Company: APPN
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001441683-25-000017
Chunk: 45

Company: APPIAN CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 45
---
 as AWS.

Virtually every jurisdiction or regulated industry in which we operate has established its own data security and privacy legal framework with which we or our customers must comply. Since we operate across a variety of industries, we may be hosting or otherwise processing substantial amounts of sensitive or otherwise regulated personal information such as identifiable health information. The effects of any of this legislation and future changes to interpretations of this legislation could be potentially far-reaching and will require us to modify our data management practices and to incur substantial expense in an effort to comply. 

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible these laws and other actual or alleged legal obligations such as contractual or self-regulatory obligations may be interpreted and applied in a manner inconsistent with our existing data management practices or the features of our platform. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.

Any inability to adequately address privacy or cybersecurity concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platform. Privacy concerns, whether valid or not valid, may inhibit market adoption of our platform, particularly in certain industries and foreign countries.

If our platform fails to function in a manner allowing our customers to operate in compliance with regulations and/or industry standards, our revenue and operating results could be harmed.

Certain of our customers use our platform to create applications that ensure secure communications given the nature of the content being distributed and associated applicable regulatory requirements. As attitudes towards privacy and data security evolve, governmental and other customers may also require our platform to comply with certain privacy, security, and other certifications and standards that are specialized or industry-specific. Our cloud platform holds various security certifications from government agencies and industry organizations, including the 

30

Federal Risk and Authorization Management Program, or FedRAMP, compliance and HITRUST certification. It also meets the ISO 27001, Payment Card Industry Data Security Standard, or PCI D