HUBS · Read the filing

10-K

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(MARK ONE)

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2022

FOR THE TRANSITION PERIOD FROM TO

Commission File Number 001-36680

HubSpot, Inc.

(Exact name of registrant as specified in its charter)

25 First Street

Cambridge, Massachusetts, 02141

(Address of principal executive offices)

(888) 482-7768

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading symbol(s) Name of each exchange on which registered

Common Stock, par value $0.001 per share HUBS New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ NO ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. YES ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ NO ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ NO ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act:

Large accelerated filer ☒ Accelerated filer ☐

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal controls over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C 7262(b)) by the registered public accounting firm that prepared or issued its audit report YES ☒ NO ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. YES ☐ NO ☒

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). YES ☐ NO ☒

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). YES ☐ NO ☒

The aggregate market value of common stock held by non-affiliates of the registrant, based on the closing price of the registrant’s common stock on June 30, 2022, as reported by the New York Stock Exchange on such date was approximately $13,710,448,147. Shares of the registrant’s common stock held by each executive officer, director and holder of 5% or more of the outstanding common stock have been excluded in that such persons may be deemed to be affiliates. This calculation does not reflect a determination that certain persons are affiliates of the registrant for any other purpose.

On February 10, 2023, the registrant had 49,392,241 shares of common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive Proxy Statement for its 2023 Annual Meeting of Stockholders are incorporated by reference in Part III of this Annual Report on Form 10-K. Such Proxy Statement will be filed with the U.S. Securities and Exchange Commission within 120 days after the end of the fiscal year to which this report relates. Except with respect to information specifically incorporated by reference in this Form 10-K, the Proxy Statement is not deemed to be filed as part of this Form 10-K.

HUBSPOT, INC.

TABLE OF CONTENTS

Page No.

PART I

ITEM 1. Business 7

ITEM 1A. Risk Factors 15

ITEM 1B. Unresolved Staff Comments 44

ITEM 2. Properties 44

ITEM 3. Legal Proceedings 44

ITEM 4. Mine Safety Disclosures 44

PART II

ITEM 6. [Reserved] 46

ITEM 7A. Quantitative and Qualitative Disclosures About Market Risk 65

ITEM 8. Financial Statements and Supplementary Data 66

ITEM 9A. Controls and Procedures 101

ITEM 9B. Other Information 102

ITEM 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 102

PART III

ITEM 10. Directors, Executive Officers and Corporate Governance 103

ITEM 11. Executive Compensation 103

ITEM 14. Principal Accounting Fees and Services 103

PART IV

ITEM 15. Exhibits, Financial Statement Schedules 104

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, and these statements involve substantial risks and uncertainties. All statements other than statements of historical fact contained in this Annual Report on Form 10-K are forward-looking statements. Forward-looking statements generally relate to future events or our future financial or operating performance. In some cases, you can identify forward-looking statements because they contain words such as “may,” “should,” “expects,” “plans,” “anticipates,” “could,” “intends,” “target,” “projects,” “contemplates,” “believes,” “estimates,” “predicts,” “potential” or “continue” or the negative of these words or other similar terms or expressions that concern our expectations, strategy, plans or intentions. Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

•

our future financial and operational performance and operational expenditures, including our expectations regarding our revenue, cost of revenue, gross margin and operating expenses;

•

maintaining and expanding our customer base and increasing our average subscription revenue per customer;

•

the impact of competition in our industry and innovation by our competitors;

•

our anticipated growth and expectations regarding our ability to manage our future growth;

•

our expectations regarding the potential impact of geo-political conflicts, inflationary pressures, foreign currency movement, macroeconomic stability, and the COVID-19 pandemic on our business, the broader economy, our workforce and operations, the markets in which we and our partners and customers operate, and our ability to forecast future financial performance;

•

our anticipated areas of investments, including sales and marketing, research and development, customer service and support, data center infrastructure and service capabilities, and expectations relating to such investments;

•

our predictions about industry and market trends;

•

our ability to anticipate and address the evolution of technology and the technological needs of our customers, to roll-out upgrades to our existing software platform and to develop new and enhanced applications to meet the needs of our customers;

•

our ability to maintain our brand and inbound marketing, selling and servicing thought leadership position;

•

the impact of our corporate culture and our ability to attract, hire and retain necessary qualified employees to expand our operations;

•

the anticipated effect on our business of litigation to which we are or may become a party;

•

our ability to successfully acquire and integrate companies and assets;

•

our plans regarding declaring or paying cash dividends in the foreseeable future; and

•

our ability to stay abreast of new or modified laws and regulations that currently apply or become applicable to our business both in the United States and internationally.

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Annual Report on Form 10-K.

You should not rely upon forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Annual Report on Form 10-K primarily on our current expectations and projections about future events and trends that we believe may affect our business, financial condition, results of operations and prospects. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties and other factors described in “Risk Factors” and elsewhere in this Annual Report on Form 10-K. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report on Form 10-K. The results, events and circumstances reflected in the forward-looking statements may not be achieved or occur, and actual results, events or circumstances could differ materially from those described in the forward-looking statements.

The forward-looking statements made in this Annual Report on Form 10-K relate only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements made in this Annual Report on Form 10-K to reflect events or circumstances after the date of this Annual Report on Form 10-K or to reflect new information or the occurrence of unanticipated events, except as required by law.

We may not actually achieve the plans, intentions or expectations disclosed in our forward-looking statements and you should not place undue reliance on our forward-looking statements. Our forward-looking statements do not reflect the potential impact of any future acquisitions, mergers, dispositions, joint ventures, or investments we may make.

In this Annual Report on Form 10-K, the terms “HubSpot,” “we,” “us,” and “our” refer to HubSpot, Inc. and its subsidiaries, unless the context indicates otherwise.

Risk Factor Summary

The risk factors detailed in Item 1A entitled “Risk Factors” in this Annual Report on Form 10-K are the risks that we believe are material to our investors and a reader should carefully consider them. Those risks are not all of the risks we face and other factors not presently known to us or that we currently believe are immaterial may also affect our business if they occur. The following is a summary of the risk factors detailed in Item 1A:

•

We are dependent upon customer renewals, the addition of new customers, increased revenue from existing customers and the continued growth of the market for a CRM Platform.

•

We face significant competition from both established and new companies offering marketing, sales, customer service, operations and content management software and other related applications, as well as internally developed software, which may harm our ability to add new customers, retain existing customers and grow our business.

•

Failure to effectively develop and expand our marketing, sales, customer service, operations, and content management capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our platform.

•

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards and changing customer needs or requirements, our CRM Platform may become less competitive.

•

Our ability to introduce new products and features is dependent on adequate research and development resources. If we do not adequately fund our research and development efforts, we may not be able to compete effectively and our business and operating results may be harmed.

•

We are exposed to fluctuations in currency exchange rates that could adversely affect our financial results.

•

The current economic downturn may lead to decreased demand for our products and services and otherwise harm our business and results of operations.

•

Interruptions or delays in service from our third-party data center providers could impair our ability to deliver our platform to our customers, resulting in customer dissatisfaction, damage to our reputation, loss of customers, limited growth, and reduction in revenue.

•

If our CRM Platform has outages or fails due to defects or similar problems, and if we fail to correct any defect or other software problems, we could lose customers, become subject to service performance or warranty claims or incur significant costs.

•

If our or our customers’ security measures are compromised or unauthorized access to data of our customers or their customers is otherwise obtained, our CRM Platform may be perceived as not being secure, our customers may be harmed and may curtail or cease their use of our platform, our reputation may be damaged and we may incur significant liabilities.

•

We have a history of losses and may not achieve profitability in the future.

•

We may experience quarterly fluctuations in our operating results due to a number of factors, which makes our future results difficult to predict and could cause our operating results to fall below expectations or our guidance.

•

If we do not accurately predict subscription renewal rates or otherwise fail to forecast our revenue accurately, or if we fail to match our expenditures with corresponding revenue, our operating results could be adversely affected.

•

Our ability to raise capital in the future may be limited, and our failure to raise capital when needed could prevent us from growing.

•

Our Restructuring Plan and associated organizational changes may not adequately reduce our operating costs or improve operating margins, may lead to additional workforce attrition, and may cause operational disruptions.

PART 1

ITEM I. BUSINESS

Overview

We help scaling companies deliver a delightful customer experience through our cloud-based customer relationship management (“CRM”) Platform. Our CRM Platform includes marketing, sales, service, operations and a content management system, (“CMS”), as well as other tools, integrations and a native payment solution, that enable companies to attract, engage, and delight customers throughout the customer experience. Additionally, we provide education, services and support to help customers be successful with our CRM Platform.

We focus on selling to mid-market business-to-business (“B2B”) companies, which we define as companies that have between 2 and 2,000 employees. We sell our CRM Platform on a subscription basis. In 2022, our total revenue was $1.7 billion and we incurred a net loss of $112.7 million. As of December 31, 2022, we had 7,433 full-time employees and 167,386 Customers, as defined in our Key Business Metrics in Item 7, of varying sizes in more than 120 countries.

Our company was formed as a limited liability company in Delaware on April 4, 2005. We converted to a Delaware corporation on June 7, 2007. Our principal executive offices are located at 25 First Street, Cambridge, Massachusetts, and our main telephone number is 888-482-7768. Our website address is https://www.hubspot.com. Information contained on or that can be accessed through our website does not constitute part of this Annual Report on Form 10-K, and inclusions of our website address in this Annual Report on Form 10-K are inactive textual references only.

The HubSpot Approach

Our CRM Platform features a central database of lead and customer interactions and integrated applications designed to help businesses attract visitors to their websites, convert visitors into leads, close leads into customers, transact with those customers, and delight them so they become promoters of those businesses.

Designed to Help Companies Grow Better. Our CRM Platform was architected from the ground up to enable businesses to transform their marketing, sales, services, operations and content management playbook to meet the demands of customers today. Our CRM Platform includes a system of record for maintaining a unified view of the customer experience, a system of engagement for efficiently engaging customers through search engine optimization (“SEO”), web content, social, blogging, email, marketing automation, messaging, support ticketing, knowledge base, commerce, conversation routing, video hosting, and an end-to-end payment solution which enables customers to streamline their payment process with fewer tools.

Ease of Use of a Single, Extensible Platform. We provide a set of integrated applications on a common platform, which offers businesses ease of use and simplicity. Our CRM Platform has one login, one user interface, one database, and one team for support. Our CRM Platform starts free and grows with our customers. It is designed to scale its power and technical sophistication without losing its ease-of-use. In addition to being a comprehensive suite itself, our CRM Platform seamlessly integrates with hundreds of external applications, making it easy to extend the functionality of our CRM Platform and customize it for any business.

Power of a Unified Customer View. At the core of our CRM Platform is a single CRM database for each business that captures its lead and customer activity throughout the customer lifecycle. Our CRM Platform creates a unified timeline incorporating all the interactions with a particular customer. In contrast to many CRM suites which are cobbled together, we have crafted a set of core functionalities, including reporting, content, messaging, data, and automation, which runs across our product lines, which we refer to as Hubs.

Scalability. Our CRM Platform was designed and built to serve a large number of customers with demanding use cases. Our CRM Platform currently processes billions of data points each week, and we use leading global cloud infrastructure providers and our own automation technology to dynamically allocate capacity to handle processing workloads of all sizes. We have built our CRM Platform on modern, scalable distributed technologies. We built the infrastructure to support hundreds of microservices and can easily add new features and capabilities to the CRM Platform. We utilize a variety of open-source distributed systems including HBase, Kafka, Vitess, and Elasticsearch to scale our data collection and processing. Our scalability gives us flexibility for future growth and enables us to service a large variety of businesses of different sizes across different industries.

Extensible and Open Architecture. Our CRM Platform features a variety of open application programming interfaces (“APIs”) that allows easy integration of our platform with other applications. We enable our customers to connect our platform to their other applications, such as ecommerce, event management and videoconferencing applications. By connecting third-party applications, our customers can leverage our centralized inbound database to perform additional functions and analysis.

Our Competitive Strengths

We believe that our market leadership position is based on the following key strengths:

Leading Platform. We have designed and built a world-class CRM Platform. We believe our customers choose our CRM Platform over others because of its powerful, integrated, and easy-to-use applications. We built HubSpot on a single, unified, and intuitive platform, which we believe contrasts positively with many other CRM suites.

Market Leadership and Strong Brand. We are a recognized thought leader in the cloud-based marketing, sales, customer service, operations, and content management software industry with a leading brand. Our founders, Brian Halligan and Dharmesh Shah, wrote the best-selling marketing book Inbound Marketing: Get Found Using Google, Social Media and Blogs. Our marketing, sales, service, operations, and content management experience attracts, engages, and delights customers by being more relevant, more helpful, more personalized, and less interruptive than traditional marketing and sales tactics. Our INBOUND event is one of the largest inbound industry conference events. In 2022, we had nearly 45,000 registered attendees.

Large and Growing Solutions Partner Program.A Solutions Partner is a service provider that helps businesses with strategy, execution, and implementation of go-to-market activities and technology solutions. Our Solutions Partners promote our brand and offer our CRM Platform to their clients. Solutions Partners and customers referred to us by our Solutions Partners represented approximately 33% of our Customers as of December 31, 2022, and approximately 45% of our revenue for the year ended December 31, 2022. These Solutions Partners help us to promote the vision of the inbound experience, efficiently reach new mid-market businesses at scale, and provide our mutual customers with more diverse and higher-touch services.

Freemium Pricing Strategy. Our freemium model attracts customers who begin using our CRM Platform through our free products and then upgrade to our paid Hubs. Through our freemium products, our customers are able to receive value from HubSpot before converting to a paid product or engaging with sales.

Mid-Market Focus. We believe we have significant competitive advantages reaching mid-market businesses and efficiently reach this market at scale as a result of our inbound methodology, freemium pricing strategy, and our Solutions Partner channel.

Powerful Network Effects. We have built a large and growing ecosystem around our CRM Platform and company. Tens of thousands of our Customers integrate third-party applications with our CRM Platform. We believe this ecosystem drives more businesses and professionals to embrace the inbound playbook. As our engaged audience grows, more Solutions Partners collaborate with us, more third-party developers integrate their applications with our CRM Platform, and more professionals complete our certification programs, all of which help to drive more businesses to adopt our CRM Platform.

Our Growth Strategy

The key elements to our growth strategy are:

Grow Our Customer Base. The market for our CRM Platform is large and underserved. Mid-market businesses are particularly underserved by existing point application vendors and often lack sufficient resources to implement complex solutions. Our all-in-one CRM Platform allows mid-market businesses to efficiently adopt and execute an effective inbound marketing, sales, customer service, operations, and content management strategy to help them expand and grow. We will continue to leverage our inbound go-to-market approach, freemium pricing strategy and our network of Solutions Partners to keep growing our business.

Increase Revenue from Existing Customers. With 167,386 Customers in more than 120 countries spanning many industries, we believe we have a significant opportunity to increase revenue from our existing customers. We plan to increase revenue from our existing customers by expanding their use of our CRM Platform by upselling additional offerings and features, including our end-to-end payment solution, adding additional users, and cross-selling our marketing, sales, service, operations, and content management products to existing customers through touchless or low touch in-product purchases. Our scalable pricing model allows us to capture more spend as our customers grow, increase the number of their customers and prospects managed on our CRM Platform, and offer additional functionality available from our higher price tiers and add-ons, providing us with a substantial opportunity to increase the lifetime value of our customer relationships.

Keep Expanding Internationally. There is a significant opportunity for our CRM Platform outside of the United States. As of December 31, 2022, approximately 53% of our Customers were located outside of the United States and these Customers generated approximately 46% of our total revenue for the year ended December 31, 2022. We sell to those international Customers from our U.S., European, Asia Pacific, and South American based operations. We intend to grow our presence in international markets through additional investments in local sales, marketing and professional service capabilities, as well as by leveraging our Solutions Partner network. We have significant website traffic from regions outside the United States, and we believe that markets outside the United States represent a significant growth opportunity.

Continue to Innovate and Expand Our CRM Platform. Mid-market businesses are increasingly realizing the value of having an integrated marketing, sales, customer service, operations, and content management platform. We believe we are well positioned to capitalize on this opportunity by introducing new products and applications to extend the functionality of our CRM Platform.

Selectively Pursue Acquisitions. We plan to selectively pursue acquisitions of complementary businesses, technologies and teams that would allow us to add new features and functionalities to our CRM Platform and accelerate the pace of our innovation.

Our CRM Platform

Our CRM Platform features integrated applications and tools that enable companies to create a cohesive and adaptable customer experience. Each Hub can be used standalone, with our CRM Platform, a third party CRM, and/or in conjunction with any version of the other Hubs. Our Hubs are available in both free and paid tiers (i.e., Starter, Professional and Enterprise) with gradually increasing levels of functionality that support the needs of our customers as they see success with our tools and their businesses grow.

Businesses that want to use software outside of our CRM Platform can leverage our ecosystem of third-party integrations from our platform application partners. We make it easy to find and install new or existing software solutions that complement our CRM Platform. Over 1,300 integrations and applications are available for our users, across a wide range of categories, including integrations with leading social media, email, sales, video, analytics, content and webinar tools. Customers can build custom applications and integrations on top of our CRM Platform themselves, or through third party developers in our ecosystem.

HubSpot CRM

The core of our CRM Platform is a single database of lead and customer information that allows businesses to track their interactions with contacts and customers, manage their customer activities, and report on their pipeline and sales. This allows a complete view of lead and customer interactions across all of our integrated Hubs, giving our CRM Platform substantial power. This integration makes it possible to personalize every aspect of the customer interaction across web content, social media engagement, and email messages across devices, including mobile. The integrated Hubs on our CRM Platform have a common user interface and are accessed through a single login.

Marketing Hub

Marketing Hub is an all-in-one toolset for marketers to attract, engage, and nurture new leads towards sales readiness over the entire customer lifecycle. Features include: marketing automation and email, social media, SEO, and reporting and analytics.

Sales Hub

Sales Hub is designed to enhance the productivity and effectiveness of sales teams. Businesses can empower their teams with tools that deliver a personalized experience for prospects with less work for sales representatives. Features include: email templates and tracking, conversations and live chat, meeting and call scheduling, lead and website visit alerts, lead scoring, sales automation, pipeline management, quoting, forecasting, and reporting.

Service Hub

Service Hub is our customer service software designed to help businesses manage, respond and connect with customers. Features include: conversations and live chat functionality, conversational bots, tickets and help desk, automation and routing, knowledge base, team emails, feedback and reporting tools, and customer goals.

CMS Hub

Our content management system (“CMS”) Hub combines the power of customer relationship management and a content management system into one integrated platform. Our content tools enable businesses to create new and edit existing web content while also personalizing their websites for different visitors and optimizing their websites to convert more visitors into leads and customers. Features include: website pages, business blogging, smart content, landing pages and forms, SEO tools, forms and lead flow, web analytics reporting, calls-to-action, and file manager.

Operations Hub

Operations Hub is designed to help businesses unify customer data in a connected platform, automate business processes, and eliminate time-consuming data cleanup, and query and transform data to enable customer insights and connections. Features include: programmable automation, data sync, data curation, and data quality tools.

Built within the CRM Platform, we offer an end-to-end payment solution, Payments, which enables customers to accept payments from their customers in less time and with fewer tools. With Payments, customers can buy and pay directly on a website, an email, or chat and native integration with the quotes feature in Sales Hub allows our customers to get paid immediately when a quote is accepted.

Our Services

We complement our product offerings with professional services, customer success and support, which we view as critical elements of ensuring the long-term retention of our customers. The majority of our services and support is offered over email, phone, chat applications and via web meeting technology rather than in-person, which is a more efficient business model for us and our customers.

Professional Services. We offer professional services to educate and train customers on how to leverage our CRM Platform to transform how their business attracts, engages and delights customers. Depending on which Hubs and services a customer purchases, they receive onboarding guidance or one-on-one training from one of our on-boarding, inbound consultants, or technical consultants by web meetings. They can purchase additional group training and education in online or in-person classes (when offered). We also offer in-app training modules that customers can use as part of their on-boarding. Our professional services are also available to customers who need additional assistance on a one-time or ongoing basis for an additional fee. Depending on the scope of work and the services a customer needs help with, we might recommend they work with our Solutions Partner ecosystem.

Customer Success. Our customers have access to a Customer Success Manager (“CSM”), Channel Consultant ("CC") or Customer Success Team (“CST”) which are responsible for our customers’ long term success, retention and growth on our CRM Platform. Depending on the customer spend, they will either have a dedicated CSM, or be serviced by a CST in a team based approach. Our CSMs or CST address the unique needs and goals of our customers through a series of ongoing interactions and strategy calls on how to best use our CRM Platform. Our CCs play a similar role as our CSMs and CST, but focus on the growth and success of our Solutions Partners. The Solutions Partner’s customers have oversight through CSM and work collaboratively with the CC to help the Solutions Partner’s customers get the most value from our platform and the Solutions Partner’s services.

Support. In addition to assistance provided by our online articles and customer discussion forums, we offer phone and/or email and chat based support, which is included in the cost of a subscription for our Hubs. Phone, email and chat support is available starting at the Professional product level for all Hubs while email and chat based support is available for Starter Hubs. We strive to maintain an exceptional quality of customer service. We continuously monitor key customer service metrics such as phone hold time, ticket response time and ticket resolution rates, and we monitor the customer satisfaction of our customer support interactions. We believe our customer support is an important reason why businesses choose our CRM Platform and recommend it to their colleagues.

Our Customers

As of December 31, 2022, we had 167,386 Customers in more than 120 countries, representing many industries. No single customer represented more than ten percent of our revenue in 2022, 2021, or 2020.

Our Technology

Our Customers have chosen us as their CRM Platform, which we architected and built to be secure, highly distributed and highly scalable. Since our founding, we have embraced rapid, iterative product development lifecycles, cloud automation and open-source technologies, including big data platforms, to power marketing, sales, service, operations, and content management programs and provide insights not previously possible or available.

Our CRM Platform is a multi-tenant, single code-based, globally available software-as-a-service delivered through APIs, web browsers or mobile applications. Our commitment to a highly available, reliable, and scalable platform for businesses of all sizes is accomplished through the use of these technologies.

Platform Approach. We built HubSpot on a single platform with reusable and composable libraries, allowing us to rapidly address new feature areas and bring new products to market that have a consistent user experience and data model. We have built this platform with scale in mind, supporting thousands of components including hundreds of microservices,

Modern Database Architecture. We process billions of data points weekly across various channels, including social media, email, SEO and website visits, and continue to drive nearly real-time analytics across these channels. This is possible because we built our database from the ground up using distributed big data technologies such as HBase, Elasticsearch and Kafka to both process and analyze the large amounts of data we collect. We also utilize Vitess to operate MySQL at scale, allowing our engineers to choose the best datastore for each task.

Agility. Our infrastructure and development and software release processes allow us to update our platform for specific groups of customers or our entire customer base at any time. This means we can rapidly innovate and deliver new functionality frequently, without waiting for quarterly or annual release cycles. We typically deploy updates to our software platform thousands of times a day, enabling us to gather immediate customer feedback and improve our product quickly and continuously.

Cost leverage. Because our CRM Platform was built on an almost exclusive footprint of open-source software and designed to operate in cloud-based data centers, we have benefited from large-scale price reductions by these cloud computing service providers as they continue to innovate and compete for market share. As our processing volume continues to grow, we continue to receive larger volume discounts on a per-unit basis for costs such as storage, bandwidth and computing capacity. We also believe that our extensive use of open-source software will provide additional leverage as we scale our CRM Platform and infrastructure.

Scalability. By leveraging leading cloud infrastructure providers along with our automated technology stack, we are able to scale workloads of varying sizes at any time. This allows us to handle customers of all sizes and demands without traditional operational limitations such as network bandwidth, computing cycles, or storage capacity as we can scale our platform on-demand.

Reliability. Customer data is distributed and processed across multiple data centers within a region to provide redundancy. We built our CRM platform on a distributed computing architecture with reduced single points of failure and we operate across data center boundaries daily. In addition to datacenter level redundancy, this architecture supports multiple live copies of each data set along with snapshot capabilities for faster, point-in-time data recovery instead of traditional backup and restore methodologies.

Security. We leverage industry standard network and perimeter defense technologies, distributed denial-of-service, protection systems (including web application firewalls) and enterprise grade domain name system, services across multiple vendors. Our data-center providers operate and certify to high industry compliance levels. Due to the broad footprint of our customer base, we regularly test and evaluate our platform with trusted third-party vendors to ensure the security and integrity of our services.

Marketing and Sales

We believe we are a global leader in implementing an inbound experience in marketing and sales. We believe that our marketing and sales model provides us with a competitive advantage, especially when targeting mid-market businesses, because we can attract and engage these businesses efficiently and at scale.

Inbound Marketing. Our marketing team attracts new leads and users each month through our industry-leading blog, podcast network, email newsletter and other content, free tools, large social media following, high search engine rankings and personalized website and email content. In addition, we are generating leads for new and add-on product purchases through content and offers delivered through our CRM Platform to existing customers.

Inbound Direct Sales. Our sales representatives throughout the world use phone, email, and web meetings to interact with prospects and customers. The majority of revenue generated by our sales representatives originates with inbound leads produced by our marketing efforts. In addition, our freemium products and in-product cross-sell offerings help close new business with little or no interaction by our sales representatives.

Inbound Channel Sales. In addition to our direct sales team, we have sales representatives that manage relationships with our worldwide network of Solutions Partners who both use our platform for their own businesses and also, on a commissioned basis, refer customers to us. These Solutions Partners collaborate with us not only to leverage our software platform and educational resources, but also to build their own business by offering new services and shifting their revenue mix to include recurring revenue streams.

Governmental Regulations

We operate globally and are subject to numerous U.S. federal, state, and foreign laws and regulations covering a wide variety of subject matters. Our compliance with these laws and regulations may be onerous and could, individually or in the aggregate, increase our cost of doing business, impact our competitive position relative to our peers, and/or otherwise have an

adverse impact on our business, reputation, financial condition, and operating results. For information about governmental regulations applicable to our business, refer to “Risk Factors” in Item 1A.

Human Capital Management

Helping millions of organizations grow better requires a truly remarkable team. We take a thoughtful approach to talent attraction and retention in order to build a company culture where people can do their best work. That’s why our culture is rooted in what we think employees want from employers today: autonomy, flexibility, transparency, and a commitment to diversity.

HubSpot is proud to be named the #2 Best Place to Work in 2022 and #4 Best Place to Work in 2021 by the Glassdoor Employees’ Choice Awards. Based on employees’ reviews and feedback, this recognition is a strong testament to the innovative culture we are building. We have also been recognized as a top workplace in 2022 by Great Place to Work, and honored to be mentioned in a number of categories by Comparably's workplace awards in 2022 including Best CEO for Women, Best Global Culture, and a Best Company for Employee Happiness.

As of December 31, 2022, we had 7,433 full-time employees, or HubSpotters. Of these, 1,271 were in the Americas, 1,346 were in Europe, 318 were in the Asia Pacific region and 4,498 were 100% remote. In January 2023, we made the difficult decision to begin implementing a restructuring plan (the “Restructuring Plan”), part of which consisted of a reduction of headcount by approximately 7%.

•

Culture and Values. As a company with a hybrid working model, connection is core to our culture. We are focused on fostering authentic connection by offering the tools, resources, and opportunities to help our employees grow both personally and professionally. Our Culture Code underpins our culture and outlines our core company values, including, autonomy, flexibility, high performance, and HEART. HEART is at the center of who we are and represents the five traits we value the most in HubSpotters: Humility, Empathy, Adaptability, Remarkableness and Transparency. A copy of our Culture Code can be found at: https://network.hubspot.com/slides/the-hubspot-culture-code.

•

Diversity, Inclusion, and Belonging. Diversity, inclusion, and belonging (DI&B) is a core part of our mission. We are focused not just on increasing representation, but on striving for equity in systems, resources, and access to opportunities. We have incorporated DI&B into our policies and practices, education and events, and launched various initiatives to further our goal of being a more diverse, inclusive, and equitable workplace. Our DI&B initiatives include, but are not limited to: programs to increase our slate of diverse candidates, anti-racism training for employees and managers, key external partnerships, employee resource groups, and programs and initiatives to enhance the diversity and inclusion experience for candidates and employees. In addition, our annual HubSpot Diversity, Inclusion, and Belonging Report is a detailed analysis of our gender, ethnicity, and age data, as well as self-reported identities including parents, military veterans, disabilities, first-generation identity, and those who are gender diverse. A copy of our DI&B report can be found at: https://www.hubspot.com/diversity/report.

•

Compensation and Benefits. We provide competitive compensation and benefits for our employees globally. Our compensation packages may include base salary, commission or semi-annual bonuses, and stock-based compensation. We also offer general employee medical and dental plans, unlimited vacation and an annual global week of rest, life and disability insurance, employee stock purchase plan, and Section 401(k) plan matching contributions. We evaluate both compensation and benefit offerings on an annual basis and we make adjustments as needed. We are also committed to making meaningful, long-term change from pay opacity to pay clarity. This includes providing access to compensation ranges for all of our employees, anchoring compensation to one predefined major city per country and publishing compensation ranges for all job postings in the U.S.

•

Learning and growth. We believe in life-long learning and invest in employee development at every stage. We offer hands-on, regionalized on-boarding, one-on-one mentorship, year-round manager trainings and an annual mini-MBA Fellows program. We also offer several programs focused on BIPOC (Black, Indigenous, Person of Color) retention and career development, including a stay interview program, a global mentorship program for employees of color, and a structured mentoring and career coaching program for Black employees. In addition, we offer several self-paced courses for all employees through Learn@HubSpot, our internal, online learning management system designed by our Learning and Development team.

•

Hybrid Culture and Enablement. We offer a hybrid working model, with employees choosing annually between three options: @home, @office, @flex. @home employees will work the majority of the time from home, @office employees will go into a HubSpot office three or more days per week, and @flex employees will go into a HubSpot office two or fewer days per week. We also offer manager trainings focused on building connection and psychological safety.

•

Mental Health and Well-Being. We offer a mental wellness platform as a global benefit for employees. In order to prevent and battle burnout and its root causes, we also offer a company holiday week for all employees to take time off and recharge, and programming for employees to listen, learn, and identify ways to prioritize their mental health at work.

•

Social Impact. We aim to bring the best of HubSpot to help nonprofits that are committed to improving education and entrepreneurship in our communities around the world. We provide a range of opportunities for our employees to get involved with nonprofit organizations through HubSpot Helps, our community impact program, including: a dedicated employee volunteering platform, financial and in-kind donations, and flagship events. We are also committed to closing the

racial wealth gap and developing the next generation of Black business leaders by investing in partnerships and organizations that can drive real change for Black communities.

•

Employee Engagement and Feedback. We administer a quarterly employee engagement survey, known as our eNPS, to assess and understand the employee experience and engagement at the company level. The survey also enables us to provide data to leaders across the organization, empowering them to identify, address, and monitor feedback at the department level. Our eNPS process includes a Global Inclusion Index survey which we measure annually, allowing us to track progress and collect feedback on our diversity, inclusion, and belonging efforts over time.

Competition

Our market is evolving, highly competitive and fragmented, and we expect competition to increase in the future. We believe the principal competitive factors in our market are:

•

vision for the market, product strategy and pace of innovation;

•

inbound marketing focus and domain expertise;

•

integrated all-in-one CRM Platform;

•

breadth and depth of product functionality;

•

ease of use;

•

scalable, open architecture;

•

time to value and total cost of ownership;

•

integration with third-party applications and data sources;

•

use of CRM data to make strategic business decisions;

•

name recognition and brand reputation; and

•

“freemium” go-to-market motion.

We believe we compete favorably with respect to all of these factors.

We face intense competition from other software companies that develop marketing, sales, service, and content management software. Our competitors offer various point applications that provide certain functions and features that we provide, including:

•

cloud-based marketing automation providers;

•

content management systems;

•

email marketing software vendors;

•

sales force automation and CRM software vendors

•

customer service platform vendors; and

•

large-scale enterprise suites.

In addition, instead of using our CRM Platform, some prospective customers may elect to combine disparate point applications, such as content management, marketing automation, analytics, social media management, ticketing, and conversational bots. We expect that we will develop and introduce, or acquire, applications serving customer-facing and other front office functions.

Intellectual Property

Our ability to protect our intellectual property, including our technology, will be an important factor in the success and continued growth of our business. We protect our intellectual property through trade secrets law, copyrights, trademarks, patents, and

contracts. Some of our technology relies upon third-party licensed intellectual property. We have 11 issued U.S. Patents and 19 patents applications pending. We intend to pursue and are pursuing additional patent protection to the extent we believe it would be beneficial and cost-effective.

In addition to the foregoing, we have established business procedures designed to maintain the confidentiality of our proprietary information, including the use of confidentiality agreements and assignment of inventions agreements with employees, independent contractors, consultants, and companies with which we conduct business.

Despite our efforts to protect our intellectual property, unauthorized parties may still copy or otherwise obtain and use our technology. In addition, we intend to continue to expand our international operations, and effective intellectual property, copyright, trademark and trade secret protection may not be available or may be limited in foreign countries. Any significant impairment of our intellectual property rights could harm our business or our ability to compete.

Financial Information About Segments

We operate as one operating segment. Operating segments are defined as components of an enterprise for which separate financial information is regularly evaluated by the chief operating decision maker (“CODM”), which is our chief executive officer, in deciding how to allocate resources and assess performance. The CODM evaluates our financial information and resources and assesses the performance of these resources on a consolidated basis. Since we operate in one operating segment, all required financial segment information can be found in the consolidated financial statements. See Footnote 10 within the consolidated financial statements for information by geographic area.

Available Information

Our website is located at http://www.hubspot.com, and our investor relations website is located at https://www.hubspot.com/investor-relations. Copies of our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to these reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended, are available, free of charge, on our investor relations website as soon as reasonably practicable after such reports are filed with, or furnished to, the Securities and Exchange Commission, or the SEC. The SEC also maintains a website at http://www.sec.gov that contains our SEC filings and other information regarding issuers that file electronically with the SEC.

We webcast our earnings calls and certain events we participate in or host with members of the investment community on our investor relations website. Additionally, we provide notifications of news or announcements regarding our financial performance, including SEC filings, investor events, press and earnings releases, and blogs as part of our investor relations website. We have used, and intend to continue to use, our investor relations website as means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. Further corporate governance information, including our certificate of incorporation, bylaws, governance guidelines, board committee charters, and code of business conduct and ethics, is also available on our investor relations website under the heading “Corporate Governance.” The contents of our websites are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

Item 1A. RISK FACTORS

An investment in our common stock involves a high degree of risk. You should carefully consider the risks described below and the other information in this Annual Report on Form 10-K and in our other public filings before making an investment decision. Our business, prospects, financial condition, or operating results could be harmed by any of these risks, as well as other risks not currently known to us or that we currently consider immaterial. If any such risks and uncertainties actually occurs, our business, financial condition or operating results could differ materially from the plans, projections and other forward-looking statements included in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and elsewhere in this report and in our other public filings. The trading price of our common stock could decline due to any of these risks, and, as a result, you may lose all or part of your investment.

Risks Related to Our Business and Strategy

We are dependent upon customer renewals, the addition of new customers, increased revenue from existing customers and the continued growth of the market for a CRM Platform.

We derive, and expect to continue to derive, a substantial portion of our revenue from the sale of subscriptions to our CRM Platform. The market for inbound marketing, sales, service, operations and content management products is still evolving, and competitive dynamics may cause pricing levels to change as the market matures and as existing and new market participants introduce new types of point applications and different approaches to enable businesses to address their respective needs. As a result, we may be forced to reduce the prices we charge for our platform and may be unable to renew existing customer agreements or enter into new customer agreements at the same prices and upon the same terms that we have historically. In addition, our growth strategy involves a scalable pricing model (including freemium versions of our products) intended to provide us with an opportunity to increase the value of our customer relationships over time as we expand their use of our platform, sell to other parts of their organizations, cross-sell our sales products to existing marketing product customers and vice versa through touchless or low touch in product purchases, and upsell additional offerings and features. If our cross-selling efforts are unsuccessful or if our existing customers do not expand their use of our platform or adopt additional offerings and features, our operating results may suffer.

Our subscription renewal rates may decrease, and any decrease could harm our future revenue and operating results.

Our customers have no obligation to renew their subscriptions for our platform after the expiration of their subscription periods, substantially all of which are one year or less. In addition, our customers may seek to renew for lower subscription tiers, for fewer contacts or seats, or for shorter contract lengths. Also, customers may choose not to renew their subscriptions for a variety of reasons. Our renewal rates may decline or fluctuate as a result of a number of factors, including limited customer resources, pricing changes, the prices of services offered by our competitors, adoption and utilization of our platform and add-on applications by our customers, adoption of our new products, customer satisfaction with our platform, mergers and acquisitions affecting our customer base, reductions in our customers’ spending levels or declines in customer activity as a result of economic downturns or uncertainty in financial markets. If our customers do not renew their subscriptions for our platform or decrease the amount they spend with us, our revenue will decline and our business will suffer.

In addition, a subscription model creates certain risks related to the timing of revenue recognition and potential reductions in cash flows. A portion of the subscription-based revenue we report each quarter results from the recognition of deferred revenue relating to subscription agreements entered into during previous quarters. In addition, we do not record deferred revenue beyond amounts invoiced as a liability on our balance sheet. A decline in new or renewed subscriptions in any period may not be immediately reflected in our reported financial results for that period, but may result in a decline in our revenue in future quarters. If we were to experience significant downturns in subscription sales and renewal rates, our reported financial results might not reflect such downturns until future periods.

We face significant competition from both established and new companies offering marketing, sales, customer service, operations, and content management software and other related applications, as well as internally developed software, which may harm our ability to add new customers, retain existing customers and grow our business.

The marketing, sales, customer service, operations, and content management software market is evolving, highly competitive and significantly fragmented. With the introduction of new technologies and the potential entry of new competitors into the market, we expect competition to persist and intensify in the future, which could harm our ability to increase sales, maintain or increase renewals and maintain our prices.

We face intense competition from other software companies that develop marketing, sales, customer service, operations, and content management software and from marketing services companies that provide interactive marketing services. Competition could significantly impede our ability to sell subscriptions to our CRM Platform on terms favorable to us. Our current and potential competitors may develop and market new technologies that render our existing or future products less competitive, or obsolete. In addition, if these competitors develop products with similar or superior functionality to our platform, we may need to decrease the prices or accept less favorable terms for our platform subscriptions in order to remain competitive. If we are unable to maintain our pricing due to competitive pressures, our margins will be reduced and our operating results will be negatively affected.

Our competitors include:

•

cloud-based marketing automation providers;

•

email marketing software vendors;

•

sales force automation and CRM software vendors;

•

large-scale enterprise suites;

•

customer service software providers; and

•

content management systems.

In addition, instead of using our platform, some prospective customers may elect to combine disparate point applications, such as content management, marketing automation, CRM, analytics and social media management. We expect that new competitors, such as enterprise software vendors that have traditionally focused on enterprise resource planning or other applications supporting back office functions, will develop and introduce applications serving customer-facing and other front office functions. This development could have an adverse effect on our business, operating results and financial condition. In addition, sales automation and CRM vendors could acquire or develop applications that compete with our sales and CRM offerings. Some of these companies have acquired social media marketing and other marketing software providers to integrate with their broader offerings.

Our current and potential competitors may have significantly more financial, technical, marketing and other resources than we have, be able to devote greater resources to the development, promotion, sale and support of their products and services, may have more extensive customer bases and broader customer relationships than we have, and may have longer operating histories and greater name recognition than we have. As a result, these competitors may respond faster to new technologies and undertake more extensive marketing campaigns for their products. In a few cases, these vendors may also be able to offer marketing, sales, customer service and content management software at little or no additional cost by bundling it with their existing suite of applications. To the extent any of our competitors has existing relationships with potential customers for either marketing software or other applications, those customers may be unwilling to purchase our platform because of their existing relationships with our competitor. If we are unable to compete with such companies, the demand for our CRM Platform could substantially decline.

In addition, if one or more of our competitors were to merge or partner with another of our competitors, our ability to compete effectively could be adversely affected. Our competitors may also establish or strengthen cooperative relationships with our current or future strategic distribution and technology partners or other parties with whom we have relationships, thereby limiting our ability to promote and implement our platform. We may not be able to compete successfully against current or future competitors, and competitive pressures may harm our business, operating results and financial condition.

We have experienced rapid growth and organizational change in recent periods and expect growth of headcount and operations over the long-term. If we fail to manage growth and organizational change effectively, we may be unable to execute our business plan, maintain high levels of service or address competitive challenges adequately.

Prior to the implementation of our Restructuring Plan in January 2023, our headcount and operations grew substantially. For example, we had 7,433 full-time employees as of December 31, 2022, as compared with 5,895 as of December 31, 2021. To date, we

have opened several international offices. This growth has placed, and will continue to place, a significant strain on our management, administrative, operational and financial infrastructure. While we expect to continue to grow headcount and operations over the long-term, in January 2023, we authorized a workforce reduction impacting approximately 7% of our workforce and began existing select leases to consolidate our office space. We may be unable to effectively manage the organizational changes we are making in connection with the Restructuring Plan, which could result in difficulty or delays in delivering our products to customers, declines in quality or customer satisfaction, increases in costs, difficulties in introducing new products and services or enhancing existing products and services, reputational harm, loss of customers, or operational difficulties in executing sales strategies, any of which could adversely affect our business performance and operating results. We anticipate future growth will be required over the long term to address increases in our product offerings and continued expansion. Our success will depend in part upon our ability to recruit, hire, train, manage and integrate qualified managers, technical personnel and employees in specialized roles within our company, including in technology, sales and marketing. Furthermore, as more of our employees work remotely from geographic areas across the globe on a permanent basis pursuant to our hybrid workplace model, which provides our employees with the option to be fully remote, work full-time from one of our offices, or have the flexibility to work both in the office and remotely, we may need to reallocate our investment of resources and closely monitor a variety of local regulations and requirements, including local tax laws. We may experience unpredictability in our expenses and employee work culture. If we experience any of these effects in connection with future growth, if our new employees perform poorly, or if we are unsuccessful in recruiting, hiring, training, managing and integrating new employees, or retaining our existing employees, it could materially impair our ability to attract new customers, retain existing customers and expand their use of our platform, all of which would materially and adversely affect our business, financial condition and results of operations.

In addition, our information technology infrastructure, operational, financial and management systems and procedures may not be able to effectively manage changes to our headcount, operations and office space that result from the Restructuring Plan. Our Plan will increase our short-term costs, which will make it more difficult for us to address any future revenue shortfalls by reducing expenses in the short-term. If we fail to successfully manage organizational changes in connection with the Restructuring Plan or our future growth, we will be unable to successfully execute our business plan, which could have a negative impact on our business, results of operations or financial condition.

To increase Customers and achieve broader market acceptance of our CRM Platform, we will need to continue to expand our marketing, sales, customer service, operations, and content management capabilities, including our sales force and third-party channel partners. We will continue to dedicate significant resources to inbound sales and marketing programs. The effectiveness of our inbound sales and marketing and third-party channel partners has varied over time and may vary in the future and depends on our ability to maintain and improve our CRM Platform. All of these efforts will require us to invest significant financial and other resources. Our business will be seriously harmed if our efforts do not generate a correspondingly significant increase in revenue. We may not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if our sales and marketing programs are not effective.

The rate of growth of our business depends on the continued participation and level of service of our Solutions Partners.

We rely on our Solutions Partners to provide certain services to our customers, as well as pursue sales of our CRM Platform to customers. To the extent we do not attract new Solutions Partners, or existing or new Solutions Partners do not refer a growing number of customers to us, our revenue and operating results would be harmed. In addition, if our Solutions Partners do not continue to provide services to our customers, we would be required to provide such services ourselves either by expanding our internal team or engaging other third-party providers, which would increase our operating costs.

If we fail to maintain our inbound thought leadership position, our business may suffer.

We believe that maintaining our thought leadership position in inbound marketing, sales, services, operations and content management is an important element in attracting new customers. We devote significant resources to develop and maintain our thought leadership position, with a focus on identifying and interpreting emerging trends in the inbound experience, shaping and guiding industry dialog and creating and sharing the best inbound practices. Our activities related to developing and maintaining our thought leadership may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in such effort. We rely upon the continued services of our management and employees with domain expertise with inbound marketing, sales, services, operations, and content management, and the loss of any key employees in this area could harm our competitive position and reputation. If we fail to successfully grow and maintain our thought leadership position, we may not attract enough new customers or retain our existing customers, and our business could suffer.

If we fail to further enhance our brand and maintain our existing strong brand awareness, our ability to expand our customer base will be impaired and our financial condition may suffer.

We believe that our development of the HubSpot brand is critical to achieving widespread awareness of our existing and future inbound experience solutions, and, as a result, is important to attracting new customers and maintaining existing customers. In the past, our efforts to build our brand have involved significant expenses, and we believe that this investment has resulted in strong brand recognition in the B2B market. Successful promotion and maintenance of our brands will depend largely on the effectiveness of our marketing efforts and on our ability to provide a reliable and useful CRM Platform at competitive prices. Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in building our brand. If we fail to successfully promote and maintain our brand, our business could suffer.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards and changing customer needs or requirements, our CRM Platform may become less competitive.

Our future success depends on our ability to adapt and innovate our CRM Platform. To attract new customers and increase revenue from existing customers, we need to continue to enhance and improve our offerings to meet customer needs at prices that our customers are willing to pay. Such efforts will require adding new functionality and responding to technological advancements, which will increase our research and development costs. If we are unable to develop new applications that address our customers’ needs, or to enhance and improve our platform in a timely manner, we may not be able to maintain or increase market acceptance of our platform. Our ability to grow is also subject to the risk of future disruptive technologies. Access and use of our CRM Platform is provided via the cloud, which, itself, was disruptive to the previous enterprise software model. If new technologies emerge that are able to deliver inbound marketing software and related applications at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.

If we fail to offer high-quality customer support, our business and reputation may suffer.

High-quality education, training and customer support are important for the successful marketing, sale and use of our CRM Platform and for the renewal of existing customers. Providing this education, training and support requires that our personnel who manage our online training resource, HubSpot Academy, or provide customer support have specific inbound experience domain knowledge and expertise, making it more difficult for us to hire qualified personnel and to scale up our support operations. The importance of high-quality customer support will increase as we expand our business and pursue new customers. If we do not help our customers use multiple applications within our CRM Platform and provide effective ongoing support, our ability to sell additional functionality and services to, or to retain, existing customers may suffer and our reputation with existing or potential customers may be harmed.

We may not be able to scale our business quickly enough to meet our customers’ growing needs and if we are not able to grow efficiently, our operating results could be harmed.

As usage of our CRM Platform grows and as customers use our platform for additional inbound applications, such as sales and services, we will need to devote additional resources to improving our application architecture, integrating with third-party systems and maintaining infrastructure performance. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support and professional services, to serve our growing customer base, particularly as our customer demographics change over time. Any failure of or delay in these efforts could cause impaired system performance and reduced customer satisfaction. These issues could reduce the attractiveness of our CRM Platform to customers, resulting in decreased sales to new customers, lower renewal rates by existing customers, the issuance of service credits, or requested refunds, which could impede our revenue growth and harm our reputation. Even if we are able to upgrade our systems and expand our staff, any such expansion will be expensive and complex, requiring management’s time and attention. We could also face inefficiencies or operational failures as a result of our efforts to scale our infrastructure. Moreover, there are inherent risks associated with upgrading, improving and expanding our information technology systems. We cannot be sure that the expansion and improvements to our infrastructure and systems will be fully or effectively implemented on a timely basis, if at all. These efforts may reduce revenue and our margins and adversely affect our financial results.

To remain competitive, we must continue to develop new product offerings, applications, features and enhancements to our existing CRM Platform. Maintaining adequate research and development personnel and resources to meet the demands of the market is essential. If we are unable to develop our platform internally due to certain constraints, such as high employee turnover, lack of management ability or a lack of other research and development resources, we may miss market opportunities. Further, many of our competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors could materially adversely affect our business.

Changes in the sizes or types of businesses that purchase our platform or in the applications within our CRM Platform purchased or used by our customers could negatively affect our operating results.

Our strategy is to sell subscriptions to our CRM Platform to mid-sized businesses, but we have sold and will continue to sell to organizations ranging from small businesses to enterprises. Our gross margins can vary depending on numerous factors related to the implementation and use of our CRM Platform, including the sophistication and intensity of our customers’ use of our platform and the level of professional services and support required by a customer. Sales to enterprise customers may entail longer sales cycles and more significant selling efforts. Selling to small businesses may involve greater credit risk and uncertainty. If there are changes in the mix of businesses that purchase our platform or the mix of the product plans purchased by our customers, our gross margins could decrease and our operating results could be adversely affected.

We have in the past completed acquisitions and may acquire or invest in other companies or technologies in the future, which could divert management’s attention, fail to meet our expectations, result in additional dilution to our stockholders, increase expenses, disrupt our operations or harm our operating results.

We have in the past acquired, and we may in the future acquire or invest in, businesses, products or technologies that we believe could complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. We may not be able to fully realize the anticipated benefits of historical or any future acquisitions. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

There are inherent risks in integrating and managing acquisitions. If we acquire additional businesses, we may not be able to assimilate or integrate the acquired personnel, operations and technologies successfully or effectively manage the combined business following the acquisition and our management may be distracted from operating our business. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including: unanticipated costs or liabilities associated with the acquisition; incurrence of acquisition-related costs, which would be recognized as a current period expense; inability to generate sufficient revenue to offset acquisition or investment costs; the inability to maintain relationships with customers and partners of the acquired business; the difficulty of incorporating acquired technology and rights into our platform and of maintaining quality and security standards consistent with our brand; delays in customer purchases due to uncertainty related to any acquisition; the need to integrate or implement additional controls, procedures and policies; challenges caused by distance, language and cultural differences; harm to our existing business relationships with business partners and customers as a result of the acquisition; the potential loss of key employees; use of resources that are needed in other parts of our business and diversion of management and employee resources; and

use of substantial portions of our available cash or the incurrence of debt to consummate the acquisition. Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses which are not discovered by due diligence during the acquisition process. Generally, if an acquired business fails to meet our expectations, our operating results, business and financial condition may suffer. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our business, results of operations or financial condition.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to goodwill and other intangible assets, which must be assessed for impairment at least annually. If our acquisitions do not ultimately yield expected returns, we may be required to make charges to our operating results based on our impairment assessment process, which could harm our results of operations.

Because our long-term growth strategy involves further expansion of our sales to customers outside the United States, our business will be susceptible to risks associated with international operations.

A component of our growth strategy involves the further expansion of our operations and customer base internationally. We have formed several international entities and may plan to form additional entities in the future. These international operations focus primarily on sales, professional services and support, and select international locations have development teams. Our current international operations and future initiatives will involve a variety of risks, including:

•

difficulties in maintaining our company culture with a dispersed and distant workforce;

•

more stringent regulations relating to data security and the unauthorized use of, or access to, commercial and personal data, particularly in the European Union;

•

unexpected changes in regulatory requirements, taxes or trade laws;

•

differing labor regulations, especially in the European Union, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations;

•

challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits and compliance programs;

•

difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems and regulatory systems;

•

currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we chose to do so in the future;

•

global economic uncertainty caused by global political events;

•

limitations on our ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries;

•

limited or insufficient intellectual property protection;

•

international disputes, wars (such as the conflict between Russia and Ukraine), political instability or terrorist activities; and resulting economic instability;

•

likelihood of potential or actual violations of domestic and international anticorruption laws, such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, or of U.S. and international export control and sanctions regulations, which likelihood may increase with an increase of sales or operations in foreign jurisdictions and operations in certain industries; and

•

adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash.

Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If in the future, we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and operating results will suffer. We continue to implement policies and procedures to facilitate our compliance with U.S. laws and regulations applicable to or arising from

our

international business. Inadequacies in our past or current compliance practices may increase the risk of inadvertent violations of such laws and regulations, which could lead to financial and other penalties that could damage our reputation and impose costs on us.

In January 2023, we began implementing our Restructuring Plan that is designed to reduce operating costs and enable investment in key opportunities for long-term growth while driving continued profitability. The Restructuring Plan includes a reduction of the Company’s current workforce by approximately 7% and a lease consolidation to create higher density across our workspaces. The Company estimates that it will incur charges of approximately $72.0 million to $105.0 million in connection with the Restructuring Plan, consisting primarily of cash expenditures. $24.0 million to $31.0 million of the charges under the Restructuring Plan are related to employee severance costs and $48.0 million to $74.0 million of the charges are related to lease consolidation.

The estimates of the charges and expenditures that we expect to incur in connection with the Restructuring Plan, and timing thereof, are subject to a number of assumptions, including local law requirements in various jurisdictions, and we may incur costs that are greater than we currently expect in connection with the Restructuring Plan.

The Restructuring Plan may yield unintended consequences and costs, such as the loss of institutional knowledge and expertise, employee attrition beyond our intended reduction in force, a reduction in morale among our remaining employees, greater-than-anticipated costs incurred in connection with implementing the Restructuring Plan, and the risk that we may not achieve the benefits from the Restructuring Plan to the extent or as quickly as we anticipate, all of which may have a material adverse effect on our results of operations or financial condition. These restructuring initiatives could place substantial demands on our management and employees, which could lead to the diversion of our management’s and employees’ attention from other business priorities. In addition, while certain positions have been eliminated in connection with the Restructuring Plan, certain functions necessary to our reduced operations remain, and we may be unsuccessful in distributing the duties and obligations of departed employees among our remaining employees or to external service providers, which could result in disruptions to our operations. We may also discover that the workforce reduction and other restructuring efforts will make it difficult for us to pursue new opportunities and initiatives and require us to hire qualified replacement personnel, which may require us to incur additional and unanticipated costs and expenses. We may further discover that, despite the implementation of our Restructuring Plan, we may require additional capital to continue expanding our business, and we may be unable to obtain such capital on acceptable terms, if at all. Our failure to successfully accomplish any of the above activities and goals may have a material adverse impact on our business, financial condition, and results of operations.

Risks Related to Employee Matters

If we cannot maintain our company culture as we experience changes in our workforce, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success and our business may be harmed.

We believe that a critical component to our success has been our company culture, which is based on transparency and personal autonomy. We have invested substantial time and resources in building our team within this company culture. In January 2023, we authorized a workforce reduction impacting approximately 7% of our workforce as part of our Restructuring Plan. The workforce reduction may make it more difficult to preserve our company culture and may negatively impact employee morale. In 2020, we made the decision to permanently move to a hybrid workplace model, which means our employees have the option to be fully remote, work full-time from one of our offices, or work both in the office and remotely. Preservation of our corporate culture has been made more difficult as a majority of our workforce has been working from home in connection with our hybrid workplace model, and may become more difficult due to the changes resulting from the Restructuring Plan. Any failure to preserve our culture could negatively affect our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives. As we grow and continue to develop our company infrastructure, and experience organizational change, we may find it difficult to maintain these important aspects of our company culture and our business may be adversely impacted.

We rely on our management team and other key employees, and the loss of one or more key employees could harm our business.

Our success and future growth depend upon the continued services of our management team, including our co-founders, Brian Halligan and Dharmesh Shah, our chief executive officer, Yamini Rangan, and other key employees in the areas of research and development, marketing, sales, services, operations, content management, and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. We also are dependent on the continued service of our existing software engineers and information technology personnel because of the complexity of our platform, technologies and infrastructure. We may terminate any employee’s employment at any

time, with or without cause, and any employee may resign at any time, with or without cause. We do not have employment agreements with any of our key personnel. The loss of one or more of our key employees could harm our business.

The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy.

To execute our business strategy, we must attract and retain highly qualified personnel. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing and managing cloud-based software, as well as for skilled information technology, marketing, sales and operations professionals, and we may not be successful in attracting and retaining the professionals we need. Also, inbound sales, marketing, services, operations, and content management domain experts are very important to our success and are difficult to replace. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and difficulty in retaining highly skilled employees with appropriate qualifications. In particular, we have experienced a competitive hiring environment in the Greater Boston area, where we are headquartered and will continue to experience a competitive hiring environment as we recruit for remote talent worldwide. Many of the companies with which we compete for experienced personnel have greater resources than we do. The change by companies to offer a remote or hybrid work environment may increase the competition for such employees from employers outside of our traditional office locations. The workforce reduction we are implementing as part of our Restructuring Plan may negatively impact our ability to attract, integrate, retain and motivate highly qualified employees, and may harm our reputation with current or prospective employees. In addition, if we choose to no longer offer a remote or hybrid work environment, we may face more difficulty in retaining our workforce. Further, labor is subject to external factors that are beyond our control, including our industry’s highly competitive market for skilled workers and leaders, cost inflation, and workforce participation rates. In addition, if our reputation were to be harmed, whether as a result of media, legislative, or regulatory scrutiny or otherwise, it could make it more difficult to attract and retain personnel that are critical to the success of our business.

In addition, in making employment decisions, particularly in the software industry, job candidates often consider the value of equity incentives they are to receive in connection with their employment. If the price of our stock declines, or experiences significant volatility, our ability to attract or retain key employees will be adversely affected. If we fail to attract new personnel or fail to retain and motivate our current personnel, our growth prospects could be severely harmed.

Risks Related to Global Economic Conditions

We are exposed to fluctuations in currency exchange rates that could adversely affect our financial results.

We face exposure to movements in currency exchange rates, which may cause our revenue and operating results to differ materially from expectations. As we have expanded our international operations, our exposure to exchange rate fluctuations has increased, in particular with respect to the Euro, British Pound Sterling, Australian Dollar, Singapore Dollar, Japanese Yen, Colombian Peso, and Canadian Dollar. Fluctuations in the value of the U.S. dollar versus foreign currencies may impact our operating results when translated into U.S. dollars. Thus, our results of operations and cash flows are subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign currency exchange rates. As exchange rates vary, revenue, cost of revenue, operating expenses and other operating results, when re-measured, may differ materially from expectations. In addition, our operating results are subject to fluctuation if our mix of U.S. and foreign currency denominated transactions and expenses changes in the future. While we have limited currency exchange exposure to the Russian, Belarusian and Ukrainian currencies, we expect exchange rates with respect to these currencies to be volatile and other exchange rates may also be more volatile than normal as a result of the ongoing conflict between Russia and Ukraine. Such volatility, even when it increases our revenues or decreases our expenses, impacts our ability to predict our future results and earnings accurately. Although we may apply certain strategies to mitigate foreign currency risk, these strategies might not eliminate our exposure to foreign exchange rate fluctuations and would involve costs and risks of their own, such as ongoing management time and expertise, external costs to implement the strategies and potential accounting implications. Additionally, as we anticipate growing our business further outside of the United States, the effects of movements in currency exchange rates will increase as our transaction volume outside of the United States increases.

Weakened global economic conditions may harm our industry, business and results of operations.

Our overall performance depends in part on worldwide economic conditions. Global financial developments and downturns seemingly unrelated to us or the software industry may harm us. The United States and other key international economies have been affected from time to time by falling demand for a variety of goods and services, restricted credit, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, bankruptcies, inflation and overall uncertainty with respect to the economy, including with respect to tariff and trade issues. Weak economic conditions or significant uncertainty regarding the stability of financial markets related to stock market volatility, inflation, recession, changes in tariffs, trade agreements or

governmental fiscal, monetary and tax policies, among others, could adversely impact our business, financial condition and operating results. Further, weak market conditions have, and could in the future result in, impairment of our investments and long-lived assets.

Further, the economies of countries in Europe have been experiencing weakness associated with high sovereign debt levels, weakness in the banking sector, uncertainty over the future of the Euro zone and volatility in the value of the pound sterling and the Euro and instability resulting from the ongoing conflict between Russia and Ukraine. The effect of the conflict between Russia and Ukraine, including any resulting sanctions, export controls or other restrictive actions that may be imposed against governmental or other entities in, for example, Russia, have in the past contributed and may in the future contribute to disruption, instability and volatility in the global markets. We have operations, as well as current and potential new customers, throughout Europe. If economic conditions in Europe and other key markets for our platform continue to remain uncertain or deteriorate further, it could adversely affect our customers’ ability or willingness to subscribe to our platform, delay prospective customers’ purchasing decisions, reduce the value or duration of their subscriptions or affect renewal rates, all of which could harm our operating results.

More recently, global inflation rates have increased to levels not seen in several decades, which may result in decreased demand for our products and services, increases in our operating costs, including our labor costs, constrained credit and liquidity, reduced government spending and volatility in financial markets. The Federal Reserve and other international government agencies have raised, and may again raise, interest rates in response to concerns over inflation risk. Increases in interest rates on credit and debt that would increase the cost of any borrowing that we may make from time to time and could impact our ability to access the capital markets. Increases in interest rates, especially if coupled with reduced government spending and volatility in financial markets, may have the effect of further increasing economic uncertainty and heightening these risks. In an inflationary environment, we may be unable to raise the sales prices of our products and services at or above the rate at which our costs increase, which could/would reduce our profit margins and have a material adverse effect on our financial results and net income. We also may experience lower than expected sales and potential adverse impacts on our competitive position if there is a decrease in consumer spending or a negative reaction to our pricing. A reduction in our revenue would be detrimental to our profitability and financial condition and could also have an adverse impact on our future growth.

There continues to be uncertainty in the changing market and economic conditions, including the possibility of additional measures that could be taken by the Federal Reserve and other domestic and international government agencies, related to concerns over inflation risk. A sharp rise in interest rates could have an adverse impact on the fair market value of certain securities in our portfolio and investments in some financial instruments could pose risks arising from market liquidity and credit concerns, which could adversely affect our financial results.

The current economic downturn may lead to decreased demand for our products and services and otherwise harm our business and results of operations.

Our overall performance depends, in part, on worldwide economic conditions. In recent months, we have observed increased economic uncertainty in the United States and abroad. Impacts of such economic weakness include:

•

falling overall demand for goods and services, leading to reduced profitability;

•

reduced credit availability;

•

higher borrowing costs;

•

reduced liquidity;

•

volatility in credit, equity and foreign exchange markets; and

•

bankruptcies.

These developments could lead to inflation, higher interest rates, and uncertainty about business continuity, which may adversely affect our business and our results of operations. As our customers react to global economic conditions and the potential for a global recession, we may see them reduce spending on our products and take additional precautionary measures to limit or delay expenditures and preserve capital and liquidity. Reductions in spending on our solutions, delays in purchasing decisions, lack of renewals, inability to attract new customers, as well as pressure for extended billing terms or pricing discounts, would limit our ability to grow our business and could negatively affect our operating results and financial condition.

Risks Related to Our Technical Operations Infrastructure and Dependence on Third Parties

We currently serve the majority of our platform functions from third-party data center hosting facilities operated by Amazon Web Services in the United States and Europe. We also have several colocations which host certain critical services (for example, VPN access) in various locations around the world. In addition, we use Cloudflare Global CDN to optimize content delivery across our locations.

Any damage to, or failure of, the systems of our third-party providers could result in interruptions to our platform. Despite precautions taken at our data centers, the occurrence of spikes in usage volume, a natural disaster, such as earthquakes or hurricane, an act of terrorism, vandalism or sabotage, a decision to close a facility without adequate notice, power or telecommunications failures or other unanticipated problems at a facility could result in lengthy interruptions in the availability of our on-demand software. In the event that any of our third-party facilities arrangements is terminated, or if there is a lapse of service or damage to a facility, we could experience interruptions in our platform as well as delays and additional expenses in arranging new facilities and services. Even with current and planned disaster recovery arrangements, our business could be harmed. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce our revenue, subject us to liability and cause us to issue credits or cause customers to fail to renew their subscriptions, any of which could materially adversely affect our business.

Our CRM Platform and its underlying infrastructure are inherently complex and may contain material defects or errors. We release modifications, updates, bug fixes and other changes to our software several times per day, without traditional human-performed quality control reviews for each release. We have from time to time found defects in our software and may discover additional defects in the future. We may not be able to detect and correct defects or errors before customers begin to use our platform or its applications. Consequently, we or our customers may discover defects or errors after our platform has been implemented. Defects or errors could result in product outages and could also cause inaccuracies in the data we collect and process for our customers, or even the loss, damage or inadvertent release of such confidential data. We implement bug fixes and upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes and upgrades in a timely manner, any history of product outages, defects or inaccuracies in the data we collect for our customers, or the loss, damage or inadvertent release of confidential data could cause our reputation to be harmed, and customers may elect not to purchase or renew their agreements with us. Furthermore, these issues could subject us to service performance credits (whether offered by us or required by contract), warranty claims or increased insurance costs. The costs associated with product outages, any material defects or errors in our platform or other performance problems may be substantial and could materially adversely affect our operating results.

In addition, third-party applications and features on our CRM Platform may not meet the same quality standards that we apply to our own development efforts and, to the extent they contain bugs, vulnerabilities or defects, they may create disruptions in our customers’ use of our products, lead to data loss, unauthorized access to customer data, damage our brand and reputation and affect the continued use of our products, any of which could harm our business, results of operations and financial condition.

If our information technology systems, including our CRM Platform, have outages or fail due to defects or similar problems, and if we fail to correct any defect or other software problems, it could disrupt our internal operations or services provided to customers, and could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price.

We rely on our information technology systems, including the sustained and uninterrupted performance of our CRM Platform, to manage numerous aspects of our business, including marketing, sales, content management, customer service and other internal operations. Our information technology systems are an essential component of our business and any disruption could significantly limit our ability to manage and operate our business efficiently.

remediating them could be more expensive, time-consuming, disruptive and resource intensive than planned. Such disruptions could adversely impact our internal operations and interrupt other processes. Delayed sales, lower margins or lost customers resulting from these disruptions could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price.

We are dependent on the continued availability of third-party data hosting and transmission services.

A significant portion of our operating cost is from our third-party data hosting and transmission services, including Amazon Web Services (“AWS”), which hosts the substantial majority of our products and platform. If the costs for such services increase due to vendor consolidation, regulation, contract renegotiation, or otherwise, we may not be able to increase the fees for our CRM Platform or services to cover the changes, which could have a negative impact on our operating results.

Additionally, our customers need to be able to access our platform at any time, without interruption or degradation of performance. AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We have experienced, and expect that in the future we may experience interruptions, delays and outages in service and availability due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints. In some instances, including because we do not control our service providers, we may not be able to identify the cause or causes of these problems within a period of time acceptable to our customers. Additionally, as our business continues to grow, to the extent that we do not effectively address capacity constraints, through our providers of cloud infrastructure, our results of operations may be adversely affected. In addition, any changes in service levels from our service providers may adversely affect our ability to meet our customers’ requirements, result in negative publicity which could harm our reputation and brand and may adversely affect the usage of our platform.

If we do not or cannot maintain the compatibility of our CRM Platform with third-party applications that our customers use in their businesses, our revenue will decline.

A significant percentage of our customers choose to integrate our platform with certain capabilities provided by third-party application providers using application programming interfaces (“APIs”) published by these providers. The functionality and popularity of our CRM Platform depends, in part, on our ability to integrate our platform with third-party applications and platforms, including CRM, CMS, e-commerce, call center, analytics and social media sites that our customers use and from which they obtain data. Third-party providers of applications and APIs may change the features of their applications and platforms, restrict our access to their applications and platforms, or alter the terms governing use of their applications and APIs and access to those applications and platforms in an adverse manner. Such changes could functionally limit or terminate our ability to use these third-party applications and platforms in conjunction with our platform, which could negatively impact our offerings and harm our business. If we fail to integrate our platform with new third-party applications and platforms that our customers use for marketing, sales, services, operations or content management purposes, or fail to renew existing relationships pursuant to which we currently provide such integration, we may not be able to offer the functionality that our customers need, which would negatively impact our ability to generate new revenue or maintain existing revenue and adversely impact our business.

We rely on data provided by third parties, the loss of which could limit the functionality of our platform and disrupt our business.

Select functionality of our CRM Platform depends on our ability to deliver data, including search engine results and social media updates, provided by unaffiliated third parties, such as Facebook, Google, LinkedIn and Twitter. Some of this data is provided to us pursuant to third-party data sharing policies and terms of use, under data sharing agreements by third-party providers or by customer consent. In the future, any of these third parties could change its data sharing policies, including making them more restrictive, or alter its algorithms that determine the placement, display, and accessibility of search results and social media updates, any of which could result in the loss of, or significant impairment to, our ability to collect and provide useful data to our customers. These third parties could also interpret our, or our service providers’ data collection policies or practices as being inconsistent with their policies, which could result in the loss of our ability to collect this data for our customers. Any such changes could impair our ability to deliver data to our customers and could adversely impact select functionality of our platform, impairing the return on investment that our customers derive from using our solution, as well as adversely affecting our business and our ability to generate revenue.

Privacy concerns and end users’ acceptance of Internet behavior tracking may limit the applicability, use and adoption of our CRM Platform.

Privacy concerns may cause end users to resist providing the personal data necessary to allow our customers to use our platform effectively. We have implemented various features intended to enable our customers to better protect end user privacy, but these measures may not alleviate all potential privacy concerns and threats. Even the perception of privacy concerns, whether or not valid, may inhibit market adoption of our platform. Privacy advocacy groups and the technology and other industries are considering various

new, additional or different self-regulatory standards that may place additional burdens on us. The costs of compliance with, and other burdens imposed by these groups’ policies and actions may limit the use and adoption of our CRM Platform and reduce overall demand for it, or lead to significant fines, penalties or liabilities for any noncompliance or loss of any such action.

Our operations involve the storage and transmission of data of our customers and their customers, including personal data. Our storage is typically the sole source of record for portions of our customers’ businesses and end user data, such as initial contact information and online interactions. Security incidents could result in unauthorized access to, loss of or unauthorized disclosure of this information, litigation, indemnity obligations and other possible liabilities, as well as negative publicity, which could damage our reputation, impair our sales and harm our customers and our business. Cyber-attacks and other malicious Internet-based activity continue to increase generally, and cloud-based platform providers of marketing services have been targeted. If our security measures, or those of our service providers, are compromised as a result of third-party action, employee or customer error, malfeasance, stolen or fraudulently obtained log-in credentials or otherwise, our reputation could be damaged, our business may be harmed and we could incur significant liability. Additionally, if third parties with whom we work, such as vendors or developers, violate applicable laws, our security policies or our acceptable use policy, such violations may also put our customers’ information at risk and could in turn have an adverse effect on our business. In addition, if the security measures of our customers or our service providers are compromised, even without any actual compromise of our own systems, we may face negative publicity or reputational harm if our customers or anyone else incorrectly attributes the blame for such security breaches to us or our systems. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because they change frequently and generally are not detected until after an incident has occurred. As we increase our customer base and our brand becomes more widely known and recognized, we may become more of a target for third parties seeking to compromise our security systems or gain unauthorized access to our customers’ data. Additionally, we provide extensive access to our database, which stores our customer data, to our development team to facilitate our rapid pace of product development. If such access or our own operations cause the loss, damage or destruction of our customers’ business data, their sales, lead generation, support and other business operations may be permanently harmed. As a result, our customers may bring claims against us for lost profits and other damages, or such concerns may cause us to limit access by our development team. Additionally, in certain of our subscription agreements with our customers, we agree to indemnify these customers against claims by a third party alleging our breach of confidentiality obligations or our misuse of customer data in violation of the subscription agreement.

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including phishing) are prevalent in our industry, the industries of certain of our service providers and our customers' industries. Our internal computer systems and those of our current and any future strategic collaborators, vendors, and other contractors or consultants are vulnerable to damage from cyber-attacks, computer viruses, unauthorized access, natural disasters, cybersecurity threats, terrorism, war and telecommunication and electrical failures. Accordingly, if our cybersecurity measures or those of our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), compromise or the mishandling of data by our employees and contractors, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected. Cyber incidents have been increasing in sophistication and frequency and can include third parties gaining access to employee or customer data using stolen or inferred credentials, computer malware, viruses, spamming, phishing attacks, ransomware, card skimming code, and other deliberate attacks and attempts to gain unauthorized access. The techniques used to sabotage or to obtain unauthorized access to our platform, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Because the techniques used by threat actors who may attempt to penetrate and sabotage our computer systems change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Additionally, during the COVID-19 pandemic, and potentially beyond as remote work and resource access expand, there is an increased risk that we may experience cybersecurity-related events such as COVID-19 themed phishing attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number of cybersecurity threats or attacks, and other security challenges as a result of most of our employees and our service providers continuing to work remotely from non-corporate managed networks. There is also a risk of potential increase in such attacks due to cyberwarfare in connection with the ongoing conflict between Russia and Ukraine, and this could adversely affect our and our suppliers' ability to maintain or enhance key cybersecurity and data protection measures. We have previously been, and may in the future become, the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data, systems, or infrastructure, or to disrupt our operations or ability to provide our services.

Additionally, it is also possible that unauthorized access to sensitive customer and business data may be obtained through inadequate use of security controls by our customers, suppliers or other vendors. While we are not currently aware of any material impact that the SolarWinds, Log4j, Kaseya, or other recent supply chain attacks had on our business, new information on the scope of such attacks is continuing to emerge and there is a residual risk that we may experience a security breach arising from one of these, or

a similar, supply chain attack in the future. Supply chain attacks are becoming increasingly common, and we may not be able to anticipate and prevent negative impacts from such an attack. If we are impacted by a supply chain attack, we could incur liability, our competitive position could be harmed and the further development and commercialization of our product and services could be hindered or delayed.

Recent cybersecurity incidents and compromises affecting large institutions, including an incident that affected us, suggest that the risk of such events is significant, even if privacy protection and security measures are implemented and enforced. A cyber-attack could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other proprietary information or other disruptions. These cyber-attacks could be carried out by threat actors of all types (including but not limited to nation states, organized crime, other criminal enterprises, individual actors and/or advanced persistent threat groups). In addition, we may experience intrusions on our physical premises by any of these threat actors. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, incur significant costs associated with remediation and the implementation of additional security measures, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants, and our competitive position could be harmed. Any breach, loss, or compromise of personal data may also subject us to civil fines and penalties, or claims for damages either under the General Data Protection Regulation (the “EU GDPR”), the EU GDPR as incorporated into United Kingdom law, and relevant member state law in the European Union, other foreign laws, and other relevant state and federal privacy laws in the United States.

Many governments have enacted laws requiring companies to notify individuals of data security incidents or unauthorized transfers involving certain types of personal data. In addition, the data processing agreement we execute with our customers contractually requires us to notify them of any personal data breach. Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information that we store, or that is stored by our direct payment card processing vendors, we could be liable to the payment card issuing banks for their cost of issuing new cards and related expenses. Data breaches and other data security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which may lead to widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could materially and adversely affect our business and operating results.

There can be no assurance that any limitations of liability provisions in our contracts for a security breach would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, financial condition and operating results.

Risks Related to Intellectual Property

Our business may suffer if it is alleged or determined that our technology infringes the intellectual property rights of others.

The software industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets and other intellectual and proprietary rights. Companies in the software industry, including those in marketing software, are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. Many of our competitors and other industry participants have been issued patents and/or have filed patent applications and may assert patent or other intellectual property rights within the industry. Moreover, in recent years, individuals and groups that are non-practicing entities, commonly referred to as “patent trolls,” have purchased patents and other intellectual property assets for the purpose of making claims of infringement in order to extract settlements. From time to time, we may receive threatening letters or notices or may be the subject of claims that our services and/or platform and underlying technology infringe or violate the intellectual property rights of others. Responding to such claims, regardless of their merit, can be time consuming, costly to defend in litigation, divert management’s attention and resources, damage our reputation and brand and cause us to incur significant expenses. Our technologies may not be able to withstand any third-party claims or rights against their use. Claims of intellectual property infringement might require us to redesign our application, delay releases, enter into costly settlement or license agreements or pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our platform. If we cannot or do not license the infringed technology on reasonable terms or at all, or substitute similar technology from another source, our revenue and operating results could be adversely impacted. Additionally, our customers may not purchase our CRM Platform if they are concerned that they may infringe third-party intellectual property rights. The occurrence of any of these events may have a material adverse effect on our business.

In certain of our subscription agreements with customers, we agree to indemnify these customers against claims by a third party alleging infringement of a valid patent, registered copyright or registered trademark. However, whether or not a subscription agreement includes an indemnity obligation in favor of a customer, there can be no assurance that customers will not assert a common law indemnity claim or that any existing limitations of liability provisions in our contracts would be enforceable or adequate, or would otherwise protect us from any such liabilities or damages with respect to any particular claim. Our customers who are accused of intellectual property infringement may in the future seek indemnification from us under common law or other legal theories. If such claims are successful, or if we are required to indemnify or defend our customers from these or other claims, these matters could be disruptive to our business and management and have a material adverse effect on our business, operating results and financial condition.

If we fail to adequately protect our proprietary rights, in the United States and abroad, our competitive position could be impaired and we may lose valuable assets, experience reduced revenue and incur costly litigation to protect our rights.

Our success is dependent, in part, upon protecting our proprietary technology. We rely on a combination of copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and protect our proprietary rights in our products and services. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Any of our trademarks or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our technology and use information that we regard as proprietary to create products and services that compete with ours. Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our offerings may be unenforceable under the laws of certain jurisdictions and foreign countries. In addition, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States. To the extent we expand our international activities, our exposure to unauthorized copying and use of our technology and proprietary information may increase.

We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances. No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements may not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our platform and offerings.

We may be required to spend significant resources to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation, could delay further sales or the implementation of our platform and offerings, impair the functionality of our platform and offerings, delay introductions of new features or enhancements, result in our substituting inferior or more costly technologies into our platform and offerings, or injure our reputation.

Our use of “open source” software could negatively affect our ability to offer our platform and subject us to possible litigation.

A substantial portion of our cloud-based platform incorporates so-called “open source” software, and we may incorporate additional open source software in the future. Open source software is generally freely accessible, usable and modifiable. Certain open source licenses may, in certain circumstances, require us to offer the components of our platform that incorporate the open source software for no cost, that we make available source code for modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of the particular open source license. If an author or other third party that distributes open source software we use were to allege that we had not complied with the conditions of one or more of these licenses, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, including being enjoined from the offering of the components of our platform that contained the open source software and being required to comply with the foregoing conditions, which could disrupt our ability to offer the affected software. We could also be subject to suits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition and require us to devote additional research and development resources to change our products.

Risks Related to Government Regulation

We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security, and our actual or perceived failure to comply with such obligations could harm our business. Compliance with such laws could also impair our efforts to maintain and expand our customer base, and thereby decrease our revenue.

Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, including the U.S. Federal Trade Commission ("FTC"), and various state, local and foreign agencies. We collect personal data and other data from our customers, prospects, and partners. We also handle personal data about our customers’ customers. We use this information to provide services to our customers, to support, expand and improve our business. We may also share customers’ personal data with third parties as authorized by the customer or as described in our privacy policy.

The U.S. federal and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use and storage of personal data of individuals. In the United States, the FTC and many state attorneys general are applying federal and state consumer protection laws to impose standards for the online collection, use and dissemination of personal and other data. However, these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. Any failure or perceived failure by us to comply with privacy or security laws, policies, legal obligations or industry standards or any security incident that results in the unauthorized, disclosure, release or transfer of personal data or other customer data may result in governmental enforcement actions, litigation, fines and penalties and/or adverse publicity, and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Laws and regulations concerning privacy, data protection and information security are evolving, and changes to such laws and regulations could require us to change features of our platform or restrict our customers’ ability to collect and use email addresses, page viewing data and other personal data, which may reduce demand for our platform. Our failure to comply with federal, state and international data privacy laws and regulations could harm our ability to successfully operate our business and pursue our business goals. For example, the California Consumer Privacy Act (the “CCPA”), as amended by the California Privacy Rights Act (the "CPRA"), among other things, require covered companies to provide new disclosures to California consumers and afford such consumers the ability to opt-out of sales of personal data.

The CPRA, which amends the CCPA, took effect on January 1, 2023. The CPRA imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal data. The CPRA also creates a new state agency that will be vested with authority to implement regulations and enforce the CCPA and the CPRA. It is not yet fully clear how the CCPA and CPRA will be enforced and how certain of its requirements will be interpreted. The effects of the CCPA and CPRA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

Certain other state laws impose similar privacy obligations and we also expect that more states may enact legislation similar to the CCPA, which provides consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal data of such consumers. The CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

For example, on March 2, 2021, Virginia enacted the Consumer Data Protection Act (the “CDPA”). The CDPA became effective January 1, 2023. The CDPA will regulate how businesses (which the CDPA refers to as “controllers”) collect and share personal data. While the CDPA incorporates many concepts similar to the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of controllers. The new law will also govern how controllers collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests.

Also, on July 8, 2021, Colorado’s governor signed the Colorado Privacy Act (“CPA”) into law. The CPA will become effective July 1, 2023. The CPA is similar to Virginia’s CPDA but also contains additional requirements. The new measure applies to companies conducting business in Colorado or who produce or deliver commercial products or services intentionally targeted to its residents of the state that either: (1) control or process the personal data of at least 100,000 consumers during a calendar year; or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of at least 25,000 consumers. In addition, on March 24, 2022, Utah enacted the Utah Consumer Privacy Act (“UCPA”), which will become effective on December 31, 2023. Also, in May 2022, Connecticut Governor Lamont signed the Connecticut Data Privacy Act (“CTDPA”) into law, which takes effect on July 1, 2023. The UCPA and CTDPA draw heavily upon their predecessors in Virginia and Colorado.

With the CTDPA, Connecticut became the fifth state to enact a comprehensive privacy law. A number of additional other states have proposed bills for comprehensive consumer privacy laws and it is quite possible that certain of these bills will pass. The existence of comprehensive privacy laws in different states in the country, if enacted, will add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies regarding and the availability of personal data, and has resulted in and will result in increased compliance costs and/or changes in business practices and policies. At the federal level, a significant and potentially transformative bipartisan bill was considered during the 117th Congress. If passed, this proposed legislation, the American Data Privacy and Protection Act, would help to streamline certain of our privacy obligations, but would also introduce new stringent privacy and data security obligations that would apply to personal data we process.

In addition, many foreign jurisdictions in which we do business, including the European Union, Japan, United Kingdom, Canada, Australia, and others have laws and regulations dealing with the collection and use of personal data obtained from their residents, which are more restrictive in certain respects than those in the U.S. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personal data that identifies or may be used to identify an individual. In relevant part, these laws and regulations may affect our ability to engage in lead generation activities by imposing heightened requirements, such as affirmative opt-ins or consent prior to sending commercial correspondence or engaging in electronic tracking activities that aid our marketing and business intelligence. We may be required to modify our policies, procedures, and data processing measures in order to address requirements under these or other privacy, data protection, or cyber security regimes, and may face claims, litigation, investigations, or other proceedings regarding them and may incur related liabilities, expenses, costs, and operational losses.

In Japan, for example, the Act on the Protection of Personal Information (“APPI”) of Japan regulates privacy protection issues in Japan. The APPI shares similarities with the GDPR, including extraterritorial application and obligations to provide certain notices and rights to citizens of Japan. Amendments to the APPI that created new cross-border data transfer requirements and a new category of regulated information called “personal-related information” took effect in April 2022. In Japan, our email marketing activities are also subject to stringent regulation under the Law Concerning the Proper Transmission of Specified Electronic Mail and the Law for the Partial Amendment to the Law Concerning Specified Commercial Transactions.

In Canada, our collection, use, disclosure, and management of personal information must comply with both federal and provincial privacy laws, which impose separate requirements, but may overlap in some instances. The Personal Information Protection and Electronic Documents Act, or PIPEDA, applies in all Canadian provinces except Alberta, British Columbia and Québec, as well as to the transfer of consumer data across provincial borders. PIPEDA imposes stringent consumer data protection obligations, requires privacy breach reporting, and limits the purposes for which organizations may collect, use, and disclose consumer data. The provinces of Alberta, British Columbia, and Québec have enacted separate data privacy laws that are substantially similar to PIPEDA, but all three additionally apply to our handling of our own employees’ personal data within their respective provinces. Notably, Québec’s Act respecting the protection of personal information in the private sector, or the Private Sector Act, was amended by Bill 64, an Act to modernize legislative provisions as regards the protection of personal information, which introduced major amendments to the Private Sector Act, notably, to impose significant and stringent new obligations on Québec businesses while increasing the powers of Quebec’s supervisory authority. We may incur additional costs and expenses related to compliance with these laws and may incur significant liability if we are not able to comply with these laws. We are also subject to Canada’s anti-spam legislation, or CASL, which includes rules governing commercial electronic messages, which include marketing emails, text messages, and social media advertisements. Under these rules, we must follow certain standards when sending marketing communications, are prohibited from sending them to customers without their consent and can be held liable for violations.

Within the European Union, legislators adopted the EU GDPR, which became effective in May 2018, and which imposes heightened obligations and risk upon our business and which may substantially increase the penalties to which we could be subject in the event of any non-compliance. In addition, further to the United Kingdom's exit from the European Union on January 31, 2020, the GDPR ceased to apply in the United Kingdom at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the United Kingdom’s European Union (Withdrawal) Act 2018 incorporated the EU GDPR (as it existed on December 31, 2020 but subject to certain United Kingdom specific amendments) into United Kingdom law (the “UK GDPR”, together with the EU GDPR, the “GDPR”). The UK GDPR and the UK Data Protection Act 2018 set out the United Kingdom’s data protection regime, which is independent from but aligned to the European Union’s data protection regime. In addition, the UK has announced plans to reform the country’s data protection legal framework in its Data Reform Bill. This may lead to increased compliance costs as we may no longer be able to take a unified approach across the European Union and United Kingdom, and will need to amend our processes and procedures to align with the new framework. The Data Reform Bill could also, as a result of this divergence, threaten the United Kingdom adequacy decision that currently allows personal data to flow freely from the European Economic Area to the United Kingdom.

Non-compliance with the GDPR and the related national data protection laws of the European Union Member States may result in monetary penalties of up to €20 million (£17.5 million) or 4% of worldwide annual revenue, whichever is higher. Like the EU

GDPR, the UK GDPR restricts personal data transfers outside the United Kingdom to countries not regarded by the United Kingdom as providing adequate protection (this means that personal data transfers from the United Kingdom to the European Economic Area remain free flowing). Although the United Kingdom is regarded as a third country under the EU GDPR, the European Commission has issued a decision recognizing the United Kingdom as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the European Union to the United Kingdom remain unrestricted.

The proliferation of privacy and data protection laws has heightened risks and uncertainties concerning cross-border transfers of personal data and other data, which could impose significant compliance costs and expenses on our business, increase our potential exposure to regulatory enforcement and/or litigation, and have a negative effect on our existing business and on our ability to attract and retain new customers. On July 16, 2020, the European Court of Justice (“CJEU”), in Case C-311/18 (Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, or “Schrems II”), invalidated the EU–US Privacy Shield ruling that facilitated transfers of personal data from the European Economic Area to the U.S. because it failed to offer adequate protections for personal data. The CJEU, in the same decision, deemed that the Standard Contractual Clauses ("SCCs"), approved by the European Commission for transfers of personal data between European Union exporters and non-European Economic Area importers are valid, however the European Court of Justice deemed that transfers made pursuant to the SCCs need to be analyzed on a case-by-case basis to ensure the European Economic Area's standards of data protection are met. On June 4, 2021, the European Commission published new versions of the SCCs, which, since December 27, 2022 are required for all transfers of personal data from the European Union to third countries (including the U.S). The new versions of the SCCs seek to address the issues identified by the CJEU’s decision and provide further details regarding the transfer assessments that the parties are required to conduct when implementing the new SCCs. Our customer agreements include the updated SCCs and UK IDTA/Addendum. However, as a result of the Schrems II decision, companies may be required to adopt additional measures to accomplish transfers of personal data to the United States and other third countries in compliance with the GDPR, and there continue to be concerns about whether the SCCs will face additional challenges. Until the remaining legal uncertainties regarding how to legally continue these transfers are settled, we will continue to face uncertainty as to whether our customers will be permitted to transfer personal data to the United States for processing by us as part of our platform services. Our customers may view alternative data transfer mechanisms as being too costly, too burdensome, too legally uncertain or otherwise objectionable and therefore decide not to do business with us. For example, some of our customers or potential customers who do business in the European Economic Area may require their vendors to host all personal data within the European Economic Area and may decide to do business with one of our competitors who hosts personal data within the European Economic Area instead of doing business with us. In addition, some companies based in the European Economic Area may be reluctant to transfer personal data to us for processing outside the European Economic Area because of the burden on some requirements to conduct transfer impact assessments in order to rely on the SCCs as well as the substantial obligations that the recently updated SCCs impose upon data exporters. The United Kingdom is not subject to the new SCCs but, on March 21, 2022, the United Kingdom adopted new international data transfer agreement templates ("IDTAs")and/or UK Addendum to facilitate transfers of personal data from the United Kingdom. The IDTAs and/or UK Addendum must be entered into for new contracts concluded on or before September 21, 2022. For existing contracts, the IDTAs and/or UK Addendum allow for a transition period until March 21, 2024 in which controllers and processors may move to the new forms. We are in the process of transitioning to the IDTAs and UK Addendum and doing so will require significant effort and cost. The European Commission and the U.S. White House announced that they had reached an agreement in principle on a data transfer framework to replace the Privacy Shield. However, it is too soon to tell how this future framework will evolve and what impact it will have on our cross-border activities. The European Commission published a draft adequacy decision on this framework on December 13, 2022, which must now be reviewed by the European Data Protection Board. We continue to monitor developments with respect to cross-border transfers and any prospective impacts on our activities.

HUBS US Equity

HUBS · 10-K · period ended 2022-12-31

ITEM 1. Business 7

Item 1A. RISK FACTORS

HUBS US Equity☆

HUBS · 10-K · period ended 2022-12-31

ITEM 1. Business 7

Item 1A. RISK FACTORS

HUBS US Equity