DigitalOcean Holdings (DOCN) Risk Analysis

We continue to invest in our AI/ML product offerings, which may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, privacy or security risks, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. The increasing focus on the risks and strategic importance of AI/ML technologies has already resulted in regulatory restrictions that target products and services capable of enabling or facilitating AI/ML. Several jurisdictions around the world, including Europe, the U.S. federal government and certain U.S. states, have proposed, enacted or are considering laws governing the development and use of AI/ML, such as the EU's AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties' AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor "poisons" the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called "hallucination"). Furthermore, concerns regarding third-party use of AI/ML for purposes contrary to governmental interests, including concerns relating to the misuse of AI/ML applications, models, and solutions, could result in restrictions on AI/ML products, for example those that can be used for training, refining, and deploying large language models (LLMs). If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage. In addition, unfavorable developments with evolving laws and regulations affecting AI/ML-related products may limit global adoption, impede our strategy and negatively impact our long-term expectations in this area. For example, there is significant uncertainty in the U.S. courts as to how AI/ML technologies affect intellectual property ownership, including copyright protections, and the use of AI/ML-related technology in the development of our products or implementation of AI/ML features in our products could expose us or our customers to claims of copyright infringement or misappropriation. We may not be able to anticipate how to respond to or comply with these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. The cost of complying with such frameworks could be significant and may increase our operating expenses. Because AI/ML technology is highly complex and rapidly developing, it is not possible to predict all legal, operational or technological risks that may arise relating offering AI/ML products. It is also unclear how our status as an infrastructure provider for customers developing and deploying AI/ML applications as opposed to developing such applications ourselves will affect the applicability of these regulations on our offerings.

Our agreements with our customers and other third parties may include indemnification provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred, including as a result of intellectual property infringement or misappropriation claims or for failure to comply with data protection requirements. Large indemnity payments could harm our business, financial condition and results of operations. Although we attempt to contractually limit our liability with respect to such indemnity obligations, we are not always successful and may still incur substantial liability related to them, and we may be required to cease use of certain functions of our platform or products as a result of any such claims. Any dispute with a customer or other third party with respect to such obligations could have adverse effects on our relationship with such customer or other third party and other existing or prospective customers, reduce demand for our products and services and adversely affect our business, financial conditions and results of operations. In addition, although we carry general liability insurance, our insurance may not be adequate to indemnify us for all liability that may be imposed or otherwise protect us from liabilities or damages with respect to claims alleging compromises of customer data, and any such coverage may not continue to be available to us on acceptable terms or at all.

We use open source software in connection with developing, operating, and offering our products, services, and technology, and we expect to continue to incorporate open source software in our products, services, and technology in the future. Some open source projects have known vulnerabilities and architectural instabilities and are provided on an "as-is" basis which, if not properly addressed, could negatively affect the performance of our product. Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products. For example, some open source licenses may, depending on the nature of our use and the terms of the applicable license, include terms requiring us to offer certain of our solutions for no cost, make our source code available, or license our modifications or derivative works under the terms of applicable open source licenses. From time to time, there have also been claims challenging the ownership rights in open source software against companies that incorporate it into their products, and the licensors of such open source software provide no warranties or indemnities with respect to such claims. Our use of open source software, and participation in open source projects, may also limit our ability to assert certain of our intellectual property and proprietary rights against third parties, including competitors, who access or use software or technology that we have contributed to such open source projects. Moreover, we cannot ensure that we have incorporated open source software in our products, services, and technology in a manner that is consistent with the terms of the applicable license or our current policies and procedures. If an author or other third party that distributes such open source software were to allege that we had not complied with the conditions of one or more of these licenses or such third party changes the type of open source license applicable to such software without our knowledge, we or our customers could be subject to lawsuits, and we could incur significant legal expenses defending against such allegations, be subject to significant damages resulting from the suits, enjoined from the sale of our products that contained the open source software, and required to comply with onerous conditions or restrictions on these products, which could disrupt the distribution and sale of these products. Such litigation could be costly for us to defend, have a negative effect on our business, financial condition and results of operations, or require us to devote additional research and development resources to change or reengineer our products or take other remedial actions.

The legal and regulatory environment pertaining to the internet and products and services such as ours, both in the United States and internationally, is uncertain and may change. New laws may be passed, existing but previously inapplicable or unenforced laws may be deemed to apply, legal safe harbors may be narrowed, and courts may issue decisions affecting existing regulations or leading to new ones. Furthermore, legal and regulatory authorities, both in the United States and internationally, may characterize or recharacterize us and our business, products, or services in ways that would apply additional or different regulations to us. These changes could affect, among other things, areas related to our business such as the following: - the liability of online service providers for actions by customers or users, including fraud, illegal content, spam, phishing, libel and defamation, hate speech, infringement of third-party intellectual property and other abusive conduct;- other claims based on the nature and content of internet materials;- privacy and security issues;- consumer protection risks;- evolving regulatory framework for AI/ML;- digital marketing aspects;- characteristics and quality of services, including changes to networking relationships and anti-circumvention technologies;- the contractual terms within our terms of service and other agreements with customers;- the developing global regulatory landscape regarding the internet, including changing regulatory approaches to net neutrality and censorship restrictions on ISPs, which could negatively affect our business or ability to attract and retain customers in ways that we cannot predict;- cross-border e-commerce issues; and - ease of access by our users to our platform. New laws or regulations, or new applications or interpretations of existing laws or regulations, could hinder growth and decrease acceptance, both of the internet and online services, or of our specific products or services, both generally or with respect to certain uses or industries. Such legal changes could increase our costs of doing business, subject our business to increased liability for non-compliance, or prevent us from marketing or delivering our services over the internet or in specific jurisdictions, thereby materially adversely affecting our business and results of operations. In addition, certain jurisdictions may require us to establish a local corporate presence in the country, which could increase our exposure to government censorship demands, heightened data security and breach risks, and regulatory enforcement. Failure to comply with such requirements could result in fines, operational restrictions, or the suspension or prohibition of our ability to do business in those regions.

We have in the past and may in the future be involved in litigation, including securities class action lawsuits and stockholder derivative lawsuits. For example, in September 2023, a putative class action lawsuit was filed against us and certain of our current and former executive officers for alleged violations of the U.S. federal securities laws, which was subsequently dismissed. Lawsuits are subject to inherent uncertainties, and the actual defense and disposition costs will depend upon many unknown factors and their outcomes are necessarily uncertain. We could be forced to expend significant resources and incur significant expense in the defense of any lawsuits. Monitoring, initiating and defending against legal actions are time-consuming for our management, may be expensive and may detract from our ability to fully focus our internal resources on our business activities. We may not be successful in having any lawsuits dismissed or settled within the limits of our insurance coverage. There also could be adverse publicity associated with any such lawsuits that could negatively affect public perception of our business, regardless of whether the allegations are valid or whether we are ultimately found liable.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency. Our tax provision could also be impacted by changes in accounting principles, changes in U.S. federal, state, or international tax laws applicable to corporate multinationals, other fundamental law changes currently being considered by many countries, and changes in taxing jurisdictions' administrative interpretations, decisions, policies, and positions. For example, the Organisation for Economic Co-operation and Development ("OECD") has been spearheading a multilateral effort on proposals, commonly referred to as "BEPS 2.0", which, to the extent implemented, will make important changes to the international tax system. These proposals are based on two "pillars", involving the reallocation of taxing rights in respect of certain multinational enterprises above a fixed profit margin to the jurisdictions in which they carry on business (Pillar One) (based on the thresholds, we currently expect to be outside the scope of the Pillar One proposals, but could fall within their scope in the future) and imposing a minimum effective corporate tax rate on certain multinational enterprises (Pillar Two). A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules. The OECD has issued administrative guidance providing transition and safe harbor rules around the implementation of Pillar Two. Based on our current understanding of the minimum revenue thresholds, we currently expect to be outside the scope of the Pillar Two proposals but could fall within their scope in the future, which could increase our tax obligations and require us to incur additional material costs to ensure compliance with any such rules in the countries where we do business. We are monitoring developments and evaluating the potential impacts of these new rules, including on our effective tax rates, and our eligibility to qualify for the transition and safe harbor rules.

In the ordinary course of business, we process sensitive information. Our data processing activities subject us to various data privacy and security obligations, including regional laws, guidance, industry standards, external and internal privacy and security policies, contractual requirements, directives, regulations, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). We publish privacy policies, and other notices including disclosures regarding compliance with certain security or privacy certifications or self-governing compliance frameworks. Regulators in various jurisdictions are increasingly scrutinizing these disclosures and other statements. If these policies, disclosures or other statements are determined to be deficient, insufficiently transparent, misleading, deceptive, or otherwise inconsistent with our practices, we could be subject to investigations, enforcement actions, penalties, or other adverse consequences. In the United States, such actions may be brought by federal agencies and state attorneys general. In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards with which we must legally comply or that contractually apply to us. If we fail to follow these security standards even if no customer or personal information is compromised, we may incur significant fines or experience a significant increase in costs or reputational harm. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our inability or failure to do so could result in adverse consequences. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 ("CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR"), the United Kingdom's GDPR (UK GDPR), and China's Personal Information Protection Law ("PIPL") impose strict requirements for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20.0 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and various related provincial laws, as well as Canada's Anti-Spam Legislation ("CASL"), apply to our operations. In Australia, the Privacy Act also applies to our operations. As another example, the General Data Protection Law ("Lei Geral de Proteção de Dados Pessoais", or "LGPD") (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. The Swiss Federal Act on Data Protection, or the FADP, also applies to the collection and processing of personal data by companies located in Switzerland, or in certain circumstances, by companies located outside of Switzerland. We also have customers in Asia and may be subject to new and emerging data privacy regimes in Asia, including China's PIPL, which imposes a set of specific obligations on covered businesses in connection with their processing and transfer of personal data and imposes fines of up to RMB 50 million or 5% of the prior year's total annual revenue of the violator. India's new privacy legislation, the Digital Personal Data Protection Act (DPDP), also applies to our operations. In addition to the EU GDPR, the European Commission has proposed a draft regulation, known as the Regulation on Privacy and Electronic Communications ("ePrivacy Regulation"), which is intended to replace the current ePrivacy Directive. If adopted, the ePrivacy Regulation could impose additional or enhanced consent and privacy requirements governing the use of communications content and metadata. Such requirements could negatively impact our platform and products and our relationships with our customers. Compliance with the EU GDPR and, if and when effective, the proposed ePrivacy Regulation, may require us to incur substantial operational costs or modify our business practices. We may not be successful in our efforts to achieve compliance, which could adversely affect our ability to retain or attract new European or multi-national customers or increase our potential liability under customer agreements. Although we utilize data centers in the European Economic Area ("EEA") and elsewhere globally to host certain customer and user data originating from the EU, we may be required to implement additional systems or processes to maintain such data in the EEA, resulting in increased costs and operational complexity. Similar data localization requirements in other jurisdictions could further increase the costs of establishing and maintaining data storage and processing infrastructure. In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. Certain jurisdictions, including the EEA and the United Kingdom (UK), have enacted laws that restrict or condition the transfer of personal data to the United States and other countries whose privacy protections are deemed inadequate. Other jurisdictions have adopted or may adopt similar data localization or cross-border data transfer requirements. Although there are currently mechanisms that may permit transfers of personal data from the EEA and UK to the United States in compliance with law, including standard contractual clauses, the UK's International Data Transfer Agreement or Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to evolving regulatory interpretations and legal challenges. As a result, there can be no assurance that we will be able to continue to rely on these mechanisms or otherwise lawfully transfer personal data to the United States or other jurisdictions. If we are unable to transfer personal data lawfully, or if the requirements for a compliant transfer become unduly burdensome, we could experience significant adverse consequences, including disruptions to or degradation of our operations, increased compliance costs, limitations on our ability to work with customers, partners, vendors, or other third parties, or the need to relocate some or all of our data processing or business operations to other jurisdictions at substantial expense. We could also face increased regulatory scrutiny, investigations, fines, penalties, injunctions, or restrictions on our processing of personal data necessary. Data privacy and security obligations, as well as customer and consumer expectations regarding data protection, are rapidly evolving, increasingly stringent, and subject to differing and sometimes conflicting interpretations across jurisdictions. Compliance with these requirements requires significant management attention and resources, and may necessitate changes to our products, services, systems, practices, or business model, as well as those of third parties that process data on our behalf. Furthermore, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our products. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and foreign countries. Actual or perceived failures by us or our third party partners to comply with applicable data privacy and security obligations could result in regulatory enforcement actions, litigation (including class-action claims and mass arbitration demands); additional reporting or oversight obligations, bans or restrictions on processing data; or orders to delete or refrain from using personal data. Privacy-related claims have become increasingly common and, in some cases, may permit the recovery of statutory damages on a per-violation basis, which could be substantial depending on the volume of data involved. Any of these events could have a material adverse effect on our reputation, business, results of operations, or financial condition, including but not limited to though loss of customers, interruptions to our business operations; limitations of our ability to process data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity, or required changes to our products or services. Furthermore, certain customers operate in highly regulated industries and require us to comply with additional data protection and security obligations. For example, to support certain customers in the healthcare industry, we are required to comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and enter into business associate agreements ("BAAs"), which impose additional obligations and potential liabilities, including penalties and fines in the event we fail to comply with the terms of such agreements. Meeting these requirements may require further investment in our platform, systems, and controls, and may increase our operating expenses, as well as increase our exposure to penalties and fines in the event of noncompliance.

We believe that the successful use of our platform and products requires a high level of support and engagement for many of our customers, particularly our business customers. In order to deliver appropriate customer support and engagement, we must successfully assist our customers in deploying and continuing to use our platform and products, resolving performance issues, addressing interoperability challenges with the customers' existing IT infrastructure, and responding to security threats and cyber-attacks and performance and reliability problems that may arise from time to time. Because our platform and products are designed to be highly configurable and to rapidly implement customers' reconfigurations, if customers make errors in configuring our platform and products, they may experience significant disruption to their workloads on our platform. Increased demand for customer support, without corresponding increases in revenue, could increase our costs and adversely affect our business, results of operations, and financial condition. In addition, we rely on our user community to serve as a resource for questions on any part of our platform. Members of our user community are not obligated to participate in discussions with other users, and to the extent they do not, our customers' ability to find answers to questions about our platform or services may suffer. If we are unable to develop self-service support resources that are easy to use and that our customers utilize to resolve their technical issues, or if our customers choose not to take advantage of these self-service support services, our customers' experience with our platform may be negatively impacted. There can be no assurance that we will be able to hire sufficient support personnel as and when needed, particularly if our sales exceed our internal forecasts. To the extent that we are unsuccessful in hiring, training, and retaining adequate support resources, our ability to provide high-quality and timely support to our customers will be negatively impacted, and our customers' satisfaction and their usage of our platform could be adversely affected.

Our success largely depends on our ability to effectively integrate new members of our executive leadership team and senior management. In 2024, we hired a Chief Executive Officer, Chief Ecosystem and Growth Officer and Chief Revenue Officer, and in 2026, we hired a new Chief Product and Technology Officer, in addition to other members of senior management. The ability of these members of leadership and senior management to understand our business, operations, and strategic plans will be critical to the Company and our management's ability to make informed decisions about our strategic direction and operations. Ensuring that executives and management gain detailed knowledge of our operations may take time and resources. An inadequate transition may cause disruption to our business due to, among other things, diverting management's attention away from the Company's financial and operational goals or causing a deterioration in morale. Additionally, our success and future growth depend largely upon the continued services of our executive leadership team, members of senior management and other key employees. If we fail to motivate or retain our executive leadership team, members of senior management and other key employees, our success and future growth may be impacted. Our executive officers and other key employees are employed on an at-will basis, which means that these personnel could terminate their employment with us at any time. The loss of one or more of our executive officers, or the failure by our executive team to effectively work with our employees and lead our company, could harm our business.

We lease space with third-party data center providers located in the United States, India, Germany, the United Kingdom, Canada, the Netherlands, Singapore and Australia. Our business is reliant on these data center facilities. Given that we lease this data center space, we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our data center facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes, floods, fires, power loss, system failures, computer vulnerabilities, physical or electronic break-ins, human error, malfeasance or interference, including by employees, former employees, or contractors, terrorism and other catastrophic events. We and our data centers have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes and capacity constraints, due to an overwhelming number of customers accessing our platform simultaneously. Data center facilities housing our network infrastructure may also be subject to local administrative actions, changes to legal or permitting requirements, labor disputes, litigation to stop, limit, or delay operations, and other legal challenges, including local government agencies seeking to gain access to customer accounts for law enforcement or other reasons. In addition, while we have entered into various agreements for the lease of data center space, equipment, maintenance and other services, the third party could fail to live up to the contractual obligations under those agreements. Other factors, many of which are beyond our control, that can affect the delivery, performance, and availability of our platform and products include: - the development, maintenance, and functioning of the infrastructure of the internet as a whole;- the performance and availability of third-party telecommunications services with the necessary speed, data capacity, and security for providing reliable internet access and services;- the failure of our redundancy systems, in the event of a service disruption at one of the facilities hosting our network infrastructure, to redistribute load to other components of our network;- the failure of our disaster recovery and business continuity plans;- the failure of utility providers to deliver power at sufficient levels on commercially acceptable terms to support our data centers; and - decisions by the owners and operators of the co-location and ISP-partner facilities where our network infrastructure is deployed or by global telecommunications service provider partners who provide us with network bandwidth to terminate our contracts, discontinue services to us, shut down operations or facilities, increase prices, change service levels, limit bandwidth, declare bankruptcy, breach their contracts with us, or prioritize the traffic of other parties. The occurrence of any of these factors, or our inability to efficiently and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively impact our relationship with our customers, or otherwise materially harm our business, results of operations, and financial condition. The components of our global network are interrelated, such that disruptions or outages affecting one or more of our network data center facilities may increase the strain on other components of our network. In addition, the failure of any of our data center facilities for any significant period of time could place a significant strain upon the ongoing operation of our business, as we have only limited redundant functionality for these facilities, and there may be concentration issues regarding the storing and backup of customer data. Such a failure of a core data center facility could degrade and slow down our network, reduce the functionality of our products for our customers, impact our ability to bill our customers, and otherwise materially and adversely impact our business, reputation, and results of operations. In addition, if we do not optimize and operate these data center facilities efficiently, or if we fail to expand our data centers in a timely manner to meet increased customer demand, it could result in either lack of available capacity (resulting in poor service performance or technical issues) or excess data center capacity (resulting in increased unnecessary costs), both of which could result in the dissatisfaction or loss of customers and cause our business, results of operations and financial condition to suffer. As we continue to add product and service capabilities, our data center networks become increasingly complex and operating them becomes more challenging. The terms of our existing data center agreements and leases vary in length and expire on various dates. Upon the expiration or termination of our data center facility leases, we may not be able to renew these leases on terms acceptable to us, if at all. Even if we are able to renew the leases on our existing data centers, rental rates, which will be determined based on then-prevailing market rates with respect to the renewal option periods and which will be determined by negotiation with the landlord after the renewal option periods, may increase from the rates we currently pay under our existing lease agreements. Migrations to new facilities could also be expensive and present technical challenges that may result in downtime for our affected customers. There can also be no assurances that our plans to mitigate customer downtime for affected customers will be successful.