Bandwidth (BAND) Risk Analysis

Our customers have been subject to "phishing," which occurs when a third party calls or sends an email or text message to a customer that claims to be from a business or organization that provides services to the customer. The purpose of the inquiry is typically to encourage the customer to visit a bogus website designed to look like a website operated by the legitimate business or organization or provide information to the operator. At the bogus website, the operator attempts to trick the customer into divulging customer account or other personal information such as credit card information or to introduce viruses through "Trojan horse" programs to the customers' computers. This could result in identity theft from our customers and the unauthorized use of our services. Third parties also have used our communications services to commit fraud. If we are unable to detect and prevent "phishing" and other similar methods, use of our services for fraud and similar activities, our brand reputation and growth may suffer and we may incur additional costs, including costs to increase security, or be required to credit significant amounts to customers. Third parties also have used our communications services without paying, including by submitting fraudulent credit information and fraudulent credit card information. This has resulted in our incurring the cost of providing the services, including incurring call termination fees, without any corresponding revenue. We have implemented anti-fraud procedures in order to limit the expenses resulting from theft of service. If our procedures are not effective, theft of service could significantly increase our expenses and adversely affect our business, results of operations and financial condition.

The market for cloud communications is rapidly evolving, significantly fragmented and highly competitive, with relatively low barriers to entry in some segments while other areas experience increased barriers. The principal competitive factors in our market include completeness of our suite of service offerings, credibility with enterprises and developers, global reach, ease of integration and programmability, product features, platform scalability, reliability, deliverability, security and performance, brand awareness and reputation, the strength of sales and marketing efforts and customer support, as well as the cost of deploying and using our services. Our competitors fall into two primary categories: - CPaaS companies that offer software APIs, less robust customer support and fewer other features, while relying on third-party networks and physical infrastructure; and - network service providers that offer limited developer functionality on top of their own networks and physical infrastructure. Some of our competitors and potential competitors are larger and have greater name recognition, longer operating histories, more established customer relationships, greater penetration into the enterprise space, a larger global reach, larger budgets and significantly greater resources than we do. In addition, they have the operating flexibility to bundle competing products and services at little or no incremental cost, including by offering them at a lower price as part of a larger sales transaction. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, technical and commercial standards or customer requirements and preferences. In addition, some competitors may offer services that address one or a limited number of functions at lower prices, with greater depth than our services or in different geographies. Our current and potential competitors may develop and market new services with comparable functionality to our services, which may force us to compete on price in order to remain competitive and therefore erode our profit margins. In addition, some of our competitors have lower list prices than us, which may be attractive to certain customers even if those services have different or lesser functionality. If we are unable to maintain our current pricing due to competitive pressures, our revenue and margins will be reduced and our business, results of operations and financial condition will be adversely affected. Customers utilize our services in many ways and use varying levels of functionality that our services offer or are capable of supporting or enabling our services within their applications. Customers using only limited functionality may be able to more easily replace our services with competitive offerings. By contrast, customers using many of the features of our services or using our services to support or enable core functionality for their applications may find it difficult or impractical to replace our services with a competitor's services. With the introduction of new services and new market entrants, we expect competition to intensify in the future. In addition, some of our customers choose to use both our services and our competitors' services in order to provide redundancy in their ability to deliver their own product offerings. Moreover, as we expand the scope of our services, we may face additional competition. If one or more of our competitors were to merge or partner with another of our competitors, this change in the competitive landscape could further adversely affect our ability to compete effectively. In addition, pricing pressures and increased competition generally could result in reduced revenue, reduced margins, increased losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business, results of operations and financial condition. Our current and potential competitors have developed, and in the future may develop, service offerings that are available not only in the United States, but also internationally. To the extent that customers seek service offerings that include support and scaling internationally, they may choose to use other service providers to fill their communication service needs before we have fully expanded and scaled our international offerings. Each of these factors could lead to reduced revenue, slower growth and lower international brand name recognition amongst our industry competitors, any or all of which could harm our business, results of operations and financial condition.

We believe that maintaining and enhancing our brand identity and increasing market awareness of our company and services are critical to achieving widespread acceptance of our company and our communications platform, strengthening our relationships with our existing customers, and attracting new customers. The successful promotion of our brand depends largely on our continued marketing efforts, our ability to continue to offer high quality services meeting the evolving needs of existing and prospective customers, and our ability to successfully differentiate our services from competing products and services. Our brand promotion activities may not be successful or yield increased revenue. In addition, independent industry analysts often provide reviews of our services and competing products and services, which may significantly influence the perception of our services in the marketplace. If these reviews are negative or not as strong as reviews of our competitors' services, then our brand may be harmed. From time to time, we have received customer complaints about our services, including with respect to pricing, customer support, unwanted traffic and disruption to, or outage of, our services. If we do not handle customer complaints effectively, then our brand and reputation may suffer, our customers may lose confidence in us and they may reduce or cease their use of our services. In addition, social media has become a widespread method by which consumers communicate about products and services they purchase, including our services and communications platform. Our ability to generate positive customer feedback and address or minimize negative feedback on social media channels where existing and potential customers seek and share information is important to our brand and reputation. Complaints or negative publicity about us, our services or our communications platform could materially and adversely affect our ability to attract and retain customers, our business, results of operations and financial condition. The promotion of our brand also requires us to make substantial expenditures, and we anticipate that these expenditures will increase as our market becomes more competitive and as we expand into new markets. To the extent that these activities increase revenue, this revenue still may not be enough to offset the increased expenses we incur. If we do not successfully maintain and enhance our brand, then our business may not grow, we may see our pricing power reduced relative to competitors and we may lose customers, all of which would adversely affect our business, results of operations and financial condition.

Our ability to attract new customers and increase revenue from existing customers depends in part on our ability to increase adoption and usage of our services, enhance and improve functionality of our existing services, and introduce new services and features. The success of any enhancements or new services or features depends on several factors, including timely completion, adequate quality testing, actual performance quality, market-accepted pricing levels and overall market acceptance. Enhancements and new services or features that we develop may not be introduced in a timely or cost-effective manner, may contain errors or defects, may have interoperability difficulties with our communications platform, network or other services, or may not achieve the broad market acceptance necessary to generate significant revenue. We also must integrate with a variety of network, hardware, mobile and software platforms and technologies, which requires us to adapt our communications platform and product offerings to changes and innovation in these technologies. Wireline and wireless telephone providers, as well as cell-phone operating system providers such as Apple and Google, have developed, and may in the future develop, new applications, functions or technologies intended to filter illegal robocalls or other unwanted phone calls or messages. Such applications, functions or technologies may inadvertently filter legal and desired calls or messages to or from our customers. In certain instances, we may need to update our services and technology or work with these providers to ensure customer success in the face of these applications, functions or technologies. Any failure to operate effectively with evolving or new technologies could reduce the demand for our services. If we cannot respond to these changes in a cost-effective manner, our services may become less competitive or obsolete, and our business, results of operations and financial condition could be adversely affected. The introduction of new features for existing products may require new technology and services, which we may procure from third party vendors. The success of these upgrades may be dependent on reaching mutually acceptable terms with vendors, on vendors meeting their obligations in a timely manner, and on the financial and operational stability of selected vendors. Furthermore, our ability to increase the usage of our services depends, in part, on the development of new use cases for our services, which may be outside of our control. Our ability to generate usage of additional services or features by our customers may also require increasingly sophisticated and more costly sales efforts and result in a longer sales cycle. If we are unable to successfully enhance our existing services to meet evolving customer requirements, increase adoption and usage of our services or develop new services or features, or if our efforts to increase the usage of our services are more expensive than we expect, then our business, results of operations and financial condition would be adversely affected.

Our communications platform processes, stores, and transmits our own sensitive data as well as customers' and partners' proprietary, confidential, and sensitive data, such as personal information, protected health information, and financial data. We are a target of threat actors seeking unauthorized access to our or our customers' or third-party service providers' systems or data or to disrupt our operations or ability to provide our services. We also use third-party service providers, sub-processors, and technology to help us deliver services to our customers and their end-users, as well as for our internal business operations. These third-party providers may process, store, or transmit data of our employees, partners, customers, and customers' end-users or may otherwise be used to help operate our technology. Some of this third-party technology, including open-source software, could be used as an attack vector. Even though we may not control the security measures of these vendors, we may be responsible for any breach of such measures. Cyber-attacks, including through the use of malware, computer viruses, distributed denial of service ("DDoS") attacks, credential harvesting and other means for obtaining unauthorized access to or disrupting the operation of our networks and systems and those of our suppliers, vendors and other service providers, could cause harm to our business, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our services and our communications platform. Cyber-attacks may cause service degradation or outages, equipment failures, loss of information, including sensitive personal information of customers or employees or valuable technical and marketing information, as well as disruptions to our or our customers' operations. Cyber-attacks against companies have increased in frequency, scope and potential harm in recent years. Further, the perpetrators of cyber-attacks are not restricted to particular groups or persons. These attacks may be committed by company employees or external actors operating in any geography, including jurisdictions where law enforcement measures to address such attacks are unavailable or ineffective, and may even be launched by or at the behest of nation-states. Despite our efforts to reduce the risks associated with cyber-attacks, including the implementation of a number of defensive measures and protocols designed to protect our systems and networks, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information, and such efforts may be insufficient to repel or mitigate the effects of a major cyber-attack. Cybersecurity events, like the DDoS attack we experienced in late 2021, may have cascading effects that unfold over time and result in additional costs, including costs associated with defensive measures, investigations, contractual claims, performance penalties, litigation, the loss of future business and other losses and liabilities that may be difficult to foresee. Any perception by existing and prospective customers that our network and systems are not secure could result in a material loss of business and revenue and damage our reputation. We will continue to deploy security enhancements in an effort to further secure our network. The techniques used by individuals or entities to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target. We may be unable to anticipate these techniques, and we may not become aware in a timely manner of a security breach, which could exacerbate the negative impact of such an event on our business or that of our customers. Additionally, we depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data and customer proprietary network information pursuant to applicable federal law, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or the loss of data. Any data security incidents, including inadvertent disclosure or internal malfeasance by our employees, unauthorized access or usage, virus or similar breach or disruption of us or our services providers, could result in a loss of confidential information, theft of our intellectual property, damage to our reputation, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities. Our existing general liability and cyber liability insurance policies may not cover, or may cover only a portion of, any potential claims related to cyber incidents or security breaches that we experience or may not be adequate to indemnify us for all or any portion of liabilities that may be imposed. As insurance claims hit record levels and new cyber insurance legislation is introduced in the United States, we also cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or in amounts sufficient to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage of any future claim. Many global insurance carriers now exclude coverage for attacks carried out by nation-states from their cyber insurance policies. Accordingly, if our cybersecurity measures and those of our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyber-attacks) and the mishandling of data by our employees and contractors, then our reputation, business, results of operations and financial condition could be adversely affected.

We have expanded our international operations, including through the deployment of data centers in certain locations outside of the U.S. and our acquisition of Voxbone in late 2020. As part of our growth strategy, we will continue to evaluate potential opportunities for further international expansion. Operating in international markets requires significant resources and management attention, and subjects us to legal, regulatory, economic and political risks in addition to those we face in the United States. We have limited experience with international operations, and further international expansion efforts may not be successful. In addition, we face risks in doing business internationally that could adversely affect our business, including: - exposure to international political developments that may cause instability for businesses and volatility in global financial markets and the value of foreign currencies, any of which could disrupt trade and the sale of our services in international markets;- difficulties in managing and staffing international operations, including difficulties related to the increased operations, travel, infrastructure, employee attrition and legal compliance costs associated with numerous international locations;- our ability to effectively price our products in competitive international markets;- new and different sources of competition;- costs associated with network service providers outside of the United States;- the need to adapt and localize our products for specific countries;- challenges in keeping abreast of, understanding and complying with local laws, regulations and customs in multiple foreign jurisdictions, particularly in the areas of telecommunications and data privacy and security;- complexities related to differing technical standards, certification requirements and audit requirements outside the United States, which could prevent customers from deploying our products or limit their usage;- export controls and economic sanctions administered by the Bureau of Industry and Security of the U.S. Department of Commerce and the Office of Foreign Assets Control of the U.S. Department of the Treasury;- compliance with various anti-bribery and anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and U.K. Bribery Act 2010;- international trade policies, tariffs and other non-tariff barriers, such as quotas;- more limited protection for intellectual property rights in some countries;- adverse consequences relating to the complexity of operating in multiple international jurisdictions with differing tax frameworks;- fluctuations in currency exchange rates, which could increase the price of our products outside of the United States, increase the expenses of our international operations and expose us to foreign currency exchange rate risk;- currency control regulations, which might restrict or prohibit our conversion of other currencies into U.S. dollars;- restrictions on the transfer of funds from or between international jurisdictions;- deterioration of political relations between the United States and other countries;- public health epidemics, such as COVID-19, or natural disasters, which could have an adverse impact on our employees, contractors, customers, partners, travel and the global economy; and - political or social unrest, acts of war or economic instability in a specific country or region in which we operate, which could have an adverse impact on our operations in that location. In addition, due to potential costs from our international expansion efforts and network service provider fees outside of the United States, our gross margin for international customers may be lower than our gross margin for domestic customers. As a result, our overall gross margin may fluctuate as we further expand our operations and customer base internationally. Our failure to manage any of these risks successfully could harm our international operations, and adversely affect our business, results of operations and financial condition.

We face exposure to the effects of fluctuations in currency exchange rates. While historically we have primarily transacted in U.S. dollars, we generally have transacted with customers and partners in Europe in British Pounds and Euros. We expect to expand the number of transactions with customers and partners that are denominated in foreign currencies in the future as we continue to expand our business internationally. We also incur expenses for some of our network service provider costs outside of the United States in local currencies and for employee compensation and other operating expenses in local currency. Fluctuations in the exchange rates between the U.S. dollar and other currencies could result in an increase to the U.S. dollar equivalent of such expenses. In addition, our international subsidiaries maintain net assets denominated in currencies other than the functional operating currencies of these entities. As we expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Accordingly, changes in the value of foreign currencies relative to the U.S. dollar may affect our results of operations due to transactional and translational re-measurements. Such foreign currency exchange rate fluctuations could make it more difficult to detect underlying trends in our business and results of operations. The trading price of our Class A common stock also could be adversely affected if fluctuations in currency exchange rates cause our results of operations to differ from our expectations or the expectations of our investors and securities analysts who follow our stock. We do not currently maintain a program to hedge transactional exposures in foreign currencies. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

Market prices for certain of our services have decreased over recent years. These decreases resulted from downward market pressure and other factors including: - technological changes and network expansions, which have resulted in increased transmission capacity available for sale by us and by our competitors; and - some of our competitors have been willing to accept smaller operating margins in the short term in an attempt to increase long-term revenue. To retain customers and revenue, we must sometimes reduce prices in response to market conditions and trends. We cannot predict to what extent we may need to reduce our prices to remain competitive or whether we will be able to sustain future pricing levels as our competitors introduce competing services or similar services at lower prices. Our ability to meet price competition may depend on our ability to operate at costs equal to or lower than our competitors or potential competitors. As our prices for some of our services decrease, our operating results may suffer unless we are able to either reduce our operating expenses or increase traffic volume from which we can derive additional revenue.