BOX INC

Previous wording

If we do not compete effectively, our customers do not renew their subscriptions or expand their use of our services, we are unable to attract new customers at rates that are consistent with our expectations, or if the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected.

Current wording

If we do not compete effectively, our customers do not renew their subscriptions or expand their use of our services, or if we are unable to attract new customers to our higher-tiered Suites plan or at rates that are consistent with our expectations, or if the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected.

Previous wording

Issues relating to the use of artificial intelligence and machine learning could adversely affect our business and operating results.

Current wording

Issues relating to the use of artificial intelligence and machine learning in Box solutions could adversely affect our business and operating results.

Previous wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the cloud content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Current wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the enterprise content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, artificial intelligence, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future and our primary competitors may change. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our intelligent content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Previous wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 101% and 108% as of January 31, 2024 and 2023, respectively.

Current wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 102% and 101% as of January 31, 2025 and 2024, respectively.

Previous wording

Our net retention rate may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, the effectiveness of our customer support services, the performance of our partners and resellers, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, our ability to successfully integrate new or acquired technology into our products, our ability to execute on our product roadmap, our customers’ budgets and spending levels, and the effects of global economic conditions, especially if challenging macroeconomic conditions continue. If our customers do not renew their subscriptions, renew them on less favorable terms, purchase fewer seats, or fail to purchase new product offerings, our revenue may decline, and we may not realize improved operating results from our customer base.

Current wording

Our net retention rate may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, the effectiveness of our customer support services, the performance of our partners and resellers, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, our ability to successfully integrate new or acquired technology into our products, our ability to execute on our product roadmap, our customers’ budgets and spending levels, and the effects of global economic conditions, especially if challenging macroeconomic conditions continue. If our customers do not renew their subscriptions, renew them on less favorable terms, purchase fewer seats, or fail to purchase new product offerings, our revenue may decline, and we may not realize improved operating results from our customer base. Our future success depends on our customers’ adoption of our intelligent content management platform and purchase of our higher-tiered Suites plan, including our recently-announced Enterprise Advanced plan.

Previous wording

The market for cloud-based enterprise services is not as mature as the on-premise enterprise software market. Because we derive, and expect to continue to derive, substantially all of our revenue and cash flows from sales of our cloud content management solutions, our success will depend to a substantial extent on the widespread adoption of cloud computing in general and of cloud-based content management services in particular. Many organizations have invested substantial personnel and financial resources to integrate traditional enterprise software into their organizations and may be reluctant or unwilling to migrate to a cloud-based model for managing their content. It is difficult to predict customer adoption rates and demand for our services, the future growth rate and size of the cloud computing market or the entry of competitive services. The expansion of the cloud content management market depends on a number of factors, including the cost, performance and perceived value associated with cloud computing, as well as the ability of companies that provide cloud-based services to address security and privacy concerns. If there is a reduction in demand for cloud-based services, it could result in decreased revenue, harm our growth rates, and adversely affect our business and operating results.

Current wording

Since we derive, and expect to continue to derive, substantially all of our revenue and cash flows from sales of our cloud content management solutions, our success will depend to a substantial extent on the widespread adoption of cloud computing in general and of cloud-based content management services in particular. Many organizations have invested substantial personnel and financial resources to integrate traditional enterprise software into their organizations and may be reluctant or unwilling to migrate to a cloud-based model for managing their content. It is difficult to predict customer adoption rates and demand for our services, the future growth rate and size of the cloud computing market or the entry of competitive services. The expansion of the cloud content management market depends on a number of factors, including the cost, performance and perceived value associated with cloud computing, as well as the ability of companies that provide cloud-based services to address security and privacy concerns. If there is a reduction in demand for cloud-based services, it could result in decreased revenue, harm our growth rates, and adversely affect our business and operating results.

Previous wording

To improve our operating results and continue growing our business, it is important that we continue to attract new customers and expand deployment of our solutions and products with existing customers. To the extent we are successful in increasing our customer base, we could incur increased losses because costs associated with new customers are generally incurred up front, while revenue is recognized ratably over the term of our subscription services. Alternatively, to the extent we are unsuccessful in increasing our customer base, we could also incur increased losses as costs associated with marketing programs and new products intended to attract new customers would not be offset by incremental revenue and cash flow. Changes in economic conditions may financially impact our existing and prospective customers and cause them to delay or reduce their technology spending, which may adversely affect our ability to attract new customers. For example, our business has been impacted by pressure from customers’ lower headcount growth and greater budget scrutiny on IT decisions since the second half of fiscal year 2023. All of these factors could negatively impact our future revenue and operating results.

Current wording

To improve our operating results and continue growing our business, it is important that we continue to attract new customers and expand deployment of our solutions and products with existing customers. To the extent we are successful in increasing our customer base, we could incur increased losses because costs associated with new customers are generally incurred up front, while revenue is recognized ratably over the term of our subscription services. Alternatively, to the extent we are unsuccessful in increasing our customer base, we could also incur increased losses as costs associated with marketing programs and new products intended to attract new customers would not be offset by incremental revenue and cash flow. Changes in economic conditions may financially impact our existing and prospective customers and cause them to delay or reduce their technology spending, which may adversely affect our ability to attract new customers. For example, our business continues to be impacted by pressure from customers’ lower headcount growth and greater budget scrutiny on IT decisions. All of these factors could negatively impact our future revenue and operating results.

Previous wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The United States and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, potential United States (U.S.) sovereign default, bank failures and financial instability, ongoing supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the Hamas-Israel and Russia-Ukraine conflicts, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. Since the second half of our fiscal year 2023, we have seen an impact from additional customer scrutiny being placed on deals due to the economic environment. In addition, there can be no assurance that cloud content management and collaboration spending levels will increase following any recovery.

Current wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The United States (U.S.) and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, potential U.S. sovereign default, bank failures and financial instability, supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the ongoing Russia-Ukraine conflict and the conflict in the Middle East, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. We continue to face challenges from customers scrutinizing deals more closely due to the economic environment. In addition, there can be no assurance that enterprise content management and collaboration spending levels will increase following any recovery.

Previous wording

Our industry is marked by rapid technological developments and new and enhanced applications and services. If we are unable to enhance our existing services or offer new services that achieve market acceptance or keep pace with rapid technological developments, our business could be adversely affected. The success of any new services or enhancements to our existing services, such as Box AI and Box Hubs, depends on several factors, including their timely completion, introduction and market acceptance. We also may experience business or economic disruptions that could adversely affect the productivity of our employees and result in delays in our product development process. We maintain a hybrid workforce (with a mix of employees working from offices and others working remotely), which may lead to disruptions and decreased productivity that could result in delays in our product development process. Failure in this regard may significantly impair our revenue growth and our future financial results. Our product development efforts could also be impacted by our workforce location strategy as we hire an increasing number of our employees in countries such as Poland and the Netherlands. In addition, because our services are designed to operate on a variety of systems, we must continuously modify and enhance our services to keep pace with changes in internet-related hardware, mobile operating systems, and other software, communication, browser and database technologies. We may not be successful in developing these modifications and enhancements or bringing them to market in a timely fashion, which may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers. Furthermore, modifications to existing platforms or technologies will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and adversely affect our business.

Current wording

Our industry is marked by rapid technological developments and new and enhanced applications and services. If we are unable to enhance our existing services or offer new services that achieve market acceptance or keep pace with rapid technological developments, our business could be adversely affected. The success of any new services or enhancements to our existing services, such as Box AI, Box Hubs, Box Doc Gen and Box Forms, depends on several factors, including their timely completion, introduction and market acceptance. We also may experience business or economic disruptions that could adversely affect the productivity of our employees and result in delays in our product development process. We maintain a hybrid workforce (with a mix of employees working from offices and others working remotely), which may lead to disruptions and decreased productivity that could result in delays in our product development process. Failure in this regard may significantly impair our revenue growth and our future financial results. Our product development efforts could also be impacted by our workforce location strategy as we hire an increasing number of our employees in international locations, such as Poland. In addition, because our services are designed to operate on a variety of systems, we must continuously modify and enhance our services to keep pace with changes in internet-related hardware, mobile operating systems, and other software, communication, browser and database technologies. We may not be successful in developing these modifications and enhancements or bringing them to market in a timely fashion, which may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers. Furthermore, modifications to existing platforms or technologies will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and adversely affect our business.

Previous wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. Developing, testing and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Current wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. For example, in May 2024, the European Council formally adopted the AI Act (the “EU AI Act”), which imposes significant obligations related to the use of AI systems and is anticipated to impact the entire AI ecosystem in the European Union. Additionally, as the EU AI Act is implemented, subsequent guidance, standards and regulations, as well as regulatory bodies within respective member states are expected, which may present unforeseen risks and related challenges. In January 2025, President Trump issued an Executive Order on AI that rescinded former President Biden’s Executive order on AI, and announced efforts to invest in AI infrastructure and innovation. With this shift in AI policy at the federal level, it is unclear the extent to which this may present opportunities or risks to Box in the adoption of AI, including integrating with AI systems developed outside the U.S. that may be, for example, more cost effective. Conversely, at the state level, California and Colorado have enacted several AI-specific bills covering the deployment and regulation of AI technology, which may impact Box. Developing, testing, and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Previous wording

We sell to government customers, which can be highly competitive, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government certification requirements may change, or we may lose one or more government certifications, and in doing so restrict our ability to sell into the government sector or maintain existing government customers until we attain revised certifications. Government demand and payment for our products and services are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Moreover, an extended federal government shutdown resulting from budgetary decisions, a prolonged continuing resolution, breach of the federal debt ceiling, or potential U.S. sovereign default may limit or delay federal government spending on our solutions and adversely affect our revenue. Government entities may also have statutory, contractual or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future operating results.

Current wording

We sell to government customers, which can be highly competitive, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government certification requirements may change, or we may lose one or more government certifications, and in doing so restrict our ability to sell into the government sector or maintain existing government customers until we attain revised certifications. Government demand and payment for our products and services are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Moreover, recent efforts to reduce U.S. federal spending, make the federal government operate more efficiently, an extended federal government shutdown resulting from budgetary decisions, a prolonged continuing resolution, breach of the federal debt ceiling, or potential U.S. sovereign default may limit or delay federal government spending on our solutions and adversely affect our revenue. Government entities may also have statutory, contractual or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future operating results.

Previous wording

A key element of our growth strategy is to expand our international operations and develop a worldwide customer base. In addition, we have opened, and may continue to open, international offices and hire employees to work at these offices in order to gain access to additional talent. For example, in 2020, we established an office in Warsaw, Poland and, in 2021, we acquired SignRequest B.V., a company located in the Netherlands. We have continued to increase our headcount in these countries as we migrate a larger portion of our development to lower cost regions. We are currently committed to our presence in these countries and have entered into a long-term operating lease in Poland to support our growth. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, geographic, social, and political risks that differ from those in the United States. Because of our limited experience with international operations and significant differences between international and U.S. markets, we may not succeed in creating demand for our services outside of the United States or in effectively selling our services in all of the international markets we enter. In addition, we will face challenges in doing business internationally that could adversely affect our business, including:

Current wording

A key element of our growth strategy is to expand our international operations and develop a worldwide customer base. In addition, we have opened, and may continue to open, international offices and hire employees to work at these offices in order to gain access to additional talent. We have continued to migrate a larger portion of our development to lower cost regions, and have entered into a long-term operating lease in Poland to support our growth. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, geographic, social, and political risks that differ from those in the United States. Because of significant differences between international and U.S. markets, we may not succeed in creating demand for our services outside of the United States or in effectively selling our services in all of the international markets we enter. In addition, we will face challenges in doing business internationally that could adversely affect our business, including:

Previous wording

unstable regional, economic, social and political conditions, such as the Hamas-Israel and Russia-Ukraine conflicts.

Current wording

unstable regional, economic, social and political conditions, such as the Russia-Ukraine conflict and the conflict in the Middle East.

Previous wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen, the British pound and the Euro have all experienced declines in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2024 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we plan to implement hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Current wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen has experienced a decline in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2025 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we began implementing hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Previous wording

general economic, industry and market conditions, including those caused by the Hamas-Israel and Russia-Ukraine conflicts, and as a result of inflation, rising interest rates, or bank failures and financial instability;

Current wording

general economic, industry and market conditions, including those caused by the Russia-Ukraine conflict and the conflict in the Middle East, and as a result of inflation, rising interest rates, or bank failures and financial instability;

Previous wording

The services we offer involve the storage of large amounts of our and our customers’ sensitive and proprietary information, some of which may be considered personally identifiable. Cyberattacks and other malicious internet-based activity, including ransomware, malware and viruses, continue to increase in frequency and magnitude and we face security threats from malicious third parties that could obtain unauthorized access to, or disrupt, our systems, infrastructure and networks. These threats may come from a variety of sources including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, sophisticated organizations, hacking groups and individuals and insider threats. These sources can also implement social engineering techniques, such as “phishing,” “smishing” or “vishing” attacks, to induce our partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ data. Hackers that acquire user account information at other companies can attempt to use that information to compromise the accounts of our personnel, or our users’ accounts if an account shares the same sensitive information such as passwords. As we increase our customer base, our brand becomes more widely known and recognized, and our service is used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences, and financial services, we have become more of a target for these malicious third parties.

Current wording

The services we offer involve the storage of large amounts of our and our customers’ sensitive and proprietary information, some of which may be considered personal information, personal data, or other forms of regulated information. Cyberattacks and other malicious internet-based activity, including ransomware, malware and viruses, continue to increase in frequency and magnitude and we face security threats from malicious third parties that could obtain unauthorized access to, or disrupt, our systems, infrastructure and networks. These threats may come from a variety of sources including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, sophisticated organizations, hacking groups and individuals and insider threats. These sources can also implement social engineering techniques, such as “phishing,” “smishing” or “vishing” attacks, to induce our partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ data. Hackers that acquire user account information at other companies can attempt to use that information to compromise the accounts of our personnel, or our users’ accounts if an account shares the same sensitive information such as passwords. As we increase our customer base, our brand becomes more widely known and recognized, and our service is used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences, and financial services, we have become more of a target for these malicious third parties.

Previous wording

We cannot guarantee that any security measures that we or third parties on which we rely have implemented will be completely effective against current or future security threats, or that our systems and networks or those of such third parties have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us or our products or services. Given that our customers manage significant amounts of sensitive and proprietary information on our platform, and many of our customers are in heavily regulated industries where there may be a greater concentration of sensitive and proprietary data, our reputation and market position are particularly sensitive to impacts from actual or perceived security breaches or incidents, security vulnerabilities, or concerns regarding security. If our security measures or those of third parties on which we rely are or are believed to be inadequate or breached or otherwise compromised as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of our data or our customers’ data, or any other disruption of the confidentiality, integrity or availability of our data or our customers’ data, we could incur significant liability to various parties, including our customers and individuals or organizations whose information is stored by our customers, and our business, reputation or competitive position may be harmed. Techniques used to obtain unauthorized access to, or to sabotage, systems or networks, are constantly evolving and generally are not recognized until launched against a target. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents or vulnerabilities. We have observed increased level of sophistication in the types of techniques, including social engineering techniques, that malicious third parties may use in an attempt to gain access to our or our users’ data. Due to the Hamas-Israel and Russia-Ukraine conflicts, or other areas of geopolitical tension around the world, we and the third parties on which we rely are vulnerable to a heightened risk of cybersecurity attacks, social engineering attacks, viruses, malware, ransomware, hacking or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our supply chain and our systems, operations and platform. Addit…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We cannot guarantee that any security measures that we or third parties on which we rely have implemented will be completely effective against current or future security threats, or that our systems and networks or those of such third parties have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us or our products or services. Given that our customers manage significant amounts of sensitive and proprietary information on our platform, and many of our customers are in heavily regulated industries where there may be a greater concentration of sensitive and proprietary data, our reputation and market position are particularly sensitive to impacts from actual or perceived security breaches or incidents, security vulnerabilities, or concerns regarding security. If our security measures or those of third parties on which we rely are or are believed to be inadequate or breached or otherwise compromised as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of our data or our customers’ data, or any other disruption of the confidentiality, integrity or availability of our data or our customers’ data, we could incur significant liability to various parties, including our customers and individuals or organizations whose information is stored by our customers, and our business, reputation or competitive position may be harmed. Techniques used to obtain unauthorized access to, or to sabotage, systems or networks, are constantly evolving and generally are not recognized until launched against a target. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents or vulnerabilities. We have observed increased levels of sophistication in the types of techniques, including social engineering techniques, that malicious third parties may use in an attempt to gain access to our or our users’ data. Due to the Russia-Ukraine conflict and the conflict in the Middle East, or other areas of geopolitical tension around the world, we and the third parties on which we rely are vulnerable to a heightened risk of cybersecurity attacks, social engineering attacks, viruses, malware, ransomware, hacking or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our supply chain and our systems, operations …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

These laws and regulations, which may be enforceable by private parties and/or governmental entities, are constantly evolving and can be subject to significant change. A number of new laws coming into effect and/or proposals pending before federal, state and foreign legislative and regulatory bodies could affect our business. For example, the European Union’s General Data Protection Regulation (GDPR), which imposes significant obligations on companies regarding the handling of personal data and penalties for noncompliance of up to the greater of 20 million Euros or four percent of a company’s global revenue. Further, local data protection authorities in Europe may adopt regulations and/or guidance more stringent than the GDPR, which may impose additional compliance costs or other burdens that impact our business. In 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield framework, and imposed additional obligations on companies when relying on model contractual clauses approved by the European Commission (EC) to transfer personal data from the EU to the U.S. On September 8, 2020, the Swiss Federal Data Protection and Information Commissioner invalidated the Swiss-U.S. Privacy Shield in light of the CJEU’s decision. These developments or other developments relating to cross-border data transfer may result in the EC, European Data Protection Board and/or other regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from the European Economic

Current wording

These laws and regulations, which may be enforceable by private parties and/or governmental entities, are constantly evolving and can be subject to significant change. A number of existing data protection and privacy laws, as well as new laws coming into effect and/or proposals pending before federal, state and foreign legislative and regulatory bodies could affect our business. For example, the European Union’s General Data Protection Regulation (GDPR) imposes significant obligations on companies regarding the handling of personal data and provides for penalties for noncompliance of up to the greater of 20 million Euros or four percent of a company’s global revenue. Further, local data protection authorities in Europe may adopt regulations and/or guidance more stringent than the GDPR, which may impose additional compliance costs or other burdens that impact our business. Additionally, developments relating to cross-border data transfer may result in the European Commission (EC), European Data

Previous wording

Area (EEA), Switzerland, or the United Kingdom (UK) to the U.S. For example, on June 4, 2021, the EC published new standard contractual clauses (SCCs) that were required to be implemented by companies relying on the SCCs as a basis for cross-border transfers of personal data by December 27, 2022. These or other developments relating to cross-border data transfer required us to issue additional policies, update our data transfer agreements with applicable customers and third-party service providers and assess our practices. This CJEU decision that invalidated the EU-U.S. Privacy Shield framework and/or other legal challenges relating to cross-border data transfers may serve as a basis for challenges to our personal data handling practices, or those of our customers, and may otherwise adversely impact our business, financial condition and operating results. Moreover, European governments and the U.S. government have cooperated to adopt the EU-U.S. Data Privacy Framework, UK-U.S. Data Bridge and Swiss-U.S. Framework (together, the “Data Privacy Framework”) replacing the EU-U.S. Privacy Shield Framework. While the Data Privacy Framework could benefit the industry as a whole, and we presently maintain self-certification under the Data Privacy Framework, maintaining compliance with the Data Privacy Framework could result in additional costs. The EU-U.S. Data Privacy Framework also already has faced legal challenges, and more generally, the Data Privacy Framework may be subject to future reviews, and subject to suspension, amendment, repeal, or limitations.

Current wording

Protection Board and/or other regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from the European Economic Area (EEA), Switzerland, or the United Kingdom (U.K.) to the U.S. For example, revised standard contractual clauses were published by regulators in EEA, Switzerland and the U.K., which we adopted in our data processing addenda. However, we cannot guarantee that our relevant policies and measures will ensure compliance due to possible fluctuations in these laws and related frameworks and their interpretation and enforcement. Moreover, European governments and the U.S. government have cooperated to adopt the EU-U.S. Data Privacy Framework, U.K.-U.S. Data Bridge and Swiss-U.S. Data Privacy Framework (together, the “Data Privacy Framework”), replacing the EU-U.S. Privacy Shield Framework. While the Data Privacy Framework could benefit the industry as a whole, and we presently maintain self-certification under the Data Privacy Framework, maintaining compliance with the Data Privacy Framework could result in additional costs. The EU-U.S. Data Privacy Framework has also already faced legal challenges, and more generally, the Data Privacy Framework may be subject to future reviews, and subject to suspension, amendment, repeal, or limitations.

Previous wording

Brexit has created uncertainty around data protection issues and could lead to further legislative and regulatory changes. For example, the UK Data Protection Act of 2018 substantially mirrors the EU GDPR in the UK and was the subject of statutory amendments that further aligned it with the GDPR in 2019. In June 2021, the EC announced a decision that the UK is an “adequate country” to which personal data could be exported from the EEA, but this decision must be renewed and may face challenges in the future, creating uncertainty regarding transfers of personal data to the UK from the EEA. It remains unclear how UK data protection laws or regulations will develop, and how data transfers to and from the UK will be regulated, over time. In 2022, the Information Commissioner’s Office (ICO) issued the UK SCCs as a valid data transfer mechanism for cross border data transfers from the UK to third countries that are required to be implemented by companies relying on the UK SCCs as a basis for cross-border transfers of personal data by March 21, 2024. Additional or modified guidance regarding, or changes to, UK cross border data transfers and/or overall UK data protection laws and/or guidance could occur, which may require us to change our policies, practices and engage in additional contractual negotiations. Such legislative and regulatory changes may result in increased costs of compliance and limitations on our customers and us.

Current wording

Furthermore, additional or modified guidance regarding, or changes to, U.K. cross border data transfers and/or overall U.K. data protection laws and/or guidance could occur, which may require us to change our policies, practices and engage in additional contractual negotiations. Such legislative and regulatory changes may result in increased costs of compliance and limitations on our customers and us.

Previous wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with those regulations adopted on March 29, 2023. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, Virginia, Colorado, Connecticut, and Utah enacted such legislation that became effective in 2023, and Delaware, Tennessee, Iowa, Indiana, Montana, Florida, Oregon, Texas, New Hampshire, and New Jersey have enacted privacy laws that become effective between 2024 and 2026. In addition, Pennsylvania, Massachusetts, and North Carolina, amongst other U.S. states, are anticipated to follow suit. Efforts to comply with these laws and related fluctuations in laws relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and other proposed federal and state laws relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Current wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with an enforcement date of March 29, 2024. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, laws enacted in Colorado, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia are currently effective, and laws enacted in Maryland, Minnesota, and Tennessee are set to go into effect before the end of 2025. Additionally, laws enacted in Indiana, Kentucky and Rhode Island will become effective in 2026. Other U.S. states are anticipated to follow suit. Other states have also enacted privacy laws relating to particular subject matter, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. Efforts to comply with these laws and related fluctuations in laws relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and other proposed federal and state laws relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Previous wording

We also expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. We cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of, existing laws and regulations, industry standards, or other obligations may have on us or our business. Moreover, these existing and proposed laws, regulations, standards, and other actual or asserted obligations can be difficult and costly to comply with, delay or impede the development or adoption of our products and services, reduce the overall demand for our products and services, increase our operating costs, require modifications to our policies, practices, or products or services, require significant management time and attention, and slow the pace at which we close (or prevent us from closing) sales transactions. Additionally, any actual or alleged noncompliance with these laws, regulations, standards, or other actual or asserted obligations could result in negative publicity and subject us to investigations and other proceedings by regulatory authorities, claims, demands, and litigation by private entities, or other requested remedies or demands, including demands that we modify or cease existing business practices, and expose us to significant fines, penalties and other damages and liabilities. In addition to the possibility of fines, proceedings, demands, claims, and litigation, we may find it necessary or appropriate to fundamentally change our business activities and practices, including the establishment of in-region data storage or other data processing operations, or modify or cease offering certain products or services, any of which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new offerings and features could be limited.

Current wording

Resilience Act (DORA), which became effective in January 2025, establishes a universal framework for managing and mitigating information and communication technology risk that applies to entities in the financial sector and their third-party cloud service providers, such as Box. Under DORA, third-party cloud service providers can face significant penalties for non-compliance, including fines of up to $5 million euros for violations. However, the specific impact and effects of these new and evolving laws and regulations are uncertain and subject to change over time as they are implemented. As a result, we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of, existing laws and regulations, industry standards, or other obligations may have on us or our business. Moreover, these existing and proposed laws, regulations, standards, and other actual or asserted obligations can be difficult and costly to comply with, delay or impede the development or adoption of our products and services, reduce the overall demand for our products and services, increase our operating costs, require modifications to our policies, practices, or products or services, require significant management time and attention, and slow the pace at which we close (or prevent us from closing) sales transactions. Additionally, any actual or alleged noncompliance with these laws, regulations, standards, or other actual or asserted obligations could result in negative publicity and subject us to investigations and other proceedings by regulatory authorities, claims, demands, and litigation by private entities, or other requested remedies or demands, including demands that we modify or cease existing business practices, and expose us to significant fines, penalties and other damages and liabilities. In addition to the possibility of fines, proceedings, demands, claims, and litigation, we may find it necessary or appropriate to fundamentally change our business activities and practices, including the establishment of in-region data storage or other data processing operations, or modify or cease offering certain products or services, any of which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new offerings and features could be limited.

Previous wording

There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the UK continue to shift, it could impact our ability to comply with and maintain EU and UK Processor and Controller Binding Corporate Rules.

Current wording

There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, the HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, it could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules.

Previous wording

We have experienced significant growth in the number of users and the amount of data that our operations infrastructure supports. We seek to maintain sufficient excess capacity in our operations infrastructure to meet our customers’ needs. We also seek to maintain excess capacity to facilitate the rapid provisioning of new customer deployments and the expansion of existing customer deployments. In addition, we need to properly manage our technological operations infrastructure in order to support version control, changes in hardware and software parameters and the evolution of our services. However, the provision of new hosting infrastructure requires significant lead-time. We have experienced, and may in the future experience, website disruptions, incidents of data corruption and loss, service outages and other performance problems. These problems may be caused by a variety of factors, including infrastructure changes, changes to our core services architecture, changes to our infrastructure necessitated by legal and compliance requirements governing the storage and transmission of data, human or software errors, viruses, security attacks, fraud, spikes in customer usage, primary and redundant hardware or connectivity failures, dependent data center and other service provider failures and denial of service issues. Additionally, our ability to properly manage our technical operations infrastructure depends on the reliability of the global supply chain for hardware, network, and platform infrastructure equipment. Significant and unforeseen disruptions to the supply chain may impede our ability to meet our infrastructure capacity requirements. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time, which may harm our reputation and operating results. Furthermore, if we encounter any of these problems in the future, our customers may lose access to important data or experience data corruption or service outages that may subject us to financial penalties, other liabilities and customer losses. If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our business. Further, as we decommission on-premise infrastructure hosted in data centers, our sale of data center equipment could occur over a period longer than planned and result in lower than expected sale proceeds.

Current wording

We have experienced significant growth in the number of users and the amount of data that our operations infrastructure supports. We need to properly manage our technological operations infrastructure in order to support version control, changes in hardware and software parameters and the evolution of our services. We have experienced, and may in the future experience, website disruptions, incidents of data corruption and loss, service outages and other performance problems. These problems may be caused by a variety of factors, including infrastructure changes, changes to our core services architecture, changes to our infrastructure necessitated by legal and compliance requirements governing the storage and transmission of data, human or software errors, viruses, cybersecurity attacks, fraud, spikes in customer usage, connectivity failures, and other third-party service provider failures and denial of service issues. Additionally, any limitation on the capacity or performance of our third-party cloud computing and hosting providers, including due to technical failures, shifts in product capabilities or licensing models, natural disasters, fraud, or cybersecurity attacks, could impede our ability to fulfill our current contractual commitments or expand our services. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time, which may harm our reputation and operating results. Furthermore, if we encounter any of these problems in the future, our customers may lose access to important data or experience data corruption or service outages that may subject us to financial penalties, other liabilities and customer losses.

Previous wording

We currently store and process our customers’ information in third-party cloud computing and hosting facilities inside and outside of the United States. As we have recently migrated our storage and processing operations to cloud computing and hosting facilities operated by third parties, our service has become more susceptible to interruptions or delays that are out of our direct control. These third parties are vulnerable to operational and technological disruptions, including from cyber-attacks and security breaches and incidents, which may negatively impact our ability to provide services to our customers and operate our business. Similarly, as part of our disaster recovery arrangements, our production environment and all of our customers’ data is typically replicated on third-party storage platforms located inside and outside of the United States. These facilities may be located in areas prone to natural disasters and may experience events such as earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, cyber-attacks and similar misconduct, including by state-sponsored or otherwise well-funded actors. Any damage to, or failure of, our systems generally, or those of the third-party cloud computing and hosting providers, could result in interruptions in our service, which may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers. We may only have limited remedies against third-party providers in the event of any service disruptions. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. Our business will also be harmed if our customers and potential customers believe our service is unreliable. Despite precautions taken by these third-party providers, the occurrence of disasters, security issues (including an act of terrorism or an armed conflict), certain geopolitical events, labor or trade disputes, or pandemics, could lead to a decision to close the facilities without adequate notice or other unanticipated problems that result in lengthy interruptions in our service or cause us to not comply with certification requirements. Even with the disaster recovery arrangements, we have never performed a full live failover of our services and, in an actual disaster, we could learn our recovery arrangements are not sufficient to address all possible scenarios and our service could be interrupted for a longer period than expected. We have encountered issues in the past that have caused Box services to be temporarily unavailable that resulted in our issuing service credits to some of our customers, and we cannot assure you that we will not experience interruptions or delays in our service in the future. If third parties are unable to perform services for us …

Excerpt shortened here; the source contains the full paragraph.

Current wording

We currently store and process our customers’ information in third-party cloud computing and hosting facilities inside and outside of the United States. As we have recently migrated our storage and processing operations to cloud computing and hosting facilities operated by third parties, our service has become more susceptible to interruptions or delays that are out of our direct control. These third parties are vulnerable to operational and technological disruptions, including from cyber-attacks and security breaches and incidents, which may negatively impact our ability to provide services to our customers and operate our business. Similarly, as part of our disaster recovery arrangements, our production environment and all of our customers’ data is typically replicated on third-party storage platforms located inside and outside of the United States. These facilities may be located in areas prone to natural disasters and may experience events such as earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, cyber-attacks and similar misconduct, including by state-sponsored or otherwise well-funded actors. Any damage to, or lack of availability or failure of, our systems generally, or those of the third-party cloud computing and hosting providers, could result in interruptions in our service, which may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers. We may only have limited remedies against third-party providers in the event of any service disruptions. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. Our business will also be harmed if our customers and potential customers believe our service is unreliable. Despite precautions taken by these third-party providers, the occurrence of disasters, security issues

Previous wording

In order to grow our business, we anticipate that we will continue to depend on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Cisco, Cloudflare, Google, IBM, Macnica Networks, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-Netsuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM and Zoom to market, resell, integrate with or endorse our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources.

Current wording

To grow our business and to expand our reach in the market, we expect to be more dependent on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Carahsoft, Cisco, Cloudflare, Google, Guidewire, IBM, Macnica, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-Netsuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM, Zoom and Zscaler to market, resell, or integrate with our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources.

Previous wording

Our success is also dependent upon contributions from our executive officers and other key employees and, in particular, Aaron Levie, our co-founder and Chief Executive Officer. In addition, occasionally, there may be changes in our senior management team that could disrupt our business. For example, in November 2023, Olivia Nottebohm joined us as our Chief Operating Officer. The loss of one or more of our executive officers or key employees, or the failure of our senior management team to work together effectively and execute our plans and strategies, could harm our business.

Current wording

Our success is also dependent upon contributions from our executive officers and other key employees and, in particular, Aaron Levie, our co-founder and Chief Executive Officer. In addition, occasionally, there may be changes in our senior management team that could disrupt our business. The loss of one or more of our executive officers or key employees, or the failure of our senior management team to work together effectively and execute our plans and strategies, could harm our business.

Previous wording

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our services and grow our business. For example, in December 2023, we acquired Crooze Corporation, a provider of no-code enterprise content management applications built on the Box platform. We may not be able to successfully complete or integrate identified acquisitions. Moreover, we may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition. The risks we face in connection with acquisitions include:

Current wording

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our services and grow our business. For example, in December 2023, we acquired Crooze Corporation, a provider of no-code enterprise content management applications built on the Box platform, and in August 2024, we acquired the intelligent document processing technology of Alphamoon. We may not be able to successfully complete or integrate identified acquisitions. Moreover, we may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition. The risks we face in connection with acquisitions include:

Previous wording

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties, which may differ from or be more significant than the risks our business faces; and

Current wording

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders, tax authorities or other third parties, which may differ from or be more significant than the risks our business faces; and

Previous wording

On occasion, we may need additional financing for a variety of reasons, including servicing our liabilities, operating or growing our business, responding to business opportunities, undertaking acquisitions, funding stock repurchases, satisfying our dividend or share redemption obligations of our Series A Convertible Preferred Stock, or repaying our 0.00% convertible senior notes due January 15, 2026 (the “Convertible Notes”).

Current wording

On occasion, we may need additional financing for a variety of reasons, including servicing our liabilities, operating or growing our business, responding to business opportunities, undertaking acquisitions, funding stock repurchases, satisfying our dividend or share redemption obligations of our Series A Convertible Preferred Stock, or repaying our 1.50% convertible senior notes due September 15, 2029 (the “2029 Convertible Notes”) or our 0.00% convertible senior notes due January 15, 2026 (the “2026 Convertible Notes” and together with the 2029 Convertible Notes, the “Convertible Notes”).

Previous wording

For example, in January 2021, we issued $345.0 million aggregate principal amount of Convertible Notes, which we have irrevocably elected to settle in cash upon maturity. Additionally, in May 2021, we issued and sold 500,000 shares of our Series A Convertible Preferred Stock for an aggregate purchase price of $500 million. Our ability to refinance or obtain additional financing, if and when required, will depend on investor and lender demand, our operating performance, the condition of the capital markets and other factors. We cannot guarantee that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and our existing stockholders may experience dilution. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support the operation or growth of our business could be significantly impaired and our operating results may be harmed. Rising interest rates may reduce our access to equity-linked or debt capital and increase our cost of borrowings, which could adversely impact our business, operating results and financial position.

Current wording

For example, in September 2024, we issued $460.0 million aggregate principal amount of 2029 Convertible Notes, and in January 2021, we issued $345.0 million aggregate principal amount of 2026 Convertible Notes. We may require additional capital to satisfy our obligations to pay cash upon conversion or at maturity of the Convertible Notes or to repurchase the Convertible Notes in the event of a fundamental change. Additionally, in May 2021, we issued and sold 500,000 shares of our Series A Convertible Preferred Stock for an aggregate purchase price of $500 million. Our ability to refinance or obtain additional financing, if and when required, will depend on investor and lender demand, our operating performance, the condition of the capital markets and other factors. We cannot guarantee that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and our existing stockholders may experience dilution. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support the operation or growth of our business could be significantly impaired and our operating results may be harmed. Rising interest rates may reduce our access to equity-linked or debt capital and increase our cost of borrowings, which could adversely impact our business, operating results and financial position.

Previous wording

Further, in 2021, the Organization for Economic Cooperation and Development (OECD) introduced a framework, referred to as Pillar Two, which contemplates a global minimum effective tax rate of 15%. In December 31, 2023, Pillar Two was implemented by the Council of the European Union and its member states. Similar directives under Pillar Two are already adopted or expected to be adopted by taxing authorities in other countries where we do business, including the UK. The OECD continues to release more guidance on these rules and framework and we are evaluating the impact to our financial position. These enactments or amendments could adversely affect our tax rate and ultimately result in a negative impact on our operating results and cash flows.

Current wording

Further, in 2021, the Organization for Economic Cooperation and Development (OECD) introduced a framework, referred to as Pillar Two, which contemplates a global minimum effective tax rate of 15%. In December 31, 2023, Pillar Two was implemented by the Council of the European Union and its member states. Similar directives under Pillar Two are already adopted or expected to be adopted by taxing authorities in other countries where we do business, including the U.K. We have evaluated the impact of Pillar Two to our financial position and concluded it to be not material. We will continue to monitor developments to Pillar Two in countries where we do business. These enactments or amendments could adversely affect our tax rate and ultimately result in a negative impact on our operating results and cash flows.

Previous wording

As of January 31, 2024, we had U.S. federal net operating loss carryforwards of approximately $400.9 million, state net operating loss carryforwards of approximately $520.7 million, and foreign net operating loss carryforwards of approximately $298.1 million. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an “ownership change” occurs if there is a cumulative change in our ownership by “5% shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. If we experience ownership changes as a result of future transactions in our stock, then we may be further limited in our ability to use our net operating loss carryforwards and other tax assets to reduce taxes owed on the net taxable income that we earn. Any such limitations on the ability to use our net operating loss carryforwards and other tax assets could adversely impact our business, financial condition and operating results.

Current wording

As of January 31, 2025, we had U.S. federal net operating loss carryforwards of approximately $233.7 million, state net operating loss carryforwards of approximately $487.3 million, and foreign net operating loss carryforwards of approximately $268.5 million. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an “ownership change” occurs if there is a cumulative change in our ownership by “5% shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. If we experience ownership changes as a result of future transactions in our stock, then we may be further limited in our ability to use our net operating loss carryforwards and other tax assets to reduce taxes owed on the net taxable income that we earn. Any such limitations on the ability to use our net operating loss carryforwards and other tax assets could adversely impact our business, financial condition and operating results.

Previous wording

Our bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders and also provide that the federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act of 1933, as amended, each of which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, stockholders or employees.

Current wording

Our bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders and also provide that the federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act of

Previous wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million and during fiscal year 2023, we repurchased 10.2 million shares for a total amount of $266.7 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Current wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2025, we repurchased 7.6 million shares for a total amount of $211.5 million and during fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases or that we will have adequate cash flow to fund any repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Previous wording

In January 2021, we issued $345.0 million aggregate principal amount of Convertible Notes. Prior to October 15, 2025, the Convertible Notes are convertible at the option of the holders only under certain conditions or upon occurrence of certain events as described in Note 9, Part II, Item 8 of our Annual Report on Form 10-K. We have made an irrevocable election to settle the principal of the Convertible Notes in cash upon any conversion of the Convertible Notes. As a result, if holders of the Convertible Notes elect to convert their Convertible Notes, we will be required to make cash payments in respect of the Convertible Notes being converted. Holders of the Convertible

Current wording

As of January 31, 2025, we had outstanding debt, including an aggregate principal amount of (i) $460.0 million issued under the 2029 Convertible Notes and (ii) $205.0 million issued under the 2026 Convertible Notes. During specified periods, the Convertible Notes are convertible at the option of the holders under certain conditions or upon occurrence of certain events as described in Note 9, Part II, Item 8 of this Annual Report on Form 10-K. If one or more holders of the Convertible Notes elect to convert their notes, we are required to settle the principal of the Convertible Notes in cash upon any conversion of such notes, which could adversely affect our liquidity. In addition, even if holders of the Convertible Notes do not elect to convert their Convertible Notes, we may be required under applicable accounting standards to reclassify the carrying value of the Convertible Notes as current, rather than long-term, if any of the conditions to the convertibility of the Convertible Notes are satisfied. This reclassification could materially reduce our reported working capital.

Previous wording

Notes also have the right to require us to repurchase all or a portion of their Convertible Notes upon the occurrence of a fundamental change (as defined in the indenture governing the Convertible Notes) at a repurchase price equal to 100% of the principal amount of the Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any. If the Convertible Notes have not previously been converted or repurchased, we will be required to repay the outstanding principal amount of the Convertible Notes, plus accrued and unpaid special interest, if any, in cash at maturity. The Convertible Notes are scheduled to mature on January 15, 2026.

Current wording

Holders of the Convertible Notes also have the right to require us to repurchase all or a portion of their Convertible Notes upon the occurrence of a fundamental change (as defined in the indenture governing the applicable Convertible Notes) at a repurchase price equal to 100% of the principal amount of the Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any. If the Convertible Notes have not previously been converted or repurchased, we will be required to repay the outstanding principal amount of the Convertible Notes, plus accrued and unpaid special interest, if any, in cash at maturity. The 2026 Convertible Notes and the 2029 Convertible Notes are scheduled to mature on January 15, 2026 and September 15, 2029, respectively.

Previous wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes at maturity will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal year 2024, we may continue to incur significant losses in the future. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Current wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal years 2025, 2024 and 2023, we may incur significant losses in the future and may not maintain profitability on a consistent basis. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Previous wording

In addition, our ability to repurchase or pay cash upon conversion or at maturity of the Convertible Notes may be limited by law or regulatory authority. Our failure to repurchase Convertible Notes following a fundamental change or to pay cash upon conversion or at maturity of the Convertible Notes as required by the indenture would constitute a default under such indenture. A default under the indenture or the fundamental change itself could also lead to a default under our senior credit facility, our other outstanding indebtedness, or agreements governing our future indebtedness and could have a material adverse effect on our business, results of operations, and financial condition. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Convertible Notes or to pay cash upon conversion or at maturity of the Convertible Notes.

Current wording

In addition, our ability to repurchase or pay cash upon conversion or at maturity of the Convertible Notes may be limited by law or regulatory authority. Our ability to service our debt also depends on the operating results of our subsidiaries and upon the ability of such subsidiaries to provide us with cash generated by the subsidiaries. Any dividends, loans or other distributions to us from our subsidiaries may be subject to legal, contractual or other restrictions and are subject to other business and tax considerations. Our failure to repurchase Convertible Notes following a fundamental change or to pay cash upon conversion or at maturity of the Convertible Notes as required by the applicable indenture would constitute a default under such indenture. A default under the indentures or the fundamental change itself could also lead to a default under our senior credit facility, our other outstanding indebtedness, or agreements governing our future indebtedness and could have a material adverse effect on our business, results of operations, and financial condition. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Convertible Notes or to pay cash upon conversion or at maturity of the Convertible Notes.

Previous wording

In connection with the issuance of the Convertible Notes, we entered into capped call transactions with various counterparties (the “Capped Calls”). The Capped Calls cover, subject to customary adjustments, the number of shares of our Class A common stock initially underlying the Convertible Notes. The Capped Calls are expected generally to reduce or offset the potential dilution to our Class A common stock upon any conversion of the Convertible Notes with such reduction or offset, as the case may be, subject to a cap based on the cap price.

Current wording

In connection with the issuance of each series of the Convertible Notes, we entered into capped call transactions with various counterparties (the “Capped Calls”). The Capped Calls cover, subject to customary adjustments, the number of shares of our Class A common stock initially underlying the applicable series of Convertible Notes. The Capped Calls are expected generally to reduce or offset the potential dilution to our Class A common stock upon any conversion of the applicable series of Convertible Notes with such reduction or offset, as the case may be, subject to a cap based on the cap price.