Company: DOMO
Filing Date: 2025-06-06
Form Type: 10-Q
Source: 0001628280-25-029801
Chunk: 41

Company: DOMO, INC.
Filing Date: 2025-06-06
Form: 10-Q
Item: Item 1A
Chunk 41
---
, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features. 

In addition to the privacy and data protection regulations described above, our business is also subject to contractual obligations to maintain compliance with leading security frameworks and standards such as AICPA’s SOC 1 and SOC 2; International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standards for ISO 27001 and ISO 27018; HITRUST Alliance’s HITRUST CSF; and Texas Department of Information Resources’ TX-RAMP certification. Annually, we also perform an internal/self-analysis of our adherence to the requirements stated in Australian Cyber Security Center (ASCS)’s IRAP framework and the United Kingdom’s National Cyber Security Centre’s Cyber Essentials. Any failure or perceived failure by us to comply with these contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection and cybersecurity may result in loss of certification, governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. 

If our network, application, or computer systems are breached or unauthorized access to customer data or other sensitive data is otherwise obtained or if we experience any other type of security incident, our platform may be perceived as insecure and we may lose existing customers or fail to attract new customers, operations may be disrupted if systems or data become unavailable, our reputation may be damaged and we may incur significant remediation costs or liabilities, including regulatory fines for violation of compliance requirements.

As a provider of cloud services, our operations involve the storage and transmission of our customers’ sensitive and proprietary information, and we also collect, store, transmit, and otherwise process large amounts of sensitive corporate, personal, and other information relating to our business and operations, including intellectual property, proprietary business information, and other confidential information. Cyber-attacks and other malicious internet-based activity continue to increase generally in both frequency and sophistication (including the use of emerging artificial intelligence technologies), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-target