burdens imposed by these groups’ policies and actions may limit the use and adoption of our customer platform and reduce overall demand for it, or lead to significant fines, penalties or liabilities for any noncompliance or loss of any such action.
If our or our customers’ security measures are compromised or unauthorized access to data of our customers or their customers is otherwise obtained, our customer platform may be perceived as not being secure, our customers may be harmed and may curtail or cease their use of our platform, our reputation may be damaged and we may incur significant liabilities.
Our operations involve the storage and transmission of data of our customers and their customers, including personal data. Our storage is typically the sole source of record for portions of our customers’ businesses and end user data, such as initial contact information and online interactions. Security incidents could result in unauthorized access to, loss of or unauthorized disclosure of this information, litigation, indemnity obligations and other possible liabilities, as well as negative publicity, which could damage our reputation, impair our sales and harm our customers and our business. Cyber-attacks and other malicious Internet-based activity continue to increase generally, and cloud-based platform providers of marketing services have been targeted. If our security measures, or those of our service providers, are compromised as a result of third-party action, employee or customer error, malfeasance, stolen or fraudulently obtained log-in credentials or otherwise, our reputation could be damaged, our business may be harmed and we could incur significant liability. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable laws, our security policies or our acceptable use policy, such violations may also put our customers’ information at risk and could in turn have an adverse effect on our business. In addition, if the security measures of our customers or our service providers are compromised, even without any actual compromise of our own systems, we may face negative publicity or reputational harm if our customers or anyone else incorrectly attributes the blame for such security breaches to us or our systems. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because they change frequently and generally are not detected until after an incident has occurred. As we increase our customer base and our brand becomes more widely known and recognized, we may become more of a target for third parties seeking to compromise our security systems or gain unauthorized access to our customers’ data. Additionally, we provide our employees with limited access restricted via just-in-time-access controls and least privilege access models to our databases, which store our customer data, and to our APIs to facilitate our rapid pace of product development and to support our customers. If such access, unauthorized access or our own operations, cause damage, destruction or loss (including, without limitation, because of actions by a bad actor, attempts to exfiltrate customer data which attempts we have experienced in the past and could experience in the future), our systems being compromised or unintentional or accidental disclosure, or destruction of our customers’ business data, their sales, lead generation, support and other business operations may be permanently harmed. As a result, our customers may bring claims against us for lost profits and other damages, or such concerns may cause us to further limit access by our development team. Additionally, in certain of our subscription agreements with our customers, we agree to indemnify these customers against claims by a third party alleging our breach of confidentiality obligations or our misuse of customer data in violation of the subscription agreement.
Cyber-attacks, denial-of-service attacks, ransomware attacks, supply chain attacks, business email compromises, computer malware, viruses, social engineering (including phishing), and other compromises are prevalent in our industry, the industries of certain of our service providers and our customers' industries. We have in the past experienced threats and security incidents related to our data and systems, and we may in the future experience other threats, compromises, breaches, or incidents. Our internal computer systems and those of our current and any future strategic collaborators, vendors, and other contractors or consultants are vulnerable to damage from cyber-attacks, computer viruses, unauthorized access, natural disasters, cybersecurity threats, terrorism, geopolitical conflict, war and telecommunication and electrical failures. Accordingly, if our cybersecurity measures or those of our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyber-attacks), compromise or the mishandling of data by our employees and contractors, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected. Cyber incidents have been increasing in sophistication and frequency and can include third parties gaining access to employee or customer data using stolen or inferred credentials, computer malware, viruses, spamming, phishing attacks, ransomware, vulnerabilities in first- or third-party code, card skimming code, and other deliberate attacks and attempts to gain unauthorized access. This risk is increased by the difficulty of balancing rapid vulnerability patching and system availability in a large and rapidly-changing production environment. At times, we may be unable to patch all of our systems in a manner that strictly adheres to our internally prescribed timelines. The techniques used to sabotage or to obtain unauthorized access to our platform, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Because the techniques used by threat actors who may attempt to penetrate and sabotage our computer systems change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Additionally, with the expansion of remote work and resource access, there is an increased risk that we may experience cybersecurity-related events such as phishing attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number of cybersecurity threats or attacks, and other security challenges as a result of most of our employees and our service providers continuing to work remotely from non-corporate managed networks. There is also a risk of potential increase in such attacks due to cyberwarfare in connection with the ongoing global conflicts, and this could adversely affect our and our suppliers' ability to maintain or enhance key cybersecurity and data protection measures. We have previously been, and may in the future become, the target of cyber-attacks, incidents, or compromises by third