AppFolio (APPF) Risk Analysis

The market for cloud-based business management solutions has relatively low barriers to entry and is global, highly competitive and continually evolving in response to a number of factors, including changes in technology, operational requirements, and laws and regulations. We compete with both other real estate industry cloud-based solution providers and providers of broad cloud-based solutions across multiple industries. We also face competition from numerous cloud-based solution providers that focus almost exclusively on one or more point solutions. Our competitors include established vendors, as well as newer entrants in the market. Our established competitors may have greater name recognition, longer operating histories, and significantly greater resources, which may allow them to respond more quickly and effectively to new or changing opportunities or challenges, technologies, operational requirements and industry standards. Our competitors who are new entrants to the market, and generally smaller, may have more nimble operations due to having fewer products and less overhead and may be willing to take legal and operational risks, which may allow them to launch products and meet customer demand more quickly and efficiently. Regardless of size, our current and potential competitors may develop, market and sell new technologies with comparable functionality to our products and services, which could cause us to lose customers, slow the rate of growth of new customers and/or cause us to decrease our prices to remain competitive. If we are unable to differentiate ourselves from our competitors and drive value for our customers or otherwise compete effectively against any of these competitive threats, our business, financial condition and results of operations could be harmed. Further, we expect to face more competition as AI continues to advance and be integrated into the markets in which we compete. Our competitors or other third parties may incorporate AI into their offerings more successfully and efficiently, and achieve greater and faster adoption, which could impair our ability to compete effectively and adversely affect our business and financial results. Other companies may obtain proprietary rights that would prevent, limit or interfere with our ability to make, use or sell our AI offerings. In addition, we have introduced, and expect to continue to introduce, variations to our pricing model that are intended to provide broader usage and better align the cost of our services to the value they provide our customers. Although we believe that these pricing changes will increase customer adoption and revenue, it is possible that they will not and may make our services less appealing, cause adoption friction, or that we could experience competitive pressure to adjust our pricing, which could negatively impact our business, revenue, and operating results.

Maintaining and enhancing our brands is critical to achieving widespread awareness and acceptance of our products and services as well as maintaining and expanding our customer base, which is a key component of our strategy. We expect the importance of brand recognition will increase as competition for our products and services increases. If we do not continue to build awareness of our brands, we will be at a competitive disadvantage compared to companies whose brands are, or become, more recognizable than ours. Maintaining and enhancing our brands requires us to make substantial investments, and these investments may not result in commensurate increases in our revenue. In addition, new and existing technologies, industry trends, and laws that restrict online advertising or that affect our ability to customize and target advertising may require us to significantly increase our marketing costs to generate and capture demand and maintain our brand awareness, level of sales, and operating results. Moreover, our efforts to maintain and enhance our brands could be impacted by negative publicity or reputational harm from adverse events, such as lawsuits, customer or third-party-service provider disputes, or cybersecurity incidents. If we fail to successfully maintain and enhance our brands, or if we make investments that are not offset by increased revenue, our operating results could be adversely affected.

Our business involves the storage, processing and transmission of sensitive and proprietary data and personal information collected by or on behalf of our customers, the personal information of our employees, customers, and prospective customers and our proprietary financial, operational and strategic information. Cyber attacks, malicious internet-based activity, online and offline fraud, and other similar activities may threaten the confidentiality, integrity, and availability of our information technology systems, or those of the third parties upon which we rely, along with the proprietary, confidential, and sensitive data stored in or processed by such systems. As our business grows, the number of individuals using our products, as well as the amount of information we collect, store, process, and transmit is increasing, and our brands are becoming more widely recognized, which makes us a greater target for malicious activity. We have incurred, and expect to continue to incur, significant expenses in connection with our efforts to keep our systems, products and networks protected and up to date. However, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. Furthermore, no security program can entirely eliminate the risk of human error, such as an employee's or contractor's failure to follow one or more security protocols, which has previously occurred and we expect will occur again despite our efforts to train our employees and contractors on cybersecurity issues and enforce our security protocols. Additionally, with many of our employees continuing to work remotely, we face an increased risk of attempted security breaches and incidents. Therefore, despite our significant efforts to keep our systems, products and networks protected and up to date, we may be unable to anticipate new modes for cyber attacks, detect security incidents or react to them in a timely manner, or implement adequate preventive measures, any of which may expose us to a risk of loss, harm to our reputation, litigation, fines, penalties, and potential liability. Computer malware, ransomware, viruses, social engineering (deepfakes, phishing, smishing and vishing attacks), denial of service or other attacks, employee theft or misuse, and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud service providers. The sophistication of these malicious attacks has also increased, and it appears that cyber crimes and cyber criminal networks, some of which may be state-supported, have substantial resources and may target U.S. enterprises or our customers and their use of our products. Furthermore, the risk of state-supported and geopolitical-related cyber attacks may increase in connection with ongoing global geopolitical tensions. In the past, we have had to take corrective action against cyber attackers to protect our cloud environment. If our security measures are, or are believed to have been breached or otherwise to have failed as a result of third-party action, employee error, malfeasance or otherwise, our reputation could be damaged, our business may suffer, and we could incur significant liability. In addition, some of our third-party service providers also collect, store, process, and transmit our sensitive information and our customers' data on our behalf. These service providers have experienced cybersecurity incidents in the past involving such information and data, and we expect they will continue to be subject to threats of cyber attacks and other malicious internet-based activities in the future. Our contracts with these third parties may not provide us with adequate remedies in the event of such an incident, which could also expose us to risk of loss, litigation, fines, penalties, and potential liability as well as reputational damage. If our security measures, or the security measures of our third-party service providers, are breached as a result of wrongdoing or malicious activity on the part of our employees, our third-party service providers' employees, our customers' employees, or any third party, or as a result of any human error or neglect, product defect or otherwise, and this results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access to personal data or other sensitive information, we could incur liability to our customers, employees, and to individuals or organizations whose information was being stored by us or our customers, as well as be subject to fines, penalties, or actions from payment processing networks or by governmental bodies. If we experience a widespread security breach, our insurance coverage may not offset liabilities actually incurred and insurance may not continue to be available to us on reasonable terms, or at all. In addition, security breaches could result in reputational damage, adversely affect our ability to attract new customers and cause existing customers to reduce or discontinue the use of our products and services. Furthermore, the perception by our current or potential customers that our products could be vulnerable to exploitation or that our security measures are inadequate, even in the absence of a particular problem or threat, could reduce market acceptance of our products and services and cause us to lose customers.

Our tax filings are subject to reviews and audits in various jurisdictions and the positions or assumptions we take may be challenged. Although we believe our tax positions are reasonable, it is possible that tax authorities may disagree with certain positions we have taken and an adverse outcome of such a review or audit could result in additional tax, interest and penalties, which could have a negative effect on our financial condition and operating results. In addition, defending our tax positions may be costly and a distraction to management, which may affect our operating results.

We collect, store, process, and transmit personal information relating to our employees, customers, prospective customers, and other individuals. Our customers use our platform to store and transmit a significant amount of personal information relating to their customers, vendors, employees and other industry participants. Federal and state government bodies and agencies have adopted, and are increasingly adopting, laws and regulations regarding the collection, storage, use, processing, security and transmission of personal information. For example, the California Consumer Privacy Act ("CCPA") requires certain privacy related disclosures and provides California consumers rights with respect to their personal information, including the right to request deletion of their personal information, receive the personal information on record for them, know what categories of personal information generally are maintained about them, and opt-out of certain sales and sharing of personal information for certain advertising purposes. The CCPA also granted a new state agency, the California Privacy Protection Agency, powers to adopt and enforce regulations interpreting the CCPA. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. In addition to California, we are currently subject to comprehensive privacy laws across multiple states, and in 2026, will be subject to new comprehensive privacy laws in Indiana, Kentucky, and Rhode Island. These new and existing privacy laws and regulations impose increasingly complex operational requirements and will likely increase the cost of compliance to support the delivery our services. We have incurred, and may in the future incur, substantial costs and expenses related to an increased exposure to regulatory enforcement and/or litigation. Despite our efforts, we cannot guarantee that we will be able to maintain full compliance with constantly evolving, and sometimes conflicting, data privacy laws in the jurisdictions in which we operate. If our privacy or data security measures fail to comply with current or future laws and regulations, we may be subject to claims, legal proceedings or other actions by individuals or governmental authorities based on privacy or data protection regulations and our privacy commitments to customers or others. Privacy advocates and industry groups may also propose various self-regulatory standards that may legally or contractually apply to our business. As new laws, regulations and industry standards take effect and we offer new services, we will need to understand and comply with various new requirements, which may impede our plans for growth or result in significant additional costs. These laws, regulations and industry standards have had, and will likely continue to have, negative effects on our business, including by increasing our costs and operating expenses, and/or delaying or impeding our deployment of new or existing core functionality or Value Added Services. Failure to comply with these laws, regulations and industry standards could result in negative publicity, subject us to fines or penalties, expose us to litigation, or result in demands that we modify or cease existing business practices. Furthermore, privacy concerns may cause residents, vendors, employees and other industry participants to resist providing the personal information necessary to allow our customers to use our applications effectively, which could reduce overall demand for our services. Any of these outcomes could adversely affect our business and operating results.

Our customers use our products to manage critical aspects of their businesses. Any errors, defects or other disruptions in our products, or the products of our third-party service providers upon which certain of our products are dependent, may result in loss of or damage to our customers' data and disruption to our customers' businesses, which could harm our reputation and subject us to potential liability. Such product problems could be caused by a variety of factors, including infrastructure changes, power or network outages, fire, flood or other natural disasters, human or software errors, viruses, security breaches, fraud or other malicious activity, spikes in customer usage or distributed denial of service attacks. In addition, we provide continuous updates to our products and these updates may contain undetected errors, defects or other disruptions when first introduced. In the past, we have discovered errors, defects, or other disruptions in our updates after they have been released, and similar problems may arise in the future. Real or perceived errors, defects, or other disruptions in our products or the products of our third-party service providers upon which certain of our products are dependent, could result in negative publicity, reputational harm, loss of customers, delay in market acceptance of our products and services, loss of competitive position, withholding or delay of payment to us, claims by customers for losses sustained by them and potential litigation or regulatory action. In any such event, we may be required to expend additional resources to correct the problem or we may choose to expend additional resources to take corrective action even when not required. The costs incurred in correcting any material errors, defects or other disruptions could be substantial. In addition, we may not carry insurance sufficient to offset any losses that may result from claims arising from such errors, defects or other disruptions.

Our success and future growth depend, in part, upon the continued services of our executive officers and other key employees. To execute our growth plan and achieve our strategic objectives, we must continue to retain and hire highly qualified and motivated personnel across our organization. In particular, to continue to enhance our products and services, add new and innovative core functionality and/or Value Added Services, as well as develop new products, it will be critical for us to maintain and, over time, grow the current skill set and abilities of our research and product development organization. Further, for us to achieve broader market acceptance of our products and services, grow our customer base, and pursue new markets consistent with our strategic plan, we will need to maintain and, over time, grow the current skill set and abilities of all of our employees, including but not limited to those in our research and product development, sales, marketing, and customer service and support organizations. Competition for personnel is intense within our industry and there continues to be upward pressure on the compensation paid, particularly with respect to personnel with backgrounds in AI and cybersecurity. Retaining, identifying, recruiting, and training qualified personnel is difficult and requires a significant investment of time and resources. Many of the companies with which we compete for personnel have greater name recognition and financial resources and may also employ a different compensation philosophy. As a result, we may experience greater challenges retaining and hiring skilled personnel than our competitors. In addition, existing and prospective employees often consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, we are unable to offer equity awards in competitive amounts, or the price of our Class A common stock experiences volatility, this may adversely affect our ability to retain and recruit highly skilled employees. If we are unable to retain and attract the personnel necessary to execute our growth plan, we may be unable to achieve our strategic objectives and our operating results may suffer. In addition, from time-to-time there may be changes in our management team that may be disruptive to our business.

Some of our property management customers require their renters to maintain certain insurance coverage requirements. Through wholly owned and licensed subsidiaries, we make renters insurance policies available to these renters and, if our customers so elect, add uncovered units to a qualifying liability to landlord insurance policy via a licensed insurance broker. If our property management customers stop requiring renters to maintain insurance coverage because of regulatory or competitive pressures, demand for our insurance-related risk mitigation products may decline and our revenues and operating results could be adversely affected.

Adverse global and regional economic conditions, including, but not limited to, recessionary or inflationary pressures, tightening in the credit markets, extreme volatility or distress in the financial markets, supply chain issues, fluctuations in rental occupancy rates, reduced consumer confidence or economic activity, government fiscal and tax policies, geopolitical events, and other negative financial news or macroeconomic developments could have an adverse impact on the demand for our products and services or cause us to experience increased costs that could negatively affect our operating results.

Our business operations are subject to interruption by natural disasters, flooding, fire, power shortages, health epidemics, terrorism, political unrest, telecommunications failure, vandalism, cyber-attacks, geopolitical instability, war, the effects of climate change (such as drought, wildfires, hurricanes, and increased storm severity) and other events beyond our control. Although we maintain crisis management and disaster response plans, such events could make it difficult or impossible for us to deliver our services to our customers, decrease demand for our services, and cause us to incur substantial expense. Our insurance may not be sufficient to cover losses or additional expenses that we may sustain. The majority of our research and development activities, offices, information technology systems, and other critical business operations are located near major seismic faults in California. Customer data could be lost, significant recovery time could be required to resume operations and our financial condition and operating results could be adversely affected in the event of a major natural disaster or catastrophic event. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards or expectations regarding the environmental impacts of our business.