Gloo Holdings, Inc. Class A (GLOO) Risk Analysis

We rely on our own and our third-party service providers' platforms, computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our internal and customer-facing operations, disruptions of or unauthorized access to third-party IT Systems can adversely affect our business, financial condition and results of operations. If we experience difficulties in implementing new or upgraded IT Systems or experience significant failures or other disruptions of our IT Systems, or if we are unable to successfully obtain or procure IT Systems or otherwise modify our IT Systems to respond to changes in our business needs, our ability to run our business could be adversely affected. It is also possible that our competitors could develop better platforms than ours, which could adversely affect obtaining and retaining our customers. Any of these or other related problems could, in turn, adversely affect our business, reputation and brand, financial condition and results of operations. We may rely on third parties when deploying, servicing or otherwise operating our IT Systems, and in doing so, expose them and therefore us to security risks outside of our direct control. Specifically, certain third parties who create applications that integrate with our platform may receive, store or otherwise process our and our customers' information, including confidential, sensitive or personal information and other information about individuals, our customers, employees, contractors and business partners ("Sensitive Information"). Our third-party service providers may fail to adequately secure their or our IT Systems or our data. Our ability to monitor our service providers' security is limited, and, in any event, third parties may be able to circumvent those security measures. Moreover, techniques used to obtain unauthorized access to systems and networks change frequently and may not be known until launched against us or our third-party service providers. Certain AI technologies, including technologies that facilitate the identification and exploitation of security vulnerabilities, may increase the susceptibility of our IT Systems to security breaches and incidents and may cause security breaches and incidents affecting our IT Systems to be more impactful. Additionally, remote working arrangements at our company, and many of our third-party providers, increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard all IT Systems and information upon which we rely. We face numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing (including on our customers and end customers), malware (including ransomware attacks), malfeasance by insiders, human or technological error, or other techniques used to obtain unauthorized access, disable or degrade services or sabotage systems, and as a result of malicious code embedded in open-source software, or misconfigurations, "bugs" or other vulnerabilities in commercial software that is integrated into our (or our suppliers' or service providers') IT Systems. We may be unable to detect, prevent, mitigate, remediate or otherwise respond to cybersecurity breaches or other incidents, or to avoid a material adverse impact to our IT Systems, data or business. Notwithstanding our efforts, we and our third-party service providers have failed to and may in the future fail to detect cybersecurity breaches or other incidents, including potential breaches or incidents that may compromise our IT Systems or data, and may face difficulties or delays in identifying any such breaches or incidents. Such breaches or incidents have resulted in and may in the future result in theft, loss, damage, unavailability of, or unauthorized access to or use, disclosure, modification or other processing of, our data, loss of access to our data or IT Systems or cause other business delays or disruptions. The use of our platform involves the transmission, storage and processing of Sensitive Information. The secure processing, maintenance, transmission and storage of our Sensitive Information is critical to us, and we devote significant resources to protecting this information. We expect our management, use and storage of Sensitive Information to increase, including through the use of AI and our managed IT services. Any actual or perceived cybersecurity breach or other incident, including any unauthorized or inadvertent access to, our IT Systems and any loss or unavailability of, unauthorized access to, or unauthorized use, disclosure, modification or other processing of, our data, could result in regulatory investigations and other proceedings, orders and other obligations, claims, demands, litigation and other proceedings, indemnity obligations, damages, penalties, fines and incurring other costs, violations of applicable laws and regulations and other liabilities, the perception that our platform offerings are insecure and the loss of existing customers or failure to attract and retain new customers, which could have a material and adverse effect on our business, financial condition and results of operations. We also could be required to divert substantial resources to prevent further cybersecurity breaches or other incidents. We have experienced such incidents in the past, and may experience similar incidents in the future. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. We cannot be certain that our insurance coverage will be adequate for all liabilities incurred relating to any cybersecurity breach or incident, or that insurance will continue to be available to us on economically reasonable terms, if at all.

We have from time to time been subject to claims, disputes, regulatory investigations or legal proceedings. We may in the future be subject to claims, disputes, regulatory investigations, class action, whistleblower and other litigation, and other proceedings, including those relating to intellectual property, privacy, commercial, recordings, AI-technologies, product liability, employment or the use of cookies, pixels or other tracking technology. The number and significance of any claim, dispute, investigation, litigation or other proceeding may increase as our business expands. Any such actual or threatened matter, even if unfounded, can be time-consuming, divert management's attention and resources, cause us to incur significant expenses or liability or require us to change our business practices. In addition, the amount and timing of expenses that we may need to incur in response to any of the foregoing matters from period to period are difficult to estimate, subject to change and may harm our financial condition and results of operations. Because of the potential risks, expenses and uncertainties of any claim, dispute, regulatory investigation, litigation or other proceeding, we may choose to settle these matters even where we have meritorious claims or defenses. Any of the foregoing matters may harm our business, financial condition and results of operations.

We receive, collect, store, use and otherwise process personal information and other confidential or proprietary data, for numerous purposes, including legal, marketing and other business-related purposes. Depending on various factors, including the nature of the information and the relationship with our users, we may act as either a data controller or business, or a data processor or service provider, each of which carries distinct legal and regulatory commitments under applicable privacy laws. As a data controller or business, we are directly responsible for determining the purposes and means of processing personal information, which subjects us to stringent requirements, including regarding privacy, transparency and accountability. Conversely, when we act as a data processor or service provider on behalf of our clients, we are obligated to process personal information in accordance with their instructions and applicable contractual terms and privacy laws. We are subject to laws, regulations and other obligations that govern privacy and cybersecurity, including with respect to marketing, consumer protection and our collection, storage, sharing, use, disclosure, protection, sale and other processing of personal information. The regulatory framework for privacy and cybersecurity may be subject to new or differing interpretations, inconsistent, or conflicting with, other obligations, and is expected to remain rapidly evolving and to increase our compliance costs and liability exposure. Many of these laws, regulations and other obligations impose differing obligations depending on whether we are acting as a data controller or business, or a data processor or service provider. For example, as a data controller or business, we are required to meet obligations around obtaining data subject consents, enabling individuals to exercise their rights under applicable laws, and ensuring data accuracy. As a data processor or service provider, our primary obligations focus on implementing appropriate security measures, following the instructions of the data controller or business and assisting the controller or business in meeting its own compliance requirements. These dual roles increase the complexity of our compliance efforts and the potential for liability in the event of a breach or regulatory violation. In the United States, privacy and cybersecurity laws include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the California Consumer Privacy Act of 2018 ("CCPA") and other state and federal laws relating to privacy and cybersecurity. The CCPA requires covered companies to make certain disclosures to California consumers about their data collection, use and sharing practices, allows consumers to opt out of the sale of personal information to third parties, and provides a private right of action and statutory damages for data breaches. The California Privacy Rights Act of 2020 ("CPRA"), which took effect on January 1, 2023, amended the CCPA by imposing additional requirements, including granting California residents the ability to limit the use of their Sensitive Information, imposing penalties for violations concerning California residents under the age of 16, and establishing the California Privacy Protection Agency to implement and enforce the law. While the CPRA regulations introduced more stringent requirements, many of these regulations lack significant enforcement history, creating uncertainty and compliance challenges. The enactment of the CCPA has spurred a wave of similar legislative developments in other states, resulting in a complex patchwork of overlapping but sometimes differing privacy laws. For example, Virginia, Colorado, Utah and Connecticut have enacted general privacy laws that became effective in 2023; Florida, Montana, Oregon and Texas have enacted privacy laws that became effective in 2024; Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey and Tennessee have enacted privacy laws that became effective in 2025; Indiana, Kentucky and Rhode Island have enacted privacy laws that became effective in 2026; Alabama and Oklahoma have enacted privacy laws that become effective in 2027; and Vermont has enacted a privacy law and becomes effective in 2028. Each of these laws imposes unique compliance requirements and creates additional challenges for maintaining consistency across jurisdictions. At the federal level, there is ongoing discussion about the possibility of comprehensive privacy legislation. However, no uniform standard has been enacted, and state-level activity continues to shape the regulatory landscape. The evolving nature of privacy and cybersecurity laws increases our compliance costs and potential liability as we navigate variations in requirements across jurisdictions. Additionally, the Department of Justice recently issued a final rule that took effect in April 2025 and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to business partners located in China or with other specified links to China (and other designated countries). These rules also may broadly require us to extract promises from business partners that they will not transfer data we share with them onward to parties linked to countries of concern. We are also subject to a variety of industry standards, contractual and other obligations, such as self-regulatory guidelines, that govern our privacy and cybersecurity practices. These obligations require us to, for example, implement opt-out mechanisms, provide detailed disclosures and adhere to principles such as transparency and accountability. Failure to comply or to meet industry expectations with respect to these obligations could result in regulatory investigations, negative publicity, private litigation or other proceedings, which could adversely impact our reputation, increase costs and damage our business. As we expand our operations and data-related solutions, the scrutiny on our data collection, use, sharing and processing practices may increase. Future laws and regulations could impose additional restrictions on data processing, including requirements for explicit consent, limitations on data retention or increased data subject rights. These changes may require us to redesign our platform, increase compliance costs or limit our ability to collect and use data, potentially reducing demand for our offerings. Additionally, as we continue to expand and develop new products and services, we may face challenges in uniformly applying compliance standards, particularly as requirements evolve or as certain legacy systems and processes are integrated into our broader platform. Any failure to fully implement or apply these standards across our offerings could result in increased compliance costs, reputational harm, loss of customer trust, regulatory scrutiny or legal liability, which could adversely affect our business, financial condition and results of operations. While we have implemented measures designed to address privacy and cybersecurity laws, regulations and other obligations, we may, or may be perceived to have, not done so consistently across all our products and services. For instance, while we have completed a SOC 2 Type II audit, the scope of the system for this certification does not incorporate all of our products and services. This limitation may expose us to risks if customers or regulators expect all our offerings to meet the standards set forth in the certification or if gaps in compliance across different products create vulnerabilities. Compliance with privacy and cybersecurity laws, regulations and other obligations is, and is likely to remain, uncertain for the foreseeable future. We cannot guarantee that we have been or will in the future be fully compliant with such laws, regulations and other obligations in every jurisdiction. Complying with these laws, regulations or other obligations may require us to modify our platform offerings, incur substantial compliance, technical and operational costs, modify our practices and restrict our business operations. Any failure or perceived failure to comply with these laws, regulations and other obligations relating to privacy or cybersecurity, including our own privacy policies, may result in regulatory investigations or enforcement actions, litigation (including individual or class action lawsuits), claims or public statements against us by consumer advocacy groups or others, and could result in significant monetary liability, fines, penalties, loss of customers, reputational harm and loss of goodwill and trust, which could have a material and adverse effect on our business, financial condition, results of operations and reputation.

Our platform operates across a broad and highly fragmented market. We believe our competition primarily falls into five categories: - Faith-tech and general market point solutions, including providers of church management systems, communications tools and engagement platforms such as Subsplash, Ministry Brands, Planning Center and Mailchimp that compete with the Gloo Workspace communications and insights products;- Proprietary and custom systems, including larger ministries that build internal technology stacks that compete with our Gloo 360 solutions;- Traditional advertising networks, including large media and marketing platforms that offer reach and audience access such as Meta and Google that compete with the Gloo Media Network;- Technology development solutions, including providers that compete with the platform solutions offered by our Gloo Capital Partners, Midwestern and Servant.io; and - Specialized and general e-commerce marketplaces, including providers of physical and digital products sold to CFLs for their operations, such as Amazon and Concordia Supply that compete with Outreach and our other e-commerce marketplaces. Our competitors may have greater resources, broader brand recognition, deeper relationships with customers or more experience with certain technologies. If we fail to differentiate our offerings, maintain or grow our relationships with key ministry leaders and churches, or effectively adapt to evolving technology and customer preferences, we may fail to achieve widespread adoption of our platform and our business, financial condition and results of operations could be harmed.

Our current and potential customers include churches, ministries, foundations, nonprofit organizations and other members of the faith and flourishing ecosystem that fully or partially rely on charitable donations, grants, government aid and philanthropic contributions to fund their operations, including to pay for offerings like ours. Consequently, a significant portion of our revenue indirectly depends on the availability of such external funding. We have limited ability to influence the fundraising efforts and external funding decisions that impact our customers and potential customers, and any reduction in their ability to secure necessary funding for their operations exposes us to fluctuations in demand for our platform offerings, which could adversely affect our business, financial condition and results of operations. For example, the frequency and amounts of charitable donations may decrease from time to time as a result of deteriorating general economic conditions, changes to applicable tax laws, a sustained or significant decline in religious affiliation or participation in the faith and flourishing ecosystem, shifts in philanthropic priorities and other factors that limit available financial resources.

We believe that the brand identity, reputation and awareness of Gloo and Gloo Capital Partners is critical to our sales and marketing efforts and continued business growth. In the faith and flourishing ecosystem, our reputation and the quality of our brand are uniquely important to our business, and the faith and flourishing ecosystem is particularly susceptible to scrutiny and criticism. We also believe that maintaining and enhancing these brands are critical to maintaining and expanding our customer base. Any unfavorable publicity about our company or our management, including about the quality, stability and reliability of our platform, changes to our platform, our privacy and cybersecurity practices, litigation, employee relations, regulatory enforcement and other actions involving us, as well as the perception of us and our platform by our customers and users, even if inaccurate, could cause a loss of confidence in us and adversely affect our brand. Additionally, widespread use of social media platforms and other forms of internet-based communication provide individuals with access to a broad audience of consumers and other interested persons. Many social media platforms immediately publish the content their users post, often without filters or checks on the accuracy of the content. Adverse or inaccurate information concerning us may be posted on such platforms at any time, and such posts can be amplified quickly, potentially harming our reputation, performance, prospects or business. We also rely on the reputation of third parties affiliated with us, such as partners across the faith and flourishing ecosystem, to reflect positively on our business. Unfavorable media coverage or public controversy involving these affiliated third parties, even if we are not directly involved, may be perceived by our users and customers as reflecting poorly on us or our values. Although our acceptable use policy incorporated into our terms of service provides for express limitations on how our customers can use our platform and we reserve our right to remove content that violates our acceptable use policy, it may not always be possible to remove such content prior to it receiving unfavorable attention or publicity. Any such harm to our brand and reputation could diminish trust among our customers and users, negatively impact demand for our platform and adversely affect our business. Negative publicity involving us or affiliated third parties could also have an adverse effect on the size and engagement of our customer base and could result in decreased revenue, which could have an adverse effect on our business, financial condition and results of operations.

Our business involves hosting, distributing and training AI models on content supplied by others, including licensed and public datasets. Some of that content may violate a third party's rights or a law, rule or regulation, and we could face lawsuits, liability or negative publicity for hosting or distributing such content, such as claims for fraud, defamation, libel, invasion of privacy, negligence, copyright or trademark infringement or other theories based on the nature of such information or content. Such lawsuits, liability, negative publicity or claims, with or without merit, could be costly to defend or divert the attention of our management or other personnel. While we take steps to mitigate such risks, we cannot guarantee that those steps will be effective or sufficient to protect us from liability or to minimize our costs. Preventing or responding to these actions may require us to make substantial investments in people and technology and these investments may not be successful, adversely affecting our business, financial condition and results of operations. For example, we take steps to avail ourselves of the safe harbor for copyright infringement under the Digital Millennium Copyright Act of 1998 ("DMCA"). The DMCA is intended, among other things, to reduce the liability of online service providers with respect to user-uploaded content. Under the DMCA there are safe harbors for copyright infringement available for online service providers that provide specific services, if they take certain affirmative steps as required under the DMCA. The applications and interpretations of the statutory requirements of the DMCA are evolving and may be modified by court rulings and industry practice. We therefore cannot guarantee that we will meet the safe harbor requirements of the DMCA, despite our efforts to do so. If we fail to comply with such statutory requirements or if the interpretations of the DMCA change, we may be subject to liability for copyright infringement resulting from our hosting and distribution of user-generated content.

We procure third-party insurance policies to cover various operations-related risks, including employment practices liability, workers' compensation, business interruptions, errors and omissions, cybersecurity and data breaches, crime, directors' and officers' liability, and general business liabilities. For certain types of operations-related risks or future risks related to our new and evolving offerings, we are not able to, or may not be able to, acquire insurance. In addition, we may not obtain enough insurance to adequately mitigate such operations-related risks or risks related to our new and evolving offerings, and we may have to pay high premiums, co-insurance, self-insured retentions or deductibles for the coverage we do obtain. We rely on a limited number of insurance providers, and should such providers discontinue or increase the cost of coverage, we cannot guarantee that we would be able to secure replacement coverage on reasonable terms or at all. If our insurance carriers change the terms of our policies in a manner not favorable to us, our insurance costs could increase. Further, if the insurance coverage we maintain is not adequate to cover losses that occur, or if we are required to purchase additional insurance for other aspects of our business, we could be liable for significant additional costs. Additionally, if any of our insurance providers becomes insolvent, it would be unable to pay any operations-related claims that we make. If the amount of one or more operations-related claims were to exceed our applicable aggregate coverage limits, we would bear the excess, in addition to amounts already incurred in connection with deductibles, self-insured retentions, co-insurance, or otherwise paid by our insurance policy. Insurance providers have raised premiums and deductibles for many businesses and may do so in the future. As a result, our insurance costs and claims expense could increase, or we may decide to raise our deductibles or self-insured retentions when our policies are renewed or replaced. The foregoing factors could adversely affect our business, financial condition, results of operations and prospects. We are also subject to certain contractual requirements to obtain insurance. For example, some of our agreements with partners require that we procure certain types of insurance, and if we are unable to obtain and maintain such insurance, we may be in violation of the terms of these agreements. In addition, we are subject to local laws, rules, and regulations relating to insurance coverage which could result in proceedings or actions against us by governmental entities or others. Any failure or perceived failure by us to comply with existing or future local laws, rules and regulations, or contractual obligations relating to insurance coverage could result in proceedings or actions against us by governmental entities or others. Additionally, anticipated or future local laws, rules, and regulations relating to insurance coverage, could require additional fees and costs. Compliance with these rules and any related lawsuits, proceedings, or actions may subject us to significant penalties and negative publicity, require us to increase our insurance coverage, require us to amend our insurance policy disclosure, increase our costs, and disrupt our business.