spend Customers and other growing technology
companies and on continuously innovating to meet those needs in a simple, scalable and approachable way. We have accelerated the pace of product innovation and made disciplined investments to expand our offerings for our IaaS and PaaS offerings, as well as our newer AI/ML offerings. In 2024, we released a number of new products and product features, including GPU Droplets, our GenAI platform, Autonomous on our Managed Hosting offering to automatically scale resources based on website traffic, and enhancements to our role-based access control functionality and Backups offering. The market opportunity for our services continues to expand and we expect to make additional investments to offer an enhanced and tailored suite of IaaS, PaaS/SaaS and AI/ML offerings that address the changing needs of our customers.
•Driving Increased Adoption Through Our Community Ecosystem. We attract a large number of developers to our website and platform and we are committed to supporting and expanding this community of innovators and technologists by continuing to produce high-quality educational content and hosting developer-focused programs and events around the world. Supporting and educating the developer community is not only one of our values, but it also fosters brand loyalty, expands our customer base and drives increased adoption of our products.
•Augmenting our Platform though Strategic Partnerships and Acquisitions. In addition to organic growth, we believe that strategic partnerships and acquisitions will allow us to accelerate our key platform, product and marketing initiatives. In recent years, we completed acquisitions of Paperspace, which launched our AI/ML offerings, and Cloudways, which added our Managed Hosting offering to our platform. In addition, we have entered into partnerships to augment our product offerings. For example, in 2024, we announced a partnership with Hugging Face, which allows customers to quickly and easily deploy the most popular third-party models on GPU Droplets and significantly simplifies the model deployment process for our customers. We intend to actively pursue both strategic partnerships and acquisitions that we believe will be complementary to our business, accelerate customer acquisition, increase usage of our platform and/or expand our product offerings in our core markets.
Our Platform and Product Offerings
We have designed our global cloud platform to ensure a simple, scalable and approachable cloud computing experience for our customer base of growing technology companies. This entails maintaining a high-performance and reliable global infrastructure, offering a highly curated set of solutions and providing a superior customer experience. The combination of these elements enables our customers to focus their time and attention on building and running their applications or businesses rather than managing the underlying infrastructure.
Our Global Infrastructure & Technology Network
Our global infrastructure and technology network, built on the foundation of open source scalable cloud-native technologies, allows us to deliver an exceptional developer experience and suite of infrastructure and software solutions to our customers spread across the globe. Our infrastructure is offered to our customers across 16 data centers worldwide that are connected by a high-speed private backbone, enabling our customers to deploy their solutions across nine different geographic regions. We lease data centers in the New York, San Francisco and Atlanta metropolitan areas in the United States, as well as in Australia, Canada, Germany, India, the Netherlands, Singapore and the United Kingdom. We plan to open our new Atlanta data center in 2025. These data center locations were selected for their proximity to key customer markets and to allow access to global internet exchange points to provide consistent low-latency connectivity to large end-user networks. Our global data center network allows our customers to choose where best to deploy the solution to optimize performance and minimize latency for their users. In addition, we utilize points of presence locations situated across the globe to improve website and application performance by allowing geographically dispersed users to receive content from a location nearest to them.
We work closely with leading hardware manufacturers when designing our server platforms to continue to reduce acquisition costs while at the same time aligning our long-term server strategy to future technology advancements. We optimize reliability and performance for our customers by providing physical security and availability for our customers; managing the physical server capacity to ensure that we are able to meet our customers’ demands; operating the global networking backbone to ensure that we are making the best connectivity peering agreements to get customer traffic to the destination via the best available path; and actively monitoring the cloud environment and responding to network incidents to ensure that customer impact is minimized and service availability is managed.
We focus heavily on securing our network, products and customer data from potential security threats, leveraging a dedicated team of security professionals. We have implemented a cybersecurity risk management program that includes administrative, technical and physical safeguards designed to maintain the confidentiality, integrity, and availability of our
company’s and our customers’ information. We design our products with security in mind and build security features to integrate directly with our platform, making it simple for our customers to build the additional security layers required for their use cases, rather than navigating the operational complexity of purchasing, integrating, and managing disparate security tooling into their projects. We also offer a number of security features to our customers free of charge, including our Distributed Denial of Service (DDoS) Protection service and enhanced Role Based Access Control (RBAC) offering. See Part I, Item 1C. “Cybersecurity” for additional detail on our cybersecurity program.
In combination, our infrastructure and network provide our customers with a reliable, highly-performant and cost-effective platform to confidently build, deploy and scale their optimal solution, from single node based applications to globally distributed systems.
Our Product Portfolio
We provide a variety of cloud products and services that are specifically designed to address the needs of growing technology companies. We listen carefully to our customers’ feedback so we understand what they want and need. Our goal is to address the core needs of our customer base instead of offering thousands of complex products and services that are more suited to large enterprise companies.
We offer IaaS, PaaS/SaaS and AI/ML solutions to our customers. Our initial product, launched in 2012, was the Droplet, a virtual machine that provides flexibility to build, test, secure and grow customers’ applications from start-up to scale. Since then, we have successfully launched many new products, which honor our commitment to always provide a simple, scalable and approachable experience for our core customer base. We have expanded our product portfolio with product innovations such as Dedicated Droplets, Premium Droplets, Spaces, Managed Kubernetes, Managed Databases, App Platform, and, more recently, GPU Droplets and our GenAI Platform, which have proven our ability to successfully launch or acquire new products to market and serve our customers’ needs. Furthermore, we regularly launch new product features in response to customer needs and requests and to grow the functionality of our platform. We have developed a product roadmap designed to enhance our ability to offer secure, scalable and reliable solutions for our customers to grow their applications or businesses. We also provide management and collaboration tools to enable our customers to monitor and manage their usage of our platform.
•IaaS Offerings. Our Infrastructure-as-a-Service (IaaS) offerings include our compute, storage and networking products. We provide flexible server configurations sized for any application, attractive price-to-performance and highly predictable pricing that is the same across regions and usage volumes. Our current IaaS offerings include:
◦Droplets. Droplets are our core compute offering. Developers can spin up the virtual machine of their choice in under a minute. We offer basic Droplets and Dedicated Droplets, such as general purpose, CPU-optimized, memory-optimized or storage-optimized configurations, which provide flexibility to build, test, secure and grow any application from start-up to scale. Our Premium Droplet offerings provide enhanced speed and memory performance, while maintaining our commitment to simplicity.
◦Storage Offerings. Our storage solutions allow our customers to store and quickly access any amount of data reliably in the cloud. We offer several kinds of storage offerings, depending on the customer’s needs, including:
▪Spaces (Object Storage). Our object storage with a built-in content delivery network (CDN) makes scaling easy, reliable and affordable. Our simple and predictable pricing makes this offering very attractive compared to our competitors.
▪Volumes (Block Storage). Our block storage product allows customers to add more storage space and mix and match compute and storage to suit their database, file storage, application, service, mobile and backup needs. This provides supplemental storage beyond the generous local solid-state drive (SSD) offered with our compute offerings.
▪Backups and Snapshots. Our disk images of Droplets provide peace of mind and a sense of security to our customers. Our customers can choose between Backups, which are automatically-created disk images of Droplets taken on a daily or weekly basis, or Snapshots, which are manually-created disk images taken on demand, providing our customers with the ability to revert to an older state or create new Droplets. We also provide the flexibility to customize backup windows for disk images, choose retention policies and elect which files to back up.
◦Networking Offerings. We provide a suite of networking capabilities to secure and control the traffic to our customers’ applications. Data transfer costs can quickly become a major expense for operators of complex cloud applications. At DigitalOcean, we provide a generous amount of bandwidth with each successive Droplet purchase. This bandwidth is pooled for the customer’s account and shared by all applications or resources running in their account, which we believe is a key differentiator for us in the marketplace. Our key networking product offerings include:
•Cloud Firewalls. Our Cloud Firewall offering is a software service that allows customers to quickly secure their infrastructure from common vulnerabilities and define what services are visible on their infrastructure. Cloud Firewalls are free to our customers and are used for staging and production deployments of software.
•Managed Load Balancers. Our Managed Load Balancer offering is a software service that allows customers to load balance traffic to their software applications located on multiple Droplets, enabling them to scale their applications and improve availability, security and performance across their infrastructure in a few clicks with affordable pricing.
•Virtual Private Cloud (VPC). Our VPC offering is a private network interface for collections of DigitalOcean resources. VPC networks provide a more secure connection between resources because the network is inaccessible from the public internet and other VPC networks, enabling our customers to manage their information and data traffic between applications without exposure to the public internet.
•IP Address Management. In addition to IPv4 addresses, we also offer IPv6 addresses, which provide larger address space and increased security, among other benefits. Customers also have the option to use Reserved IP Addresses, which are publicly-accessible static IP addresses that can be assigned to Droplets and instantly remapped to other Droplets in the same data center.
•Domain Name System (DNS) Management. DNS Management offering allows customers to add domains to their DigitalOcean accounts and manage the domain’s DNS records through our control panel. Managing DNS records through the DigitalOcean platform also allows customers to integrate DNS records with other DigitalOcean offerings, including Load Balancers to manage traffic and Spaces to streamline automatic SSL certificate management.
•PaaS/SaaS Offerings. Our Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) offerings provide a complete development and deployment environment. PaaS/SaaS offerings include infrastructure as well as database management systems, application platforms, development tools and other services designed to support the complete web application lifecycle. Our current PaaS/SaaS offerings include:
◦Managed Hosting. Our Managed Hosting offering provides simple onboarding and day-to-day management for hosting that is purpose-built for growing technology companies looking to outsource their on-ramp to the internet and offload the complexities of cloud infrastructure so they can spend more time running and scaling their businesses. This offering is particularly attractive for growing technology companies without the knowledge or resources to fully manage their hosting infrastructure, including digital agencies, entrepreneurs creating eCommerce sites, bloggers, freelancers, and other users hosting on WordPress, PHP and Magento.
◦Managed Databases. Our Managed Databases offering, a fully-managed database solution, provides our customers with the application performance they need without the operational demands that come with building and running a database server. We currently offer managed offerings for relational databases (SQL) such as PostgreSQL and MySQL, as well as NoSQL databases such as Redis. In addition, we offer DigitalOcean Managed MongoDB, a fully-managed database as a service offering in partnership with MongoDB, and Dedicated CPU Managed MongoDB to boost the performance of MongoDB and enable users to migrate databases from any source to DigitalOcean Managed MongoDB with minimal downtime. Finally, our Managed Kafka offering provides our customers with the ability to build high-throughput, low-latency data streams of Kafka without the complexity of managing their infrastructure.
◦Managed Kubernetes and Container Registry. Our easy-to-use Managed Kubernetes service provides scalability and portability for cloud-native applications. Customers can get started quickly and cheaply with our free control plane, inexpensive bandwidth and our free egress gateway, which give our
customers even more confidence in leveraging our Kubernetes offering to deploy their code in the cloud. Alternatively, customers have the option to scale-up with our high availability control plane, which increases control plane availability and uptime. Our Managed Container Registry offering lets customers easily store and manage private container images for rapid deployment to our Managed Kubernetes service.
◦App Platform. Our App Platform offering allows customers to build, deploy and scale applications quickly using a simple, fully-managed solution. We handle the infrastructure, application runtimes and dependencies so that developers can push code to production in just a few clicks, enabling them to deliver applications to market faster and on a global scale.
◦Functions. Our Functions offering is a serverless compute solution that leverages our App Platform product. Serverless computing has become a popular trend in cloud application development because it allows for freedom from server management and the ability to pay only for what you use. Our Functions offering runs on-demand, which simplifies the cloud programming experience and helps customers focus more on application development and business outcomes and less on managing the underlying infrastructure.
◦Uptime. Our Uptime offering provides real-time uptime and latency alerts, allowing customers to quickly recover from incidents before their own customers are impacted. Alerts are triggered when customer assets are slow, down, or vulnerable to attack.
◦Marketplace. Our Marketplace is a platform where developers can find pre-configured applications and solutions that are optimized to run on our infrastructure quickly. The DigitalOcean Marketplace contains highly-curated everyday applications and cutting-edge technologies, providing customers access to the most efficient tools to build their businesses while removing the time and expense of research, configuration and manual setup. We work closely with partners to deliver a truly seamless experience for customers, creating the ability for developers to deploy thoroughly tested app environments with the click of a button on Droplets and Kubernetes clusters. The DigitalOcean Marketplace also offers add-ons that run in the cloud and are available on demand. More than 350 preconfigured one-click applications are available in our Marketplace, including WordPress, LAMP, Docker, Grafana, and Plesk, among others.
•AI/ML Offerings. Our artificial intelligence and machine learning (AI/ML) offerings enable customers to more easily test, develop and deploy AI/ML applications or augment and enhance existing AI/ML applications. Our current AI/ML offerings include:
◦GPU Droplets. Our GPU Droplets provide similar functionality to our core CPU offerings, but with the extra power of GPUs, and come pre-configured with pre-installed drivers, software and one-click models, allowing AI developers to simply and quickly run AI experiments, train large language models, and scale AI projects. Our GPU Droplets provide fast, easy and affordable access to high-performance GPUs without requiring upfront investments in costly hardware.
◦GenAI Platform. Our GenAI platform is a comprehensive solution for deploying AI applications. The platform provides access to third party foundational models out-of-the-box so that customers can easily put together an AI application without requiring specific AI expertise.
◦Bare Metal GPUs. Our Bare Metal GPU offering provides customers with access to a GPU server without any virtualization layer, to give developers with an entirely customizable server for their use case.
◦Jupyter Notebooks. Our Jupyter Notebooks offering provides customers with a simple cloud workspace that runs on GPUs, providing a managed interactive development environment for exploring data and training and building machine learning models.
Sales and Marketing
Our sales and marketing teams work together closely to drive awareness and adoption of our platform, accelerate customer acquisition and expand our revenue from existing customers. These teams focus on customer acquisition, our self-service acquisition funnel, customer support and success, community education, inside sales, targeted outside sales, and partnership and channel development.
By reducing the friction that typically accompanies the purchase of business software and eliminating the need for complicated and costly implementation and training, our efficient self-service acquisition model enables customers to get started on our platform very quickly and without the need for assistance. We attract visitors to our website through a combination of high-quality content, developer outreach and highly-targeted paid demand generation campaigns.
We focus on building a large, highly-engaged community that can connect and educate developers across the globe. Our developer community enables new and experienced developers to learn new skills and technologies and create and deliver new applications. The DigitalOcean community is based on forging genuine relationships through a series of meaningful and memorable interactions. We believe that our focus on community drives brand loyalty amongst a fast-growing developer community and spurs our community followers to become advocates for us and our platform. Our community education websites contain high-quality technical tutorials and a forum with tens of thousands of questions and answers that guide developers in creating and delivering modern applications—not just focused on DigitalOcean products and services, but relevant to any cloud service. We expect to continue to grow the high-quality developer content on our websites, including through the creation of new content and product demonstrations, alongside continuous maintenance and refreshes of our legacy content, while making our education website easier to navigate by integrating our own GenAI platform on our education websites so our customers can get the answers they need more seamlessly and efficiently.
We host a number of events to further build our community, including Hacktoberfest with over 65,000 developers participating in 2024 and Deploy, a conference for developers, startups, founders, and others to learn from experts, connect, and be inspired to build their vision on our platform. We are focused on expanding our developer engagement efforts by hosting regular in-person meetings and creating innovative knowledge-sharing hubs in cities around the world. In addition, we operate the “Hatch by DigitalOcean” program to support entrepreneurs and startups more directly as they begin their journey by providing them with a robust set of benefits to help them succeed. Many attendees at our meetings and events and participants in our Hatch program have learned about DigitalOcean through these developer engagement efforts and have not only become loyal DigitalOcean customers but have become advocates of our platform, drawing others to DigitalOcean.
We complement our efficient self-service customer acquisition model and community building and developer outreach efforts with a sales force focused on inside sales, outbound prospecting targeting specific use cases, volume expansion of our self-service customers, expanding our revenue in specific international markets and seeking partnership opportunities to drive revenue growth. Our sales team includes experienced engineers who fashion technical solutions for customers to convert and migrate their workloads from other cloud providers. Our customer success professionals focus on customer retention and customer expansion by adding value throughout the customer lifecycle as customers scale and expand their usage of our product portfolio and will directly contact customers to determine if there are ways to augment their usage of our platform with additional services. We are also focused on partnership opportunities that introduce new avenues for customer growth. As we continue to evolve our sales motion, we have introduced a high-touch approach for retaining and expanding top customers, and securing new cloud and AI business from outbound efforts — all to help augment our highly-efficient self-service customer acquisition model and accelerate growth.
We are committed to providing robust customer support to all customers, which we believe has been a strategic differentiator for us. The customer support team addresses account-related questions and provides high-quality technical advice and troubleshooting. Developers and engineers are a key part of the customer support team, and we offer technical support free of charge to all of our customers. In addition, we offer paid support plans, which allow customers to choose the paid support option that best suits their needs and provide customers with faster response times and dedicated support from technical managers. Customer engagement with our customer support team also serves as an important feedback loop to our product and technology teams, helping us better understand the specific needs of our customers. This feedback has influenced, and will continue to influence, our product roadmap, the content strategy for our community tutorials and other business decisions. We closely track various metrics to ensure we are providing exceptional customer support. We internally monitor our customer satisfaction score (CSAT) and net promoter score (NPS) to gauge the quality of our interactions with customers and our ability to increase loyalty. We also have specific service-level objectives (SLOs) for response and resolution times to ensure we maintain a high level of customer satisfaction.
We intend to continue to invest in our sales and marketing capabilities to capitalize on our large and global market opportunity, while remaining very efficient in terms of sales and marketing expense as a percentage of revenue.
Our Customers
Our customer base is incredibly diverse with respect to technical competency, type of business, use case and geography. We have been successful in increasing our customer base of Higher Spend Customers, and our ARPU by expanding our product portfolio and optimizing our sales and marketing initiatives to meet the needs of our customers. While our pricing is primarily consumption-based and the majority of our customers use our platform on a month-to-month basis, a growing number of customers are using our platform for larger workloads and some of these customers are opting to enter into committed contracts, committing to a minimum spend on our platform. As of December 31, 2024, we had approximately 165,000 Higher Spend Customers, an increase from approximately 156,000 as of December 31, 2023. Our ARPU has increased from $82.76 in 2022 to $90.99 in 2023 to $100.71 in 2024. We have no material customer concentration, as our top 25 customers made up 8%, 7% and 10% of our revenue in 2024, 2023 and 2022, respectively. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Business Metrics” for more detail on the definition of ARPU.
Competition
The markets that we serve are highly competitive and rapidly evolving. With the introduction of new technologies and innovations, we expect the competitive environment to remain intense.
We believe that the principal factors on which we compete include:
Simplicity:
•ease of use and operation
•speed of deployment
•price, total cost of ownership and transparency
•features, functionality and quality of tools
Scalability:
•performance, reliability, scalability and security
•geographic reach
Approachability:
•customer experience, support and service
•community engagement and education
•brand awareness and reputation
We compete primarily with large, diversified technology companies that focus on large enterprise customers and provide cloud computing as just a portion of the products and services that they offer. The primary vendors in this category include Amazon (AWS), Microsoft (Azure), Google (GCP), IBM (IBM Cloud), Alibaba (Alibaba Cloud) and Oracle (Oracle Cloud).
We also compete with smaller and/or niche cloud service providers that typically target individuals and smaller businesses, simple use cases and/or narrower geographic markets. Examples in this category include OVHcloud, Akamai (Linode), Hetzner, Vultr, Contabo, Scaleway, UpCloud, and Heroku.
Our AI/ML offerings compete with providers of AI/ML infrastructure and services, including the same large, diversified technology companies, Amazon (AWS), Microsoft (Azure), and Google (GCP), and smaller more infrastructure-focused companies such as Coreweave and Lambda Labs.
Finally, our Managed Hosting offering competes with digital agencies and other managed hosting providers, including Kinsta and WP Engine.
Despite the competitive intensity, we believe we compete successfully on the basis of the factors listed above. We focus on solutions for growing technology companies—and combine the power of being simple, scalable and approachable for the portion of the cloud market whose needs are not fully met by larger cloud providers. This differentiates us dramatically from the enterprise cloud competitors. At the same time, our ability to address complex use cases that allows
customers to scale with us as they grow, differentiates us from the many niche competitors who have less robust and extensible offerings.
Human Capital Management
As of December 31, 2024, we had a total of 1,210 employees, including 703 located outside the United States. We also engage individuals through professional employer organizations and contractors on an as-needed basis. None of our employees are represented by a labor union or covered by a collective bargaining agreement. We have not experienced any work stoppages, and we consider our relations with our employees to be good.
We provide competitive compensation and benefits for our employees globally, including base salary, cash bonuses, commissions (for our sales team), long-term equity awards and the opportunity to participate in an employee stock purchase plan and a wide array of benefits aligned with local reward practices and competitive with those offered by companies with whom we compete for talent.
Talent development and employee engagement are key to attracting and retaining talented employees. We facilitate employee review cycles where employees have development conversations with their managers multiple times throughout the year. We also offer thousands of training courses and videos on a wide range of topics to further support employee development. Finally, we conduct anonymous global engagement surveys regularly to measure the effectiveness of our business and people initiatives and identify areas of strength and development opportunities among teams.
We are also committed to social responsibility as evidenced by our joining the Pledge 1% movement in connection with our IPO and our launch of DO Impact in 2022, which is our social impact effort designed to empower changemakers around the globe through products and philanthropy.
Intellectual Property
Intellectual property rights are important to the success of our business. We rely on a combination of trademark, patent, copyright and trade secret laws in the United States and other jurisdictions, as well as license agreements, confidentiality provision, non-disclosure agreements with third parties and other contractual protections, to protect our intellectual property rights, including our proprietary technology, software, know-how and brand. We use open source software in our services.
As of December 31, 2024, we owned thirteen registered trademarks in the United States and ten registered trademarks in various non-U.S. jurisdictions. We have filed applications for registration for two additional trademarks in non-U.S. jurisdictions. In addition, we own one International Registration through the World Intellectual Property Organization, which has been extended to registrations in seven additional jurisdictions. As of December 31, 2024, we owned five issued patents and had one patent that is published in the United States. The issued patents are each scheduled to expire in 2039 and 2040 and the patent that has been published, when issued, will be scheduled to expire in 2039. In addition, we license third-party software and use open source software and other technologies that are used in the provision of or incorporated into some elements of our services. Many parts of our business utilize proprietary technology and/or licensed technology, including open source software.
We control access to and use of our proprietary technology and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, customers, vendors and partners. Our policy is to require all employees and independent contractors to sign agreements assigning to us any inventions, trade secrets, works of authorship, developments, processes and other intellectual property generated by them on our behalf and under which they agree to protect our confidential information. In addition, we generally enter into confidentiality agreements with our customers, vendors and other partners. See Part I, Item 1A. “Risk Factors” for a more comprehensive description of risks related to our intellectual property.
Governmental Regulation
Our business is and will continue to be subject to extensive U.S. federal and state and foreign laws and regulations, including laws and regulations involving privacy, data protection, data transfers, artificial intelligence, content regulation, security, intellectual property, competition, taxation, anti-corruption, anti-bribery, anti-money laundering, and other similar laws. Many of these laws and regulations are still evolving and are likely to remain uncertain for the foreseeable future, and these laws and regulations can vary significantly from jurisdiction to jurisdiction. The costs of complying with these laws and regulations are high and are likely to increase in the future. We are also subject to U.S. and foreign laws and regulations that govern or restrict our business and activities in certain countries and with certain persons, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained
by the U.S. Treasury Department’s Office of Foreign Assets Control. Compliance with these laws, rules, and regulations has not had, and is not expected to have, a material effect upon our results of operations, capital expenditures or competitive position. Nevertheless, compliance with existing or future governmental regulations, including, but not limited to, those pertaining to global trade, business acquisitions, consumer and data protection, and taxes, could have a material impact on our business in subsequent periods.
For a more comprehensive discussion of the risks we face from regulation and compliance matters, see Part I, Item 1A. “Risk Factors”.
Corporate Information
We were incorporated in Delaware in 2012 under the name Digital Ocean, Inc. In 2016, as part of a restructuring, Digital Ocean, Inc. was converted into DigitalOcean, LLC, and DigitalOcean Holdings, Inc. was formed as the ultimate parent holding company. We completed our initial public offering in March 2021 and our common stock is listed on the New York Stock Exchange under the symbol “DOCN.” Our principal executive offices are located at 101 6th Avenue, New York, New York 10013, and our telephone number is (646) 827-4366. Our website address is www.digitalocean.com.
Available Information
Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to reports filed pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended (the Exchange Act), are filed with the Securities and Exchange Commission (the SEC). Such reports and other information filed by us with the SEC are available free of charge on our website at www.investors.digitalocean.com when such reports are available on the SEC’s website. The SEC maintains a website that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC at www.sec.gov. The information contained on the websites referenced in this Annual Report on Form 10-K is not incorporated by reference into this filing. Further, our references to website URLs are intended to be inactive textual references only.
ITEM 1A. RISK FACTORS
Our operations and financial results and an investment in our common stock are subject to various risks and uncertainties. You should consider and read carefully all of the risks and uncertainties described below, as well as other information included in this Annual Report on Form 10-K, including our consolidated financial statements and related notes. The risks described below are not the only ones we face. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition or results of operations.
Risks Related to Our Business and Industry
We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our results of operations, our stock price and the value of your investment could decline.
Our results of operations have fluctuated in the past and are expected to fluctuate in the future due to a variety of factors, many of which are outside of our control. As a result, our past results may not be indicative of our future performance. In particular, you should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. Even if our revenue continues to increase, our revenue growth rate may decline in the future as a result of a variety of factors, including the maturation of our business. Overall growth of our revenue depends on a number of factors as described in more detail under the heading Part I, Item 1. “Business” in this Annual Report on Form 10-K, as well as the factors set forth below. We may not successfully accomplish any of our objectives and, as a result, it is difficult for us to forecast our future results of operations. If the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, we may be unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.
In addition to the other risks described herein, factors that may affect our results of operations include the following:
•fluctuations in demand for or pricing and usage of our platform and products;
•our ability to attract new customers and retain existing customers;
•customer expansion rates;
•integration of new products;
•timing and amount of our investments and capital expenditures related to successfully optimizing, utilizing and expanding our data center facilities;
•the investment in and integration of new products and features relative to investments in our existing infrastructure and products;
•our ability to control costs, including our operating expenses, and the timing of payment for expenses;
•the amount and timing of non-cash expenses, including stock-based compensation, goodwill impairments and other non-cash charges;
•the amount and timing of costs associated with recruiting, training and integrating new employees and retaining and motivating existing employees;
•the effects of acquisitions and their integration;
•general economic conditions, both domestically and internationally, and economic conditions specifically affecting industries in which our customers participate;
•changes in regulatory or legal environments that may cause us to, among other elements, be unable to continue operating in a particular market, remove certain customers from our platform, and/or incur expenses associated with compliance;
•changes in the competitive dynamics of our market, including consolidation among competitors or customers or new entrants into our market;
•significant security breaches of, technical difficulties with, or interruptions to, the delivery and use of our products and platform capabilities;
•our ability to control fraudulent registrations and usage of our platform, reduce bad debt and lessen capacity constraints on our data centers, servers and equipment; and
•the impact of new accounting pronouncements.
Any of these and other factors, or the cumulative effect of some of these factors, may cause our results of operations to vary significantly. If our results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our common stock could decline substantially, and we could face costly lawsuits, including securities class action suits.
We may not be able to sustain profitability in the future.
While we have experienced revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of sales to sustain or increase our growth or maintain profitability in the future. We also expect our costs and expenses will increase in future periods, which could negatively affect our future results of operations if our revenue also does not increase. Our efforts to grow our business may be costlier than we expect, or the rate of our growth in revenue may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications or delays, and other unknown events. If we are unable to sustain profitability, the value of our business and common stock may significantly decrease.
In addition, we expect to continue to expend substantial financial and other resources on:
•our technology infrastructure, including systems architecture, scalability, availability, performance, security, hardware, equipment and other capital expenditures, including expenses to increase or maintain data center capacity and to successfully optimize and operate data center facilities;
•product development, including the development of new products and new functionality for our platform as well as investments in both further optimizing our existing products and infrastructure;
•our sales and marketing organization to engage our existing and prospective customers, increase brand awareness and drive adoption of our products;
•strategic investments and acquisitions; and
•general administration, including increased legal and accounting expenses.
Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays, and other unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, our business, financial position and results of operations may be harmed, and we may not sustain profitability in the future.
If we are unable to expand usage of our platform by existing customers, attract new customers and/or retain existing customers, we may not achieve the growth we expect, which would adversely affect our results of operations and financial condition.
In order to grow our business, we must continue to expand the usage by our existing customers on our platform, attract new customers in a cost-effective manner and enable these customers to realize the benefits associated with our products and services. Our business is usage-based and it is important for our business and financial results that our paying customers maintain or increase their usage of our platform and purchase additional products from us. Historically, we have relied on our self-service customer acquisition model for a significant majority of our revenue. We complement our self-service customer acquisition model with a sales force focused on inside sales, targeted outside sales and partnership opportunities to drive revenue growth. If our self-service customer acquisition model is not as effective as we anticipate or our sales force is not successful at growing our customer base, specifically our Higher Spend Customers, our future growth will be impacted.
In addition, we must persuade potential customers that our products offer significant advantages over those of our competitors. As our market matures, our products evolve, and competitors introduce lower cost or differentiated products that are perceived to compete with our platform and products, our ability to maintain or expand usage of our platform could be impaired. Even if we do attract new customers, the cost of new customer acquisition, product implementation and ongoing customer support may prove higher than anticipated, thereby impacting our profitability.
Other factors, many of which are out of our control, may now or in the future impact our ability to add new customers in a cost-effective manner, include:
•potential customers’ commitments to existing platforms or greater familiarity or comfort with other platforms or products;
•our failure to expand, retain, and motivate our sales and marketing personnel;
•our failure to obtain or maintain industry security certifications for our platform and products;
•negative media, industry, or financial analyst commentary regarding our platform and the identities and activities of some of our customers;
•the perceived risk, commencement, or outcome of litigation; and
•deteriorating general economic conditions.
The majority of our contracts with our customers are based on our terms of service, which do not require our customers to commit to a specific contractual period, and which permit the customer to terminate their contracts or decrease usage of our products and services without advance notice. These customers generally have no obligation to maintain their usage of our platform. This ease of termination could cause our results of operations to fluctuate significantly from quarter to quarter. Our customer retention may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with the security, performance, and reliability of our products, our prices and usage plans, our customers’ budgetary restrictions, the perception that competitive products provide better or less expensive options, negative public perception of us or our customers, and deteriorating general economic conditions. As a result, we may face high rates of customer churn if we are unable to meet our customer needs, requirements and preferences.
Our future financial performance also depends in part on our ability to expand our existing customers’ usage of our platform and sell additional products to our existing customers. Conversely, our paying customers may reduce their usage to lower-cost pricing tiers if they do not see the marginal value in maintaining their usage at a higher-cost pricing tier, thereby impacting our ability to increase revenue. In order to expand our commercial relationships with our customers, existing customers must decide that the incremental cost associated with such an increase in usage or subscription to additional products is justified by the additional functionality. Our customers’ decision whether to increase their usage or subscribe to additional products is driven by a number of factors, including customer satisfaction with the security, performance, and reliability of our platform and existing products, the functionality of any new products we may offer,
general economic conditions, and customer reaction to our pricing model. If our efforts to expand our relationships with our existing customers are not successful, our financial condition and results of operations may materially suffer.
In addition, to encourage awareness, usage, familiarity and adoption of our platform and products, we may offer a credit or other incentives to new customers who sign up for and use our platform. To the extent that we are unable to successfully retain customers after use of the initial incentives, we will not realize the intended benefits of these marketing strategies and our ability to grow our revenue will be adversely affected.
We are focused on expanding the number of Higher Spend Customers on our platform, both through expanding usage by existing customers and attracting new Higher Spend Customers. Net new sales to Higher Spend Customers involve risks that may not be present or that are present to a lesser extent with sales to smaller customers.
Sales to Higher Spend Customers involve risks that may not be present or that are present to a lesser extent with sales to smaller customers, such as longer sales cycles, more complex customer requirements, substantial upfront sales costs, and less predictability in completing some of our sales. For example, Higher Spend Customers may require considerable time to evaluate and test our solutions and those of our competitors prior to making a decision on whether to subscribe to our platform. As a result, we may spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale. Moreover, Higher Spend Customers often begin to deploy our products on a limited basis, but nevertheless demand configuration, integration services and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these customers will deploy our products widely enough across their organization to justify our substantial upfront investment.
The market for our platform and solutions may develop more slowly or differently than we expect.
It is difficult to predict customer adoption rates and demand for our products and services, the entry of competitive products or services or the future growth rate and size of the Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), and artificial intelligence and machine learning (AI/ML) markets. The expansion of these markets depends on a number of factors, including the cost, performance, and perceived value associated with the markets in which we operate. The market for these applications as a whole, including our platform and products, could be negatively affected by a number of factors, many of which are outside of our control. For example, demand for our products and services could be negatively impacted if we or other providers in our space experience security incidents, loss of customer data, disruptions or other similar problems. If there is a reduction in demand caused by technological challenges, weakening economic conditions, data security or privacy concerns, governmental regulation, competing technologies and products, or decreases in information technology spending or otherwise, either now or in the future, the market for our platform and products might not continue to develop or might develop more slowly than we expect, which would adversely affect our business, financial condition and results of operations.
Our core customer base consists of growing technology companies. As these customers grow, if we are unable to meet their evolving needs, we may not be able to retain them. Our business will also suffer if the market for our solutions proves less lucrative than projected or if we fail to effectively acquire and service such users.
We expect that our path to growth will, in part, rely on scaling our platform to meet the needs of our customers as they increase usage of our platform. Accordingly, if such customers fail to grow as expected, then our path to growth may be adversely affected. In addition, our inability to offer both suitable services to support their businesses at scale and suitable and appropriately priced services for the initial state of their business, could adversely affect our business, financial condition and results of operations.
We intend to continue to devote substantial resources to the market for our Higher Spend Customers and the broader market for growing technology companies. However, these customers and potential customers may have limited budgets and may choose to allocate resources to items other than our solutions, especially in times of economic uncertainty or recessions. If these markets fail to be as lucrative as we project or we are unable to market and sell our services to such customers effectively, our ability to grow our revenues quickly and achieve or maintain profitability will be harmed.
Our artificial intelligence and machine learning (AI/ML) products and services may not be successful, which could adversely affect our business operating results or financial condition.
While we believe that the AI/ML offerings and services that we offer to customers will drive significant growth in our business, the AI/ML landscape is rapidly evolving and may create risks and challenges for our business. If we fail to develop and timely offer the right AI/ML offerings, if such offerings fail to meet our customers’ demands, if such offerings fail to operate as expected, or if our competitors launch AI/ML offerings more quickly or more successfully than we do, we
may lose our competitive position, our products may become obsolete, we may experience brand or reputational harm and our business, operating results or financial condition could be adversely affected.
In addition, the markets for AI/ML offerings or AI/ML-enabled products and services may not develop in the manner or time periods we anticipate, or at all. If domestic or global economies worsen, overall spending on the development of AI-related products and services may decrease, which would adversely impact demand for our products and services in these markets. Even if the demand for such products and services develops in the manner or in the time periods we anticipate, if we do not have timely and competitively-priced products and services that meet our customers’ needs, we may miss a significant opportunity and our business, operating results and financial condition could be materially and adversely affected. Also, because the markets for AI/ML-related products and services are still emerging, demand for these products and services may be unpredictable and may vary significantly from one period to another. See Risk Factor entitled “Our increased focus on the development and use of artificial intelligence and machine learning may result in reputational harm, liability or other adverse consequences to our business, results of operations or financial results” below.
We use artificial intelligence-based tools in our business operations that may present risks and challenges to our business.
In an effort to enhance internal efficiencies, we currently use and may continue to explore additional usage of internally-developed and third-party AI/ML platforms, offerings and tools, including generative AI products (AI/ML technology), in our internal operations. AI/ML technology is subject to privacy and data security laws, as well as increasing regulation and scrutiny. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.
We have developed policies governing the use of AI/ML technology to help reasonably ensure that such AI/ML technology is developed and used in a trustworthy manner by our employees, contractors, and authorized agents and that our assets, including intellectual property, competitive information, financial information, personal data we may collect or process, and customer information, are protected. Any failure by our personnel, contractors or other agents to adhere to our established policies could violate confidentiality obligations or applicable laws and regulations (including data privacy laws), jeopardize our intellectual property rights, cause or contribute to unlawful discrimination, result in the misuse of personally identifiable information, or introduce greater vulnerabilities to cybersecurity attacks or malware into our systems. Because the use of AI/ML technology is relatively new and rapidly evolving, we cannot be certain that our policies or adherence to them will offer us sufficient protection or that the use of such technologies will not harm our reputation, financial condition or operating results and certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. We also could be subject to claims from providers of third-party AI/ML technologies that we are using their products, tools or outputs in a manner that is inconsistent with their terms of use, and such claims may result in costly legal proceedings.
The use of third-party AI/ML technology by our business partners with access to our confidential information, including personal data, customer data, confidential information and trade secrets, may continue to increase. This carries increased risk that it could lead to the misuse or disclosure of such information, which could negatively impact us, including our ability to realize the benefits of our intellectual property. The use of AI/ML technology by our business partners may lead to novel and urgent cybersecurity risks, which could have a material adverse effect on our operations and reputation as well as the operations of any of our business partners. Finally, the use of AI/ML technology also presents emerging ethical issues and if our use of third-party AI/ML technology becomes controversial, we may experience brand or reputational harm, competitive harm or legal liability.
Any of these risks could be difficult to eliminate or manage and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition and future prospects. See also the Risk Factor entitled “Our increased focus on the development and use of artificial intelligence and machine learning may result in reputational harm, liability or other adverse consequences to our business, results of operations or financial results” below.
If we fail to timely release updates and new features to our platform and adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, or customer needs, our platform and products may become less competitive.
Our ability to attract new users and customers, expand our customer base, and increase revenue from existing customers depends in large part on our ability to enhance and improve our existing platform and products, increase adoption and usage of our platform and products, and introduce new products and capabilities. The markets in which we
compete are subject to rapid technological change, evolving industry standards, and changing regulations, as well as changing customer needs, requirements and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, anticipate and respond to customer demands and preferences, address business model shifts, optimize our go-to-market execution by improving our cost structure, align sales coverage with strategic goals, improve channel execution and strengthen our services and capabilities in our areas of strategic focus. If we were unable to enhance our products and platform capabilities to keep pace with rapid technological and regulatory change, or if new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely than our products, our business, financial condition and results of operations could be adversely affected.
We expect that the number of integrations and tools we will need to support will continue to expand as current and prospective customers adopt new technologies, and we will have to develop new or upgraded versions of our platform and products to work with those new platforms. This development effort may require significant engineering, sales and marketing resources, all of which would adversely affect our business. Any failure of our platform or products to operate effectively with future technologies and tools could reduce the demand for our platform and products. If we are unable to respond to these changes in a cost-effective manner, our platform may become less marketable and less competitive or obsolete, and our business, financial condition and results of operations could be adversely affected.
We rely on third-party data center providers to ensure the functionality of our platform and products. If our data center providers fail to meet the requirements of our business, or if our data center facilities experience damage, interruption or a security breach, our ability to provide access to our platform and maintain the performance of our network could be negatively impacted.
We lease space with third-party data center providers located in the United States, India, Germany, the United Kingdom, Canada, the Netherlands, Singapore and Australia. Our business is reliant on these data center facilities. Given that we lease this data center space, we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our data center facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes, floods, fires, power loss, system failures, computer vulnerabilities, physical or electronic break-ins, human error, malfeasance or interference, including by employees, former employees, or contractors, terrorism and other catastrophic events. We and our data centers have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes and capacity constraints, due to an overwhelming number of customers accessing our platform simultaneously. Data center facilities housing our network infrastructure may also be subject to local administrative actions, changes to legal or permitting requirements, labor disputes, litigation to stop, limit, or delay operations, and other legal challenges, including local government agencies seeking to gain access to customer accounts for law enforcement or other reasons. In addition, while we have entered into various agreements for the lease of data center space, equipment, maintenance and other services, the third party could fail to live up to the contractual obligations under those agreements.
Other factors, many of which are beyond our control, that can affect the delivery, performance, and availability of our platform and products include:
•the development, maintenance, and functioning of the infrastructure of the internet as a whole;
•the performance and availability of third-party telecommunications services with the necessary speed, data capacity, and security for providing reliable internet access and services;
•the failure of our redundancy systems, in the event of a service disruption at one of the facilities hosting our network infrastructure, to redistribute load to other components of our network;
•the failure of our disaster recovery and business continuity plans; and
•decisions by the owners and operators of the co-location and ISP-partner facilities where our network infrastructure is deployed or by global telecommunications service provider partners who provide us with network bandwidth to terminate our contracts, discontinue services to us, shut down operations or facilities, increase prices, change service levels, limit bandwidth, declare bankruptcy, breach their contracts with us, or prioritize the traffic of other parties.
The occurrence of any of these factors, or our inability to efficiently and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively impact our relationship with our customers, or otherwise materially harm our business, results of operations, and financial condition.
The components of our global network are interrelated, such that disruptions or outages affecting one or more of our network data center facilities may increase the strain on other components of our network. In addition, the failure of any of our data center facilities for any significant period of time could place a significant strain upon the ongoing operation of our business, as we have only limited redundant functionality for these facilities, and there may be concentration issues regarding the storing and backup of customer data. Such a failure of a core data center facility could degrade and slow down our network, reduce the functionality of our products for our customers, impact our ability to bill our customers, and otherwise materially and adversely impact our business, reputation, and results of operations.
In addition, if we do not optimize and operate these data center facilities efficiently, or if we fail to expand our data centers to meet increased customer demand, it could result in either lack of available capacity (resulting in poor service performance or technical issues) or excess data center capacity (resulting in increased unnecessary costs), both of which could result in the dissatisfaction or loss of customers and cause our business, results of operations and financial condition to suffer. As we continue to add product and service capabilities, our data center networks become increasingly complex and operating them becomes more challenging.
The terms of our existing data center agreements and leases vary in length and expire on various dates. Upon the expiration or termination of our data center facility leases, we may not be able to renew these leases on terms acceptable to us, if at all. Even if we are able to renew the leases on our existing data centers, rental rates, which will be determined based on then-prevailing market rates with respect to the renewal option periods and which will be determined by negotiation with the landlord after the renewal option periods, may increase from the rates we currently pay under our existing lease agreements. Migrations to new facilities could also be expensive and present technical challenges that may result in downtime for our affected customers. There can also be no assurances that our plans to mitigate customer downtime for affected customers will be successful.
If our systems or those of the third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions to our business operations; loss of revenue or profits; loss of customers; and other adverse consequences.
In the ordinary course of our business, we and the third parties with whom we work, process, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) proprietary, confidential, and sensitive data, including personal data, customer data, intellectual property, and trade secrets (collectively, “sensitive information”). Security incidents (including breaches of security) or unauthorized access to our platform and products have in the past and may in the future result in the loss of our or our customers’ or users’ data, litigation, disruptions to our business operations, indemnity obligations, fines, penalties, disputes, regulatory investigations and actions, and other liabilities.
Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Our platform, information technology systems, networks and physical facilities, and those of the third parties with whom we work, have been in the past and may continue in the future to be breached, and sensitive and proprietary data may have been and could be otherwise compromised.
We have in the past and may in the future also be impacted by and the target of cyber-attacks by third parties seeking unauthorized access to our or our customers’ or users’ sensitive or proprietary data or to disrupt our ability to provide our services. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these will be effective and our security measures, or those of our third parties that process sensitive information on our behalf, could be breached or we could suffer a loss of our sensitive information. We take steps designed to detect, mitigate and remediate vulnerabilities in our information technology systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.
We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts including, without limitation, data center facilities, encryption and authentication technology, employee email,
content delivery to customers, and other functions. Our ability to monitor these third parties information security practices is limited, and these third parties may not have adequate information security measures in place.
Cyber-attacks, computer malware, viruses, supply chain attacks, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and spear phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats have become more prevalent in our industry, particularly against cloud services.
In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.
Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
In addition, errors due to the action or inaction of our employees, contractors, or others with authorized access to our network could lead to a variety of security incidents. If the third parties with whom we work experience a security incident or other interruption, we have in the past and may in the future experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships reputation, and revenue in the future may be adversely impacted. We do not directly control content that our customers or users store, use, or access in our products. If our customers or users use our products for the transmission or storage of sensitive information and our security measures are or are believed to have been weak or breached, our reputation could be damaged, our business may suffer, and we could incur significant liability.
In addition, our existing security measures and remediation efforts may not be effective against current or future security threats. We expend significant resources or modify our business activities to try to protect against security incidents. Further to the risks associated with experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies.
Applicable data privacy and security obligations may require us, or we have voluntarily chosen, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. Because there are many different mechanisms that can cause security breaches and such mechanisms continue to evolve, we may be unable to anticipate attempted security breaches, react in a timely manner or implement adequate preventative measures. Third parties may also conduct attacks designed to temporarily deny customers or users access to our cloud services.
Any security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our platform and damage to our brand, reduce the demand for our products, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity
obligations, and adversely affect our business, financial condition and results of operations. These risks are likely to increase as we continue to grow and process, store, and transmit increasingly large amounts of data.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and security obligations. Additionally, although we maintain cybersecurity insurance coverage, we cannot be certain that such coverage will be adequate for data security liabilities actually incurred, will cover any indemnification claims against us relating to any incident, will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation, business, financial condition and results of operations.
In addition, our customers require and expect that we and/or the third parties with whom we work maintain industry-related compliance certifications. There are significant costs associated with maintaining existing and implementing any newly-adopted industry-related compliance certifications, including costs associated with retroactively building security controls into services which may involve re-engineering technology, processes and staffing. The inability to maintain applicable compliance certifications could result in monetary fines, disruptive participation in forensic audits due to a breach, security-related control failures, customer contract breaches, customer churn and brand and reputational harm.
We may not be able to successfully manage our growth, and if we are not able to grow efficiently, our business, financial condition and results of operations could be harmed.
The growth and expansion of our business will continue to require additional management, operational and financial resources. As usage of our platform grows, we will need to devote additional resources to improving and maintaining our infrastructure and integrating with third-party applications. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support, to serve our growing customer base, and to improve our information technology and financial infrastructure, operating and administrative systems and our ability to effectively manage headcount, capital and processes, including by reducing costs and inefficiencies. Any failure of or delay in these efforts could result in impaired system performance and reduced customer satisfaction, which would negatively impact our revenue growth and our reputation. Even if we are successful in our expansion efforts, they will be expensive and complex, and require the dedication of significant management time and attention. We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition and results of operations.
In addition, we must also continue to effectively manage our capital expenditures by maintaining and expanding our data center capacity, servers and equipment, grow in geographies where we currently have a small presence and ensure that the performance, features and reliability of our service offerings and our customer service remain competitive in a rapidly changing technological environment. If we fail to manage our growth, the quality of our platform and products may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.
If we underestimate or overestimate our data center capacity requirements and our capital expenditures on data centers, servers and equipment, our results of operations could be adversely affected.
The costs of building out, leasing and maintaining our data centers constitute a significant portion of our capital and operating expenses. To manage our capacity while minimizing unnecessary excess capacity costs, we continuously evaluate our short and long-term data center capacity requirements in order to effectively manage our capital expenditures. We may be unable to project accurately the rate or timing of increases in volume of usage on our platform or to successfully allocate resources to address such increases, and may underestimate the data center capacity needed to address such increases, and in response, we may be unable to increase our data capacity, and increase our capital expenditures on servers and other equipment, in an expedient and cost-effective manner to address such increases. If we underestimate our data center capacity requirements and capital expenditure requirements, we may not be able to provide our platform and products to current customers or service the expanding needs of our existing customers and may be required to limit new customer acquisition or enter into leases or other agreements for data centers, servers and other equipment that are not optimal, all of which may materially and adversely impair our results of operations.
In addition, many of our data center sites are subject to multi-year leases. If our capacity needs are reduced, or if we decide to close a data center, we may nonetheless be committed to perform our obligations under the applicable leases
including, among other things, paying the base rent for the balance of the lease term and continuing to pay for any servers or other equipment. If we overestimate our data center capacity requirements and capital expenditures, and therefore secure excess data center capacity and servers or other equipment, our operating margins could be materially reduced.
Finally, the costs of operating our data centers have increased and may increase in the future due to rising energy prices as a result of global geopolitical issues.
We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability of these components could delay our ability to expand or increase the capacity of our platform or replace defective equipment.
We do not manufacture the products or components we use to build our platform and the related infrastructure. We rely on a limited number of suppliers for several components of the equipment we use to operate our platform and provide products to our customers. Our reliance on these suppliers exposes us to risks, including:
•reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components;
•competition with larger cloud computing companies and other consumers with respect to high demand equipment, such as GPUs;
•limited ability to control the quality, quantity and cost of our products or of their components;
•the potential for binding price or purchase commitments with our suppliers at higher than market rates;
•limited ability to adjust production volumes in response to our customers’ demand fluctuations;
•labor and political unrest at facilities we do not operate or own;
•geopolitical disputes, regulatory restrictions and sanctions disrupting our supply chain;
•business, legal compliance, litigation and financial concerns affecting our suppliers or their ability to manufacture and ship our products in the quantities, quality and manner we require;
•impacts on our supply chain from adverse public health developments, including outbreaks of contagious diseases; and
•disruptions due to floods, earthquakes, storms and other natural disasters, particularly in countries with limited infrastructure and disaster recovery resources.
In addition, we are continually working to expand and enhance our platform features, technology and network infrastructure and other technologies to accommodate substantial increases in the volume of usage on our platform, the amount of content we host and our overall total customers. We may be unable to project accurately the rate or timing of these increases or to successfully allocate resources to address such increases, and may underestimate the data center capacity needed to address such increases, and our limited number of suppliers may not be able to quickly respond to our needs, which could have a negative impact on customer experience and our financial results. In the future, we may be required to allocate additional resources, including spending substantial amounts, to build, purchase or lease data centers and equipment and upgrade our technology and network infrastructure in order to handle increased customer usage, and our suppliers may not be able to satisfy such requirements. In addition, our network or our suppliers’ networks might be unable to achieve or maintain data transmission capacity high enough to process orders or download data effectively or in a timely manner. Our failure, or our suppliers’ failure, to achieve or maintain high data transmission capacity could significantly reduce consumer demand for our products. Such reduced demand and resulting loss of traffic, cost increases, or failure to accommodate new technologies could harm our business, revenue and financial condition.
If we do not or cannot maintain the compatibility of our platform with third-party applications that our customers use in their businesses, our business will be harmed.
Because our customers choose to integrate our products with certain capabilities provided by third-party providers, the functionality and popularity of our platform depends, in part, on our ability to integrate our platform and applications with developer tools and other third-party applications. These third parties may change the features of their technologies, restrict our access to their applications, or alter the terms governing use of their applications in a manner that is adverse to our business. Such changes could functionally limit or prevent our ability to use these third-party technologies in conjunction with our platform, which would negatively affect adoption of our platform and harm our business. If we fail
to integrate our platform with third-party applications that our customers use, we may not be able to offer the functionality that our customers need, which would harm our business.
We rely heavily on the reliability, security and performance of our internally developed systems and operations. Any difficulties in maintaining these systems may result in damage to our brand, service interruptions, decreased customer service or increased expenditures.
The reliability and continuous availability of the software, hardware and workflow processes underlying our internal systems, networks and infrastructure and the ability to deliver our products are critical to our business. Any interruptions resulting in our inability to timely deliver our products, or materially impacting the efficiency or cost with which we provide our products, would harm our brand, profitability and ability to conduct business. If third-party vendors increase their prices and we are unable to successfully pass those costs on to our customers, it could have a substantial effect on our results of operations.
We rely on our relationships with third-party software providers and other partners for certain essential financial and operational services, and a failure or disruption in these services could materially and adversely affect our ability to manage our business effectively.
We rely on third-party software providers and other partners for many essential financial and operational services to support our business, including, without limitation, encryption and authentication technology, infrastructure operations, certain database services, employee email, content delivery to customers, back-office support, credit card processing and other functions. These vendors provide their services to us via a cloud-based model instead of software that is installed on our premises. As a result, we depend upon these vendors to provide us with services that are always available and are free of errors or defects that could cause disruptions in our business processes. Any failure by these vendors to do so, or any disruption in our ability to access the internet, would materially and adversely affect our ability to manage our operations. In addition, although we have developed systems and processes that are designed to protect customer and user data and prevent data loss and other security breaches, including systems and processes designed to reduce the impact of a security breach at a third-party service provider, such measures cannot provide absolute security. Furthermore, if these services become unavailable or are no longer available to us on commercially reasonable terms due to circumstances beyond our control, such as an acquisition of our third-party provider, our expenses could increase, our ability to access certain data could be interrupted, and our processes for providing certain services to our customers could be impaired until equivalent services, if available, are identified, obtained and implemented, all of which could adversely affect our business.
Performance problems or defects associated with our platform may adversely affect our business, financial condition and results of operations.
It may become increasingly difficult to maintain and improve our platform performance, especially during peak usage times and as our customer base grows and our platform becomes more complex. If our platform is unavailable or if our customers are unable to access our platform within a reasonable amount of time or at all, we may experience a loss of customers, lost or delayed market acceptance of our platform, delays in payment to us by customers, injury to our reputation and brand, legal claims against us, significant cost of remedying these problems and the diversion of our resources. In addition, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition and results of operations, as well as our reputation, may be adversely affected.
Further, the software technology underlying our platform is inherently complex and may contain material defects or errors, particularly when new products are first introduced or when new features or capabilities are released. We have from time to time found defects or errors in our platform, and new defects or errors in our existing platform or new products may be detected in the future by us or our users. We cannot assure you that our existing platform and new products will not contain defects. Any real or perceived errors, failures, vulnerabilities, or bugs in our platform could result in negative publicity or lead to data security, access, retention or other performance issues, all of which could harm our business. The costs incurred in correcting such defects or errors may be substantial and could harm our business. Moreover, the harm to our reputation and legal liability related to such defects or errors may be substantial and could similarly harm our business.
The markets in which we participate are competitive, and if we do not compete effectively, our business, financial condition and results of operations could be harmed.
The markets that we serve are highly competitive and rapidly evolving. With the introduction of new technologies and innovations, we expect the competitive environment to remain intense. We compete primarily with large, diversified
technology companies that focus on large enterprise customers and provide cloud computing as just a portion of the products and services that they offer. The primary vendors in this category include Amazon (AWS), Microsoft (Azure), Google (GCP), IBM (IBM Cloud), Alibaba (Alibaba Cloud) and Oracle (Oracle Cloud). We also compete with smaller and/or niche cloud service providers that typically target individuals and smaller businesses, simple use cases and/or narrower geographic markets. Examples in this category include OVHcloud, Akamai (Linode), Hetzner, Vultr, Contabo, Scaleway, UpCloud, and Heroku. Our AI/ML offerings compete with providers of AI/ML infrastructure and services, including the same large, diversified technology companies, Amazon (AWS), Microsoft (Azure), and Google (GCP), and smaller more infrastructure-focused companies such as Coreweave and Lambda Labs. Finally, our Managed Hosting offering competes with digital agencies and other managed hosting providers, including Kinsta and WP Engine. We may also face increased competition from other companies that are using AI/ML applications, some of whom may develop more effective methods than we and any of our business partners have, which could have a material adverse effect on our business, results of operations or financial condition.
Our competitors vary in size and in the breadth and scope of the products offered. Many of our competitors and potential competitors, particularly our larger competitors, have substantial competitive advantages as compared to us, including greater name recognition and longer operating histories, larger sales and marketing and customer support budgets and resources, the ability to bundle products together, larger and more mature intellectual property portfolios, greater resources to make acquisitions and greater resources for technical assistance and customer support. Further, other potential competitors not currently offering competitive solutions may expand their product or service offerings to compete with our products and platform capabilities, or our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product offerings in our addressable market. In addition, some of our actual and potential competitors have been acquired by other larger enterprises and have made or may make acquisitions or may enter into partnerships or other strategic relationships that may provide more comprehensive offerings than they individually had offered or achieve greater economies of scale than us. Further, new entrants not currently considered to be competitors may enter the market through acquisitions, partnerships or strategic relationships. Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, and customer requirements. An existing competitor or new entrant could introduce new technology that reduces demand for our products and platform capabilities.
For all of these reasons, we may not be able to compete successfully against our current or future competitors, and this competition could result in the failure of our platform to continue to achieve or maintain market acceptance, any of which would harm our business, results of operations, and financial condition.
We may be unable to accurately predict the optimal pricing necessary to attract new customers and retain existing customers. Our pricing model subjects us to various challenges that could make it difficult for us to derive sufficient value from our customers.
We have in the past changed our pricing model from time to time and in the future may need to make further changes to the pricing model. As the market for our products matures, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers using the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. We generally charge our customers for their usage of our platform, and the add-on features and functionality they choose to enable. We do not know whether our current or potential customers or the market in general will continue to accept this pricing model going forward and, if it fails to gain acceptance, our business could be harmed. In addition, certain customers may demand substantial price concessions. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.
If we fail to effectively integrate new members of our executive leadership team and senior management or if we fail to retain and motivate members of our executive leadership team and senior management team and other key employees, our business and future growth prospects could be harmed.
Our success largely depends on our ability to effectively integrate new members of our executive leadership team and senior management. In 2024, we hired a Chief Executive Officer, Chief Product and Technology Officer, Chief Ecosystem and Growth Officer and Chief Revenue Officer, in addition to other members of senior management. The ability of these members of leadership and senior management to understand our business, operations, and strategic plans will be critical to the Company and our management’s ability to make informed decisions about our strategic direction and operations. Ensuring that executives and management gain detailed knowledge of our operations may take time and
resources. An inadequate transition may cause disruption to our business due to, among other things, diverting management’s attention away from the Company’s financial and operational goals or causing a deterioration in morale.
Additionally, our success and future growth depend largely upon the continued services of our executive leadership team, members of senior management and other key employees. If we fail to motivate or retain our executive leadership team, members of senior management and other key employees, our success and future growth may be impacted. Our executive officers and other key employees are employed on an at-will basis, which means that these personnel could terminate their employment with us at any time. The loss of one or more of our executive officers, or the failure by our executive team to effectively work with our employees and lead our company, could harm our business.
If we fail to retain and motivate, or fail to attract qualified personnel to support our operations, our business and future growth prospects would be harmed.
In order to execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel is intense, especially for engineers experienced in cloud computing, infrastructure solutions, and AI/ML. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources. In addition, prospective and existing employees often consider the value of the equity awards they receive in connection with their employment. Volatility or lack of performance in our stock price may affect our ability to recruit and retain key employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects would be harmed. In addition, since our equity awards are typically communicated to employees in dollar amounts, a decreasing share price may also require us to increase the number of shares that we include in employee equity awards, which has and may continue to affect our outstanding share count and cause dilution to existing shareholders.
We have in the past and may in the future undertake internal restructuring activities that could result in disruptions to our business or otherwise materially harm our results of operations or financial condition.
We have in the past and may in the future undertake internal restructuring activities in an effort to better align our resources with our business strategy. We incur substantial costs to implement restructuring plans, and our restructuring activities may subject us to reputational risks and litigation risks and expenses. There can be no assurance that any restructuring activities that we undertake will achieve the cost savings, operating efficiencies or other benefits that we may initially expect. In addition, restructuring activities may result in loss of institutional knowledge and expertise, attrition beyond our intended reduction-in-force, or a negative impact on employee morale and productivity or our ability to attract highly-skilled employees. Internal restructurings can also require a significant amount of time and focus from management and other employees, which may divert attention from commercial operations. While we take actions to mitigate these risks, there can be no certainty that such efforts to mitigate are effective. If any internal restructuring activities we have undertaken or undertake in the future fail to achieve some or all of the expected benefits therefrom, our business, results of operations and financial condition could be materially and adversely affected.
Our corporate culture has contributed to our success and if we cannot maintain this culture as we grow , we could lose the innovation, creativity and entrepreneurial spirit we have worked hard to foster, which could harm our business.
We believe our corporate culture has been a key contributor to our success to date. If we do not continue to maintain our corporate culture as we grow or as a result of any reductions in workforce, we may be unable to foster the innovation, creativity and entrepreneurial spirit we believe we need to support our growth.
We have in the past and may in the future be named as a defendant in litigation, including securities class action lawsuits and stockholder derivative lawsuits. Any lawsuits could result in substantial damages, divert management’s time and attention from our business, and have a material adverse effect on our results of operations. Lawsuits may be costly to defend or pursue and are uncertain in their outcome.
We have in the past and may in the future be involved in litigation, including securities class action lawsuits and stockholder derivative lawsuits. For example, in September 2023, a putative class action lawsuit was filed against us and certain of our current and former executive officers for alleged violations of the U.S. federal securities laws, which was subsequently dismissed. Lawsuits are subject to inherent uncertainties, and the actual defense and disposition costs will depend upon many unknown factors and their outcomes are necessarily uncertain. We could be forced to expend significant resources and incur significant expense in the defense of any lawsuits. Monitoring, initiating and defending against legal actions are time-consuming for our management, may be expensive and may detract from our ability to fully
focus our internal resources on our business activities. We may not be successful in having any lawsuits dismissed or settled within the limits of our insurance coverage. There also could be adverse publicity associated with any such lawsuits that could negatively affect public perception of our business, regardless of whether the allegations are valid or whether we are ultimately found liable.
If we fail to maintain and enhance our brands, our ability to expand our customer base will be impaired and our business, financial condition and results of operations may suffer.
We believe that maintaining and enhancing our brands are important to support the marketing and sale of our existing and future products to new customers and expand sales of our platform and products to existing customers. We also believe that the importance of brand recognition will increase as competition in our market increases. Successfully maintaining and enhancing our brands will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable products that continue to meet the needs of our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and use cases, and our ability to successfully differentiate our products and platform capabilities from competitive products. Our brand promotion activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. As noted below in “Risks Related to Our Intellectual Property,” there also are risks that we may not be able to adequately enforce and protect our trademark rights in our brands. If we fail to successfully promote and maintain our brands, our business, financial condition and results of operations may suffer.
Our ability to maintain customer satisfaction depends in part on the quality of our customer support. Failure to maintain high-quality customer support could have an adverse effect on our business, results of operation, and financial condition.
We believe that the successful use of our platform and products requires a high level of support and engagement for many of our customers, particularly our business customers. In order to deliver appropriate customer support and engagement, we must successfully assist our customers in deploying and continuing to use our platform and products, resolving performance issues, addressing interoperability challenges with the customers’ existing IT infrastructure, and responding to security threats and cyber-attacks and performance and reliability problems that may arise from time to time. Because our platform and products are designed to be highly configurable and to rapidly implement customers’ reconfigurations, if customers make errors in configuring our platform and products, they may experience significant disruption to their workloads on our platform. Increased demand for customer support, without corresponding increases in revenue, could increase our costs and adversely affect our business, results of operations, and financial condition.
In addition, we rely on our user community to serve as a resource for questions on any part of our platform. Members of our user community are not obligated to participate in discussions with other users, and to the extent they do not, our customers’ ability to find answers to questions about our platform or services may suffer. If we are unable to develop self-service support resources that are easy to use and that our customers utilize to resolve their technical issues, or if our customers choose not to take advantage of these self-service support services, our customers’ experience with our platform may be negatively impacted.
There can be no assurance that we will be able to hire sufficient support personnel as and when needed, particularly if our sales exceed our internal forecasts. To the extent that we are unsuccessful in hiring, training, and retaining adequate support resources, our ability to provide high-quality and timely support to our customers will be negatively impacted, and our customers’ satisfaction and their usage of our platform could be adversely affected.
Unfavorable conditions in our industry or the global economy, or reductions in information technology spending, could limit our ability to grow our business and negatively affect our results of operations.
Our results of operations may vary based on the impact of unfavorable changes in our industry or the global economy on us or our customers and potential customers. Adverse changes in macroeconomic conditions can significantly harm demand for our products and make it more challenging to forecast our operating results and make business decisions, including regarding prioritization of investments in our business. Unfavorable conditions in the economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, supply chain disruptions, inflationary pressures, interest rates, financial and credit market fluctuations, volatility in the capital markets, liquidity concerns at, and failures of, banks and other financial institutions, international trade relations, economic sanctions, political turmoil, political instability and transitions of power in regions where we operate, natural catastrophes, outbreaks of contagious diseases, warfare and terrorist attacks on the United States, Europe or elsewhere, including military actions affecting Russia, Ukraine, the Middle East or elsewhere could cause a decrease in business investments in information technology and negatively affect the growth of our business and our results of operations.
Geopolitical risks, including those arising from trade tension and/or the imposition of trade tariffs (including recent U.S. tariffs imposed or threatened to be imposed and any retaliatory actions taken by other countries), terrorist activity or acts of civil or international hostility, are increasing. While we do not currently have employees or direct operations in any region with ongoing military conflict, we may have customers with business activities in these countries and regions. Based on ongoing military conflicts and associated sanctions imposed by the U.S. government, our ability to receive payments from customers in those regions and our ability to realize revenues from those customers may be impacted. Further, due to political uncertainty and military actions, we and the third parties upon which we rely may be vulnerable to a heightened risk of cyber-attacks, computer malware, viruses, supply chain attacks, social engineering (including spear phishing and ransomware attacks) and general hacking that could materially disrupt our systems and operations.
Further, fluctuations in inflation rates and interest rates could have a material and adverse effect on our business, financial condition or results of operations. Economic weakness, customer financial difficulties and constrained spending on information technology operations could adversely affect our customers’ ability or willingness to subscribe to our service offerings, delay purchasing decisions and lengthen our sales cycles, reduce the usage of our products and services, or increase churn, all of which could have an adverse effect on our sales and operating results.
We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, our business, results of operations and financial condition could be materially and adversely affected. The full impact of any conflict, economic slowdown or other factor on our business operations and financial performance remains uncertain and will depend on future developments, including the severity and duration and its impact on our customers and third-party providers, as well as regional and global economic conditions. Any such disruptions may also exacerbate the impact of other risks described in this Annual Report on Form 10-K.
Our current operations are international in scope, and we plan further geographic expansion, creating a variety of operational challenges.
Our workforce and operations are international in scope and our customers are spread across approximately 190 countries. We are continuing to adapt to and develop strategies to address international markets, but there is no guarantee that such efforts will have the desired effect. We expect that our international activities will continue to grow for the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant dedication of management attention and financial resources.
Our current and future international business and operations involve a variety of risks, including:
•slower than anticipated availability and adoption of cloud-based infrastructures and platforms by international businesses;
•the need to adapt and localize our products for specific countries;
•potential changes in laws, regulations, sanctions or trade relations;
•more stringent regulations relating to data privacy and security and the unauthorized use of, or access to, commercial and personal data, particularly in Europe;
•challenges inherent in efficiently managing, and the increased costs associated with, an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs that are specific to each jurisdiction;
•greater difficulty collecting accounts receivable and longer payment cycles;
•payment issues and other foreign currency risks, including fluctuations in exchange rates;
•inflation in certain regions where we operate;
•laws and business practices favoring local competitors or general market preferences for local vendors;
•political instability or terrorist activities;
•an outbreak of a contagious disease or a natural disaster that may cause us or our third-party providers and/or customers to temporarily suspend our or their respective operations in the affected city or country; and
•adverse tax burdens and foreign exchange restrictions that could make it difficult to repatriate earnings and cash.
If we invest substantial time and resources to further expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.
We are exposed to fluctuations in currency exchange rates and interest rates, which could negatively affect our results of operations and our ability to invest and hold our cash.
Our sales are currently primarily denominated in U.S. dollars, and therefore, our revenue is generally not subject to foreign currency risk. However, the current strengthening of the U.S. dollar increases the real cost of our platform to our customers outside of the United States, which could adversely affect our results of operations. Our operating expenses incurred outside the United States are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected.
Our international operations may subject us to potential adverse tax consequences.
The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency.
Our tax provision could also be impacted by changes in accounting principles, changes in U.S. federal, state, or international tax laws applicable to corporate multinationals, other fundamental law changes currently being considered by many countries, and changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions. For example, the Organisation for Economic Co-operation and Development (OECD) has been spearheading a multilateral effort on proposals, commonly referred to as “BEPS 2.0”, which, to the extent implemented, will make important changes to the international tax system. These proposals are based on two “pillars”, involving the reallocation of taxing rights in respect of certain multinational enterprises above a fixed profit margin to the jurisdictions in which they carry on business (Pillar One) (based on the thresholds, we currently expect to be outside the scope of the Pillar One proposals, but could fall within their scope in the future) and imposing a minimum effective corporate tax rate on certain multinational enterprises (Pillar Two). A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules. The OECD has issued administrative guidance providing transition and safe harbor rules around the implementation of Pillar Two. Based on our current understanding of the minimum revenue thresholds, we currently expect to be outside the scope of the Pillar Two proposals but could fall within their scope in the future, which could increase our tax obligations and require us to incur additional material costs to ensure compliance with any such rules in the countries where we do business. We are monitoring developments and evaluating the potential impacts of these new rules, including on our effective tax rates, and our eligibility to qualify for the transition and safe harbor rules.
We could be required to collect additional taxes or be subject to other tax liabilities or obligations that may increase the costs our clients would have to pay for our products and adversely affect our results of operations.
An increasing number of jurisdictions have considered or adopted laws to impose tax obligations on companies without a physical presence in the jurisdiction. The Supreme Court of the United States has ruled that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s state. State or local governments may adopt, or begin to enforce, laws requiring us to calculate, collect, and remit sales and use taxes in their jurisdictions. Similarly, many foreign jurisdictions have considered or adopted laws that impose obligations related to value-added taxes, digital services taxes, or other taxes on companies without a physical presence in the foreign jurisdiction. A successful assertion by one or more state or local governments or foreign jurisdictions requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest. Obligations to calculate, collect and remit sales, value-added, digital services, or other taxes in jurisdictions in which we have no physical presence could also create additional administrative burdens for us, put us at a competitive disadvantage if similar obligations are not imposed on our competitors, and decrease our future sales, which could have a material adverse effect on our business and results of operations.
Our ability to use our net operating losses and other tax credits to offset future taxable income may be subject to certain limitations.
As of December 31, 2024, we had net operating losses (NOL) carryforwards for federal, state and foreign income tax purposes and other tax credit carryforwards for federal and state tax purposes. Certain of these NOL carryforwards and tax credit carryforwards will expire in various years beginning in 2029 for federal purposes and 2030 for state purposes if not utilized. Our ability to utilize our NOL carryforwards and other tax credit carryforwards to offset taxable income may be subject to certain limitations. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an “ownership change” (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-change NOLs or other tax credits to offset future taxable income. We have experienced ownership changes under Section 382 of the Code in the past and may experience a future ownership change under Section 382 of the Code that could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs and tax credits of companies that we have acquired or may acquire in the future may be subject to limitations. There is also a risk that regulatory changes, such as suspensions on the use of NOLs or other tax credits, or other unforeseen reasons, could cause our existing NOLs or tax credits to expire or otherwise be unavailable to reduce current or future income tax liabilities, including for state tax purposes. For these reasons, we may not be able to utilize a material portion of the NOLs and tax credits reflected on our balance sheet, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.
Changes in our effective tax rate or tax liability may have an adverse effect on our results of operations.
Our effective tax rate could increase due to several factors, including:
•changes in the relative amounts of income before taxes in the various jurisdictions in which we operate that have differing statutory tax rates;
•changes in tax laws, tax treaties, and regulations or the interpretation of them;
•changes to our assessment about our ability to realize our deferred tax assets that are based on estimates of our future results, the prudence and feasibility of possible tax planning strategies, and the economic and political environments in which we do business;
•the outcome of future tax audits, examinations, or administrative appeals; and
•limitations or adverse findings regarding our ability to do business in some jurisdictions.
Any of these developments could adversely affect our results of operations.
Our leverage could adversely affect our financial condition, our ability to raise additional capital to fund our operations, our ability to operate our business, our ability to react to changes in the economy or our industry, divert our cash flow from operations for debt payments and prevent us from meeting our debt obligations.
In November 2021, we issued $1.5 billion aggregate principal amount of 0% convertible senior notes due 2026 in a private placement. As of December 31, 2024, we had no outstanding indebtedness, but significant borrowing capacity, under our credit facility with KeyBank National Association, as administrative agent, and the other lenders party thereto. We may not be able to refinance our existing indebtedness because of our amount of debt, debt incurrence restrictions under our debt agreements or adverse conditions in credit markets generally. Our inability to generate sufficient cash flow to satisfy our debt obligations, or to refinance our indebtedness on commercially reasonable terms or at all, would result in an adverse effect on our financial condition and results of operations. Although our credit agreement contains restrictions on the incurrence of additional indebtedness and entering into certain types of other transactions, these restrictions are subject to a number of qualifications and exceptions. Additional indebtedness incurred in compliance with these restrictions could be substantial. These restrictions also do not prevent us from incurring obligations, such as trade payables. In addition, in connection with our acquisition of Paperspace, we acquired a number of equipment leases, which remain outstanding. Pursuant to the terms of the equipment leases, we may be restricted from engaging in certain activities.
Our credit agreement currently imposes and any other debt we incur may impose significant operating and financial restrictions on us and our subsidiaries, which may prevent us from capitalizing on business opportunities.
The credit agreement that governs our credit facility imposes significant operating and financial restrictions on us. These restrictions limit the ability of our subsidiaries, and effectively limit our ability to, among other things:
•incur or guarantee additional debt or issue disqualified equity interests;
•pay dividends and make other distributions on, or redeem or repurchase, capital stock;
•make certain investments;
•incur certain liens;
•enter into transactions with affiliates;
•merge or consolidate;
•enter into agreements that restrict the ability of restricted subsidiaries to make certain intercompany dividends, distributions, payments or transfers; and
•transfer or sell assets.
Any other indebtedness we incur could impact our business and financial condition in one or more of the following ways:
•requiring a substantial portion of cash flow from operations to be dedicated to the payment of principal and interest on our indebtedness;
•exposing us to increased interest expense;
•making it more difficult for us to satisfy our obligations with respect to our indebtedness;
•restricting us from making strategic acquisitions;
•limiting our ability to obtain additional financing for working capital, capital expenditures, product development, satisfaction of debt service requirements, acquisitions and general corporate or other purposes;
•increasing our vulnerability to adverse economic, industry or competitive developments; and
•limiting our flexibility in planning for, or reacting to, changes in our business or market conditions and placing us at a competitive disadvantage compared to our competitors who may be better positioned to take advantage of opportunities that our leverage prevents us from exploiting.
As a result of any of the existing restrictions described above or any other restrictions arising from our indebtedness, we could be limited as to how we conduct our business and we may be unable to raise additional debt or equity financings to compete effectively or to take advantage of new business opportunities. The terms of any future indebtedness we may incur could include more restrictive covenants. We cannot assure you that we will be able to maintain compliance with these covenants in the future and, if we fail to do so, that we will be able to obtain waivers from the lenders or amend the covenants.
Our failure to comply with any of the existing restrictions described above or any other restrictions associated with the terms of any future indebtedness from time to time could result in an event of default, which, if not cured or waived, could result in our being required to repay these borrowings before their due date. If we are forced to refinance these borrowings on less favorable terms or are unable to refinance these borrowings, our results of operations and financial condition could be adversely affected.
We may require additional capital to support the growth of our business, and this capital might not be available on acceptable terms, if at all.
We have historically funded our operations through equity and debt financings and sales of our products. We cannot be certain if our operations will continue to generate sufficient cash to fully fund our ongoing operations or the growth of our business. If our ongoing operations, growth and any other investments to support our business cannot be funded by our operations, we may be required to engage in equity or debt financings to secure additional funds. Additional financing may not be available on terms favorable to us, if at all. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, and financial condition. If we incur additional debt, the debt holders would have rights senior to holders of common stock to make claims on our assets, and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in the future will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests. Our
inability to obtain adequate financing on terms satisfactory to us, when we require it, could significantly limit our ability to continue to support our business growth, respond to business challenges, expand our operations or otherwise capitalize on our business opportunities due to lack of sufficient capital. Even if we are able to raise such capital, we cannot assure you that it will enable us to achieve better operating results or grow our business.
Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify, pose integration challenges, divert the attention of management, disrupt our business, dilute stockholder value, and adversely affect our business, financial condition and results of operations.
We have in the past and may in the future seek to acquire or invest in businesses, joint ventures, products and platform capabilities, or technologies that we believe could complement or expand our services and platform capabilities, enhance our technical capabilities, or otherwise offer growth opportunities. Any such acquisition or investment may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable opportunities, whether or not the transactions are completed, and may result in unforeseen operating difficulties and expenditures. In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products and platform capabilities, personnel or operations of any acquired companies, particularly if the key personnel of an acquired company choose not to work for us, if we do not have sufficient internal expertise to integrate and grow the acquired business, their infrastructure is not easily adapted to work with our platform, or we have difficulty retaining the customers of any acquired business due to changes in ownership, management or otherwise. In addition, we could face risk related to liability for activities of any acquired company prior to the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities, and litigation or other claims in connection with the acquired company, including claims from terminated employees, users, former stockholders or other third parties, and our efforts to limit such liabilities could be unsuccessful. Finally, we may need to implement or improve the controls, procedures and policies of any acquired company, and we may face risks if any of those controls, procedures or policies are insufficiently effective. If we are unsuccessful in integrating or growing any acquired business, the acquisition may not result in the synergies and other benefits we had expected to achieve, and the revenue and operating results of the combined company could be adversely affected. In addition, the acquisition may not ultimately strengthen our competitive position or could be viewed negatively by our customers, investors or securities analysts.
Our business could be disrupted by catastrophic occurrences and similar events.
Our platform and the public cloud infrastructure on which our platform relies are vulnerable to damage or interruption from catastrophic occurrences, such as earthquakes, floods, fires, power loss, telecommunication failures, terrorist attacks, criminal acts, sabotage, other intentional acts of vandalism and misconduct, geopolitical events, disease, and similar events. Despite any precautions we may take, the occurrence of a natural disaster or other unanticipated problems at our facilities or the facilities of our public cloud providers could result in disruptions, outages, and other performance and quality problems. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be seriously harmed.
Risks Related to Our Regulatory Environment
Activities of our customers or the content on their websites could subject us to liability.
We provide products and services that enable our customers and users to exchange information and engage in various online activities, and our products and services include substantial user-generated content. For instance, customers and users include content on their Droplets, post or generate content on our website’s community section, and offer applications and integrations through our marketplace. Customer or user content or activity may be infringing, illegal, hostile, offensive, unethical, or inappropriate, may violate our terms of service or a customer’s own policies, or may be intended to, or inadvertently, circumvent or threaten the confidentiality, integrity, security or availability of information or network services of other products, services, or systems, including, for example, by launching various attacks. From time to time, we are subject to legal claims or regulatory enforcement actions arising from the conduct of certain of our customers and may be subject to additional lawsuits or regulatory enforcement actions relating to the content or actions by our customers or users. Even if claims against us are ultimately unsuccessful, defending against such claims will increase our legal expenses and divert management’s attention from the operation of our business, which could adversely impact our business and results of operations, and our brand, reputation, and financial results may be harmed.
We (like other intermediary online service providers) rely primarily on two sets of laws in the United States to shield us from legal liability with respect to user activity. The Digital Millennium Copyright Act (DMCA), provides
service providers a safe harbor from monetary damages for copyright infringement claims, provided that service providers comply with various requirements designed to stop or discourage infringement on their platforms by their users. Section 230 of the Communications Decency Act (CDA), protects providers of an interactive computer service from liability with respect to most types of content provided over their service by others, including users. Both the DMCA safe harbor and Section 230 of the CDA face regular and current, calls for revision. For example, a variety of bills have been introduced in the U.S. Congress that would seek to make changes to the scope of Section 230 of the CDA, including legislation in the U.S. Congress that, if enacted, would narrow the protections of Section 230 of the CDA. Enactment of this legislation or an unfavorable outcome of the FCC rulemaking could limit our ability to rely on the protections of Section 230 of the CDA. Furthermore, recent litigation has created uncertainty with respect to the applicability of DMCA protections to companies that host substantial amounts of user content. For these reasons and others, now or in the future, the DMCA, CDA, and similar provisions may be interpreted as not applying to us or may provide us with incomplete or insufficient protection from claims.
We do not typically monitor the content, activities, or Droplets of our customers or users, so inappropriate content may be posted or activities executed before we are able to take protective action, which could subject us to legal liability. Even if we comply with legal obligations to remove or disable content, we may continue to allow use of our products or services by individuals or entities who others find hostile, offensive, or inappropriate. The activities or content of our customers or users may lead us to experience adverse political, business and reputational consequences, especially if such use is high profile. Conversely, actions we take in response to the activities of our customers or users, up to and including banning them from using our products, services, or websites, may harm our brand and reputation.
In addition to liability based on our activities in the United States, we may also be deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, which may impose additional liability or expense on us, including additional theories of intermediary liability. For example, in 2019, the European Union approved a copyright directive that will impose additional obligations on online platforms, and failure to comply could give rise to significant liability. Other recent laws in Germany (extremist content), Australia (violent content), India (intermediary liability) and Singapore (online falsehoods), as well as other new similar laws, may also expose cloud-computing companies like us to significant liability. We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition. Potential litigation could expose us to claims for damages and affect our business, financial condition and results of operations.
Our business could be affected by the enactment of new governmental regulations regarding the internet or the application of additional or different existing governmental regulation to our business, products, or services.
The legal and regulatory environment pertaining to the internet and products and services such as ours, both in the United States and internationally, is uncertain and may change. New laws may be passed, existing but previously inapplicable or unenforced laws may be deemed to apply, legal safe harbors may be narrowed, and courts may issue decisions affecting existing regulations or leading to new ones. Furthermore, legal and regulatory authorities, both in the United States and internationally, may characterize or recharacterize us and our business, products, or services in ways that would apply additional or different regulations to us. These changes could affect, among other things, areas related to our business such as the following:
•the liability of online service providers for actions by customers or users, including fraud, illegal content, spam, phishing, libel and defamation, hate speech, infringement of third-party intellectual property and other abusive conduct;
•other claims based on the nature and content of internet materials;
•user data privacy and security issues;
•consumer protection risks;
•evolving regulatory framework for AI/ML;
•digital marketing aspects;
•characteristics and quality of services, including changes to networking relationships and anti-circumvention technologies;
•the contractual terms within our terms of service and other agreements with customers;
•cross-border e-commerce issues; and
•ease of access by our users to our platform.
New laws or regulations, or new applications or interpretations of existing laws or regulations, could hinder growth and decrease acceptance, both of the internet and online services, or of our specific products or services, both generally or with respect to certain uses or industries. Such legal changes could increase our costs of doing business, subject our business to increased liability for non-compliance, or prevent us from marketing or delivering our services over the internet or in specific jurisdictions, thereby materially harming our business and results of operations. In addition, certain jurisdictions may attempt to require us to establish a corporate presence in the country, which, if we were to comply, may also increase our exposure to government requests for censorship and to data breaches in general and, in the case of noncompliance, may subject us to fines or being blocked from doing business in the region.
The success of our business depends on our customers’ continued and unimpeded access to our platform on the internet and, as a result, also depends on internet providers and the related regulatory environment.
Our customers must have internet access in order to use our platform. Some internet providers may take measures that affect their customers’ ability to use our platform, such as degrading the quality of the content we transmit over their lines, giving that content lower priority, giving other content higher priority than ours, blocking our content entirely, or attempting to charge their customers more for using our platform.
On multiple occasions, the FCC has adopted and later repealed net neutrality rules that bar internet providers from blocking or slowing down access to online content, thereby protecting services like ours from such interference. The FCC’s actions follow changes in the composition of commissioners at the FCC. Currently, there are no federal net neutrality rules.
Changes to party composition and control in Congress, statehouses or state legislatures may create at least the possibility that Congress or states may enact laws on net neutrality, though the prospects for such actions are uncertain. Certain states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers. California’s net neutrality law took effect in 2021, and a similar law in Vermont is subject to a pending challenge, but went into effect on April 20, 2022. We cannot predict whether future FCC net neutrality rules or other state initiatives will be enforced, modified, overturned or vacated by legal action of a court, federal legislation or the FCC. In addition, the status of state regimes may be affected by the FCC's action in its new network neutrality proceeding.
To the extent network operators attempt to interfere with our platform, extract fees from us to deliver our platform or from customers for the use of our platform, or otherwise engage in discriminatory practices, our business could be adversely impacted. Within such a regulatory environment, we could experience discriminatory or anti-competitive practices that could impede our domestic and international growth, cause us to incur additional expense, or otherwise harm our business. The adoption of any new laws or regulations, or the application or interpretation of existing laws or regulations to the internet, could impact our customers’ continued and unimpeded access to our platform on the internet.
Our increased focus on the development and use of artificial intelligence and machine learning may result in reputational harm, liability or other adverse consequences to our business, results of operations or financial results.
We continue to invest in our AI/ML product offerings, which may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, privacy or security risks, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. The increasing focus on the risks and strategic importance of AI/ML technologies has already resulted in regulatory restrictions that target products and services capable of enabling or facilitating AI/ML.
Several jurisdictions around the world, including Europe, the U.S. federal government and certain U.S. states, have proposed, enacted or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws.
Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen
if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”).
Furthermore, concerns regarding third-party use of AI/ML for purposes contrary to governmental interests, including concerns relating to the misuse of AI/ML applications, models, and solutions, could result in restrictions on AI/ML products, for example those that can be used for training, refining, and deploying large language models (LLMs). If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.
Furthermore, unfavorable developments with evolving laws and regulations affecting AI/ML-related products may limit global adoption, impede our strategy and negatively impact our long-term expectations in this area. For example, there is significant uncertainty in the U.S. courts as to how AI/ML technologies affect intellectual property ownership, including copyright protections, and the use of AI/ML-related technology in the development of our products or implementation of AI/ML features in our products could expose us or our customers to claims of copyright infringement or misappropriation. We may not be able to anticipate how to respond to or comply with these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions.
The cost of complying with such frameworks could be significant and may increase our operating expenses. Because AI/ML technology is highly complex and rapidly developing, it is not possible to predict all legal, operational or technological risks that may arise relating offering AI/ML products. It is also unclear how our status as an infrastructure provider for customers developing and deploying AI/ML applications as opposed to developing such applications ourselves will affect the applicability of these regulations on our offerings.
We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, information security policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
In the ordinary course of business, we process sensitive information. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, guidance, industry standards, external and internal privacy and security policies, contractual requirements, directives, regulations, and other obligations relating to data privacy and security.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). We publish privacy policies, marketing materials, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. In the United States, these include enforcement actions by federal agencies and state attorneys general.
In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards with which we must legally comply or that contractually apply to us. If we fail to follow these security standards even if no customer or personal information is compromised, we may incur significant fines or experience a significant increase in costs or reputational harm. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our inability or failure to do so could result in adverse consequences.
Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments.
These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA) applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.
Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union’s General Data Protection Regulation (EU GDPR), the United Kingdom’s GDPR (UK GDPR), and China’s Personal Information Protection Law (PIPL) impose strict requirements for processing personal data.
For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and various related provincial laws, as well as Canada’s Anti-Spam Legislation (CASL), apply to our operations. In Australia, the Privacy Act also applies to our operations.
As another example, the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. The Swiss Federal Act on Data Protection, or the FADP, also applies to the collection and processing of personal data by companies located in Switzerland, or in certain circumstances, by companies located outside of Switzerland.
We also have customers in Asia and may be subject to new and emerging data privacy regimes in Asia, including China’s PIPL, which imposes a set of specific obligations on covered businesses in connection with their processing and transfer of personal data and imposes fines of up to RMB 50 million or 5% of the prior year’s total annual revenue of the violator. India’s new privacy legislation, the Digital Personal Data Protection Act (DPDP), also applies to our operations.
In addition to the EU GDPR, the European Commission has another draft regulation, known as the Regulation on Privacy and Electronic Communications (ePrivacy Regulation), that would replace the current ePrivacy Directive. New rules related to the ePrivacy Regulation are likely to include enhanced consent requirements in order to use communications content and metadata, which may negatively impact our platform and products and our relationships with our customers.
Complying with the EU GDPR and the ePrivacy Regulation, if and when the latter becomes effective, may cause us to incur substantial operational costs or require us to change our business practices. We may not be successful in our efforts to achieve compliance and may also experience difficulty retaining or obtaining new European or multi-national customers or significantly increased liability with respect to these customers pursuant to the terms set forth in our engagements with them. While we utilize data centers in the European Economic Area (EEA) to maintain certain customer and user data (which may include personal data) originating from the EU in the EEA, we may find it necessary to establish additional systems and processes to maintain such data in the EEA, which may involve substantial expense and distraction from other aspects of our business. Additionally, data localization requirements in other jurisdictions may cause us to incur potentially significant costs for establishing and maintaining facilities for storing and processing such data.
In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent interpretations of their data localization and cross-border data transfer laws.
Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.
If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.
Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.
Furthermore, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our products. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and foreign countries.
We, or the third parties with whom we work, may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; and orders to destroy or not use personal data.
In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.
Furthermore, in order to offer our products to certain customers, we may be required to comply with additional regulations. For example, to offer our products to certain customers in the healthcare industry, we are required to implement certain security and privacy measures and related procedures to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and we have executed HIPAA business associate agreements (BAAs) with certain customers that are “covered entities” under HIPAA, which subject us to additional liabilities, penalties and fines in the event we fail to comply with the terms of such agreements. The storage of such information may also require us to modify and enhance our platform at a significant cost.
Our policies regarding user privacy could cause us to experience adverse business and reputational consequences with customers, employees, suppliers, government entities, users, and other third parties.
From time to time, government entities (including law enforcement bodies) may seek our assistance with obtaining information about our customers or users. Although we strive to protect the privacy of our customers, we may be required from time to time to provide information about our customers to government entities. In light of our privacy commitments, we may legally challenge law enforcement requests to provide access to our systems, customer Droplets, or other user content but may face complaints that we have provided information improperly to law enforcement or in response to third party abuse complaints. We may experience adverse political, business, and reputational consequences, to the extent that we (a) do not provide assistance to or comply with requests from government entities or challenge those requests publicly or in court or (b) provide, or are perceived as providing, assistance to government entities that exceeds our legal obligations. Any such disclosure could significantly and adversely impact our business and reputation.
We publish a transparency report on an annual basis to provide details of government entity requests we receive. Our transparency report also includes a list of certain actions we have taken (e.g., disclosure of information) in response to law enforcement requests, as well as our standard policies and procedures regarding any such requests. Both the publishing of our transparency report and, conversely, the actions we take or challenge in response to law enforcement requests could damage our business and reputation.
We are subject to governmental export and import controls, economic sanctions, and foreign investment laws and regulations that could impair our ability to compete in international markets or subject us to liability if we are not in full compliance with applicable laws.
Our business activities are subject to various export, import, sanctions, and foreign investment laws and regulations, including, without limitation, the United States Department of Commerce’s Export Administration Regulations and various economic and trade sanctions regulations administered by the United States Department of the Treasury’s Office of Foreign Assets Controls. The United States export control laws and United States economic sanctions laws include restrictions or prohibitions on the sale or supply of certain products and services to United States embargoed or sanctioned countries, governments, persons and entities. In addition, various countries regulate the import of certain technology and have enacted or could enact laws that could limit our ability to provide our customers access to our platform or could limit our customers’ ability to access or use our platform in those countries.
We incorporate encryption technology into certain of our products. U.S. export control laws require authorization for the export of encryption items. In addition, various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products and services or could limit our customers’ ability to implement our products and services in those countries. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities.
Trade-related laws and restrictions continue to evolve in response to geopolitical tensions and the introduction and increasing adoption of new technologies. Most recently, new export controls have included strict licensing restrictions on exports of U.S. regulated semiconductor- and supercomputer-related products and technologies, as well as certain chips and chip-related products and technologies. New regulations relating to certain U.S. person transactions, including acquisitions of equity interest, involving persons with a qualifying nexus to China and specified technology sectors, to include semiconductors and artificial intelligence, also have been implemented. These as well as other restrictions that could be forthcoming may impact certain of our business activities, particularly as they relate directly or indirectly to China. Further, achieving compliance with such developments may require additional resources and raise costs. Although we take precautions to prevent our platform from being provided in violation of such laws, our platform may have in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and fines. We may also be adversely affected through penalties, reputational harm, loss of access to certain markets, compliance costs, or otherwise.
Changes in our platform, or future changes in trade-related regulations may prevent our users with international operations from utilizing our platform globally or, in some cases, prevent the export or import of our platform to certain countries, governments, or persons altogether. Any change in export or import regulations, economic sanctions, foreign investment laws, or other related legislation, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of our platform by, or in our decreased ability to export or sell subscriptions to our platform to, existing or potential users with international operations. Any decreased use of our platform or limitation on our ability to export or sell our platform would likely adversely affect our business, results of operations, and financial results.
We are subject to anti-corruption, anti-bribery, anti-money laundering, and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business, financial condition and results of operations.
We are subject to the U.S. Foreign Corrupt Practices Act (FCPA), U.S. domestic bribery laws, the UK Bribery Act, and other anti-corruption and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees and their third-party intermediaries from authorizing, offering or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector. As we increase our international business, we may engage with business partners and third party intermediaries to market our products and to obtain
necessary permits, licenses, and other regulatory approvals, and may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities.
We cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we increase our international business, our risks under these laws may increase.
Detecting, investigating, and resolving actual or alleged violations of anti-corruption laws, and responding to any action, can require a significant diversion of time, resources, and attention from senior management and significant defense costs and other professional fees. In addition, noncompliance with anti-corruption, anti-bribery, or anti-money laundering laws could subject us to whistleblower complaints, investigations, various penalties or debarment from contracting with certain persons, and other collateral consequences. If any subpoenas or investigations are launched, or sanctions are imposed, or if we do not prevail in any possible proceeding, our business, financial condition and results of operations could be harmed. In addition, responding to any action will likely result in a significant diversion of management’s attention and resources.
Risks Related to Our Intellectual Property
Any failure to obtain, maintain, protect or enforce our intellectual property and proprietary rights could impair our ability to protect our proprietary technology and brand.
Our success depends to a significant degree on our ability to obtain, maintain, protect and enforce our intellectual property rights. We rely on a combination of trademarks, service marks, trade secrets, patents, copyrights, contractual restrictions, and confidentiality procedures to establish and protect our intellectual and proprietary rights, including in our technology, know-how, and brand. Legal standards relating to intellectual property rights are uncertain, in both the United States and other jurisdictions in which we operate, and protecting, monitoring, and defending our intellectual property rights might entail significant expense. Intellectual property rights that we have or may obtain may be challenged, circumvented, invalidated or held unenforceable. Furthermore, even though we attempt to enter into contractual provisions with third parties to control access to, or the distribution, use, misuse, misappropriation, reverse engineering or disclosure of, our intellectual property or technology, no assurance can be given that these agreements will be sufficient or effective in protecting our intellectual property rights.
Moreover, intellectual property laws, standards, and enforcement mechanisms in foreign countries may be uncertain, may not be as protective of intellectual property rights as those in the United States, or may not be available to us. As we expand our international activities, our exposure to unauthorized copying and use of our products, services, and other intellectual property, such as our trademarks, will likely increase. As we further expand internationally, we may be unable to register, obtain the right to use, or stop others from using, our brand names in certain jurisdictions.
Despite our efforts, we may be unable to adequately obtain, maintain, protect, and enforce our intellectual property rights or prevent third parties from infringing upon, misappropriating or otherwise violating our intellectual property rights. If we fail to protect our intellectual property rights adequately, our competitors may gain access to, or be able to replicate, our proprietary technology, products, or services, or may use brands similar to our own valuable brands, and our business, financial condition, results of operations or prospects may be harmed. Our attempt to enforce our intellectual property rights, even if successful, could result in costly litigation or diversion of our management’s attention and resources, and, as a result, delay sales or the implementation or introduction of our products and platform capabilities, or injure our reputation.
We may become subject to intellectual property claims from third parties, which may subject us to significant liability, increased costs, and impede our ability to operate our business.
Our success depends, in part, on our ability to develop and commercialize our products and services without infringing, misappropriating or otherwise violating the intellectual property rights of third parties. However, we may not be aware that our products, services, or intellectual property are infringing, misappropriating, or violating third party intellectual property rights. Additionally, the technology industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets, and other intellectual and proprietary rights. Companies in the industry are often required to defend against litigation claims based on allegations of infringement, misappropriation or other violations of intellectual property rights, and third parties have brought such claims against us and may bring additional claims against us in the future. In addition, we may become subject to intellectual property disputes or otherwise subjected to
liability for customer content on our platform. From time to time, we are subject to legal claims arising from intellectual property disputes regarding our customer’s alleged infringement of third party intellectual property and may be subject to similar claims.
Lawsuits are time-consuming and expensive to resolve, and they divert management’s time and attention, and our technologies or intellectual property may not be able to withstand third party claims against their use. Any intellectual property litigation to which we might become a party, or for which we are required to provide indemnification, may require us to do one or more of the following:
•cease selling or using products or services that incorporate the intellectual property rights that we allegedly infringe, misappropriate or violate;
•make substantial payments for legal fees, settlement payments or other costs or damages;
•obtain a license, which may not be available on reasonable terms or at all, to sell or use the relevant technology; or
•redesign the allegedly infringing products to avoid infringement, misappropriation or violation, which could be costly, time-consuming or impossible.
We cannot predict the outcome of lawsuits and cannot ensure that the results of any such actions will not have an adverse effect on our business, financial condition or results of operations. Although we carry liability insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed. Even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and harm our business and operating results. Moreover, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and, if securities analysts or investors perceive these results to be negative, it could have an adverse effect on the price of our common stock.
We use open source software in our products, which could negatively affect our ability to sell our services or subject us to litigation or other actions.
We use open source software in connection with developing, operating, and offering our products, services, and technology, and we expect to continue to incorporate open source software in our products, services, and technology in the future.
Some open source projects have known vulnerabilities and architectural instabilities and are provided on an “as-is” basis which, if not properly addressed, could negatively affect the performance of our product. Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products. For example, some open source licenses may, depending on the nature of our use and the terms of the applicable license, include terms requiring us to offer certain of our solutions for no cost, make our source code available, or license our modifications or derivative works under the terms of applicable open source licenses. From time to time, there have also been claims challenging the ownership rights in open source software against companies that incorporate it into their products, and the licensors of such open source software provide no warranties or indemnities with respect to such claims.
Our use of open source software, and participation in open source projects, may also limit our ability to assert certain of our intellectual property and proprietary rights against third parties, including competitors, who access or use software or technology that we have contributed to such open source projects.
Moreover, we cannot ensure that we have incorporated open source software in our products, services, and technology in a manner that is consistent with the terms of the applicable license or our current policies and procedures. If an author or other third party that distributes such open source software were to allege that we had not complied with the conditions of one or more of these licenses or such third party changes the type of open source license applicable to such software without our knowledge, we or our customers could be subject to lawsuits, and we could incur significant legal expenses defending against such allegations, be subject to significant damages resulting from the suits, enjoined from the sale of our products that contained the open source software, and required to comply with onerous conditions or restrictions on these products, which could disrupt the distribution and sale of these products. Such litigation could be costly for us to defend, have a negative effect on our business, financial condition and results of operations, or require us to devote additional research and development resources to change or reengineer our products or take other remedial actions.
Indemnity provisions in various agreements to which we are party potentially expose us to substantial liability for infringement or misappropriation of intellectual property rights, failure to comply with data protection requirements and other losses.
Our agreements with our customers and other third parties may include indemnification provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred, including as a result of intellectual property infringement or misappropriation claims or for failure to comply with data protection requirements. Large indemnity payments could harm our business, financial condition and results of operations. Although we attempt to contractually limit our liability with respect to such indemnity obligations, we are not always successful and may still incur substantial liability related to them, and we may be required to cease use of certain functions of our platform or products as a result of any such claims. Any dispute with a customer or other third party with respect to such obligations could have adverse effects on our relationship with such customer or other third party and other existing or prospective customers, reduce demand for our products and services and adversely affect our business, financial conditions and results of operations. In addition, although we carry general liability insurance, our insurance may not be adequate to indemnify us for all liability that may be imposed or otherwise protect us from liabilities or damages with respect to claims alleging compromises of customer data, and any such coverage may not continue to be available to us on acceptable terms or at all.
Risks Related to Ownership of Our Common Stock and Our Status as a Public Company
Our stock price may be volatile, and the value of our common stock may decline.
The market price of our common stock may be highly volatile and may fluctuate or decline substantially as a result of a variety of factors, some of which are beyond our control, including:
•actual or anticipated fluctuations in our financial condition or results of operations;
•variance in our financial performance from expectations of securities analysts or the financial guidance we provide to the public;
•changes in the pricing of our products and platform;
•changes in our projected operating and financial results;
•changes in laws or regulations applicable to our platform and products;
•announcements by us or our competitors of significant business developments, acquisitions, or new offerings;
•significant data breaches, disruptions to or other incidents involving our software;
•our involvement in litigation;
•future sales of our common stock by us or our stockholders;
•changes in senior management or key personnel;
•the trading volume of our common stock;
•changes in the anticipated future size and growth rate of our market; and
•general economic and market conditions.
Broad market and industry fluctuations, as well as general economic, geopolitical, regulatory, and market conditions, may also negatively impact the market price of our common stock. In addition, technology stocks have historically experienced high levels of volatility. In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation. We have in the past and may in the future be the target of this type of litigation in the future, which could result in substantial expenses and divert our management’s attention.
Future sales of our common stock in the public market could cause the market price of our common stock to decline.
Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities. We are unable to predict the timing of or the effect that such sales may have on the prevailing market price of our common stock.
We have registered all of the shares of common stock issuable upon the exercise of outstanding options, the settlement of outstanding RSUs, PRSUs, MRSUs or other equity incentives we may grant in the future, for public resale under the Securities Act. The shares of common stock will become eligible for sale in the public market to the extent such options are exercised or such RSUs, PRSUs, or MRSUs are settled, subject to compliance with applicable securities laws.
Further, holders of a substantial number of shares of our capital stock have rights, subject to some conditions, to require us to file registration statements covering the sale of their shares or to include their shares in registration statements that we may file for ourselves or other stockholders.
Our issuance of additional capital stock in connection with financings, acquisitions, investments, our equity incentive plans or otherwise, and any conversions of our convertible notes, will dilute all other stockholders or may otherwise depress the price of our common stock.
We expect to issue additional capital stock in the future that will result in dilution to all other stockholders. We expect to grant equity awards to employees, directors and consultants under our equity incentive plans. We may also raise capital through equity financings in the future. As part of our business strategy, we may acquire or make investments in companies, products or technologies and issue equity securities to pay for any such acquisition or investment. Any such issuances of additional capital stock may cause stockholders to experience significant dilution of their ownership interests and the per share value of our common stock to decline.
For example, if we elect to settle our conversion obligation under our 0% convertible senior notes due 2026, or the Convertible Notes, in shares of our common stock or a combination of cash and shares of our common stock, the issuance of such common stock may dilute the ownership interests of our stockholders and sales in the public market could adversely affect prevailing market prices. The Convertible Notes are convertible only in certain circumstances as described in the indenture governing the Convertible Notes. Any sales in the public market of the common stock issuable upon any conversion of the Convertible Notes could adversely affect prevailing market prices of our common stock. In addition, the existence of the Convertible Notes may encourage short selling by market participants because the conversion of the Convertible Notes could be used to satisfy short positions, or anticipated conversion of the Convertible Notes into shares of our common stock could depress the price of our common stock.
We are required to maintain effective internal control over financial reporting. If we fail to maintain an effective system of internal controls, we may not be able to accurately report our financial results or prevent fraud. As a result, our stockholders could lose confidence in our financial reporting, which could harm our business and the trading price of our common stock.
The Sarbanes-Oxley Act of 2002 (the Sarbanes-Oxley Act), requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting and we are required to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting. Complying with the Sarbanes-Oxley Act requires a rigorous compliance program as well as adequate time and resources. We may not be able to complete our internal control evaluation, testing and any required remediation in a timely fashion. Additionally, we have in the past and may in the future identify material weaknesses in our internal control over financial reporting and as a result, we may not be able to assert that our internal controls are effective. If we do not successfully remediate any material weaknesses or other deficiencies that arise in the future, we may be unable to accurately report our financial results, which could cause our financial results to be materially misstated and require restatement. In such case, we may be unable to maintain compliance with securities law requirements regarding timely filing of periodic reports in addition to applicable stock exchange listing requirements, investors may lose confidence in our financial reporting and our stock price may decline as a result. We cannot assure you that the measures we have taken to date, or any measures we may take in the future, will prevent or avoid potential future material weaknesses.
In the fiscal year ended December 31, 2023, we identified a material weakness in our internal control over financial reporting, which was caused by inadequate controls over our tax processes. This material weakness was remediated as of December 31, 2024, as described in more detail under the heading Part II, Item 9A. “Controls and Procedures” in this Annual Report on Form 10-K.
Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.
Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management. Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:
•authorize our board of directors to issue, without further action by the stockholders, shares of undesignated preferred stock with terms, rights, and preferences determined by our board of directors that may be senior to our common stock;
•require that any action to be taken by our stockholders be effected at a duly called annual or special meeting and not by written consent;
•specify that special meetings of our stockholders can be called only by our board of directors, the chairperson of our board of directors, or our chief executive officer;
•establish an advance notice procedure for stockholder proposals to be brought before an annual meeting, including proposed nominations of persons for election to our board of directors;
•establish that our board of directors is divided into three classes, with each class serving three-year staggered terms;
•prohibit cumulative voting in the election of directors;
•provide that our directors may be removed for cause only upon the vote of at least 66 2/3% of our outstanding shares of voting stock;
•provide that vacancies on our board of directors may be filled only by a majority of directors then in office, even though less than a quorum; and
•require the approval of our board of directors or the holders of at least 66 2/3% of our outstanding shares of voting stock to amend our bylaws and certain provisions of our certificate of incorporation.
These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally, subject to certain exceptions, prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder. Any of the foregoing provisions could limit the price that investors might be willing to pay in the future for shares of our common stock, and they could deter potential acquirers of our company, thereby reducing the likelihood that you would receive a premium for your shares of our common stock in an acquisition.
Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware and, to the extent enforceable, the federal district courts of the United States of America as the exclusive forums for substantially all disputes between us and our stockholders, which restricts our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.
Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware is the exclusive forum for the following types of actions or proceedings under Delaware statutory or common law: any derivative action or proceeding brought on our behalf; any action asserting a breach of a fiduciary duty; any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws; or any action asserting a claim against us that is governed by the internal affairs doctrine. The provisions would not apply to suits brought to enforce a duty or liability created by the Exchange Act. In addition, our amended and restated certificate of incorporation provides that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, subject to and contingent upon a final adjudication in the State of Delaware of the enforceability of such exclusive forum provision.
These choice of forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees. If a court were to find either choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions. For example, the Court of Chancery of the State of Delaware recently determined that the exclusive forum provision of federal district courts of the
United States of America for resolving any complaint asserting a cause of action arising under the Securities Act is not enforceable. However, this decision may be reviewed and ultimately overturned by the Delaware Supreme Court. If this ultimate adjudication were to occur, we would enforce the federal district court exclusive forum provision in our amended and restated certificate of incorporation.
Risks Related to our Outstanding Convertible Notes
Servicing our future debt, including the Convertible Notes, may require a significant amount of cash, and we may not have sufficient cash flow from our business to pay our indebtedness.
In November 2021, we issued $1.5 billion aggregate principal amount of the Convertible Notes in a private placement.
We may be required to use a substantial portion of our cash flows from operations to pay the principal on our indebtedness. Our ability to make scheduled payments of the principal of, or to refinance our indebtedness, including the Convertible Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control. Such payments will reduce the funds available to us for working capital, capital expenditures and other corporate purposes and limit our ability to obtain additional financing for working capital, capital expenditures, expansion plans and other investments, which may in turn limit our ability to implement our business strategy, heighten our vulnerability to downturns in our business, the industry, or in the general economy, limit our flexibility in planning for, or reacting to, changes in our business and the industry and prevent us from taking advantage of business opportunities as they arise. Our business may not be able to generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional equity capital on terms that may be onerous or highly dilutive. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.
In addition, we may incur substantial additional debt in the future, subject to the restrictions contained in our future debt agreements, some of which may be secured debt. We are not restricted under the terms of the indenture governing the Convertible Notes from incurring additional debt, securing existing or future debt, recapitalizing our debt, repurchasing our stock, pledging our assets, making investments, paying dividends, guaranteeing debt or taking a number of other actions that are not limited by the terms of the indenture governing the Convertible Notes that could have the effect of diminishing our ability to make payments on the Convertible Notes when due.
The conditional conversion feature of the Convertible Notes, if triggered, may adversely affect our financial condition and operating results.
The conditional conversion feature of the Convertible Notes entitles holders of the Convertible Notes to convert the notes at any time during specified periods at their option. If one or more holders elect to convert their Convertible Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity. In addition, even if holders of Convertible Notes do not elect to convert their Convertible Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Convertible Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.