BigCommerce Holdings (BIGC) Risk Factors

We rely on onsite and cloud-based computer systems, hardware, software, technology infrastructure and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. We and certain of our third-party providers collect, maintain, transmit, process or store data about our employees, our partners, our customers, and their shoppers, including personal information, payment card information, and proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). Third-party applications available on our platform and mobile applications may also store Confidential Information. We generally cannot and do not proactively monitor the content that our customers upload or the information provided to us through the applications integrated with our ecommerce platform; therefore, we do not control the substance of the content on our servers, which may include Confidential Information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers are expected to continue to be targeted, as threat actors are becoming increasingly sophisticated in using techniques and tools-including artificial intelligence-that circumvent security controls, evade detection and remove forensic evidence. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors such as state-sponsored organizations, attackers, and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (such as viruses, worms, and ransomware), employee theft or misuse, action or inaction by our employees or contractors, human or technological error, denial-of-service attacks, malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers' or service providers') IT Systems, products, or services. As a result, despite our efforts to create security barriers to such threats, we cannot entirely mitigate these risks. We and our third-party partners and service providers also may face difficulties or delays in identifying, remediating or otherwise responding to, cyberattacks and other security breaches and incidents. As we rely on third-party and public-cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks, and the mishandling of Confidential Information. We and certain of our third-party providers have been subject to cyber-attacks and attempts in the past and will continue to be subject to such attacks in the future. Though no such incident to date has had a material impact on our business, we cannot guarantee that we will not experience material or adverse effects from any future incident. We have incurred substantial costs in efforts to protect against and address potential impacts of security breaches and incidents, and anticipate doing so in the future. Nevertheless, while we employ a number of security measures designed to prevent, detect, and mitigate potential harm to our platform, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information could have significant costs, including regulatory enforcement actions, litigation (such as class actions), litigation indemnity obligations, civil or criminal penalties, operational changes, remediation costs, network downtime, increases in insurance premiums, and reputational damage. Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition. Many companies that provide these services have reported a significant increase in cyberattack activity in recent years. Remote and hybrid working arrangements at our company (and at many third-party providers) may also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Even if a data breach did not arise out of our action or inaction, or if it were to affect one or more of our competitors or our customers' competitors, rather than us, the resulting concern could negatively affect our customers and our business. Concerns regarding data privacy and security may cause some of our customers to stop using our platform and fail to renew their subscriptions. In addition, failures to meet our customers' or shoppers' expectations with respect to security and confidentiality of their data and information could damage our reputation and affect our ability to retain customers, attract new customers, and grow our business. Our failure to comply with legal, contractual, or standards-based requirements around the security of personal information could lead to significant fines and penalties, as well as claims by our customers, their shoppers, or other stakeholders. Moreover, we have acquired and may continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. When we acquire companies that do not have security measures that are as robust as the measures we have in place, such as Feedonomics, B2B Ninja, or Bundle, the risk of fines and penalties may increase. Any such proceedings or violations could force us to spend money in defense or settlement of these proceedings, result in the imposition of monetary liability or injunctive relief, divert management's time and attention, increase our costs of doing business, and materially adversely affect our reputation and the demand for our platform. Additionally, as we accept debit and credit cards for payment, we are subject to the Payment Card Industry Data Security Standard ("PCI-DSS"), issued by the Payment Card Industry Security Standards Council. Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention. Any material interruptions or failures in our payment related systems could have a material adverse effect on our business, results of operations and financial condition. If there are amendments to PCI-DSS, the cost of compliance could increase and we may suffer loss of critical data and interruptions or delays in our operations as a result. If we or our service providers are unable to comply with the security standards established by banks and the payment card industry, we could be liable to our partners, the payment card associations, our customers, their shoppers and consumers with whom we have a direct relationship. In addition, we could be subject to fines and higher transaction fees, face regulatory or other legal action, or lose customers. The limitations of liability in our contracts may not be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. Our insurance coverage, including coverage for errors and omissions and cyber liability, may not continue to be available on acceptable terms or may not be available in sufficient amounts to cover one or more large claims. Our insurers could deny coverage as to any future claim and our cyber liability coverage may not adequately protect us against any losses, liabilities and costs that we may incur. The successful assertion of one or more large claims against us, or changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could have an adverse effect on our business, financial condition, and results of operations. Many jurisdictions have enacted laws requiring companies to notify individuals of security breaches involving certain types of personal information. Our agreements with certain customers and partners require us to notify them of certain security incidents. Some jurisdictions and customers require us to safeguard personal information or confidential information using specific measures. If we fail to observe these requirements, our business, operating results, and financial condition could be adversely affected.

A component of our growth strategy involves the further expansion of our operations and customer base internationally. In the case of the two most recent fiscal years, approximately 24 percent of our revenue has been generated from customers outside the United States. We currently have locations in the United States, Australia, the United Kingdom ("UK"), and Ukraine. We are continuing to adapt and develop strategies to address international markets, but such efforts may not be successful. We have a significant number of employees outside of the United States. We expect that our international activities will continue to grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets. These activities will require significant management attention and financial resources. We may face difficulties, including: geopolitical crises, such as the Russian invasion of Ukraine, costs associated with developing software and providing support in many languages, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles and difficulties in collecting accounts receivable, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights, and a geographically and culturally diverse workforce and customer base. Failure to overcome any of these difficulties could negatively affect our results of operations. Our current international operations and future initiatives involve a variety of risks, including: - geopolitical crises, such as the Russian invasion of Ukraine and other escalating global tensions that could lead to disruption, instability and volatility in global markets and industries;- changes in a country's or region's political or economic conditions;- the need to adapt and localize our platform for specific countries;- greater difficulty collecting accounts receivable and longer payment cycles;- potential changes in trade relations arising from policy initiatives critical of existing and proposed trade agreements;- unexpected changes in laws, regulatory requirements, taxes, or trade laws;- more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, increasingly common around the globe;- differing labor regulations, especially in Europe, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations;- challenges inherent in efficiently managing an increased number of employees over large geographic distances (including in a work-from-home environment), with the need to implement appropriate systems, policies, benefits, and compliance programs;- difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems, and regulatory systems;- increased travel, real estate, infrastructure, and legal compliance costs associated with international operations;- currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we chose to do so in the future;- limitations on our ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries;- laws and business practices favoring local competitors or general preferences for local vendors;- limited or insufficient intellectual property protection or difficulties enforcing our intellectual property;- political instability or terrorist activities;- risks related to global health epidemics, including restrictions on our ability and our customers' ability to travel, disruptions in our customers' ability to distribute products, and temporary closures of our customers' facilities;- exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act of 1977, as amended (the "FCPA"), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the UK Bribery Act of 2010, the UK Proceeds of Crime Act 2002, and similar laws and regulations in other jurisdictions;- adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash; and - our limited experience in operating our business internationally increases the risk that future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully, our business and operating results will suffer.

Our customer subscription and partner and services contracts are primarily denominated in U.S. dollars, and therefore substantially all of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar could increase the real cost of our platform to our customers outside of the United States, which could adversely affect our operating results. In addition, an increasing portion of our operating expenses is incurred and an increasing portion of our assets is held outside the United States. These operating expenses and assets are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully hedge against the risks associated with currency fluctuations, our operating results could be adversely affected.

The market for ecommerce solutions is highly competitive and evolving. We expect competition to increase in the future from established competitors and new market entrants. With the introduction of new technologies and the entry of new companies into the market, we expect competition to persist and intensify in the future, which could harm our ability to increase sales, maintain or increase renewals, and maintain our prices. We face intense competition from other software companies that may offer related ecommerce platform software solutions and services. Our competitors include larger companies that have acquired ecommerce platform solution providers in recent years. We also compete with custom software internally developed within ecommerce businesses. In addition, we face competition from niche companies that offer point products that attempt to address certain of the problems that our platform solves. Merger and acquisition activity in the technology industry could increase the likelihood that we compete with other large technology companies. Many of our existing competitors have, and our potential competitors could have, substantial competitive advantages such as greater name recognition, longer operating histories, larger sales and marketing budgets and resources, greater customer support resources, lower labor and development costs, larger and more mature intellectual property portfolios, and substantially greater financial, technical and other resources. Some of our larger competitors also have substantially broader product lines and market focus and will therefore not be as susceptible to downturns in a particular market. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. New start-up companies that innovate, and large companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our platform. In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with agency partners, technology and application providers in complementary categories, or other parties. Furthermore, ecommerce on large marketplaces, such as Amazon, could increase as a percentage of all ecommerce activity, thereby reducing customer traffic to individual customer websites. Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure, a loss of market share, or a smaller addressable share of the market and could also result in a competitor with greater financial, technical, marketing, service, and other resources, any of which could harm our ability to compete. Some of our larger competitors use broader product offerings to compete, including by selling at zero or negative margins, by bundling their product, or by closing access to their technology platforms. Potential customers may prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. Furthermore, potential customers may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our platform. These competitive pressures in our market, or our failure to compete effectively, may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share. Any failure to meet and address these factors could harm our business, results of operations, and financial condition.

We believe maintaining and growing the BigCommerce brand is important to supporting continued acceptance of our existing and future solutions, attracting new customers to our platform, and retaining existing customers. We also believe that the importance of brand recognition will increase as competition in our market increases. Successfully maintaining our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide a reliable and useful platform to meet the needs of our customers at competitive prices, our ability to maintain our customers' trust, our ability to continue to develop new functionality and solutions, and our ability to successfully differentiate our platform. Additionally, our partners' performance may affect our brand and reputation if customers do not have a positive experience. Brand promotion activities may not generate customer awareness or yield increased revenue. Even if they do, any increased revenue may not offset the expenses we incurred in building our brand. If we fail to successfully promote and maintain our brand, we may fail to attract enough new customers or retain our existing customers to realize a sufficient return on our brand-building efforts, and our business could suffer.

Not applicable.