Company: TVRD
Filing Date: 2025-05-30
Form Type: S-1
Source: 0001104659-25-054853
Chunk: 116

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-05-30
Form: S-1
Chunk 116
---
 be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

If a material breach of, or accidental or intentional loss of data from, the Company’s information technology systems or those of its vendors occurs, the market perception of the effectiveness of its security measures could be harmed and the Company’s reputation and credibility could be damaged, and the Company could be subject to adverse legal and regulatory consequences. The Company could be required to expend significant amounts of money and other resources to repair or replace information systems or networks. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences.

The Company takes steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom it works). The Company has not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Further, the Company has and may in the future experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.

Although the Company develops and maintains systems and controls designed to prevent these events from occurring, and the Company has a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Moreover, despite the Company’s efforts, the possibility of these events occurring cannot be eliminated entirely. As the Company outsources more of its information systems to vendors, and rely more on cloud-based information systems, the related