If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities.
We and certain third-party vendors of ours collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information, and personal information (collectively, “Confidential Information”) of customers and our employees and contractors. Our platform also stores, transmits, and processes our customers’ proprietary data, including personal or identifying information of their customers or employees. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of our information technology systems and Confidential Information. Unauthorized disclosure of, access to, or security breaches of our platform or our information technology systems could result in the loss of Confidential Information, loss of business, severe reputational damage adversely affecting customer or investor confidence, damage to our brand, diversion of management’s attention, regulatory investigations, and orders, litigation, indemnity obligations, damages for contract breach, penalties for violation of applicable laws or regulations, significant costs for remediation that may include liability for stolen assets or information and repair of system damage that may have been caused, incentives offered to customers or other business partners in an effort to maintain business relationships after a breach, and other liabilities. We have incurred, and expect to continue to incur, significant expenses to prevent security breaches, including deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants. Even though we do not control the security measures of third parties who may have access to our confidential information or our platform, we may be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third-party that caused the breach. In addition, any failure by our vendors to comply with applicable law or regulations could result in proceedings against us by governmental entities or others.
There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information and despite the implementation of security measures, our information technology systems, as well as those of third parties with which we have relationships, are not fully secure from, and may be vulnerable to a range of cybersecurity risks and threats, including cyberattacks, denial and degradation-of-service attacks, ransomware attacks, business email compromises, computer malware, malicious code, misconfigurations, "bugs," viruses, and social engineering (including phishing) which are prevalent in our industry and our customers’ industries. In addition, we, as well as those third parties with which we have relationships, may experience attacks, unavailable systems, unauthorized access to systems or data, or disclosure due to natural disasters, terrorism, war, telecommunication and electrical failures, hacking, employee theft or misuse, human error, fraud, denial and degradation-of-service attacks, sophisticated nation-state and nation-state-supported actors, and advanced persistent threat intrusions. Electronic security attacks designed to gain access to personal, sensitive, or confidential data are increasing in number, constantly evolving, and such attacks continue to grow in sophistication. The techniques and tools – including AI Technology – may be used to sabotage, or to obtain unauthorized access to, our platform, information technology systems, networks, or physical facilities in which Confidential Information is stored or through which Confidential Information is transmitted change frequently, and we may be unable to anticipate or implement adequate preventative measures against all such techniques in every instance or stop security breaches while they are occurring. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. As a result of our continued hybrid work environment, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our and our service providers’ employees who are, and may continue, working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. We have previously been, and may in the future become, the target of cyberattacks by third parties seeking unauthorized access to our confidential information or to disrupt our operations or ability to provide our services.
Our use of AI Technologies across our platform, products, and internal operations also introduces new attack vectors that do not exist in traditional software. For example, threat actors may use prompt injection, embedding crafted inputs in user prompts, customer data, or third-party content to manipulate an AI model or agent into bypassing safeguards, extracting confidential information, or taking unauthorized actions. Threat actors may also attempt model or data poisoning, corrupting the data our AI Technologies are trained on or rely upon to degrade performance, introduce hidden vulnerabilities, or produce inaccurate, biased, or harmful outputs. AI Technologies may also make the social engineering attacks described above more effective and scalable, including through deepfakes and more targeted phishing, increasing the likelihood that our employees, contractors, vendors, or customers are deceived into granting unauthorized access or disclosing confidential information. Because these techniques are still developing, we may be unable to anticipate, detect, or defend against them, which could result in security incidents, unauthorized access to or disclosure of confidential information, or harm to our business, financial condition, and results of operations.
We and certain of our vendors are from time to time subject to cyberattacks and security incidents. For example, in September 2026, we detected unauthorized access to a limited portion of our internal systems. We contained and remediated the incident, engaged an independent forensics firm to investigate, and notified each impacted customer. While we do not believe that we have experienced any significant system failure, accident, or material security breach to date, if such an event were to occur and cause