Company: CXDO
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001654954-25-002287
Chunk: 271

Company: Crexendo, Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1A
Chunk 271
---
Table of Contents

We collect personal and credit card information from our customers and employees could misuse this information.

The PCI Data Security Standard (“PCI DSS”) is a specific set of comprehensive security standards required by credit card brands for enhancing payment account data security, including but not limited to requirements for security management, policies, procedures, network architecture, and software design. We maintain credit card and other personal information in our systems. Due to the sensitive nature of retaining such information we have implemented policies and procedures to preserve and protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, unauthorized access, or misuse. Notwithstanding these policies, we could be subject to liability claims by individuals and customers whose data resides in our databases for the misuse of that information. While the Company believes its systems meet or exceed industry standards, the Company does not believe it is required to meet PCI level 1 compliance and has not certified under that level. Failure to meet PCI compliance levels could negatively impact the Company’s ability to collect and store credit card information which could cause substantial disruption to our business. Notwithstanding the results of this assessment there can be no assurance that payment card brands will not request further compliance assessments or set forth additional requirements to maintain access to credit card processing services, which could incur substantial additional costs and could have a material adverse effect on our business.

Our ability to offer services outside the U.S. is subject to different regulations which may be unknown and uncertain.

Regulatory treatment of VoIP providers outside the United States varies from country to country, and local jurisdictions. Many times, the laws are vague, unclear and regulations are not enforced uniformly. We are licensed as a VoIP seller in Canada and are considering expanding to other countries. We also cannot control if our customers take their devices out of the United States and use them abroad. Our resellers may sell to customers who maintain facilities outside the United States. The failure by us or our customers and resellers to comply with laws and regulations could reduce our revenue and profitability. As we expand to additional countries there may be additional regulations that we are required to comply with, the failure to comply or properly assess regulations may subject us to penalties, fines and other actions which could materially affect our business.

Examinations by relevant tax authorities may result in material changes in related tax reserves for tax positions taken in previously filed tax returns or may impact the valuation of certain deferred income tax assets, such as net operating loss carry-forwards.

Based on the outcome of examinations by relevant tax authorities