In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property, and trade secrets. Our internal computer systems, cloud-based computing services and those of our current and any future vendors, clinical investigators, CROs, collaborators, contractors, or consultants, are vulnerable to damage or interruption from natural disasters, fire, power loss, telecommunications failures, server malfunction, software or hardware failures. In addition, we and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), traditional computer "hackers," malicious code (such as viruses and worms),employee theft or misuse, denial-of-service attacks, adware, malware installation, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, sophisticated nation-state and nation-state supported actors and attacks enhanced or facilitated by AI, and other similar threats. Cyberattacks and other malicious internet-based activity continue to increase in frequency, sophistication and intensity, and are becoming increasingly difficult to detect.
We have conducted information security audits or evaluations on our internal computer systems, but we cannot guarantee that our or our vendors', clinical investigators', CROs', collaborators', contractors', or consultants' security measures will be sufficient to protect against unauthorized access to, or other compromise of, our systems and our confidential, financial or proprietary data, including personal information, which is stored in or otherwise processed by such systems. Many of our employees work remotely on a part-time basis, which may pose additional data security risks. While we have security measures in place designed to protect our confidential and proprietary information and prevent data loss and other security breaches, there can be no assurance that our security measures or those of our third-party service providers that store or otherwise process certain of our confidential, financial or proprietary data on our behalf will be effective in protecting against unauthorized access to our platform or such data, particularly given that our ability to monitor our third-party service providers' data security is limited. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in deploying remedial measures and patches designed to address identified vulnerabilities.
The techniques used to sabotage or to obtain unauthorized access to our or our third-party service providers' platform, systems, networks and/or physical facilities in which data is stored or through which data is transmitted change frequently, may not be recognized until launched, and can originate from a wide variety of sources, and we and our third-party services providers may be unable to implement adequate preventative measures or stop security breaches while they are occurring. The recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our platform, systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches, may not be adequate to prevent or detect service interruption, system failure or data loss. Our platform, systems, networks, and physical facilities could be breached, or confidential or proprietary information could be otherwise compromised due to employee error or malfeasance, third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, systems, networks and/or physical facilities utilized by our third-party service providers.
If a cyberattack or other security incident were to occur and cause interruptions in our operations, it could result in a disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other confidential or proprietary information or other similar disruptions. For example, the loss of clinical trial data could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these issues may not be successful, and these issues could result in interruptions, delays, cessation of service, negative publicity, loss of public trust, delays in the development and commercialization of our product candidates. Any security breach may also result in regulatory inquiries or action, litigation, or other investigations, fines, penalties, and damages, any of which can affect our financial and operational condition.
Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. Many jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data. In addition, our agreements with certain counterparties and partners may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause the public to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by an actual or perceived security breach.
Further, security compromises experienced by our collaborators, business partners, patients or employees with respect to data hosted on our platform, internal computer systems, and/or cloud-based computing services, even if caused by third-party misuse or negligence, may lead to loss, unauthorized access, or public disclosures of such data, which could harm our reputation, erode confidence in the effectiveness of our security measures, negatively impact our ability to attract new collaborators or other business relationships, or cause existing contractual counterparties to elect not to renew their agreements with us. Any data breach by service providers that are acting as data processors and processing personal information on our behalf could also mean that we are subject to these fines and must comply with the notification obligations set out above.
Unauthorized access to our platform, systems, networks, or physical facilities could result in litigation with or liabilities to our contractual counterparties or other relevant stakeholders, which may adversely affect our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we maintain cybersecurity insurance, we could still be required to spend money in defense or settlement, divert management's time or attention, fundamentally change our business activities and practices or modify our products and/or platform capabilities, which could have an adverse effect on our business. Litigation could also increase our costs of doing business or adversely affect our reputation.
Our risks are likely to increase as we continue to expand, and process, store, and transmit increasingly large amounts of proprietary and sensitive data and we may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. In addition, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.