10-K – 2026-02-17 – pltr-20251231.htm

companies. Our ability to sell or transfer, or realize value from noncash consideration and our investments may be limited by applicable securities laws and regulations, including the requirement that offers or sales of securities must be registered with the SEC pursuant to applicable laws or qualify for an exemption from such registration, and our ability to liquidate and realize value from our equity securities may be negatively and materially impacted by any delays or limitations on our ability to offer, sell, or transfer such equity securities. In addition, certain of our equity securities are speculative in nature and may be volatile or decline in value or be entirely lost. We have realized, and may continue to realize, losses related to these equity securities, which could have a negative impact on our future financial position, results of operations, earnings per share, and cash flows.
Additionally, in connection with approving and signing the Investment Agreements, we and each Investee or an associated entity entered into a commercial contract for access to our products and services (collectively, the “Strategic Commercial Contracts”). The total value of Strategic Commercial Contracts, which is calculated as the sum of the cumulative revenue recognized from Strategic Commercial Contracts and the remaining deal value of such contracts, was $326.1 million, with no remaining contractual options, as of December 31, 2025. When determining the total value of these Strategic Commercial Contracts, we assess customers’ financial condition, including the consideration of their ability and intention to pay, and whether all or some portion of the value of the contracts continue to meet the criteria for revenue recognition, among other factors. Certain companies with which we have entered into commercial contracts have been, and may continue to be, unable to generate sufficient revenues or profitability or to access any necessary financing or funding in a timely manner or on favorable terms to them, which has negatively impacted, and may continue to negatively impact, our expected revenue and collections. These companies are generally engaged in businesses that involve novel and unproven technologies, products, and services and such companies have been, and may continue to be, unable to perform all or some of their obligations under any commercial contracts that we enter into with them in a timely manner or at all. For example, some of our early-stage Investee customers filed for bankruptcy or terminated their contracts with us, and the remaining value of the commercial contracts with such customers that is not expected to be recognized as revenue has been excluded from the total value of Strategic Commercial Contracts above. As of December 31, 2025, the cumulative amount of revenue recognized from Strategic Commercial Contracts was $321.5 million, of which $15.3 million was recognized by us during the fiscal year ended December 31, 2025.
The occurrence of any of these risks could have a material adverse effect on our business, results of operations, and financial condition. Moreover, we cannot assure you that we would not be exposed to unknown liabilities.
Risks Related to Intellectual Property, Information Technology, Data Privacy, and Security
If any of the systems of any third parties upon which we rely, our customers’ systems, locations, or environments, or our internal systems, are breached or if unauthorized access to customer, third-party, or our data is otherwise obtained, public perception of our platforms and O&M services may be harmed, and we may lose business and incur losses or liabilities.
Our success depends in part on our ability to provide effective data security protection in connection with our technology platforms and services, and we rely on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because our platforms and services are used by our customers to store, transmit, index, or otherwise process and analyze large data sets that often contain proprietary, confidential, and/or sensitive information (including in some instances personal or identifying information, personal health information, government classified information, and other information subject to regulatory or statutory control or requirements), our software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and our software faces threats of unintended exposure, exfiltration, alteration, deletion, loss, or unavailability of data. Additionally, because many of our customers use our platforms to store, transmit, and otherwise process proprietary, confidential, or sensitive information, and complete mission critical tasks, they have a lower risk tolerance for security vulnerabilities in our platforms and services than for vulnerabilities in other, less critical, software products and services.
Our platforms and services operate in conjunction with, and we are dependent upon, third-party products and components across a broad ecosystem, including our customer environments. There have been and may continue to be significant attacks on certain third-party providers, and we cannot guarantee that our or any third-party providers’ systems, networks, products, or components have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support or otherwise interface with us and our platforms and services. Furthermore, changes such as configurations, updates or upgrades of third-party products or services have introduced and may in the future introduce or exacerbate vulnerabilities that may compromise our systems or those of our customers. If there is a security vulnerability, error, or other bug in one of these products or components and if there is a security exploit targeting them, we could face increased costs, claims, liability, reduced revenue, and harm to our reputation or competitive position. The natural sunsetting or phasing out of third-party products and operating systems that we use requires that our infrastructure teams reallocate time and attention to migration and updates, during which period potential security vulnerabilities could be exploited. In addition, the locations or environments in which our software is deployed have expanded, and may continue to expand, including on customer networks, on-premises at customer sites, on edge devices, on mobile devices, in data centers, in colocation spaces or in other locations or environments that we do not maintain or operate. In
31

Table of Contents

such locations or environments, we may not have full control over how our platforms and products are deployed, managed, or secured, our standards for information security may not be met, and our ability to deploy certain security features and controls may be limited. These locations and environments may be more vulnerable to cybersecurity attacks, phishing attacks, viruses, malware, ransomware, and hacking, or similar breaches and incidents, including those from nation-state actors or affiliated actors, and such attacks could harm our customers’ ability to operate and perform their obligations under our contracts, or result in increased costs or liabilities, a perceived or actual security breach of our platforms, or harm to our business and reputation. Moreover, if our platforms and products are not appropriately deployed, managed, and secured in these locations or environments, or such locations or environments are not appropriately secured or experience cybersecurity attacks or other security breaches or incidents, our platforms and products could be compromised, inappropriately accessed or acquired, or undergo unauthorized use, copying, and distribution, and reverse engineering of our intellectual property, which could adversely affect our business, financial condition, and results of operations. Further, certain of our platforms and services now allow customers to deploy their own applications in our environments, for example via our FedStart offering. These third-party applications have been built outside of our platforms or environments utilizing security procedures, techniques, and controls that may not meet our standards for information security, or may contain exploitable defects, errors, or bugs that could result in failures, disruptions, cybersecurity attacks, or other security breaches or incidents. Further, as we increase the number of customers we serve on our cloud environment, the likelihood increases that some usage of our products may occur that violates our terms of service or is otherwise improper or perceived as improper, which could cause reputational damage and adversely affect our business, financial condition, and results of operations.
We, and the third-party vendors upon which we rely, have experienced, and may in the future experience, cybersecurity attacks and threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors’ technology systems have been, and in the future may be, damaged, disrupted, or compromised by harmful events, including malicious activities, natural occurrences, inadvertent errors, cybersecurity incidents or cyberattacks (including computer viruses, ransomware, and other malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches and incidents, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches or incidents may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of methods and techniques, may include the use of social engineering techniques or supply-chain attacks, are constantly evolving, and have become increasingly complex and sophisticated, all of which increase the difficulty of detecting and successfully defending against them. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party vendors may not have the capacity to immediately detect such efforts, may be unable to anticipate these techniques, or may be unable to implement adequate preventative measures. Although prior known cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, our security measures may be circumvented and we cannot guarantee that past, future, or ongoing cyberattacks or other security breaches or incidents against us or a third party, if successful, will not have a material impact on our business or financial results, whether directly or indirectly. Further, the practical security prioritization decisions we make based on our assessment of potential risks may not be successful in identifying or mitigating cyberattacks or other security breaches or incidents that could result in material impacts.
We have provided, and may continue to provide, our platforms, products, personnel, and services to support operations in conflict zones. Such zones are subject to, among other things, political uncertainty, geopolitical tensions, and military actions, such as those associated with the ongoing Russia-Ukraine, and Israel and broader Middle East conflicts. As a result, we and our third-party vendors have been vulnerable to a heightened risk of, and have been exposed to, cybersecurity attacks, phishing attacks, viruses, malware, ransomware, hacking or similar breaches and incidents, including increasingly sophisticated threats, from nation-state actors or affiliated actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our products and services. While we have security measures in place to protect our information and our customers’ information and to prevent data loss and other security breaches and incidents, we have not always been able to do so and there can be no assurance that in the future we will be able to anticipate or prevent security breaches or incidents, or intentional or unintentional action or inaction by employees or third parties, which may result in unauthorized access of our information technology systems or the information technology systems of the third-party vendors upon which we rely. Despite our implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches and incidents, unauthorized tampering, bad actors, or human error.
If an actual or perceived breach of security measures, unauthorized access to our system or the systems of the third-party vendors that we rely upon, or any other cybersecurity attack, threat, or incident occurs, we may face direct or indirect liability, costs, or damages, including expenses related to responding and/or alleviating an actual or perceived breach or other incident, contract termination, our reputation in the industry and with current and potential customers may be compromised, our ability to
32

Table of Contents

attract new customers could be negatively affected, our management’s attention could be diverted, and our business, financial condition, and results of operations could be materially and adversely affected.
Further, unauthorized access to our or our third-party vendors’ information technology systems or data or other security breaches or incidents could result in the loss, corruption, or unavailability of information; significant remediation costs; litigation, disputes, regulatory action, or investigations that could result in damages, material fines, and penalties; indemnity obligations; interruptions in the operation of our business, including our ability to provide new product features, new platforms, or services to our customers; damage to our operation technology networks and information technology systems; and other liabilities. Moreover, our remediation efforts may not be successful. Any or all of these issues, or the perception that any of them have occurred, could negatively affect our ability to attract new customers, cause existing customers to terminate or not renew their agreements, hinder our ability to obtain and maintain required or desirable cybersecurity certifications, and result in reputational damage, any of which could materially adversely affect our results of operations, financial condition, and future prospects. There can be no assurance that any limitations of liability provisions in our license arrangements with customers or in our agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.
We maintain cybersecurity insurance and other types of insurance, subject to applicable deductibles and policy limits, but our insurance may not be sufficient to cover all costs associated with a potential data security incident. We also cannot be sure that our existing general liability insurance coverage and coverage for cyber liability or errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims or that the insurer will not deny coverage as to any future claim as a result of inapplicability of coverage or administrative or procedural issues. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our financial condition.
Issues raised by the use of AI (including machine learning, large language, and other generative or agentic AI models, and software functionality to operationalize the foregoing) in our platforms and business may result in reputational harm or liability.
AI is enabled by or integrated into some of our technology platforms and is a significant and growing element of our business. We have also incorporated AI into certain operations within our business, including by using our platforms for internal functions, and have developed internal policies and technological capabilities to govern AI use. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms and models may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, reflect unwanted forms of bias, or raise other legal concerns (such as concerns regarding copyright protections and other intellectual property claims). Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end-users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient, unreliable, or inaccurate, we could be subject to competitive harm, potential legal liability, including under existing, forthcoming, or proposed legislation regulating AI in jurisdictions such as the EU, and brand or reputational harm. The rapid evolution of AI and its evolving regulatory landscape may also require additional resources to develop, test, and maintain our platforms and products to help ensure that AI is implemented appropriately in order to minimize unintended or harmful impact, which may be costly and may not produce the benefits and results that we expect. Increased development and use of AI has also led to a strain on energy resources, which could lead to increased expenses or limited availability of resources needed for our business and operations.
Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges, the application or interpretation of which are complex and will likely continue to evolve. Moreover, AI, including our use of AI, may create additional cybersecurity risks or increase existing cybersecurity risks, and may result in, or increase impacts of, cyberattacks, security breaches, phishing attacks, personal data breaches, or other incidents. For example, threat actors are increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks crafted with an AI tool to attack information systems by creating more effective phishing emails or social engineering and by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition. In addition, enhanced risk of cyberattacks could be a result of us or a third party incorporating the output of an AI tool, such as malicious code from an AI generated source code.
Our technologies and business practices are designed to mitigate many of these risks. For example, our platforms include data and AI use case governance, machine learning modeling, as well as model testing and evaluation tools which help to regulate
33

Table of Contents

and limit user access to data sets and develop, deploy, and manage more effective and responsible AI capabilities. However, if these controls are not properly implemented by, or for, our customers, or if we enable or offer AI solutions that are controversial or problematic because of their purported or real impact on fundamental rights, privacy, employment, or other societal issues, we may experience brand or reputational harm, as well as regulatory or legal scrutiny. There can be no assurance that the technologies and business practices we have designed will sufficiently mitigate the risks presented by the growing use of AI in our platforms and business.
We depend on computing infrastructure operated by Amazon Web Services (“AWS”), Microsoft, and other third parties to support some of our customers and any errors, disruption, performance problems, or failure in their or our operational infrastructure could adversely affect our business, financial condition, and results of operations.
We rely on the technology, infrastructure, and software applications, including software-as-a-service offerings, of certain third parties, such as AWS and Microsoft Azure, in order to host or operate some or all of certain key technology platform features or functions of our business, including our cloud-based services (including Palantir Cloud, as defined in the section titled “ Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Components of Results of Operations” ), customer relationship management activities, billing and order management, cybersecurity program, and financial accounting services. Additionally, we rely on computer hardware purchased in order to deliver our platforms and services. We do not have control over the operations of the facilities of the third parties that we use. If any of these third-party services experience errors, disruptions, security issues, or other performance deficiencies, if they are updated such that our platforms become incompatible, if these services, software, or hardware fail or become unavailable due to extended outages, interruptions, defects, or otherwise, or if they are no longer available on commercially reasonable terms or prices (or at all), these issues could result in errors or defects in our platforms, cause our platforms to fail, our revenue and margins could decline, or our reputation and brand could be damaged, we could be exposed to legal or contractual liability, our expenses could increase, our ability to manage our operations could be interrupted, and our processes for managing our sales and servicing our customers could be impaired until equivalent services or technology, if available, are identified, procured, and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business. Many of these third-party providers attempt to impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures, and if enforceable, we may have additional liability to our customers which may not be compensated by our third-party providers which are responsible for the liability.
We have experienced, and may in the future experience, disruptions, failures, data loss, corruption, unavailability, outages, and other performance problems with our infrastructure or cloud-based offerings due to a variety of factors, which have included or may in the future include infrastructure changes, introductions of new functionality, human or software errors, employee misconduct, capacity constraints, denial of service attacks, phishing attacks, computer viruses, ransomware, and other malicious or destructive code, or other security-related incidents, and our disaster recovery planning may not be sufficient for all situations. If we experience disruptions, failures, data loss, outages, or other performance problems, our business, financial condition, and results of operations could be adversely affected.
Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences such as earthquakes, floods, fires, power loss, telecommunication failures, cybersecurity threats, terrorist attacks, such as the conflict resulting from Hamas’ attack on Israel, natural disasters, public health crises, geopolitical tensions such as those that may be caused by the ongoing Russia-Ukraine conflict, or acts of misconduct. Moreover, we have business operations in the San Francisco Bay Area, which is a seismically active region. Despite any precautions we may take, the occurrence of a catastrophic event or other unanticipated problems at our or our third-party vendors’ hosting facilities, or within our systems or the systems of third parties upon which we rely, could result in interruptions, performance problems, or failure of our infrastructure, technology, or platforms, which may adversely impact our business. In addition, our ability to conduct normal business operations could be severely affected. In the event of significant physical damage to one of these facilities, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. In addition, any negative publicity arising from these disruptions could harm our reputation and brand and adversely affect our business.
Furthermore, our platforms are in many cases important or essential to our customers’ operations, including in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements (“SLAs”). Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease use of our platforms and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our platforms to be perceived as unreliable or unsecure, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations.
Moreover, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business,
34

Table of Contents

financial condition, and results of operations could be adversely affected. The provisioning of additional cloud hosting capacity or upgrading technology, infrastructure, and software applications each require lead time and resources. AWS, Microsoft Azure, and other third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all. In addition, if we fail to meet the minimum usage commitments we have in place with third-party cloud hosting providers, we may be required to pay certain penalties or fees, including the difference between the minimum usage commitments and our actual usage, which could negatively affect our financial condition and results of operations. If AWS, Microsoft Azure, or other third parties increase pricing terms, terminate or seek to terminate our contractual relationship, establish more favorable relationships with our competitors, change or interpret their terms of service or policies in a manner that is unfavorable to us, or fall out of favor with our customers who use our cloud-based services, we may be required to transfer to other cloud providers or invest in a private cloud. If we are required to transfer to other cloud providers or invest in a private cloud, we could incur significant costs and experience possible service interruption in connection with doing so, or risk loss of customer contracts if they are unwilling to accept such a change.
A failure to maintain our relationships with our third-party providers (or obtain adequate replacements), and to receive services from such providers that do not contain any material errors or defects, could adversely affect our ability to deliver effective products and solutions to our customers and adversely affect our business and results of operations.
Our policies regarding customer confidential information and support for individual privacy and civil liberties could cause us to experience adverse business and reputational consequences.
We strive to protect our customers’ confidential information and individuals’ privacy interests consistent with applicable laws, directives, and regulations. Consequently, we do not provide information about our customers to third parties without legal process. From time to time, government entities may seek our assistance with obtaining information about our customers or could request that we modify our technology platforms in a manner to permit access or monitoring. In light of our confidentiality, privacy, and customer digital sovereignty commitments, we may legally challenge law enforcement or other government requests to provide information, to obtain encryption keys, or to modify or weaken encryption. To the extent that we do not provide assistance to or comply with requests from government entities, or if we challenge those requests publicly or in court, we may experience adverse political, business, and reputational consequences among certain customers or portions of the public. Conversely, to the extent that we do provide such assistance in accordance with applicable law, or do not challenge those requests publicly in court, we may experience adverse political, business, and reputational consequences from other customers or portions of the public arising from concerns over privacy or the government’s activities.
Failure to adequately obtain, maintain, protect and enforce our intellectual property and other proprietary rights could adversely affect our business.
Our success and ability to compete depends in part on our ability to protect proprietary methods and technologies that we develop under a combination of patent and other intellectual property and proprietary rights in the United States and other jurisdictions outside the United States so that we can prevent others from using our inventions and proprietary information and technology. Despite our efforts, third parties have and may attempt to disclose, obtain, copy, or use our intellectual property or other proprietary information or technology without our authorization or coerce or enlist our employees, partners, or suppliers to do the same, and our efforts to protect our intellectual property and other proprietary rights may not prevent such unauthorized disclosure or use, misappropriation, infringement, reverse engineering or other violation of our intellectual property or other proprietary rights. Effective protection of our rights may not be available to us in every country in which our technology platforms or services are available. The laws of some countries may not be as protective of intellectual property and other proprietary rights as those in the United States, and mechanisms for enforcement of intellectual property and other proprietary rights may be inadequate. Also, our involvement in standard setting activity or the need to obtain licenses from others may require us to license our intellectual property. Accordingly, despite our efforts, we may be unable to prevent third parties from using our intellectual property or other proprietary information or technology.
In addition, we may be the subject of intellectual property infringement or misappropriation claims, which could be very time-consuming and expensive to settle or litigate and could divert our management’s attention and other resources. These claims could also subject us to significant liability for damages if we are found to have infringed patents, copyrights, trademarks, or other intellectual property rights, or breached trademark co-existence agreements or other intellectual property licenses and could require us to cease using or to rebrand all or portions of our platforms. Any of our patents, copyrights, trademarks, or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation.
While we have issued patents and patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications or such patent protection may not be obtained quickly enough to meet our business needs. Furthermore, the patent prosecution process is expensive, time-consuming, and complex, and we may not be able to prepare, file, prosecute, maintain, and enforce all necessary or desirable patent applications at a reasonable cost or in a timely manner. The scope of patent protection also can be reinterpreted after issuance and issued patents may be invalidated. Even if our patent
35

Table of Contents

applications do issue as patents, they may not issue in a form that is sufficiently broad to protect our technology, prevent competitors or other third parties from competing with us or otherwise provide us with any competitive advantage. Even if our patents issue in a form that covers our technology, enforcing patents against suspected infringers is time consuming, expensive, and involves risks associated with litigation, including the risk the suspected infringers file counterclaims against us.
In addition, any of our patents, copyrights, trademarks, or other intellectual property or proprietary rights may be challenged, narrowed, invalidated, held unenforceable, or circumvented in litigation or other proceedings, including, where applicable, opposition, re-examination, inter partes review, post-grant review, interference, nullification and derivation proceedings, and equivalent proceedings in foreign jurisdictions, and such intellectual property or other proprietary rights may be lost or no longer provide us meaningful competitive advantages. Such proceedings may result in substantial cost and require significant time from our management, even if the eventual outcome is favorable to us. Third parties also may legitimately and independently develop products, services, and technology similar to or duplicative of our platforms. In addition to protection under intellectual property laws, we rely on confidentiality or license agreements that we generally enter into with our corporate partners, employees, consultants, advisors, vendors, and customers, and generally limit access to and distribution of our proprietary information. However, we cannot be certain that we have entered into such agreements with all parties who may have or have had access to our confidential information or that the agreements we have entered into will not be breached or challenged, or that such breaches will be detected. Furthermore, non-disclosure provisions can be difficult to enforce, and even if successfully enforced, may not be entirely effective. Additionally, as more information about us and our platforms is made or becomes publicly available, it may be more difficult to manage actions by third parties with respect to, or other use of, such information. We cannot guarantee that any of the measures we have taken will prevent infringement, misappropriation, or other violation of our technology or other intellectual property or proprietary rights. Because we may be an attractive target for cyberattacks and espionage, we also may have a heightened risk of unauthorized access to, and misappropriation of, our proprietary and competitively sensitive information. We may be required to spend significant resources to monitor and protect our intellectual property and other proprietary rights, and we may conclude that in at least some instances the benefits of protecting our intellectual property or other proprietary rights may be outweighed by the expense or distraction to our management. We have initiated, and may in the future initiate, claims or litigation against third parties for infringement, misappropriation, or other violation of our intellectual property or other proprietary rights or to establish the validity of our intellectual property or other proprietary rights. Any such litigation, whether or not it is resolved in our favor, could be time-consuming, result in significant expense to us and divert the efforts of our technical and management personnel. Furthermore, attempts to enforce our intellectual property rights against third parties could also provoke these third parties to assert their own intellectual property or other rights against us, or result in a holding that invalidates or narrows the scope of our rights, in whole or in part.
We have been, and may in the future be, subject to intellectual property rights claims, which are extremely costly to defend, could require us to pay significant damages and could limit our ability to use certain technologies.
Our success and ability to compete also depends in part on our ability to operate without infringing, misappropriating or otherwise violating the intellectual property or other proprietary rights of third parties. Companies in the software and technology industries, including some of our current and potential competitors, own large numbers of patents, copyrights, trademarks and trade secrets and frequently pursue litigation based on allegations of infringement, misappropriation or other violations of intellectual property rights. In addition, many of these companies have the capability to dedicate substantial resources to enforce their intellectual property rights and to defend claims that may be brought against them. Such litigation also may involve non-practicing patent assertion entities or companies who use their patents as a means to extract license fees by threatening costly litigation or that have minimal operations or relevant product revenue and against whom our patents may provide little or no deterrence or protection. We have received notices, and may continue to receive notices in the future, that claim we have infringed, misappropriated, misused or otherwise violated other parties’ intellectual property rights, and, to the extent we have made or will make more information about our platforms publicly available and become exposed to greater visibility, we face a higher risk of being the subject of intellectual property infringement, misappropriation or other violation claims, which is not uncommon with respect to software technologies in particular. There may be third-party intellectual property rights, including issued patents or pending patent applications, that cover significant aspects of our technologies, or business methods. There may also be third-party intellectual property rights, including trademark registrations and pending applications, that cover the goods and services that we offer in certain regions. We may also be exposed to increased risk of being the subject of intellectual property infringement, misappropriation, or other violation claims as a result of acquisitions and our incorporation of open source and other third-party software into, or new branding for, our technology platforms, as, among other things, we have a lower level of visibility into the development process with respect to such technology or the care taken to safeguard against infringement, misappropriation, or other violation risks. In addition, former employers of our current, former, or future employees may assert claims that such employees have improperly disclosed to us confidential or proprietary information of these former employers. Any intellectual property claims, with or without merit, are difficult to predict, could be very time-consuming and expensive to settle or litigate, could divert our management’s attention and other resources, and may not be covered by the insurance that we carry. These claims could subject us to significant liability for damages, potentially including treble damages if we are found to have willfully infringed a third party’s intellectual property rights. These claims
36

Table of Contents

could also result in our having to stop using technology, branding or marks found to be in violation of a third party’s rights and any necessary rebranding could result in the loss of goodwill. We could be required to seek a license for the intellectual property, which may not be available on commercially reasonable terms or at all. Even if a license were available, we could be required to pay significant royalties, which would increase our expenses. As a result, we could be required to develop alternative non-infringing technology, branding or marks, which could require significant effort and expense. If we cannot license rights or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of one or more of our platforms or features, we could lose existing customers, and we may be unable to compete effectively. Any of these results would harm our business, financial condition, and results of operations.
Further, our agreements with customers and other third parties generally include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of third-party claims of intellectual property infringement, misappropriation, or other violations of intellectual property rights, damages caused by us to property or persons, or other liabilities relating to or arising from our platforms, services, or other contractual obligations. Large indemnity payments could harm our business, financial condition, and results of operations. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business and results of operations.
Real or perceived errors, failures, defects, or bugs in our platforms could adversely affect our results of operations and growth prospects.
Because we offer very complex technology platforms, various errors, defects, failures, or bugs have occurred and may in the future occur, especially when platforms, products, or capabilities are introduced, configured, or reconfigured, or when upgrades, new versions, or other product or infrastructure updates are deployed, installed, configured, or released. Our platforms are often installed and used in large-scale computing environments with different operating systems, software products and equipment, and data source and network configurations, which may cause errors or failures in our platforms or may expose undetected errors, failures, or bugs in our platforms. Despite our internal systems and processes, errors, failures, or bugs may not be found or may not be properly mitigated or remediated in configured, reconfigured, upgraded or new software or other releases until after commencement of commercial shipments. Errors, failures, defects, and bugs have affected the performance of our platforms and can also delay the development or release of new platforms, products, or capabilities or upgrades or new versions of platforms, adversely affect our reputation and our customers’ willingness to buy platforms from us, and adversely affect market acceptance or perception of our platforms. Many of our customers use our platforms in applications that are critical to their businesses or missions and may have a lower risk tolerance to errors, failures, defects, or bugs in our platforms than in other, less critical, software products. Any errors or delays in releasing new software or new versions of platforms, allegations of unsatisfactory performance, real or perceived errors, defects, or failures, such as data loss, or untimely or ineffective upgrades, patches, or other fixes to address errors, failures, defects, or bugs, could increase the risk of security vulnerabilities, cause us to lose revenue or market share, increase our service costs, cause us to incur substantial costs in redesigning the software, cause us to lose significant customers, cause us to issue credits or refunds, subject us to liability for damages and divert our resources from other tasks, any one of which could materially and adversely affect our business, results of operations and financial condition. In addition, our platforms could be perceived to be ineffective for a variety of reasons outside of our control. Hackers or other malicious parties could circumvent our or our customers’ security measures, and customers may misuse our platforms resulting in a security breach or perceived product failure.
Real or perceived errors, failures, or bugs in our platforms and services, or dissatisfaction with our services and outcomes, could result in customer terminations and/or claims by customers for losses sustained by them. In such an event, we may be required, or we have chosen, or in the future may choose, for customer relations or other reasons, to expend additional resources in order to help correct any such errors, failures, or bugs. Although we have limitation of liability provisions in our standard software licensing and service agreement terms and conditions, these provisions may not be enforceable in some circumstances, may vary in levels of protection across our agreements, or may not fully or effectively protect us from such claims and related liabilities and costs. We generally provide a warranty for our software products and services and an SLA for our performance of software operations. In the event that there is a failure of warranties in such agreements, we are generally obligated to correct the product or service to conform to the warranty provision, or, if we are unable to do so, the customer is entitled to seek a refund of the purchase price of the product and service (generally prorated over the contract term). In the event of a violation of an SLA, some customers may be entitled to seek a refund of a portion of the applicable monthly fee, with such portion determined by the magnitude of SLA violation, subject to a cap of a portion of total monthly fees, as applicable. The sale and support of our products also entail the risk of product liability claims. We maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation and divert management’s time and other resources.
In addition, our platforms integrate a wide variety of other elements, and our platforms must successfully interoperate with products from other vendors and our customers’ internally developed software. As a result, when problems occur for a customer
37

Table of Contents

using our platforms, it may be difficult to identify the sources of these problems, and we may receive blame for a security, access control, or other compliance breach that was the result of the failure of one of the other elements in a customer’s or another vendor’s IT, security, or compliance infrastructure. The occurrence of software or errors in data, whether or not caused by our platforms, could delay or reduce market acceptance of our platforms and have an adverse effect on our business and financial performance, and any necessary revisions may cause us to incur significant expenses. The occurrence of any such problems could harm our business, financial condition, and results of operations. If an actual or perceived breach of information correctness, auditability, integrity, or availability occurs in one of our customers’ systems, regardless of whether the breach is attributable to our platforms, the market perception of the effectiveness of our platforms could be harmed. Alleviating any of these problems could require additional significant expenditures of our capital and other resources and could cause interruptions, delays, or cessation of our product licensing, which could cause us to lose existing or potential customers and could adversely affect our business, financial condition, results of operations, and growth prospects.
We rely on the availability of licenses to third-party technology that may be difficult to replace or that may cause errors or delay implementation of our platforms and services should we not be able to continue or obtain a commercially reasonable license to such technology.
Our technology platforms include software or other intellectual property licensed from third parties. It may be necessary in the future to renew licenses relating to various aspects of these platforms or to seek new licenses for existing or new platforms or other products. There can be no assurance that the necessary licenses would be available on commercially acceptable terms, if at all. Third parties may terminate their licenses with us for a variety of reasons, including actual or perceived failures or breaches of security or privacy, or reputational concerns, or they may choose not to renew their licenses with us. In addition, we may be subject to liability if third-party software that we license is found to infringe, misappropriate, or otherwise violate intellectual property or privacy rights of others. The loss of, or inability to obtain, certain third-party licenses or other rights or to obtain such licenses or rights on favorable terms, or the need to engage in litigation regarding these matters, could result in product roll-backs, delays in product releases until equivalent technology can be identified, licensed or developed, if at all, and integrated into our platforms, and may have a material adverse effect on our business, financial condition, and results of operations. Moreover, the inclusion in our platforms of software or other intellectual property licensed from third parties on a nonexclusive basis could limit our ability to differentiate our platforms from products of our competitors and could inhibit our ability to provide the current level of service to existing customers.
In addition, any data that we license from third parties for potential use in our platforms may contain errors or defects, which could negatively impact the analytics that our customers perform on or with such data. This may have a negative impact on how our platforms are perceived by our current and potential customers and could materially damage our reputation and brand.
Changes in or the loss of third-party licenses could lead to our platforms becoming inoperable or the performance of our platforms being materially reduced resulting in our potentially needing to incur additional research and development costs to ensure continued performance of our platforms or a material increase in the costs of licensing, and we may experience decreased demand for our platforms.
Our platforms contain “open source” software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.
Our technology platforms are distributed with software licensed by its authors or other third parties under “open source” licenses. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software, and that we license these modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. If we combine our proprietary software with open source software in a certain manner, we could, under certain provisions of the open source licenses, be required to release the source code of our proprietary software. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide updates, warranties, support, indemnities, assurances of title, or controls on origin of the software, and are provided on an “as-is” basis. Likewise, some open source projects have known security and other vulnerabilities and architectural instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis. We have established processes to help alleviate these risks, including a review process for screening requests from our development organization for the use of open source software, and the use of software tools to review our source code for open source software, but we cannot be sure that all open source software is submitted for approval prior to use in our platforms or that such software tools will be effective. In addition, open source license terms may be ambiguous and many of the risks associated with usage of open source software cannot be eliminated, and could, if not properly addressed, negatively affect our business. If we were found to have inappropriately used open source software, we may be required to re-engineer our platforms, to release proprietary source code, to discontinue the sale of our platforms in the event re-engineering could not be accomplished on a timely basis, or to take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business, results of operations, financial condition, and growth prospects. In addition, if the open source software we use is no longer maintained by the relevant open source community, then it may be more difficult
38

Table of Contents

to make the necessary revisions to our software, including modifications to address security vulnerabilities, which could impact our ability to mitigate cybersecurity risks or fulfill our contractual obligations to our customers. We may also face claims from copyright owners seeking to enforce the terms of an open source license governing the software, including by demanding release of the open source software, derivative works or our proprietary source code that was developed using such software. Such claims, with or without merit, could result in litigation, could be time-consuming and expensive to settle or litigation, including copyright infringement claims, could divert our management’s attention and other resources, could require us to lease some of our proprietary code, or could require us to devote additional research and development resources to change our software, any of which could adversely affect our business.
Additionally, we have intentionally made certain proprietary software available on an open source basis, both by contributing modifications back to existing open source projects, and by making certain internally developed tools available pursuant to open source licenses, and we plan to continue to do so in the future. While we have established procedures, including a review process for any such contributions, which is designed to protect any code that may be competitively sensitive, we cannot guarantee that this process has always been applied consistently. Even when applied, because any software source code we contribute to open source projects is publicly available, our ability to protect our intellectual property rights with respect to such software source code may be limited or lost entirely, and we may be unable to prevent our competitors or others from using such contributed software source code for competitive purposes, or for commercial or other purposes beyond what we intended.
Many of these risks associated with usage of open source software could be difficult to eliminate or manage, and could, if not properly addressed, negatively affect the performance of our offerings and our business.
Risks Related to Legal, Regulatory, and Accounting
Our business is subject to complex and evolving U.S. and non-U.S. laws and regulations regarding privacy, data protection and security, technology protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or otherwise harm our business.
We are subject to a variety of local, state, national, and international laws, directives, and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. International data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal and state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to continue to develop and evolve for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving software and technology industry in which we operate, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. For example, despite the EU’s adoption of an adequacy decision for the EU-U.S. Data Privacy Framework, legal challenges to the mechanisms allowing companies to transfer personal data from the European Economic Area to certain other jurisdictions, including the United States, have occurred and new legal challenges could emerge, resulting in further limitations on the ability to transfer data across borders. The California state legislature passed the California Consumer Privacy Act (“CCPA”) in 2018 and California voters approved a ballot measure establishing the California Privacy Rights Act (“CPRA”) in 2020. The CCPA and CPRA regulate the processing of personal information of California residents and increase the privacy and security obligations of entities handling certain personal information of California residents, including requiring covered companies to provide disclosures to California consumers, and affording such consumers abilities to opt-out of certain sales of personal information. The CCPA went into effect on January 1, 2020, and the California Attorney General may bring enforcement actions, with penalties for violations of the CCPA. The CPRA went into effect on January 1, 2023 instilling enforcement authority in a new dedicated regulatory body, the California Privacy Protection Agency (“CPPA”). In September 2025, the CPPA finalized regulations expanding compliance obligations under the CCPA, implementing requirements for businesses to conduct risk assessments and annual cybersecurity audits, as well as consumer rights related to automated decision-making technology, with compliance deadlines phased between January 2026 and April 2030. The CCPA’s enactment and further expansion has marked the beginning of a trend toward more stringent privacy legislation in the United States, as observed with the expanding adoption of state-level comprehensive consumer privacy legislation. As of 2025, twenty states have enacted comprehensive consumer privacy laws, and several states have enacted significant amendments expanding coverage or enhancing enforcement authority. An additional three states, Indiana, Kentucky, and Rhode Island, each have enacted legislation that will become effective in 2026. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity such as Washington’s My Health My Data Act, which includes a private right of action and applies broadly to consumer health data outside of the scope of the Health Insurance Portability and Accountability Act, and Nevada’s Senate Bill No. 370, which imposes similar health data privacy legislation.

39

Table of Contents

We cannot yet fully assess the impact of these laws and other new laws or regulations on our business or operations, but developments regarding these and other privacy and data protection laws and regulations around the world may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to maintain compliance on an ongoing basis. Outside of the United States, virtually every jurisdiction in which we operate has established its own legal framework relating to privacy, data protection, and information security matters with which we and/or our customers must comply. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, retention, disclosure, security, transfer, and other processing of data that identifies or may be used to identify or locate an individual. Some countries and regions, including the EU, are considering or have passed legislation that imposes significant obligations in connection with privacy, data protection, and information security that could increase the cost and complexity of delivering our platforms and services, including the European General Data Protection Regulation (“GDPR”) which took effect in May 2018; the EU AIA, which entered into force in August 2024 but continues to be phased in and establishes a risk-based framework for AI systems; and the Network and Information Security Directive 2 (“NIS2”), which replaced the original NIS Directive as of October 2024, and imposes additional cybersecurity risk management and incident reporting obligations. The EU also implemented the Digital Operational Resilience Act (“DORA”), which introduces new standards for Information and Communication Technology risk management and incident reporting for financial and insurance entities, and the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025. Among other things, the Data Act may affect some customers’ ability to terminate service agreements with us or our competitors, and compliance with the Data Act may require us to adjust contract terms and technical measures for data portability for customers in the EU. These changes may impact the duration of customer relationships in the EU and result in additional compliance and operational costs, which may affect our business. Forthcoming EU regulatory developments, envisioned under the recently published European Commission’s Digital Omnibus Package initiative, while aimed at streamlining regulatory obligations, may introduce further considerations or challenges for us or our customers in addressing EU digital compliance frameworks. Complying with the GDPR, EU AIA, NIS2, DORA, the Data Act, or other EU laws, directives, and regulations as they emerge may cause us to incur substantial operational costs, lead to challenges for our customers’ implementation and use of our platform, or require us to modify our data handling practices on an ongoing basis. Non-compliance with the GDPR specifically may result in administrative fines or monetary penalties of up to 4% of worldwide annual revenue in the preceding financial year or €20 million (whichever is higher) for the most serious infringements and non-compliance with the EU AIA may result in penalties up to €35 million or 7% of worldwide annual turnover (whichever is higher), each of which could result in proceedings against us by governmental entities or other related parties and may otherwise adversely impact our business, financial condition, and results of operations.
Additionally, post-Brexit updates to United Kingdom (“U.K.”) data protection laws and regulations, such as the Data (Use and Access) Act 2025, while largely conforming to EU GDPR standards paving the way for a 2021 European Commission adequacy determination for export of personal data from the European Economic Area to the U.K., may change over time as the U.K. and its regulator, the Information Commissioner’s Office, continue to examine its global market standing. In December 2025, the European Commission renewed the U.K. adequacy decisions originally adopted in 2021, subject to a term of six years and set to expire in December 2031; however, it also committed to a mid-point review of the decisions after four years to evaluate ongoing adequacy. Modifications in the standards for valid data transfer to the U.S. from the U.K., the EU, Switzerland, and other countries using standard contractual clauses or similar mechanisms may further require us to change our product and business practices, as well as to update client agreements in ways that introduce additional costs to our business.
The overarching complexity of laws and regulations relating to privacy, data protection, and information security around the world pose a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls or to the commitments we make, or the malicious or inadvertent breach of applicable legal, regulatory, or contractual privacy, data protection, or information security requirements by us, our employees, our business partners, or our customers.
In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers’ compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers’ compliance with, these standards. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data
40

Table of Contents

management practices, our policies or procedures, or the features of our platforms, or we may simply fail to properly develop or implement our practices, policies, procedures, or features in compliance with such obligations. If so, in addition to the possibility of fines, lawsuits, investigations, and other claims or proceedings, we could be required to fundamentally change our business activities and practices or modify our platforms, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new platforms and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platforms.
These existing and proposed laws and regulations can be costly to comply with and can make our platforms and services less effective or valuable, delay or impede the development of new products, result in negative publicity, increase our operating costs, require us to modify our data handling practices, limit our operations, impose substantial fines and penalties, require significant management time and attention, or put our data or technology at risk. Any failure or perceived failure by us or our platforms to comply with the laws, regulations, directives, policies, industry standards, or legal obligations of the United States, EU, or other governmental or non-governmental bodies at the regional, national, or supra-national level relating to privacy, data protection, or information security, or any security incident that results in actual or suspected loss of or the unauthorized access to, or acquisition, use, release, or transfer of, personal information, personal data, or other customer or sensitive data or information may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, indemnification or other contractual obligations, other remedies, including fines or demands that we modify or cease existing business practices, or adverse publicity, and related costs and liabilities, which could significantly and adversely affect our business and results of operations.
Our non-U.S. sales and operations subject us to additional risks and regulations that can adversely affect our results of operations.
Our successes to date have primarily come from customers in relatively stable and developed countries, but we have entered, and may continue to enter, new and emerging markets in non-U.S. countries, including with customers in law enforcement, national security, and other government agencies, as part of our growth strategy. These new and emerging markets may involve uncertain business, technology, and economic risks and may be difficult or impossible for us to penetrate, even if we were to commit significant resources to do so.
We currently have sales personnel and sales and services operations in the United States and certain countries around the world. To the extent that we experience difficulties in recruiting, training, managing, or retaining non-U.S. staff, and specifically sales management and sales personnel staff, we may experience difficulties in sales productivity in, or market penetration of, non-U.S. markets. Our ability to convince customers to expand their use of our platforms or renew their subscription, license, or maintenance and service agreements with us is correlated to, among other things, our direct engagement with the customer. To the extent we are restricted or unable to engage with non-U.S. customers effectively with our limited sales force and services capacity, we may be unable to grow sales to existing customers to the same degree we have experienced in the United States.
Our non-U.S. operations subject us to a variety of risks and challenges, including:
• increased management, travel, infrastructure, and legal and financial compliance costs and time associated with having multiple non-U.S. operations, including but not limited to compliance with local employment laws and other applicable laws and regulations;
• longer payment cycles, greater difficulty in enforcing contracts, difficulties in collecting accounts receivable, especially in emerging markets, and the likelihood that revenue from non-U.S. system integrators, government contractors, and customers may need to be recognized when cash is received, at least until satisfactory payment history has been established, or upon confirmation of certain acceptance criteria or milestones;
• the need to adapt our platforms for non-U.S. customers, whether to accommodate customer preferences or local law;
• changes to U.S. laws, regulations, or government enforcement practices which could impact the countries we operate in and, as a result, affect our ability to legally work in those countries or with their governments;
• differing regulatory and legal requirements and possible enactment of additional regulations or restrictions on the use, import, or re-export of our platforms or the provision of services, which could delay, restrict, or prevent the sale or use of our platforms and services in some jurisdictions;
• compliance with multiple and new or changing foreign laws and regulations, including those governing employment, privacy, data protection, information security, data transfer, AI, and the risks and costs of non-compliance with such laws and regulations;
• new and different sources of competition not present in the United States;
41

Table of Contents

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may cause us to withdraw from particular markets, or impact financial results and result in restatements of financial statements and irregularities in financial statements;
• volatility in non-U.S. political and economic environments, including by way of examples, the potential effects of the ongoing Russia-Ukraine conflict, as well as economic sanctions the United States and other countries have imposed on Russia, the conflict resulting from Hamas’ attack on Israel, and the ongoing conflict in the Middle East;
• weaker protection of intellectual property rights in some countries and the risk of potential theft, copying, or other compromises of our technology, data, or intellectual property in connection with our non-U.S. operations, whether by state-sponsored malfeasance or other foreign entities or individuals;
• volatility and fluctuations in currency exchange rates, including that, because many of our non-U.S. contracts are denominated in U.S. dollars, an increase in the strength of the U.S. dollar in the past has made our products more expensive for non-U.S. dollar denominated customers, which may make doing business with us less appealing to such customers;
• management and employee communication and integration problems resulting from language differences, cultural differences, and geographic dispersion;
• difficulties in repatriating or transferring funds from, or converting currencies in, certain countries;
• potentially adverse tax consequences, including multiple and possibly overlapping tax regimes, the complexities of foreign value-added tax systems, and changes in tax laws;
• lack of familiarity with local laws, customs, and practices, and laws and business practices favoring local competitors or partners; and
• interruptions to our business operations and our customers’ business operations subject to events such as war, incidents of terrorism, natural disasters, public health concerns or epidemics, shortages or failures of power, internet, telecommunications, or hosting service providers, cyberattacks or malicious acts, or responses to these events.
In addition to the factors above, foreign governments may take administrative, legislative, or regulatory action that could materially interfere with our ability to sell our platforms in certain countries. For example, foreign governments may require a percentage of prime contracts be fulfilled by local contractors or provide special incentives to government-backed local customers to buy from local competitors, even if their products are inferior to ours. Moreover, both the U.S. government and foreign governments may regulate the acquisition of or import of our technologies or our entry into certain foreign markets or partnership with foreign third parties through investment screening or other regulations. Such regulations may apply to certain non-U.S. joint ventures, platform partnerships, and strategic alliances that may be integral to our long-term business strategy.
Compliance with laws and regulations applicable to our non-U.S. operations increases our cost of doing business in foreign jurisdictions. We may be unable to keep current with changes in foreign government requirements and laws as they change from time to time. Failure to comply with these regulations could subject us to investigations, sanctions, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions, or other collateral consequences. In many foreign countries, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. regulations applicable to us. In addition, although we have implemented policies and procedures designed to ensure compliance with these laws and policies, there can be no assurance that all of our employees, contractors, partners, and agents will comply with these laws and policies. Violations of laws or key control policies by our employees, contractors, partners, or agents could result in delays in revenue recognition, financial reporting misstatements, governmental sanctions, fines, penalties, or the prohibition of the importation or exportation of our platforms. In addition, responding to any action may result in a significant diversion of management’s attention and resources and an increase in professional fees. Enforcement actions and sanctions or failure to prevail in any possible civil or criminal litigation could harm our business, reputation, financial condition, and results of operations.
Also, we are expanding operations, including our work with existing commercial customers, into countries in Asia, Europe, the Middle East, and elsewhere, which may place restrictions on the transfer of data and potentially the import and use of foreign encryption technology. Any of these risks could harm our non-U.S. operations and reduce our non-U.S. sales, adversely affecting our business, results of operations, financial condition, and growth prospects.
Some of our business partners also have non-U.S. operations and are subject to the risks described above. Even if we are able to successfully manage the risks of our own non-U.S. operations, our business may be adversely affected if our business partners are not able to successfully manage these risks.
42

Table of Contents

Failure to comply with governmental laws and regulations or contractual requirements could harm our business, and we have been, and expect to be, the subject of legal and regulatory inquiries, which may result in monetary payments or may otherwise negatively impact our reputation, business, and results of operations.
Our business is subject to regulation by various federal, state, local, and foreign governments in which we operate. In certain jurisdictions, the regulatory requirements imposed by foreign governments may be more stringent than those in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, administrative proceedings, sanctions, enforcement actions, disgorgement of profits, fines, damages, litigation, civil and criminal penalties, termination of contracts, exclusion from sales channels or sales opportunities, injunctions, or other consequences. Such matters may include, but are not limited to, claims, disputes, allegations, or investigations related to alleged violations of laws or regulations relating to anti-corruption requirements, lobbying or conflict-of-interest requirements, export or other trade controls, data privacy or data protection requirements, or laws or regulations relating to employment, procurement, cybersecurity, securities, or antitrust/competition requirements. The effects of recently imposed and proposed actions are uncertain because of the dynamic nature of governmental action and responses. For example, governmental bodies have implemented laws and are considering further regulation of AI (including machine learning), which could negatively impact our ability to use and develop platforms and products incorporating these technologies. The European Union Parliament adopted the EU AIA, that, despite recent moves to delay the implementation of some provisions, when effective, will likely impose onerous obligations related to the development, sale and use of AI-related systems. In addition, Colorado has passed a Consumer Protections for Artificial Intelligence bill introducing state-level oversight of “high-risk” AI systems, which mirrors language and several provisions appearing in the EU AIA. Many states, notably California, Utah, and Texas have signed private-sector AI governance legislation focused on various aspects of AI oversight. Further, certain administrations have encouraged companies to sign on to voluntary commitments to manage the risks posed by AI alongside related legislative or regulatory efforts, some of which we have signed. When such legislation or commitments, or if similar legislation or commitments in other jurisdictions, are enacted or adopted, compliance with such obligations may be difficult, onerous, and costly, and could adversely affect our business, reputation, financial condition, results of operations, and growth prospects.
Many governments have enacted laws requiring companies to provide notice of data security breaches or incidents involving certain types of data, including personal data. For example, the SEC adopted cybersecurity risk management and disclosure rules, which require the disclosure of information pertaining to cybersecurity incidents and cybersecurity risk management, strategy, and governance. In addition, most of our customers, including U.S. government customers, contractually require us to notify them of certain data security breaches and incidents. However, determining whether a cybersecurity incident has occurred and is notifiable or reportable may not be straightforward, and we may not effectively identify all relevant cybersecurity incidents in a timely manner, or at all. If we are unable to comply with contractual or regulatory notification requirements, which may include timelines for appropriate notification or methods by which such notifications must be made, we may be subject to additional penalties, contractual liability, and reputational damage.
We may be subject to government inquiries that drain our time and resources, tarnish our brand among customers and potential customers, prevent us from doing business with certain customers or markets, including government customers, affect our ability to hire, attract and maintain qualified employees, or require us to take remedial action or pay penalties. From time to time, we receive formal and informal inquiries from governmental agencies and regulators regarding our compliance with laws and regulations or otherwise relating to our business or transactions. Any negative outcome from such inquiries or investigations or failure to prevail in any possible civil or criminal litigation could adversely affect our business, reputation, financial condition, results of operations, and growth prospects.
We have previously been, and are currently, or in the future may become, involved in a number of legal, regulatory, and administrative inquiries and proceedings, and unfavorable outcomes in litigation or other of these matters could negatively impact our business, financial conditions, and results of operations.
We have previously been, and are currently, and from time to time going forward may become involved in and subject to regulatory or other governmental inquiries or investigations, or government or private-party litigation or proceedings for a variety of claims or disputes. These claims, lawsuits, and proceedings have involved, and could in the future involve, labor and employment, discrimination and harassment, commercial disputes, intellectual property rights (including patent, trademark, copyright, trade secret, and other proprietary rights), class actions, general contract, tort, defamation, data privacy rights, antitrust, common law fraud, government regulation, or compliance, alleged federal and state securities and “blue sky” law violations or other investor claims, and other matters. Derivative claims, lawsuits, and proceedings involving breach of fiduciary duty, failure of oversight, corporate waste claims, and other matters have been, and may in the future be, asserted against our officers and directors by our stockholders. In addition, we and certain of our officers and directors were sued in purported class action lawsuits and derivative lawsuits. Our business and results may be adversely affected by the outcome of any currently pending or any future legal, regulatory, and/or administrative claims or proceedings, including through monetary damages or injunctive relief.
43

Table of Contents

The number and significance of our legal disputes and inquiries may increase as we continue to grow larger, as our business expands in employee headcount, scope, and geographic reach, and as our platforms and services become more complex. Additionally, if customers fail to pay us under the terms of our agreements, we may be adversely affected due to the cost of enforcing the terms of our contracts through litigation. Litigation or other proceedings can be expensive and time consuming and can divert our resources and leadership’s attention from our primary business operations. The results of our litigation also cannot be predicted with certainty. If we are unable to prevail in litigation, we could incur payments of substantial monetary damages or fines, or undesirable changes to our platforms or business practices, and accordingly, our business, financial condition, or results of operations could be materially and adversely affected. Furthermore, if we accrue a loss contingency for pending litigation and determine that it is probable, any disclosures, estimates, and reserves we reflect in our financial statements with regard to these matters may not reflect the ultimate disposition or financial impact of litigation or other such matters. These proceedings could also result in negative publicity, which could harm customer and public perception of our business, regardless of whether the allegations are valid or whether we are ultimately found liable. Additional information regarding certain of the lawsuits we are involved in is described further in Note 8. Commitments and Contingencies in our consolidated financial statements included elsewhere in this Annual Report on Form 10-K.
Failure to comply with anti-bribery and anti-corruption laws could subject us to penalties and other adverse consequences.
As we operate and sell our platforms and services around the world, we are subject to the United States Foreign Corrupt Practices Act (“FCPA”), the U.K. Bribery Act, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the United States Travel Act, and other anti-corruption and anti-bribery laws and regulations in the jurisdictions in which we do business, both domestic and abroad. These laws and regulations generally prohibit improper payments or offers of improper payments to government officials, political parties, or commercial partners for the purpose of obtaining or retaining business or securing an improper business advantage.
We have operations, deal with and make sales to governmental or quasi-governmental entities in the United States and in non-U.S. countries, including those known to experience corruption, particularly certain emerging countries in East Asia, Eastern Europe, Africa, South America, and the Middle East, and further expansion of our non-U.S. sales efforts may involve additional regions.
Corruption issues pose a risk in every country and jurisdiction, but in many countries, particularly in countries with developing economies, it may be more common for businesses to engage in practices that are prohibited by the FCPA or other applicable laws and regulations, and our activities in these countries pose a heightened risk of unauthorized payments or offers of payments by one of our employees or third-party business partners, representatives, and agents that could be in violation of various laws including the FCPA. The FCPA, U.K. Bribery Act and other applicable anti-bribery and anti-corruption laws also may hold us liable for acts of corruption and bribery committed by our third-party business partners, representatives, and agents. We and our third-party business partners, representatives, and agents may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of our employees or such third parties even if we do not explicitly authorize such activities. The FCPA or other applicable laws and regulations also require that we keep accurate books and records and maintain internal controls and compliance procedures designed to prevent any such actions. While we have implemented policies and procedures to address compliance with such laws, we cannot ensure that our employees or other third parties working on our behalf will not engage in conduct in violation of our policies or applicable law for which we might ultimately be held responsible. Violations of the FCPA, the U.K. Bribery Act, and other laws may result in whistleblower complaints, adverse media coverage, investigations, imposition of significant legal fees, loss of export privileges, as well as severe criminal or civil sanctions, including suspension or debarment from U.S. government contracting, and we may be subject to other liabilities and adverse effects on our reputation, which could negatively affect our business, results of operations, financial condition, and growth prospects. In addition, responding to any enforcement action may result in a significant diversion of management’s attention and resources and significant defense costs and other professional fees. Our exposure for violating these laws increases as our non-U.S. presence expands and as we increase sales and operations in foreign jurisdictions.
Governmental trade controls, including export and import controls, sanctions, customs requirements, and related regimes, could subject us to liability or loss of contracting privileges or limit our ability to compete in certain markets.
Our offerings are subject to U.S. export controls, and we incorporate encryption technology into certain of our offerings. Our controlled software offerings and the underlying technology may be exported outside of the United States only with the required export authorizations, which may include license requirements in some circumstances. Additionally, our current or future products may be classified under the Commerce Department Export Administration Regulations (“EAR”) or as defense articles subject to the United States International Traffic in Arms Regulations (“ITAR”). Most of our products, including our core software platforms, have been classified under the EAR and are generally exportable without needing a specific license, under an EAR exception for encrypted software. If a product, or component of a product, is classified under the ITAR, or is ineligible for the EAR encryption exception, then those products could be exported outside the United States only if we obtain the applicable export license or qualify for a different license exemption or exception. In certain contexts, the services we
44

Table of Contents

provide might be classified as defense services subject to the ITAR separately from the products we provide. Compliance with the EAR, ITAR, and other applicable regulatory requirements regarding the export of our products, including new releases of our products and/or the performance of services, may create delays in the introduction of our products in non-U.S. markets, prevent our customers with non-U.S. operations from deploying our products throughout their global systems or, in some cases, prevent the export of our products to some countries altogether.
Furthermore, our activities are subject to the economic sanctions, laws and regulations of the United States and other jurisdictions. Such controls prohibit the shipment or transfer of certain products and services without the required export authorizations or export to countries, governments, and persons targeted by applicable sanctions. We take precautions to prevent our offerings from being exported in violation of these laws, including: (i) seeking to proactively classify our platforms and obtain authorizations for the export and/or import of our platforms where appropriate, (ii) implementing certain technical controls and screening practices to reduce the risk of violations, and (iii) requiring compliance with U.S. export control and sanctions obligations in customer and vendor contracts. However, we cannot guarantee the precautions we take will prevent violations of export control and sanctions laws.
As discussed above, if we misclassify a product or service, export or provide access to a product or service in violation of applicable restrictions, or otherwise fail to comply with export regulations, we may be denied export privileges or subjected to significant per violation fines or other penalties, and our platforms may be denied entry into other countries. Any decreased use of our platforms or limitation on our ability to export or sell our platforms would likely adversely affect our business, results of operations and financial condition. Violations of U.S. sanctions or export control laws can result in fines or penalties, including civil penalties of over $300,000 or twice the value of the transaction, whichever is greater, per EAR violation and a civil penalty of over $1,000,000 or twice the value of the transaction, whichever is greater, per ITAR violation. In the event of criminal knowing and willful violations of these laws, fines of up to $1,000,000 per violation and possible incarceration for responsible employees and managers could be imposed.
We also note that if we or our business partners or counterparties, including licensors and licensees, prime contractors, subcontractors, sublicensors, vendors, customers, shipping partners, or contractors, fail to obtain appropriate import, export, or re-export licenses or permits, notwithstanding regulatory requirements or contractual commitments to do so, or if we fail to secure such contractual commitments where necessary, we may also be adversely affected, through reputational harm as well as other negative consequences, including government investigations and penalties. For instance, violations of U.S. sanctions or export control laws can result in fines or penalties, including significant civil and criminal penalties per violation, depending on the circumstances of the violation or violations.
Negative consequences for violations or apparent violations of trade control requirements may include the absolute loss of the right to sell our platforms or services to the government of the United States, or to other public bodies, or a reduction in our ability to compete for such sales opportunities. Further, complying with export control and sanctions regulations for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.
Also, various countries, in addition to the United States, regulate the import and export of certain encryption and other technology, including import and export permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our platforms or could limit our customers’ abilities to implement our platforms in those countries. For example, following Russia’s invasion of Ukraine, and as the conflict has continued, the United States and other countries have imposed economic sanctions and severe export control restrictions against Russia, Belarus, and certain regions of Ukraine, and the United States and other countries could continue to impose wider sanctions and export restrictions and take other actions should the conflict further escalate. Any new export restrictions, new legislation, changes in economic sanctions, or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons, or technologies targeted by such regulations, could result in decreased use of our platforms by existing customers with non-U.S. operations, declining adoption of our platforms by new customers with non-U.S. operations, limitation of our expansion into new markets, and decreased revenue.
Changes in accounting principles or their application to us could result in unfavorable accounting charges or effects, which could adversely affect our results of operations and growth prospects.
We prepare our consolidated financial statements in accordance with Generally Accepted Accounting Principles (“GAAP”) in the United States. In particular, we make certain estimates and assumptions related to the adoption and interpretation of these principles including related to the recognition of our revenue. If these assumptions turn out to be incorrect, our financial results and position could materially differ from our expectations and could be materially adversely affected. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant effect on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results or our forecasts, which may negatively impact our financial statements.
45

Table of Contents

If our judgments or estimates relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our results of operations could fall below expectations of securities analysts and investors, resulting in a decline in our stock price.
The preparation of our financial statements in conformity with GAAP requires management to make judgments, estimates, and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” the results of which form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock. Significant judgments, estimates, and assumptions used in preparing our consolidated financial statements include, or may in the future include, those related to revenue recognition.
We could be subject to additional tax liabilities.
We are subject to federal, state, and local income taxes in the United States and numerous foreign jurisdictions. Determining our provision for income taxes requires management judgment, and the ultimate tax outcome may be uncertain. In addition, our provision for income taxes is subject to volatility and could be adversely affected by many factors, including, among other things, changes to our operating or holding structure, changes in the amounts of earnings in jurisdictions with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, and changes in U.S. and foreign tax laws. Moreover, we are subject to the examination of our income tax returns by tax authorities in the United States and various foreign jurisdictions, which have disagreed, and may in the future disagree, with our calculation of research and development tax credits, cross-jurisdictional transfer pricing, or other matters and have assessed, and may continue to assess, additional taxes, interest or penalties. While we regularly assess the likely outcomes of these examinations to determine the adequacy of our provision for income taxes and we believe that our financial statements reflect adequate reserves to cover any such contingencies, there can be no assurance that the outcomes of such examinations will not have a material impact on our results of operations and cash flows. If U.S. or other foreign tax authorities change applicable tax laws, our overall taxes could increase, and our financial condition or results of operations may be adversely impacted.
Many countries are beginning to implement legislation and other guidance to align their international tax rules with the Organisation for Economic Co-operation and Development’s (“OECD”) Base Erosion and Profit Shifting (“BEPS”) recommendations and action plan that aim to standardize and modernize global corporate tax policy, including changes to cross-border tax, transfer pricing documentation rules, and nexus-based tax incentive practices. The OECD is also continuing discussions surrounding fundamental changes in allocation of profits among tax jurisdictions in which companies do business, as well as the implementation of a global minimum tax (namely the “Pillar One” and “Pillar Two” proposals). Many countries have enacted or begun the process of enacting laws based on Pillar Two proposals, which may adversely impact our provision for income taxes, net income, and cash flows. We have considered the impact of the currently enacted Pillar Two rules and determined that we became subject to certain rules starting January 1, 2024 in some jurisdictions, and it did not have a material impact on our financial condition or results of operations for the year ended December 31, 2025. Furthermore, in response to trade negotiations with the United States, the Group of 7 countries (the “G7”) announced a joint understanding to exempt U.S.-parented multinational corporations from Pillar Two by adopting a “side-by-side” system between Pillar Two and the existing U.S. global minimum tax provisions, and the OECD released “Tax Challenges Arising from the Digitalisation of the Economy – Global Anti-Base Erosion Model Rules (Pillar Two), Side-by-Side Package: Inclusive Framework on BEPS” on January 5, 2026, to this effect, which reduces the impact of Pillar Two rules on us. We continue to monitor developments and evaluate impacts, if any, of these provisions on our financial condition or results of operations in the future.
As a result of the heightened scrutiny of corporate taxation policies, prior decisions by tax authorities regarding treatments and positions of corporate income taxes could be subject to enforcement activities, and legislative investigation and inquiry, which could also result in changes in tax policies or prior tax rulings. Any substantial changes in domestic or international corporate tax policies, regulations or guidance, enforcement activities or legislative initiatives may materially adversely affect our business, the amount of taxes we are required to pay and our financial condition and results of operations generally.
We may not be able to utilize a significant portion of our net operating loss carryforwards and tax credits, which could adversely affect our results of operations.
We record an asset for the future tax benefits from unused U.S. federal, state, and foreign net operating losses (“NOLs”) and tax credits subject to a full valuation allowance. Federal, state, and foreign taxing bodies often place limitations on NOLs and tax credit carryforward benefits. As a result, we may not be able to utilize our NOLs and tax credits. In general, under Section 382 of the United States Internal Revenue Code of 1986, as amended (the “Code”), a corporation that undergoes an ownership change is subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income. Future changes in
46

Table of Contents

our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code. If our existing NOLs are subject to limitations arising from an ownership change, our ability to utilize NOLs could be limited by Section 382 of the Code, and a certain amount of our prior year NOLs could expire without benefit. Changes in the law may also impact our ability to use our NOLs and tax credit carryforwards.
In addition, there is also a risk that the expiration of our existing NOLs or tax credits or a limitation on their use to offset future income tax liabilities could result from statutory or regulatory changes. For these reasons, we may not be able to utilize a material portion of our NOLs, which could potentially result in increased future tax liabilities to us and could adversely affect our results of operations.
For additional information, see Note 11. Taxes in our consolidated financial statements included elsewhere in this Annual Report on Form 10-K.
Our results of operations may be harmed if we are required to collect sales or other related taxes for our license arrangements in jurisdictions where we have not historically done so.
States and some local taxing jurisdictions have differing rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that may change over time. We collect and remit U.S. sales and use tax, value-added tax (“VAT”), and goods and services tax (“GST”) in a number of jurisdictions. It is possible, however, that we could face sales tax, VAT, or GST audits and that our liability for these taxes could exceed our estimates as state and foreign tax authorities could still assert that we are obligated to collect additional tax amounts from our customers and remit those taxes to those authorities. We could also be subject to audits in states and foreign jurisdictions for which we have not accrued tax liabilities. One or more states or countries may seek to impose incremental or new sales, use, or other tax collection obligations on us or may determine that such taxes should have, but have not been, paid by us.
Risks Related to Relationships and Business with the Public Sector
A significant portion of our business depends on sales to the public sector, and our failure to receive and maintain government contracts or changes in the contracting or fiscal policies of the public sector has adversely affected and could continue to adversely affect our business, results of operations, financial condition, and growth prospects.
We derive a significant portion of our revenue from contracts with federal, state, local, and foreign governments and government agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. For example, we have historically derived, and expect to continue to derive, a significant portion of our revenue from sales to agencies of the U.S. federal government, either directly by us or through other government contractors. Our perceived relationship with the U.S. government could adversely affect our business prospects in certain non-U.S. geographies or with certain non-U.S. governments.
Sales to such government agencies are subject to a number of challenges and risks. Selling to government agencies can be highly competitive, expensive, and time-consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. We also must comply with laws and regulations relating to the formation, administration, and performance of contracts, which provide public sector customers rights, many of which are not typically found in commercial contracts.
Accordingly, our business, financial condition, results of operations, and growth prospects may be adversely affected by certain events or activities, including, but not limited to:
• changes in fiscal or contracting policies or decreases in available government funding, including as a result of efforts by the federal government to analyze and enhance its operational efficiency or enforce executive orders and other administration priorities;
• changes in government programs or applicable requirements;
• restrictions in the grant of personnel security clearances to our employees;
• ability to maintain facility clearances required to perform on classified contracts for U.S. federal government and foreign government agencies;
• ability to achieve or maintain one or more government certifications, including, but not limited to, our existing FedRAMP, IL2, IL4, IL5, and IL6 authorizations;
• changes in the political environment, including before or after a change to the leadership or overall composition within the government, or due to ongoing conflicts such as the Russia-Ukraine conflict and related economic sanctions, the
47

Table of Contents

conflict resulting from Hamas’ attack on Israel and the ongoing conflict in the Middle East, and regional instability, and any resulting uncertainty or changes in policy or priorities and resultant funding;
• changes in the government’s attitude towards the capabilities that we offer, especially in the areas of national defense, cybersecurity, and critical infrastructure, including the financial, energy, telecommunications, and healthcare sectors;
• changes in the government’s attitude towards us as a company or our platforms as viable or acceptable software solutions;
• appeals, disputes, or litigation relating to government procurement, including but not limited to bid protests by unsuccessful bidders on potential or actual awards of contracts to us or our partners by the government;
• the adoption of new laws or regulations or changes to existing laws or regulations, including as may relate to the implementation of AI by federal agencies;
• budgetary constraints, including automatic reductions as a result of “sequestration” or similar measures and constraints imposed by any lapses in appropriations for the federal government or certain of its departments and agencies, for example in connection with an extended federal government shutdown, including the federal government’s shutdown in the third quarter of 2025;
• influence by, or competition from, third parties with respect to pending, new, or existing contracts with government customers;
• changes in political or social attitudes with respect to security or data privacy issues;
• potential delays or changes in the government appropriations or procurement processes, including as a result of events such as war, incidents of terrorism, natural disasters, and public health concerns or epidemics; and
• increased or unexpected costs or unanticipated delays caused by other factors outside of our control, such as performance failures of our subcontractors.
Such events or activities, among others, have caused and could continue to cause governments and governmental agencies to delay or refrain from purchasing or paying for our platforms and services in the future, reduce the size or payment amounts of purchases from existing or new government customers, or otherwise have an adverse effect on our business, results of operations, financial condition, and growth prospects.
We have contracts with governments that involve classified programs, which may limit investor insight into portions of our business.
We derive a portion of our revenue from programs with governments and government agencies that are subject to security restrictions (e.g., contracts involving classified information, classified contracts, and classified programs), which preclude the dissemination of information and technology that is classified for national security purposes under applicable law and regulation. In general, access to classified information, technology, facilities, or programs requires appropriate personnel security clearances, is subject to additional contract oversight and potential liability, and may also require appropriate facility clearances and other specialized infrastructure. In the event of a security incident involving classified information, technology, facilities, or programs or personnel holding clearances, we may be subject to legal, financial, operational, and reputational harm. We are limited in our ability to provide specific information about these classified programs, their risks, or any disputes or claims relating to such programs. As a result, investors have less insight into our classified programs than our other businesses and therefore less ability to fully evaluate the risks related to our classified business or our business overall. However, historically the business risks associated with our work on classified programs have not differed materially from those of our other government contracts.
Our business could be adversely affected if our employees cannot obtain and maintain required personnel security clearances or we cannot establish and maintain a required facility security clearance.
Certain government contracts may require our employees to maintain various levels of security clearances and may require us to maintain a facility security clearance to comply with U.S. and international government agency requirements. Many governments have strict security clearance requirements for personnel who perform work in support of classified programs. Obtaining and maintaining security clearances for employees typically involves a lengthy process, and it can be difficult to identify, recruit, and retain employees who already hold security clearances. If our employees are unable to obtain security clearances in a timely manner, or at all, or if our employees who hold security clearances are unable to maintain their clearances or terminate employment with us, then we may be unable to comply with relevant U.S. and international government agency requirements, or our customers requiring classified work could choose to terminate or decide not to renew one or more contracts requiring employees to obtain or maintain security clearances upon expiration. To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on or win new classified contracts, and existing contracts
48

Table of Contents

requiring a facility security clearance could be terminated, either of which would have an adverse impact on our business, financial condition, and results of operations.
Many of our customer contracts may be terminated by the customer at any time for convenience and may contain other provisions permitting the customer to discontinue contract performance, and if terminated contracts are not replaced, our results of operations may differ materially and adversely from those anticipated. In addition, our contracts with government customers often contain provisions with additional rights and remedies favorable to such customers that are not typically found in commercial contracts.
Many of our contracts, including our government contracts, contain termination for convenience provisions. Customers that terminate such contracts may also be entitled to a pro rata refund of the amount of the customer deposit for the period of time remaining in the contract term after the applicable termination notice period expires. Government contracts often contain provisions and are subject to laws and regulations that provide government customers with additional rights and remedies not typically found in commercial contracts. These rights and remedies allow government customers, among other things, to:
• terminate existing contracts for convenience with short notice;
• reduce orders under or otherwise modify contracts;
• for contracts subject to the Truth in Negotiations Act, reduce the contract price or cost where it was increased because a contractor or subcontractor furnished cost or pricing data during negotiations that was not complete, accurate, and current;
• for some contracts, (i) demand a refund, make a forward price adjustment, or terminate a contract for default if a contractor provided inaccurate or incomplete data during the contract negotiation process and (ii) reduce the contract price under triggering circumstances, including the revision of price lists or other documents upon which the contract award was predicated;
• cancel multi-year contracts and related orders if funds for contract performance for any subsequent year become unavailable;
• decline to exercise an option to renew a multi-year contract or issue task orders in connection with indefinite delivery/indefinite quantity (“IDIQ”) contracts;
• claim rights in solutions, systems, or technology produced by us, appropriate such work-product for their continued use without continuing to contract for our services, and disclose such work-product to third parties, including other government agencies and our competitors, which could harm our competitive position;
• prohibit future procurement awards with a particular agency due to a finding of organizational conflicts of interest based upon prior related work performed for the agency that would give a contractor an unfair advantage over competing contractors, or the existence of conflicting roles that might bias a contractor’s judgment;
• subject the award of contracts to protest by competitors, which may require the contracting federal agency or department to suspend our performance pending the outcome of the protest and may also result in a requirement to resubmit offers for the contract or in the termination, reduction, or modification of the awarded contract;
• suspend or debar us from doing business with the applicable government; and
• control or prohibit the export of our services.
If a customer were to unexpectedly terminate, cancel, or decline to exercise an option to renew with respect to one or more of our significant contracts, or if a government were to suspend or debar us from doing business with such government, our business, financial condition, and results of operations would be materially harmed.
Failure to comply with laws, regulations, or contractual provisions applicable to our business could cause us to lose government customers or our ability to contract with the U.S. and other governments.
As a government contractor, we must comply with laws, regulations, and contractual provisions relating to the formation, administration, and performance of government contracts and inclusion on government contract vehicles, which affect how we and our partners do business with government agencies. As a result of actual or perceived noncompliance with government contracting laws, regulations, or contractual provisions, we may be subject to audits and internal investigations which may prove costly to our business financially, divert management time, or limit our ability to continue selling our platforms and services to our government customers. These laws and regulations may impose other added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to claims for damages from our channel partners, penalties, and termination of contracts and suspension or debarment from government contracting for a period of time with government agencies. Any such damages, penalties, disruption, or limitation in our ability
49

Table of Contents

to do business with a government could adversely impact, and could have a material adverse effect on, our business, results of operations, financial condition, public perception, and growth prospects.
Evolving government procurement policies and increased emphasis on cost over performance could adversely affect our business.
Federal, state, local, and foreign governments and government agencies could implement procurement policies that negatively impact our profitability. Changes in procurement policy favoring more non-commercial purchases, different pricing, or evaluation criteria or government contract negotiation offers based upon the customer’s view of what our pricing should be may affect the predictability of our margins on such contracts or make it more difficult to compete on certain types of programs.
Governments and government agencies are continually evaluating their contract pricing and financing practices, and we have no assurance regarding the full scope and recurrence of any study and what changes will be proposed, if any, and their impact on our financial position, cash flows, or results of operations.
Increased competition and bid protests in a budget-constrained environment may make it more difficult to maintain our financial performance and customer relationships.
A substantial portion of our business is awarded through competitive bidding. Even if we are successful in obtaining an award, we may encounter bid protests from unsuccessful bidders on any specific award. Bid protests could result, among other things, in significant expenses to us, contract modifications, or even loss of the contract award. Even where a bid protest does not result in the loss of a contract award, the resolution can extend the time until contract activity can begin and, as a result, delay the recognition of revenue. We also may not be successful in our efforts to protest or challenge any bids for contracts that were not awarded to us, and we would be required to incur significant time and expense in such efforts.
In addition, governments and agencies increasingly have relied on competitive contract award types, including IDIQ and other multi-award contracts, which have the potential to create pricing pressure and to increase our costs by requiring us to submit multiple bids and proposals. Multi-award contracts require us to make sustained efforts to obtain orders under the contract. The competitive bidding process entails substantial costs and managerial time to prepare bids and proposals for contracts that may not be awarded to us or may be split among competitors.
We are experiencing increased competition while, at the same time, many of our customers are facing budget pressures, cutting costs, identifying more affordable solutions, performing certain work internally rather than hiring contractors, and reducing product development cycles. To remain competitive, we must maintain consistently strong customer relationships, seek to understand customer priorities, and provide superior performance, advanced technology solutions, and service at an affordable cost with the agility that our customers require to satisfy their objectives in an increasingly price competitive environment. Failure to do so could have an adverse impact on our business, financial condition, and results of operations.
The U.S. government may procure non-commercial developmental services rather than commercial products, which could materially impact our future U.S. government business and revenue.
U.S. government agencies, including our customers, often award large developmental item and service contracts to build custom software rather than firm fixed-price contracts for commercial products. We sell commercial items and services and do not contract for non-commercial developmental services. The U.S. government is required to procure commercial items and services to the maximum extent practicable in accordance with FASA, 10 U.S.C. § 2377; 41 U.S.C. § 3307, and the U.S. government may instead decide to procure non-commercial developmental items and services if commercial items and services are not practicable. In order to challenge a government decision to procure developmental items and services instead of commercial items and services, we would be required to file a bid protest at the agency level and/or with the Government Accountability Office. This can result in contentious communications with government agency legal and contracting offices, and may escalate to litigation in federal court. The results of any future challenges or potential litigation cannot be predicted with certainty, however, and any dispute or litigation with the U.S. government may not be resolved in our favor; moreover, whether or not it is resolved in our favor, such disputes or litigation could result in significant expense and divert the efforts of our technical and management personnel. These proceedings could adversely affect our reputation and relationship with government customers and could also result in negative publicity, which could harm customer and public perception of our business. The enforcement of FASA has resulted in a significant increase in our business with the U.S. federal government. Any change in or repeal of FASA, or a contrary interpretation of FASA by a court of competent jurisdiction, would adversely affect our competitive position for U.S. federal government contracts.
50

Table of Contents

A decline in the U.S. and other government budgets, changes in spending or budgetary priorities, or delays in contract awards have affected and may continue to significantly and adversely affect our future revenue and limit our growth prospects.
Because we generate a substantial portion of our revenue from contracts with governments and government agencies, and in particular from contracts with the U.S. government and government agencies, our results of operations could be adversely affected by government spending caps or changes in government budgetary priorities, as well as by delays in the government budget process, program starts, or the award of contracts or orders under existing contract vehicles, including as a result of a new U.S. administration. U.S. government spending levels for defense-related and other programs are uncertain, and may not be sustained at the levels associated with government fiscal year 2025. In addition, the current administration has launched efforts to evaluate and reduce overall government spending, which could impact our business, results of operations, financial condition, and growth prospects. Future spending and program authorizations may not increase or may decrease or shift to programs in areas in which we do not provide services or are less likely to be awarded contracts. Such changes in spending authorizations and budgetary priorities may occur as a result of shifts in spending priorities from defense-related and other programs as a result of competing demands for federal funds and the number and intensity of military conflicts or other factors.
The U.S. government also conducts periodic reviews of U.S. defense strategies and priorities which may shift Department of Defense budgetary priorities, reduce overall spending, or delay contract or task order awards for defense-related programs from which we would otherwise expect to derive a significant portion of our future revenue. A significant decline in overall U.S. government spending, a significant shift in spending priorities, the substantial reduction or elimination of particular defense-related programs, or significant budget-related delays in contract or task order awards for large programs have affected and could continue to adversely affect our future revenue and limit our growth prospects.
Risks Related to Ownership of Our Class A Common Stock
The public trading price of our Class A common stock may be volatile and may decline regardless of our operating performance.
Prior to the listing of our Class A common stock, there was no public market for shares of our Class A common stock. The market prices of the securities of other recently public companies have historically been highly volatile. The public trading price of our Class A common stock has been, and may in the future be, subject to fluctuations in response to various factors, including those listed in this Annual Report on Form 10-K, some of which are beyond our control. These fluctuations could cause you to lose all or part of your investment in our Class A common stock since you might be unable to sell your shares at or above the price you paid. Factors that could cause fluctuations in the public trading price of our Class A common stock include the following:
• the number of shares of our Class A common stock publicly owned and available for trading;
• price and volume fluctuations in the overall stock market from time to time;
• volatility in the trading prices and trading volumes of technology stocks;
• the inclusion, exclusion, or deletion of our Class A common stock from any major trading indices, such as the Standard & Poor’s (“S&P”) 500 Index or the Nasdaq-100 Index;
• changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;
• sales or expected sales of shares of our Class A common stock by us or our stockholders;
• short-selling of our Class A common stock or related derivative securities;
• failure of securities analysts to maintain coverage of us, changes in financial estimates by securities analysts who follow our company or our failure to meet these estimates or the expectations of investors;
• any financial projections we may provide to the public, any changes in those projections or our failure to meet those projections;
• announcements by us or our competitors of new platforms, products, services, or capabilities;
• the public’s reaction to our press releases, other public announcements, and filings with the SEC;
• rumors and market speculation involving us or other companies in our industry;
• actual or anticipated changes in our results of operations or fluctuations in our results of operations;
• actual or anticipated developments in our business, our competitors’ businesses, or the competitive landscape generally;
51

Table of Contents

• litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;
• actual or perceived privacy or security breaches or other incidents;
• developments or disputes concerning our intellectual property or other proprietary rights;
• announced or completed acquisitions of businesses, services or technologies by us or our competitors;
• changes in our management, including any departures of one of our Founders;
• new laws, regulations, or government policies, as well as public expectations about or new interpretations or enforcement of the aforementioned, as applicable to our business;
• changes in accounting standards, policies, guidelines, interpretations, or principles;
• any significant change in our management;
• other events or factors, including those resulting from war, including the ongoing Russia-Ukraine and Middle East conflicts, incidents of terrorism, such as Hamas’ attack against Israel, pandemics, or responses to these events; and
• general macroeconomic conditions, such as fluctuating interest rates, the potential or actual imposition of tariffs or other impacts on trade relations, and slow or negative growth of our markets.
In addition, stock markets, and the market for technology companies in particular, have experienced price and volume fluctuations that have affected and continue to affect the trading prices of equity securities of many companies. Stock prices of many companies, including technology companies, have fluctuated in a manner often unrelated to the operating performance of those companies. In the past, following periods of volatility in the overall market and the trading price of a particular company’s securities, securities class action litigation has often been instituted against these companies. Such litigation, including the purported class action lawsuits and derivative lawsuits filed against us and certain of our officers and directors, could result in substantial costs and a diversion of our management’s attention and resources and harm our business, financial condition, and results of operations. Further, in the future, we may be the target of additional litigation of this type.
Our amended and restated bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, and also provide that the federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act of 1933, as amended, each of which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, stockholders, or employees.
Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (a) any derivative action or proceeding brought on our behalf, (b) any action asserting a claim of breach of a fiduciary duty owed by any of our current or former directors, stockholders, officers, or other employees to us or our stockholders, (c) any action or proceeding asserting a claim arising pursuant to, or seeking to enforce any right, obligation or remedy under, any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws, (d) any action or proceeding as to which the Delaware General Corporation Law confers jurisdiction on the Court of Chancery of the State of Delaware, or (e) any action or proceeding asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, another state court in Delaware or, if no state court in Delaware has jurisdiction, the federal district court for the District of Delaware) and any appellate court therefrom, in all cases subject to the court having jurisdiction over the claims at issue and the indispensable parties; provided that the exclusive forum provision will not apply to suits brought to enforce any liability or duty created by the Securities Exchange Act of 1934, as amended (the “Exchange Act”).
Section 22 of the Securities Act of 1933, as amended (the “Securities Act”), creates concurrent jurisdiction for federal and state courts over all such Securities Act actions. Accordingly, both state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated bylaws also provide that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.
Any person or entity purchasing or otherwise acquiring or holding or owning (or continuing to hold or own) any interest in any of our securities shall be deemed to have notice of and consented to the foregoing bylaw provisions. Although we believe these exclusive forum provisions benefit us by providing increased consistency in the application of Delaware law and federal securities laws in the types of lawsuits to which each applies, the exclusive forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or any of our directors, officers, stockholders, or other employees, which may discourage lawsuits with respect to such claims against us and our current and former directors, officers,
52

Table of Contents

stockholders, or other employees. Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder as a result of our exclusive forum provisions. Further, in the event a court finds either exclusive forum provision contained in our amended and restated bylaws to be unenforceable or inapplicable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our results of operations.
Sales of substantial amounts of our Class A common stock in the public markets or the perception that sales might occur, including sales by our Founders and their affiliates, could cause the trading price of our Class A common stock to decline.
Sales of substantial amounts of our Class A common stock in the public markets or the perception that sales might occur, could cause the trading price of our Class A common stock to decline.
In addition to the supply and demand and volatility risk factors discussed above, sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and principal stockholders, or the perception that these sales might occur in large quantities, could cause the trading price of our Class A common stock to decline. As of December 31, 2025, approximately 2.2 million options will expire through December 2026 if not exercised prior to their respective expiration dates, and we expect many holders will elect to exercise such options prior to expiration. Upon exercise, the holders will receive shares of our Class A or Class B common stock, which may subsequently be sold.
As of December 31, 2025, there were 2,290,986,536 shares of our Class A common stock outstanding, 99,200,290 shares of our Class B common stock outstanding and 1,005,000 shares of our Class F common stock outstanding. Substantially all of these shares may be immediately sold, although sales by our affiliates remain subject to compliance with the volume limitations of Rule 144.
Further, as of December 31, 2025, there were outstanding options to purchase an aggregate of 22,036,851 shares of our Class A common stock and 130,165,461 shares of our Class B common stock, 18,195,294 shares of our Class A common stock and 23,550,00 shares of Class B common stock subject to RSUs, 11,290,917 shares of our Class A common stock subject to stock appreciation rights (“SARs”), and 117,788 shares of our Class A common stock subject to performance-based RSUs (“P-RSUs”). All shares of our common stock reserved for future issuance under our equity compensation plans have been registered for sale under the Securities Act. Subject to compliance with Rule 144 or the availability of an alternative exemption, the shares issued upon exercise of stock options or SARs, or upon settlement of RSUs or P-RSUs will be available for immediate resale in the United States in the open market.
We also may issue our capital stock or securities convertible into our capital stock from time to time in connection with a financing, acquisition, investments or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the trading price of our Class A common stock to decline.
Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may discourage certain types of transactions that may involve an actual or threatened acquisition of the Company, which will likely depress the trading price of our Class A common stock.
Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that may make the acquisition of our company more difficult, including the following:
• our multi-class common stock structure, which provides our Founders and their affiliates with the ability to effectively control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the shares of our outstanding common stock;
• prior to the Final Class F Conversion Date (as defined in our amended and restated certificate of incorporation), the holders of our common stock will only be able to take action by written consent if the action also receives the affirmative consent of a majority of the outstanding shares of our Class F common stock, and after such point the holders of our common stock will only be able to take action at a meeting of the stockholders and will not be able to take action by written consent for any matter;
• from and after the Final Class F Conversion Date, our Board of Directors will be classified into three classes of directors with staggered three-year terms;
• our amended and restated certificate of incorporation does not provide for cumulative voting;
• certain transactions, other than restructuring transactions or transactions that otherwise do not involve a Change of Control (as defined in our amended and restated certificate of incorporation), which transactions require, pursuant to Section 251(c) or Section 271(a) of the Delaware General Corporation Law, the approval of the holders of a majority of the voting power of all of the outstanding shares of our capital stock entitled to vote thereon, will require approval by the holders of at least 55.0% of the voting power of all of the outstanding shares of our capital stock entitled to vote
53

Table of Contents

thereon if the record date for determining the stockholders entitled to vote to approve such transaction occurs prior to the Final Class F Conversion Date;
• certain transactions prior to the Final Class F Conversion Date, that would require disclosure pursuant to Item 404(a) of Regulation S-K, between any of our Founders (or their controlled affiliates), on the one hand, and us, on the other, in which consideration exchanges hands between our Founders (or their controlled affiliates) and us, and such consideration has a fair market value in excess of $50.0 million as determined in accordance with our amended and restated bylaws will require approval by either (i) the holders of at least 66 2/3% of the voting power of all of the outstanding shares of our capital stock, voting together as a single class, or (ii) an Independent Committee (as defined in our amended and restated bylaws);
• the acquisition of our equity securities by our Founders (including their controlled affiliates), prior to the Final Class F Conversion Date, in a “Rule 13e-3 transaction” (as defined in Rule 13e-3 under the Exchange Act) will be conditioned on approval by (i) an Independent Committee and (ii) the holders of a majority of the voting power of our capital stock that is held by our stockholders other than the Founders (including their controlled affiliates) and any holder of the Class F Common Stock;
• vacancies on our Board of Directors will be able to be filled only by our Board of Directors and not by stockholders;
• our directors may only be removed as provided in the Delaware General Corporation Law;
• a special meeting of our stockholders may only be called by the chairperson of our Board of Directors, our Chief Executive Officer, our President, or our Board of Directors pursuant to a resolution adopted by a majority of the total number of authorized directorships, whether or not there exist any vacancies or other unfilled seats in previously authorized directorships;
• our amended and restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established and shares of which may be issued without further action by our stockholders, except that any designation and issuance of preferred stock must receive the affirmative vote of a majority of the outstanding shares of our Class F common stock; and
• advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders.
These provisions, alone or together, could discourage, delay or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could limit the opportunity for our stockholders to receive a premium for their shares of our Class A common stock, and could also affect the price that some investors are willing to pay for our Class A common stock.
If securities or industry analysts do not publish research or publish inaccurate or unfavorable research about us, our business or our market, or if they change their recommendation regarding our Class A common stock adversely, the trading price and trading volume of our Class A common stock could decline.
The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us, our business, our market or our competitors. If one or more of the analysts who cover us downgrade our ordinary shares or publish inaccurate or unfavorable research about us, the trading price of our Class A common stock would likely decline. If these analysts publish target prices for our Class A common stock that are below the then-current public price of our Class A common stock, it could cause the trading price of our Class A common stock to decline significantly. Further, if one or more of these analysts cease coverage of Palantir or fail to publish reports on us regularly, demand for our Class A common stock could decrease, which might cause our Class A common stock trading price and trading volume to decline.
Although we currently are not considered to be a “controlled company” under The Nasdaq Stock Market LLC (“Nasdaq”) corporate governance rules, we may in the future become a controlled company due to the concentration of voting power among our Founders and their affiliates.
Although we currently are not considered to be a “controlled company” under the Nasdaq corporate governance rules, we may in the future become a controlled company due to the concentration of voting power among our Founders and their affiliates resulting from the issuance of our Class F common stock. See “Risks Related to the Multiple Class Structure of our Common Stock, the Founder Voting Trust Agreement, and the Founder Voting Agreement” below. A “controlled company” pursuant to the Nasdaq corporate governance rules is a company of which more than 50% of the voting power is held by an individual, group, or another company. In the event that our Founders and their affiliates or other stockholders acquire more than 50% of the voting power of the Company, we may in the future be able to rely on the “controlled company” exemptions under the Nasdaq corporate governance rules due to this concentration of voting power and the ability of our Founders and their affiliates
54

Table of Contents

to act as a group. If we were a controlled company, we would be eligible, and could elect, not to comply with certain of the Nasdaq corporate governance standards. Such standards include the requirement that a majority of directors on our Board of Directors are independent directors, subject to certain phase-in periods, and the requirement that our compensation, nominating and governance committee consist entirely of independent directors. In such a case, if the interests of our stockholders differ from the group of stockholders holding a majority of the voting power, our stockholders would not have the same protection afforded to stockholders of companies that are subject to all of the Nasdaq corporate governance standards, and the ability of our independent directors to influence our business policies and corporate matters may be reduced.
We do not expect to pay dividends in the foreseeable future.
We have never declared nor paid cash dividends on our capital stock. We currently intend to retain any future earnings to finance the operation and expansion of our business and we do not anticipate declaring or paying any dividends to holders of our capital stock in the foreseeable future. In addition, our credit facility contains restrictions on our ability to pay dividends. Any determination to pay dividends in the future will be at the discretion of our Board of Directors. Consequently, stockholders must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investment.
Risks Related to the Multiple Class Structure of our Common Stock, the Founder Voting Trust Agreement, and the Founder Voting Agreement
The multiple class structure of our common stock has the effect of concentrating voting power with certain stockholders, in particular, our Founders and their affiliates, which will effectively eliminate your ability to influence the outcome of important transactions, including a change in control.
Our Class A common stock has one (1) vote per share, and our Class B common stock has ten (10) votes per share with respect to each matter submitted to our stockholders. Assuming that the Founders and certain of their affiliates collectively meet the Ownership Threshold (as defined below) on the applicable record date for a vote of the stockholders (except as provided in our amended and restated certificate of incorporation), shares of Class F common stock will generally have a number of votes per share in respect of a matter submitted to our stockholders that would cause the total votes of all shares of Class F common stock, together with the votes attributable to shares of Class A common stock and Class B common stock held by our Founders and their affiliates that are subject to the voting agreement among our Founders and Wilmington Trust, National Association (the “Founder Voting Agreement”) and the votes attributable to shares of Class A common stock and Class B common stock held by our Founders and their affiliates that are designated as Designated Founders’ Excluded Shares (as defined in our amended and restated certificate of incorporation), in each case entitled to vote on such matter, to equal, with respect to such matter, 49.999999% of the voting power of (i) all of the outstanding shares of capital stock of the Company entitled to vote on such matter (including in the case of the election of directors); or (ii) the shares present in person or represented by proxy and entitled to vote on such matter only if a majority of the shares present in person or represented by proxy and entitled to vote on such matter is the applicable voting standard (as applicable, “49.999999% of the Voting Power”). Accordingly, subject to limited exceptions described in our amended and restated certificate of incorporation and amended and restated bylaws, such Founders will effectively control all matters submitted to the stockholders for the foreseeable future, including the election of directors, amendments of our organizational documents, compensation matters, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. Our Founders and their affiliates also hold the substantial majority of our outstanding Class B common stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, even without regard to the voting power of the Class F common stock, our Founders and their affiliates collectively control a significant portion of the voting power of our capital stock based on their current ownership and may significantly increase their ownership of Class B common stock in the future due to the exercise of currently outstanding stock options or the settlement of RSUs.
The Founders may have interests that differ from yours and may vote in a way with which you disagree, and which may be adverse to your interests. This concentration of voting power is likely to have the effect of limiting the likelihood of an unsolicited merger proposal, unsolicited tender offer, or proxy contest for the removal of directors. As a result, our governance structure, including the provisions of our amended and restated certificate of incorporation, may have the effect of depriving our stockholders of an opportunity to sell their shares at a premium over prevailing market prices and make it more difficult to replace our directors and management.
The Founder Voting Trust Agreement and the Founder Voting Agreement also have the effect of concentrating voting power with our Founders and their affiliates, which will effectively eliminate your ability to influence the outcome of important transactions, including a change in control.
All shares of our Class F common stock are held in a voting trust (the “Founder Voting Trust”), established by our Founders pursuant to a voting trust agreement (the “Founder Voting Trust Agreement”) with Wilmington Trust, National Association as trustee (the “Trustee”). Our Founders are also currently party to the Founder Voting Agreement. Our Founders have agreed
55

Table of Contents

through the Founder Voting Trust Agreement and Founder Voting Agreement that all of the shares of Class F common stock and all of the shares of our capital stock over which they and their affiliates have granted a proxy under the Founder Voting Agreement will be voted in the manner instructed by a majority of our Founders who are then party to the Founder Voting Agreement. Accordingly, together with the multiple class structure of our common stock and subject to limited exceptions described in our amended and restated certificate of incorporation and amended and restated bylaws, such Founders will effectively control all matters submitted to the stockholders for the foreseeable future, including the election of directors, amendments of our organizational documents, compensation matters, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.
Upon the withdrawal or removal of any of our Founders from the Founder Voting Agreement, including upon their death or disability, the remaining Founders or Founder, as the case may be, will determine the manner in which the shares of our Class F common stock as well as the shares subject to the Founder Voting Agreement are voted. In such cases, the voting power of our outstanding capital stock will be further concentrated among the remaining Founders, which may be as few as one. Further, if there are only two Founders who are party to the Founder Voting Agreement, one Founder will be able to effectively defeat any stockholder action, except for the election of directors or other matters that are decided by a plurality of votes, if his instruction to vote the shares of Class F common stock differs from the other Founder. The Founders who are then party to the Founder Voting Agreement will retain the right to direct the voting of the Class F common stock without regard to their employment status with us.
All shares of our Class F common stock are held in the Founder Voting Trust and voted pursuant to the Founder Voting Trust Agreement. Accordingly, our Founders who are then party to the Founder Voting Agreement will control any vote that requires the affirmative vote of the holders of a majority of our Class F common stock, including action of our stockholders by written consent, the designation or issuance by us of shares of preferred stock, and certain amendments to our amended and restated certificate of incorporation relating to our preferred stock.
Although we are a third-party beneficiary of the Founder Voting Agreement and the Founder Voting Trust Agreement, we do not have a general consent right with respect to amendments thereto, and either agreement may be amended or modified in the future in a manner that is adverse to our stockholders, which may include increasing the ability of one or more of our Founders to exercise control over matters submitted to a vote of our stockholders.
In certain circumstances in the future, the Founders and their affiliates could have voting power that exceeds 49.999999% of the Voting Power.
If the voting power of shares of Class A common stock and Class B common stock held by the Founders or their affiliates that are subject to the Founder Voting Agreement or are Designated Founders’ Excluded Shares collectively equals greater than 49.999999% of the Voting Power with respect to a matter submitted to our stockholders, then the Class F common stock will have zero votes with respect to such matter. In this case, although the shares of our Class F common stock would generally be entitled to zero votes per share on that matter, all of the shares that are then subject to the Founder Voting Agreement would continue to be voted in accordance with the decision of a majority in number of the Founders who are then party to the Founder Voting Agreement.
For example, if the Founders and their affiliates hold shares other than the Class F common stock, such as Class B common stock, that, in the aggregate, have voting power that exceeds 49.999999% of the Voting Power with respect to a matter submitted to our stockholders, then the total voting power of the Founders and their affiliates would exceed 49.999999% of the Voting Power with respect to such matter. Our Founders and their affiliates may acquire additional shares of our Class A common stock or Class B common stock. Shares of our Class B common stock may be transferred (without converting into shares of Class A common stock) to, among others, our Founders or their affiliates, and such transfers to our Founders or their affiliates could increase the total voting power of the Founders and their affiliates above 49.999999% of the Voting Power with respect to such matter. Excluding the voting power of the Class F common stock, our Founders and their affiliates owned shares entitled to approximately 22% of the voting power of our outstanding capital stock in the aggregate as of February 10, 2026.
In addition, if one or two Founders withdraw from the Founder Voting Agreement, the total voting power of the Founders and their affiliates in the aggregate could exceed 49.999999% of the Voting Power. For instance, if one Founder has withdrawn from the Founder Voting Agreement and such withdrawing Founder votes his shares in the same manner as the shares of Class F common stock are voted pursuant to the Founder Voting Trust Agreement, then our Founders and their affiliates, in the aggregate, could exercise 49.999999% of the Voting Power of our capital stock plus the voting power of shares held by the withdrawing Founder (which would no longer represent a subset of the 49.999999% of the Voting Power of our capital stock voted by those Founders that remain party to the Founder Voting Agreement).
56

Table of Contents

As a result of future issuances of our common stock or the disposal of shares of our common stock by our Founders and their affiliates, our Founders and their affiliates could have voting power that is substantially greater than, and outsized in comparison to, their economic interests and the percentage of our common stock that they hold.
In certain circumstances, our Founders and their affiliates could have voting power that is substantially greater than, and outsized in comparison to, their economic interests and the percentage of our common stock that they hold. This separation between voting power and economic interests could cause conflicts of interest between our Founders and our other stockholders, which may result in our Founders undertaking, or causing us to undertake, actions that would be desirable for the Founders or their affiliates but would not be desirable for our other stockholders.
In the event that our Founders and their affiliates have less than 49.999999% of the Voting Power prior to giving effect to the voting power of the Class F common stock, the issuance of additional shares by us in the future to stockholders other than our Founders who are then party to the Founder Voting Agreement or their affiliates will dilute the economic interests of our Founders but will generally not result in further dilution of the voting power of such Founders and their affiliates. Because of the voting rights of the Class F common stock, such issuances will instead correspondingly increase the voting power of the Class F common stock. Any future issuances of additional shares of Class A common stock and Class B common stock will not be subject to approval by our stockholders except as required by the Nasdaq listing standards.
In addition, our Founders and their affiliates are free to transfer or otherwise dispose of their shares of Class A common stock and Class B common stock without diminishing their voting power so long as our Founders and certain of their affiliates continue to collectively hold 100,000,000 Corporation Equity Securities (as defined in our amended and restated certificate of incorporation) on the applicable record date (subject to equitable adjustments as provided in our amended and restated certificate of incorporation) (the “Ownership Threshold”). Shares of our Class F common stock will not convert into shares of our Class B common stock, and our multi-class structure will not terminate, solely because our Founders and certain of their affiliates do not satisfy this Ownership Threshold on the applicable record date. Upon the withdrawal, or removal, of one or more of our Founders from the Founder Voting Agreement (including as a result of death or disability), the Ownership Threshold that must be met on the applicable record date will be reduced on a pro rata basis based on the ownership of Corporation Equity Securities (which excludes Designated Founders’ Excluded Shares) of the Founders and certain of their affiliates as of August 10, 2020, which could substantially decrease the Ownership Threshold without reducing the effective voting power of the Class F common stock. Accordingly, our Founders who are then party to the Founder Voting Agreement will be able to achieve substantial liquidity in their holdings, and substantially diminish their economic interest in us, without diminishing their voting power.
Furthermore, meeting the Ownership Threshold on the applicable record date will not ensure that the Founders and their affiliates do not or will not have differing economic interests from the interests of holders of the Class A common stock. For example, the Founder Voting Agreement does not prohibit a Founder from hedging his economic exposure to our common stock; however, we have implemented a policy that will prohibit hedging by our directors, officers and employees, which currently includes the Founders. In addition, the trustee will vote shares of Class F common stock in accordance with the decision of a majority in number of the Founders who are then party to the Founder Voting Agreement, regardless of such Founders’ relative ownership of any class of our common stock.
In August 2020, we granted two of our Founders, Mr. Karp, our Chief Executive Officer and a member of our Board of Directors, and Mr. Cohen, our President and a member of our Board of Directors, options and RSUs for an aggregate of 207.0 million shares of our Class B common stock (collectively, the “Founder Grants”), the substantial majority of which remain subject to vesting, exercise, and/or settlement upon the future satisfaction of service conditions and certain other conditions. These awards are expected to contribute to the Founders’ ability to meet the Ownership Threshold on the applicable record date at least until the sale of such shares by Mr. Karp and Mr. Cohen.
Shares of our common stock designated by one or more of our Founders pursuant to our amended and restated certificate of incorporation may be voted or not voted by such Founders or their affiliates in their discretion and will reduce the voting power exercised in accordance with the decision of a majority in number of the Founders who are then party to the Founder Voting Agreement.
Mr. Thiel has identified a portion of the shares of Class B common stock and Class A common stock beneficially owned by him and his affiliates as Designated Founders’ Excluded Shares, which will not be subject to the Founder Voting Agreement. Such Designated Founders’ Excluded Shares would reduce the total voting power that will be exercised in accordance with the decision of a majority in number of the Founders who are then party to the Founder Voting Agreement. Mr. Thiel or his affiliates would vote or not vote such Designated Founders’ Excluded Shares in their discretion, which may include in a manner different than the voting power exercised in accordance with the decision of a majority in number of the Founders who are then party to the Founder Voting Agreement. Depending on certain circumstances, including the extent to which other holders of Class B common stock convert or sell such shares of Class B common stock, such Designated Founders’ Excluded Shares may
57

Table of Contents

have significant voting power and increase Mr. Thiel or his affiliates’ relative voting power compared to the other Founders. The shares identified by Mr. Thiel as Designated Founders’ Excluded Shares represented less than 5% of the voting power of our outstanding capital stock as of February 10, 2026. In the future, Mr. Thiel or our other Founders could designate additional shares as Designated Founders’ Excluded Shares.
The Ownership Threshold that must be met on any applicable record date is a small minority of our outstanding Corporation Equity Securities, and future issuances of Corporation Equity Securities may decrease this percentage.
The Ownership Threshold that must be met on any applicable record date is currently 100,000,000 Corporation Equity Securities, which is a small minority of our outstanding Corporation Equity Securities. While the number of outstanding Corporation Equity Securities may exceed the number of shares of our outstanding capital stock, as a comparison, there were 2,391,191,826 shares of our common stock outstanding as of December 31, 2025. Except for certain equitable adjustments as provided in our amended and restated certificate of incorporation, future issuances of Corporation Equity Securities by us will not increase the Ownership Threshold that must be met on any applicable record date and, accordingly, will decrease the percentage of outstanding Corporation Equity Securities represented by the Ownership Threshold.
Upon the withdrawal, or removal, of one or more of our Founders from the Founder Voting Agreement (including as a result of death or disability), the Ownership Threshold that must be met on the applicable record date will be reduced on a pro rata basis based on the ownership of Corporation Equity Securities of the Founders and certain of their affiliates as of August 10, 2020. We expect that the Ownership Threshold will be reduced by approximately 57 million Corporation Equity Securities upon the withdrawal or removal from the Founder Voting Agreement of Alexander Karp, approximately 12 million Corporation Equity Securities upon the withdrawal or removal of Stephen Cohen, and approximately 31 million Corporation Equity Securities upon the withdrawal or removal of Peter Thiel if such withdrawals or removals were to happen.
In addition, in the future we could create a new class of equity securities with different economic or voting rights than existing classes. If we were to create a new class of equity security, because of the broad definition of “Corporation Equity Securities,” such security could qualify as Corporation Equity Securities and therefore count towards the Ownership Threshold if held by our Founders who are then party to the Founder Voting Agreement or certain of their affiliates. If such security has lesser or no economic rights, it could have the effect of further increasing the divergence between the economic interests of our Founders who are then party to the Founder Voting Agreement and their affiliates, on the one hand, and the voting power of such Founders and their affiliates, on the other. Further, Corporation Equity Securities includes, among other things, any warrants, calls, options or other right, whether vested or unvested, to acquire from the Company certain voting or equity securities from the Company. Accordingly, the Board of Directors could issue additional equity securities, or additional options, RSUs, warrants or other rights to acquire equity securities (whether vested or unvested), to our Founders or certain of their affiliates, which would increase the number of Corporation Equity Securities they hold and enable them to meet the Ownership Threshold notwithstanding sales of Corporation Equity Securities that they currently hold. As a result, any Founders who are then party to the Founder Voting Agreement or certain of their affiliates could hold a nominal equity interest with little to no voting rights but meet the Ownership Threshold and therefore have voting power that provides effective control of our company.
The multiple class structure of our common stock features certain provisions that are novel or otherwise not common among other corporations with multiple class structures.
A number of provisions relating to the multiple class structure of our common stock are novel or otherwise not common among other corporations with multiple class structures. For instance, our Founders who are then party to the Founder Voting Agreement are free to transfer or otherwise dispose of their shares of Class A common stock and Class B common stock without diminishing their voting control so long as our Founders who are then party to the Founder Voting Agreement and certain of their affiliates meet the Ownership Threshold on the applicable record date. Shares of our Class B common stock, which have ten (10) votes per share, may remain outstanding in perpetuity. Additionally, shares of our Class B common stock may be transferred (without converting into shares of Class A common stock) to, among others, our Founders or their affiliates, which could result in our Founders and their affiliates or other stockholders obtaining additional voting control.
Additionally, certain provisions of our amended and restated certificate of incorporation related to the calculation of the voting power of the Class F common stock may have an adverse effect on our stockholders other than our Founders. Under our amended and restated certificate of incorporation, our Founders have the right to challenge the calculation of the voting power of the Class F common stock. Such a challenge may cause delays in the certification of any vote of our stockholders or in the effectiveness of any action of our stockholders.
58

Table of Contents

The multi-class structure of our common stock, the Founder Voting Trust Agreement and the Founder Voting Agreement by which our Founders exercise effective control over all matters submitted to a vote of our stockholders will exist for the foreseeable future.
Shares of our Class F common stock will convert automatically into shares of our Class B common stock only if the Founder Voting Trust Agreement or the Founder Voting Agreement is terminated. Each of these agreements could remain in place until the death of our last living Founder. As of December 31, 2025, our Founders were 58, 58, and 43 years old. Further, upon a discretionary or compulsory withdrawal of a Founder as a beneficiary of the Founder Voting Trust Agreement, the Trustee will instruct our transfer agent and us to convert the withdrawing Founder’s pro rata portion of the shares of Class F common stock held in the Founder Voting Trust at the time of the withdrawal into shares of Class B common stock in accordance with our amended and restated certificate of incorporation.
Because of the ten-to-one voting ratio between our Class B and Class A common stock, even if the Class F common stock converts to Class B common stock, our Founders will collectively control a significant portion of the voting power of our capital stock based on their current ownership. Future transfers by holders of shares of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes and transfers between related entities. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those individual holders of Class B common stock who retain their shares in the long term. If our Founders and their affiliates, individually or collectively, retain a significant portion of their holdings of Class B common stock for an extended period of time, they could, in the future, individually or collectively, continue to control a significant portion of the combined voting power of our Class A common stock and Class B common stock, even without the use of the Class F common stock, and such voting power could enable holders of Class B common stock to effectively control all matters subject to the stockholder approval. Shares of our Class B common stock may remain outstanding in perpetuity.
Further, if all, or a large portion, of the Founder Grants should be exercised or vest and settle, our Founders will increase their voting power of our Class B common stock. Although the terms of our amended and restated certificate of incorporation only provide for a separate vote of the holders of our Class B common stock on limited matters, under Delaware law, certain actions may require the approval of the holders of the Class B common stock voting as a separate class. For example, if we amend our amended and restated certificate of incorporation to adversely affect the special rights, powers, or preferences of our Class B common stock in a manner that does not so affect the Class A common stock or Class F common stock, Delaware law could require approval of the holders of our Class B common stock voting separately as single class. For any vote of the Class B common stock voting as a separate class, our Founders will significantly influence such vote if all, or a large portion, of the Founder Grants should vest and settle and the Founders retain such shares.
Our governance structure may negatively affect the decision by certain institutional investors to purchase or hold shares of our Class A common stock.
The holding of low-voting stock, such as our Class A common stock, may not be permitted by the investment policies of certain institutional investors or may be less attractive to the portfolio managers of certain institutional investors. In addition, our multi-class governance structure may make us ineligible for inclusion in certain indices, and as a result, mutual funds, exchange-traded funds, and other investment vehicles that attempt to passively track such indices would not invest in our stock. For example, S&P did not allow most newly public companies utilizing dual- or multi-class capital structures to be included in their indices from 2017 until a change in their eligibility requirements for such companies in 2023. Following this change, we joined the S&P 500 index in September 2024. Any such existing or new policies may depress our valuation compared to those of other similar companies that do not have multi-class governance structures.
Future issuances of our Class A common stock will dilute the voting power of our Class A common stockholders but may not result in further dilution of the voting power of our Founders who are then party to the Founder Voting Agreement.
Future issuances of our Class A common stock will dilute the voting power of our Class A common stockholders, and future issuances to stockholders other than our Founders who are then party to the Founder Voting Agreement will dilute the economic interests of our Founders and their affiliates. However, because of the voting rights of the shares of Class F common stock, in the event that our Founders and their affiliates have less than 49.999999% of the Voting Power prior to giving effect to the voting power of the Class F common stock, future issuances of Class A common stock to stockholders other than our Founders and their affiliates will generally not result in dilution of the voting power of our Founders who are then party to the Founder Voting Agreement or their affiliates, but rather, will correspondingly increase the voting power of the Class F common stock. Any future issuances of additional shares of Class A common stock will not be subject to approval by our stockholders except as required by the Nasdaq listing standards.
59

Table of Contents