Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 46

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 46
---
, where an AI model ingests personal data and makes 

26

connections using such data, those technologies may reveal other personal or sensitive information generated by the model.

We employ a shared responsibility model where our customers are responsible for using, configuring, and otherwise implementing security measures related to our products, services, and platform, and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this model, we make certain security features available to our customers that can be implemented at our customers' discretion, or identify security areas or measures for which our customers are responsible. For example, depending on the product implementation, our customers are responsible for adding and enforcing multi-factor authentication to access their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we or our platform are not the cause of any customer security issue or incident that may result, our customer relationships, reputation, and operating results may be adversely impacted.  

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us, or the third parties with which we work, to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. 

We rely upon third-party developers, service providers, and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. We may also rely on third-party developers, service providers, and technologies to provide other products or services to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may also share or receive sensitive information with or from third parties. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages or we may be unable to recover such award. In addition, supply chain