NOGN Nogin Inc

4

5

RISK FACTORS

You should carefully consider the risks and uncertainties described below and the other information in this prospectus before making an investment in our securities. Our business, financial condition, results of operations, or prospects could be materially and adversely affected if any of these risks occurs, and as a result, the market price of our securities could decline and you could lose all or part of your investment. This prospectus also contains forward-looking statements that involve risks and uncertainties. See “Cautionary Statement Regarding Forward-Looking Statements.” Our actual results could differ materially and adversely from those anticipated in these forward-looking statements as a result of certain factors, including those set forth below.

Risks Related to Our Business and Industry

We have a history of operating losses, and we may not be able to generate sufficient revenue to achieve and sustain profitability.

We have not yet achieved profitability. We incurred operating losses of approximately $27.6 million for the nine months ended September 30, 2022 and $6.3 million, $2.1 million and $2.3 million for the years ended December 31, 2021, 2020 and 2019, respectively. As of December 31, 2021, we had an accumulated deficit of $16.3 million. While we have experienced significant revenue growth over recent periods, we may not be able to sustain or increase our growth or achieve profitability in the future. We intend to continue to invest heavily in sales and marketing efforts. In addition, we expect to incur significant additional legal, accounting, and other expenses related to our being a public company as compared to when we were a private company. While our revenue has grown in recent years, if our revenue declines or fails to grow at a rate faster than these increases in our operating expenses, we will not be able to achieve and maintain profitability in future periods. As a result, we may continue to generate losses. We cannot assure you that we will achieve profitability in the future or that, if we do become profitable, we will be able to sustain profitability. Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays, and other unknown factors that may result in losses in future periods. If these losses exceed our expectations or our revenue growth expectations are not met in future periods, our financial performance will be harmed.

We have experienced strong growth in recent periods, and our recent growth rates may not be indicative of our future growth.

We have experienced strong growth in recent years. In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all. We believe our revenue growth depends on a number of factors, including our ability to:

We may not accomplish any of these objectives and, as a result, it is difficult for us to forecast our future revenue or revenue growth. If our assumptions are incorrect or change in reaction to changes in our market, or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability. You should not rely on our revenue for any prior periods as any indication of our future revenue or revenue growth.

7

Our future revenue and operating results will be harmed if we are unable to acquire new customers, retain existing customers, expand sales to our existing customers, develop new functionality for our CaaS platform that achieves market acceptance, or the increase in ecommerce during the COVID-19 pandemic fails to continue after the pandemic ends.

In order to continue to grow our business, we must continue to acquire new customers to purchase and use our CaaS platform. Our success in adding new customers depends on numerous factors, including our ability to: (1) offer a compelling ecommerce platform, (2) execute our sales and marketing strategy, (3) attract, effectively train and retain new sales, marketing, professional services, and support personnel in the markets we pursue, (4) develop or expand relationships with partners, payment providers, systems integrators, and resellers, (5) expand into new geographies and market segments, and (6) efficiently onboard new customers to our CaaS platform.

Our ability to increase revenue also depends, in part, on our ability to retain existing customers and to sell additional functionality and adjacent services to our existing and new customers. Our customers have no obligation to renew their contracts with our solutions after the expiration of their initial subscription period. In order for us to maintain or improve our results of operations, it is important that our customers renew their contracts with us on the same or more favorable terms to us. Our ability to increase sales to existing customers depends on several factors, including their experience with implementing and using our CaaS platform, their ability to integrate our CaaS platform with other technologies, and our pricing model.

Our ability to generate revenue may be inconsistent across small and midsize businesses, mid-market, and large enterprise customers. If we experience limited or inconsistent growth in any of these customer sets, particularly our large enterprise customers, our business, financial condition, and operating results could be adversely affected.

We may not be able to successfully implement our growth strategy on a timely basis or at all.

Our future growth, profitability and cash flows depend upon our ability to successfully implement our growth strategy, which, in turn, is dependent upon a number of factors, including our ability to:

There can be no assurance that we can successfully achieve any or all of the above initiatives in the manner or time period that we expect. Further, achieving these objectives will require investments which may result in short-term costs without generating any current revenue and therefore may be dilutive to our earnings. We cannot provide any assurance that we will realize, in full or in part, the anticipated benefits we expect our strategy will achieve. The failure to realize those benefits could have a material adverse effect on our business, financial condition and results of operations.

8

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our CaaS platform. If we are not able to generate traffic to our website through digital marketing, our ability to attract new customers may be impaired.

Our ability to increase our customer base and achieve broader market acceptance of our CaaS platform will depend on our ability to expand our marketing and sales operations. We plan to continue increasing the size of our sales force. We also plan to dedicate significant resources to sales and marketing programs, including search engine and other online advertising. The effectiveness of our online advertising may vary due to competition for key search terms, changes in search engine use and changes in search algorithms used by major search engines and other digital marketing platforms. Our business and operating results will be harmed if our sales and marketing efforts do not generate a corresponding increase in revenue. We may not achieve anticipated revenue growth from increasing the size of our sales force if we are unable to hire, develop, and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective.

If the cost of marketing our CaaS platform over search engines or other digital marketing platforms increases, our business and operating results could be adversely affected. Competitors also may bid on the search terms that we use to drive traffic to our website. Such actions could increase our marketing costs and result in decreased traffic to our website.

Furthermore, search engines and digital marketing platforms may change their advertising policies from time to time. If these policies delay or prevent us from advertising through these channels, it could result in reduced traffic to our website and subscriptions to our CaaS platform. New search engines and other digital marketing platforms may develop, particularly in specific jurisdictions, that reduce traffic on existing search engines and digital marketing platforms. If we are not able to achieve prominence through advertising or otherwise, we may not achieve significant traffic to our website through these new platforms and our business and operating results could be adversely affected.

Given these factors, it is difficult to predict whether and when a sale will be completed, and when revenue from a sale will be recognized. Consequently, a shortfall in demand for our CaaS platform and services or a decline in new or renewed contracts in a given period may not significantly reduce our revenue for that period but could negatively affect our revenue in future periods.

If we fail to maintain or grow our brand recognition, our ability to expand our customer base will be impaired and our financial condition may suffer.

We believe maintaining and growing the Nogin brand is important to supporting continued acceptance of our existing and future solutions, attracting new customers to our CaaS platform, and retaining existing customers. We also believe that the importance of brand recognition will increase as competition in our market increases. Successfully maintaining our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide a reliable and useful CaaS platform to meet the needs of our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and solutions, and our ability to successfully differentiate our CaaS platform. Brand promotion activities may not generate customer awareness or yield increased revenue. Even if they do, any increased revenue may not offset the expenses we incurred in building our brand. If we fail to successfully promote and maintain our brand, we may fail to attract enough new customers or retain our existing customers to realize a sufficient return on our brand-building efforts, and our business could suffer.

If we fail to offer high quality support, our business and reputation could suffer.

Our customers rely on our personnel for support related to our subscription and customer solutions. High-quality support is important for the renewal and expansion of our agreements with existing customers. The importance of

9

high-quality support will increase as we expand our business and pursue new customers, particularly large enterprise customers. If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to sell new software to existing and new customers could suffer and our reputation with existing or potential customers could be harmed.

If we fail to improve and enhance the functionality, performance, reliability, design, security and scalability of our CaaS platform and innovate and introduce new solutions in a manner that responds to our customers’ evolving needs, our business may be adversely affected.

The markets in which we compete are characterized by constant change and innovation and we expect them to continue to evolve rapidly. Our success has been based on our ability to identify and anticipate the needs of our customers and design platforms that provide them with the breadth of tools they need to operate and grow their businesses. Our ability to attract new customers, retain revenue from existing customers and increase sales to both new and existing customers will depend in large part on our ability to continue to improve and enhance the functionality, performance, reliability, design, security and scalability of our CaaS platform and to innovate and introduce new solutions.

We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and evolve, including developments in POS, eCommerce and payments technology. Other potential changes are on the horizon as well, notably in the payments space, such as developments in real-time payments, blockchain, crypto-currencies and in tokenization, which replaces sensitive data (e.g., payment card information) with symbols (tokens) to keep data safe in the event of a breach. Similarly, there is rapid innovation in the provision of other products and services to businesses, including tailored financial solutions and marketing services. These new services and technologies may be superior to, impair, or render obsolete the products and services we currently offer or the technologies we currently use to provide them. We have in the past, and may experience in the future, difficulties with software development that could delay or prevent the development, introduction or implementation of new solutions and enhancements. Software development involves a significant amount of time for our research and development team, as it can take our developers months to update, code and test new and upgraded solutions and integrate them into our CaaS platform. We must also continually update, test and enhance our software platforms. For example, our design team spends a significant amount of time and resources incorporating various design enhancements, such as customized colors, fonts, content and other features, into our CaaS platform. The continual improvement and enhancement of our CaaS platform requires significant investment and we may not have the resources to make such investment. Our improvements and enhancements may not result in our ability to recoup our investments in a timely manner, or at all. We may make significant investments in new solutions or enhancements that may not achieve expected returns. The success of any enhancement or new solution depends on several factors, including the timely completion and market acceptance of the enhancement or new solution. Our ability to develop new enhancements or solutions may also be inhibited by industry-wide standards, payment card networks, laws and regulations, resistance to change by customers, difficulties relating to integration or compatibility with third-party software or hardware, or third parties’ intellectual property rights.

Any new solution we develop or acquire might not be introduced in a timely or cost-effective manner and might not achieve the broad market acceptance necessary to generate significant revenue. Improving and enhancing the functionality, performance, reliability, design, security and scalability of our CaaS platform is expensive, time-consuming and complex, and to the extent we are not able to do so in a manner that responds to our customers’ evolving needs, our business, operating results and financial condition will be adversely affected.

Payment transactions on our CaaS platform subject us to regulatory requirements, additional fees, and other risks that could be costly and difficult to comply with or that could harm our business.

We are required by our payment processors to comply with payment card network operating rules and we have agreed to reimburse our payment processors for any fees or fines that are assessed by payment card networks as a

10

result of any rule violations by us or our customers. The payment card networks set and interpret the payment card industry rules, certification requirements and rules governing electronic funds transfer, any of which could change or be reinterpreted to make it more difficult for us to comply. We face the risk that one or more payment card networks or other processors may, at any time, assess penalties against us, against our customers, or terminate our ability to accept credit card payments or other forms of online payments from shoppers. This would have an adverse effect on our business, financial condition, and operating results.

If we fail to comply with the payment card network rules, including the Payment Card Industry Data Security Standard (“PCI-DSS”) and those of each of the credit card brands, we would breach our contractual obligations to our payment processors, financial institutions, partners, and customers. Such a failure may subject us to fines, penalties, damages, higher transaction fees, and civil liability. It could prevent us from processing or accepting payment cards or lead to a loss of payment processor partners, even if customer or shopper information has not been compromised.

Activities of customers, their shoppers, and our partners could damage our brand, subject us to liability and harm our business and financial results.

Our terms of service prohibit our customers from using our CaaS platform to engage in illegal activities and our terms of service permit us to take down a customer’s shop if we become aware of illegal use. Customers may nonetheless engage in prohibited or illegal activities or upload store content in violation of applicable laws, which could subject us to liability. Our partners may engage in prohibited or illegal activities, which could subject us to liability. Furthermore, our brand may be negatively impacted by the actions of customers or partners that are deemed to be hostile, offensive, inappropriate, or illegal. We do not proactively monitor or review the appropriateness of the content of our customers’ stores or our partners’ activities. Our safeguards may not be sufficient for us to avoid liability or avoid harm to our brand. Hostile, offensive, inappropriate, or illegal use could adversely affect our business and financial results.

In many jurisdictions, laws relating to the liability of providers of online services for activities of their shoppers and other third parties are being tested by actions based on defamation, invasion of privacy, unfair competition, copyright and trademark infringement, and other theories. Any court ruling or other governmental regulation or action that imposes liability on customers of online services in connection with the activities of their shoppers could harm our business. We could also be subject to liability under applicable law, which may not be fully mitigated by our terms of service. Any liability attributed to us could adversely affect our brand, reputation, ability to expand our subscriber base, and financial results.

We are dependent upon customers’ continued and unimpeded access to the internet, and upon their willingness to use the internet for commerce.

Our success depends upon the general public’s ability to access the internet, including through mobile devices, and its continued willingness to use the internet to pay for purchases, communicate, access social media, research and conduct commercial transactions. The adoption of any laws or regulations that adversely affect the growth, popularity or use of the internet, including changes to laws or regulations impacting internet neutrality, could decrease the demand for our CaaS platform, increase our operating costs, or otherwise adversely affect our business. Given uncertainty around these rules, we could experience discriminatory or anti-competitive practices that could impede both our and our customers’ growth, increase our costs or adversely affect our business. In the future, providers of internet browsers could introduce new features that would make it difficult for customers to use our CaaS platform. In addition, internet browsers for desktop, tablets or mobile devices could introduce new features, or change existing browser specifications, such that they would be incompatible with our CaaS platform. If customers become unable, unwilling or less willing to use the internet for commerce for any reason, including lack of access to high-speed communications equipment, congestion of traffic on the internet, internet outages or delays, disruptions or other damage to customers’ computers, increases in the cost of accessing the internet and security and privacy risks or the perception of such risks, our business could be adversely affected.

11

The COVID-19 pandemic may continue to materially and adversely affect our business, financial condition and results of operations.

The COVID-19 pandemic, the measures attempting to contain and mitigate the effects of the COVID-19 pandemic, including stay-at-home, business closure, and other restrictive orders, and the resulting changes in consumer behaviors, have disrupted our normal operations and impacted our employees, suppliers, partners, and customers. We expect these disruptions and impacts to continue. In response to the COVID-19 pandemic, we have taken a number of actions that have impacted and continue to impact our business, including transitioning employees across all our offices (including our corporate headquarters) to remote work-from-home arrangements and imposing travel and related restrictions. While we believe these actions were reasonable and necessary as a result of the COVID-19 pandemic, they were disruptive to our business and could adversely impact our results of operations. Given the continued spread of COVID-19 and the resultant personal, economic, and governmental reactions, we may have to take additional actions in the future that could harm our business, financial condition, and results of operations. While we have a distributed workforce and our employees are accustomed to working remotely or working with other remote employees, our workforce has not historically been fully remote. Prior to the COVID-19 pandemic, certain of our employees traveled frequently to establish and maintain relationships with one another and with our customers, partners, and investors. We continue to monitor the situation and may adjust our current policies as more information and guidance become available. Suspending travel and doing business in-person on a long-term basis could negatively impact our marketing efforts, our ability to enter into customer contracts in a timely manner, and our ability to recruit employees across the organization. These changes could negatively impact our sales and marketing in particular, which could have longer-term effects on our sales pipeline, or create operational or other challenges as our workforce remains predominantly remote. Any of these impacts could harm our business. In addition, our management team has spent, and will likely continue to spend, significant time, attention, and resources monitoring the COVID-19 pandemic and associated global economic uncertainty and seeking to manage its effects on our business and workforce. As our offices reopen, planning and risk management for these reopenings will require further additional time from management and other employees, which may further reduce the amount of time available for other initiatives.

The degree to which COVID-19 and related vaccines will affect our business and results of operations will depend on future developments that are highly uncertain and cannot currently be predicted. These developments include, but are not limited to, the duration, extent, and severity of the COVID-19 pandemic, actions taken to contain the COVID-19 pandemic, the impact of the COVID-19 pandemic and related restrictions on economic activity and domestic and international trade, the timing and deployment of any vaccine, and the extent of the impact of these and other factors on our employees, suppliers, partners, and customers. While certain COVID-19 vaccines have recently been approved and have become available for use in the United States and certain other countries, we are unable to predict when those vaccines will become widely available, how widely utilized the vaccines will be, whether they will be effective in preventing the spread of COVID-19, and when or if normal economic activity and business operations will resume. The COVID-19 pandemic and related restrictions could limit our customers’ ability to continue to operate, to obtain inventory, generate sales, or make timely payments to us. It could disrupt or delay the ability of employees to work because they become sick or are required to care for those who become sick, or for dependents for whom external care is not available. It could cause delays or disruptions in services provided by key suppliers and vendors, make us, our partners, and our service providers more vulnerable to security breaches, denial of service attacks or other hacking or phishing attacks, or cause other unpredictable effects.

The COVID-19 pandemic also has caused heightened uncertainty in the global economy. If economic conditions further deteriorate, consumers may not have the financial means to make purchases from our customers and may delay or reduce discretionary purchases, negatively impacting our customers and our results of operations. Uncertainty from the pandemic may cause prospective or existing customers to defer investment in ecommerce. Our SMB customers may be more susceptible to general economic conditions than larger businesses, which may have greater liquidity and access to capital. Uncertain and adverse economic conditions also may lead to increased refunds and chargebacks. Since the impact of COVID-19 is ongoing, the effect of the COVID-19

12

pandemic and the related impact on the global economy may not be fully reflected in our results of operations until future periods. Volatility in the capital markets has been heightened during recent months and such volatility may continue, which may cause declines in the price of our common stock.

To the extent there is a sustained general economic downturn and our software and CaaS platform is perceived by customers and potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected. Our revenue may also be disproportionately affected by delays or reductions in general information technology spending. Competitors, many of whom are larger and more established than we are, may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our subscription offerings and related services. We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, our business, results of operations, and financial condition could be materially and adversely affected.

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, global pandemics, data security breaches and terrorism may disrupt our business.

We rely heavily on our network infrastructure and IT systems for our business operations. An online attack, damage as a result of civil unrest, earthquake, fire, terrorist attack, power loss, global pandemics (such as the COVID-19 pandemic), telecommunications failure, or other similar catastrophic event could cause system interruptions, delays in accessing our service, reputational harm, and loss of critical data. Such events could prevent us from providing our CaaS platform to our customers. A catastrophic event that results in the destruction or disruption of our data centers, or our network infrastructure or IT systems, including any errors, defects, or failures in third-party hardware, could affect our ability to conduct normal business operations, and adversely affect our operating results.

In addition, as computer malware, viruses, computer hacking, fraudulent use attempts, and phishing attacks have become more prevalent, we face increased risk from these activities. These activities threaten the performance, reliability, security, and availability of our CaaS platform. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security breaches to our systems could, among other things, harm our reputation and our ability to retain existing customers and attract new customers. Many companies that provide cloud-based services have reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic.

If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We may continue to experience rapid growth and organizational change, which may continue to place significant demands on our management and our operational and financial resources. We have also experienced growth in the number of customers, the amount of transactions we process, and the amount of data that our hosting infrastructure supports. Our success will depend in part on our ability to manage this growth effectively. We will require significant capital expenditures and valuable management resources to grow without undermining our culture of innovation, teamwork, and attention to customer success, which has been central to our growth so far. If we fail to manage our anticipated growth and change in a manner that preserves our corporate culture, it could negatively affect our reputation and ability to retain and attract customers and employees.

We intend to expand our international operations in the future. Our expansion will continue to place a significant strain on our managerial, administrative, financial, and other resources. If we are unable to manage our growth successfully, our business and results of operations could suffer.

It is important that we maintain a high level of customer service and satisfaction as we expand our business. As our customer base continues to grow, we will need to expand our account management, customer service, and

13

other personnel. Failure to manage growth could result in difficulty or delays in launching our CaaS platform, declines in quality or customer satisfaction, increases in costs, difficulties in introducing new features, or other operational difficulties. Any of these could adversely impact our business performance and results of operations.

We may acquire or invest in companies, which may divert our management’s attention and result in additional dilution to our stockholders. We may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions.

We may evaluate and consider potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, products, and other assets in the future. An acquisition, investment or business relationship may result in unforeseen operating difficulties and expenditures. In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products, personnel, or operations of the acquired companies. Key personnel of the acquired companies may choose not to work for us, their software may not be easily adapted to work with ours, or we may have difficulty retaining the customers of any acquired business due to changes in ownership, management, or otherwise. We may also experience difficulties integrating personnel of the acquired company into our business and culture. Acquisitions may also disrupt our business, divert our resources and require significant management attention that would otherwise be available for development of our existing business. The anticipated benefits of any acquisition, investment, or business relationship may not be realized or we may be exposed to unknown risks or liabilities.

Negotiating these transactions can be time-consuming, difficult, and expensive, and our ability to close these transactions may often be subject to approvals that are beyond our control. Consequently, these transactions, even if undertaken and announced, may not close. For one or more of those transactions, we may:

We face intense competition, especially from well-established companies offering solutions and related applications. We may lack sufficient financial or other resources to maintain or improve our competitive position, which may harm our ability to add new customers, retain existing customers, and grow our business.

The market for ecommerce solutions is evolving and highly competitive. We expect competition to increase in the future from established competitors and new market entrants. With the introduction of new technologies and the entry of new companies into the market, we expect competition to persist and intensify in the future. This could harm our ability to increase sales, maintain or increase renewals, and maintain our prices. We face intense competition from other software companies that may offer related ecommerce platform software solutions and services. Our competitors include larger companies that have acquired ecommerce platform solution providers in recent years. We also compete with custom software internally developed within ecommerce businesses. In addition, we face competition from niche companies that offer point products that attempt to address certain of the problems that our CaaS platform solves.

Merger and acquisition activity in the technology industry could increase the likelihood that we compete with other large technology companies. Many of our existing competitors have, and our potential competitors could have, substantial competitive advantages such as greater name recognition, longer operating histories, larger sales

14

and marketing budgets and resources, greater customer support resources, lower labor and development costs, larger and more mature intellectual property portfolios, and substantially greater financial, technical and other resources.

Some of our larger competitors also have substantially broader product lines and market focus and will therefore not be as susceptible to downturns in a particular market. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. New start-up companies that innovate, and large companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our CaaS platform. In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with agency partners, technology and application providers in complementary categories, or other parties. Furthermore, ecommerce on large marketplaces, such as Amazon, could increase as a percentage of all ecommerce activity, thereby reducing customer traffic to individual customer websites. Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure, a loss of market share, or a smaller addressable share of the market. It could also result in a competitor with greater financial, technical, marketing, service, and other resources, all of which could harm our ability to compete.

We may need to reduce or change our pricing model to remain competitive.

We price our platform, which is provided as a revenue-sharing model, based on a combination of GMV and services. We expect that we may need to change our pricing from time to time. As new or existing competitors introduce products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers. We also must determine the appropriate price to enable us to compete effectively internationally. Large enterprise customers may demand substantial price discounts as part of the negotiation of sales contracts. As a result, we may be required or choose to reduce our prices or otherwise change our pricing model, which could adversely affect our business, operating results, and financial condition.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, and changing customer needs or preferences, our CaaS platform may become less competitive.

The software industry is subject to rapid technological change, evolving industry standards and practices, and changing customer needs and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. We may introduce significant changes to our CaaS platform or develop and introduce new and unproven services, including using technologies with which we have little or no prior development or operating experience. If we are unable to develop and sell new technology, features, and functionality for our CaaS platform that satisfy our customers and that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected. If new technologies emerge that deliver competitive solutions at lower prices, more efficiently, more conveniently, or more securely, it could adversely impact our ability to compete.

Our CaaS platform must also integrate with a variety of network, hardware, mobile, and software platforms and technologies. We need to continuously modify and enhance our CaaS platform to adapt to changes and innovation in these technologies. If businesses widely adopt new ecommerce technologies, we would have to develop new functionality for our CaaS platform to work with those new technologies. This development effort may require significant engineering, marketing and sales resources, all of which would affect our business and operating results. Any failure of our CaaS platform to operate effectively with future technologies could reduce the demand for our CaaS platform. If we are unable to respond to these changes in a cost-effective manner, our CaaS platform may become less marketable and less competitive or obsolete, and our operating results may be negatively affected.

15

We anticipate that our operations will continue to increase in complexity as we grow, which will create management challenges.

Our business has experienced strong growth and is complex. We expect this growth to continue and for our operations to become increasingly complex. To manage this growth, we continue to make substantial investments to improve our operational, financial, and management controls as well as our reporting systems and procedures. We may not be able to implement and scale improvements to our systems and processes in a timely or efficient manner or in a manner that does not negatively affect our operating results. For example, we may not be able to effectively monitor certain extraordinary contract requirements or individually negotiated provisions as the number of transactions continues to grow. Our systems and processes may not prevent or detect all errors, omissions, or fraud. We may have difficulty managing improvements to our systems, processes and controls or in connection with third-party software. This could impair our ability to provide our CaaS platform to our customers, causing us to lose customers, limiting our CaaS platform to less significant updates, or increasing our technical support costs. If we are unable to manage this complexity, our business, operations, operating results and financial condition may suffer.

As our customer base continues to grow, we will need to expand our services and other personnel, and maintain and enhance our partnerships, to provide a high level of customer service. Extended stay-at-home, business closure, and other restrictive orders may impact our ability to identify, hire, and train new personnel. We also will need to manage our sales processes as our sales personnel and partner network continue to grow and become more complex, and as we continue to expand into new geographies and market segments. If we do not effectively manage this increasing complexity, the quality of our CaaS platform and customer service could suffer, and we may not be able to adequately address competitive challenges. These factors could impair our ability to attract and retain customers and expand our customers’ use of our CaaS platform.

The loss of one or more key employees or an inability to attract and retain highly skilled employees may adversely affect our business.

From time to time, our executive management team may change from the hiring or departure of executives, which could disrupt our business. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period; therefore, they could terminate their employment with us at any time. The loss of one or more of our executive officers or key employees (including any limitation on the performance of their duties or short term or long-term absences as a result of COVID-19) could have a serious adverse effect on our business.

To execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel is intense, especially for experienced software engineers and senior sales executives. If we are unable to attract such personnel in cities where we are located, we may need to hire in other locations, which may add to the complexity and costs of our business operations. We expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Extended stay-at-home, business closure, and other restrictive orders may impact our ability to identify, hire, and train new personnel. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached legal obligations, resulting in a diversion of our time and resources. In addition, job candidates and existing employees often consider the value of the stock awards they receive in connection with their employment. If the perceived value of our stock awards declines, it may adversely affect our ability to recruit and retain highly skilled employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, it could adversely affect our business and future growth prospects.

If we are unable to hire, retain and motivate qualified personnel, our business will suffer.

Our future success depends, in part, on our ability to continue to attract and retain highly skilled personnel. Our ability to identify, hire, develop, motivate and retain qualified personnel will directly affect our ability to

16

maintain and grow our business, and such efforts will require significant time, expense and attention. The inability to attract or retain qualified personnel or delays in hiring required personnel may seriously harm our business, financial condition and operating results. Our ability to continue to attract and retain highly skilled personnel, specifically employees with technical and engineering skills and employees with high levels of experience in designing and developing software and internet-related services, will be critical to our future success. The continued existence of a remote working environment may negatively impact our ability to hire, retain and motivate talent. Competition for highly skilled personnel in the geographic areas in which we operate can be intense due in part to the more limited pool of qualified personnel as compared to other places in the world. In addition, to the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or have divulged proprietary or other confidential information. While we have in the past and intend to continue to issue options or other equity awards as key components of our overall compensation and employee attraction and retention efforts, we are required under GAAP to recognize compensation expense in our operating results for employee stock-based compensation under our equity grant programs which may increase the pressure to limit stock-based compensation.

If we are unable to maintain our corporate culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success, and our business may be harmed.

We believe a portion of our success has been our corporate culture. We have invested substantial time and resources in building our team. As we grow and develop our infrastructure as a public company, our operations may become increasingly complex. We may find it difficult to maintain these important aspects of our corporate culture. If we are required to maintain work-from-home arrangements for a significant period of time, it may impact our ability to preserve our corporate culture. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel, and to effectively focus on and pursue our corporate objectives.

Mobile devices are increasingly being used to conduct commerce, and if our CaaS platform does not operate as effectively when accessed through these devices, our customers and their shoppers may not be satisfied with our services, which could harm our business.

Ecommerce transacted over mobile devices continues to grow more rapidly than desktop transactions. We are dependent on the interoperability of our CaaS platform with third-party mobile devices and mobile operating systems as well as web browsers that are out of our control. Changes in such devices, systems, or web browsers that degrade the functionality of our CaaS platform or give preferential treatment to competitive services could adversely affect usage of our CaaS platform. Mobile ecommerce is a key element in our strategy and effective mobile functionality is integral to our long-term development and growth strategy. If our customers and their shoppers have difficulty accessing and using our CaaS platform on mobile devices, our business and operating results could be adversely affected.

If our software or hardware contains serious errors or defects, we may lose revenue and market acceptance and may incur costs to defend or settle claims with our customers.

Software such as ours often contains errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when first introduced or when new versions or enhancements are released. Despite internal testing, our CaaS platform may contain serious errors or defects, security vulnerabilities or software bugs that we may be unable to successfully correct in a timely manner or at all, which could result in lost revenue, significant expenditures of capital, a delay or loss in market acceptance and damage to our reputation and brand, any of which could have an adverse effect on our business, financial condition and results of operations. Furthermore, our CaaS platform is a multi-tenant cloud-based system that allow us to deploy new versions and enhancements to all of our customers simultaneously. To the extent we deploy new versions or enhancements that contain errors, defects, security vulnerabilities or software bugs to all of our customers of a single platform simultaneously, the consequences would be more severe than if such versions or enhancements

17

were only deployed to a smaller number of our customers. Additionally, our hardware products may have defects in design, manufacture, or associated software. Such defects could exposes us to product liability claims, litigation or regulatory action.

Since our customers use our services for processes that are critical to their businesses, errors, defects, security vulnerabilities, service interruptions or software bugs in our CaaS platform could result in losses to our customers. Our customers may seek significant compensation from us for any losses they suffer or cease conducting business with us altogether. Further, a customer could share information about bad experiences on social media, which could result in damage to our reputation and loss of future sales. There can be no assurance that provisions typically included in our agreements with our customers that attempt to limit our exposure to claims would be enforceable or adequate or would otherwise protect us from liabilities or damages with respect to any particular claim. Even if not successful, a claim brought against us by any of our customers would likely be time-consuming and costly to defend and could seriously damage our reputation and brand, making it harder for us to sell our solutions.

We store personal information of our employees, business partners, our customers and their shoppers or end-users. If the security of this information is compromised or is otherwise accessed without authorization, our reputation may be harmed and we may be exposed to liability and loss of business.

We collect, transmit, use, disclose, process and store personal information and other confidential information of our customers’ shoppers or end-users. Third-party applications available on our CaaS platform and mobile applications may also store personal information, credit card information, and other confidential information. We generally cannot and do not proactively monitor the content that our customers’ shoppers or end-users upload or the information provided to us through the applications integrated with our ecommerce platform; therefore, we do not control the substance of the content on our servers, which may include personal information.

We use third-party service providers and subprocessors to help us deliver services to our customers’ shoppers or end-users. These service providers and subprocessors may also collect, transmit, use, disclose, store and process personal information, credit card information and/or other confidential information. Such information, and the information technology systems that store such information, may be the target of unauthorized access or subject to security breaches and other incidents, including as a result of third-party action, employee or contractor error, nation state malfeasance, malware, phishing, computer hackers, system error, software bugs or defects, process failure or otherwise. Many companies that provide these services have reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic. Any of these could (a) result in the loss of information, litigation, indemnity obligations, damage to our reputation and other liability, or (b) have a material adverse effect on our business, financial condition, and results of operations.

Because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. Even if such a data breach did not arise out of our action or inaction, or if it were to affect one or more of our competitors or our customers’ competitors, rather than us, the resulting concern could negatively affect our customers, our customers’ shoppers or end-users, and our business. Concerns regarding data privacy and security may cause some of our customers or our customers’ shoppers or end-users to stop using our CaaS platform and fail to renew their subscriptions. In addition, failures to meet our customers’ or shoppers’ or end-users’ expectations with respect to security and confidentiality of their data and information could damage our reputation and affect our ability to retain customers, attract new customers, and grow our business.

Our failure to comply with legal, contractual, or standards-based requirements around the security of personal information could lead to significant fines and penalties, as well as claims by our customers, their shoppers or end-users, or other stakeholders. These proceedings or violations could force us to spend money in defense or settlement of these proceedings, result in the imposition of monetary liability or injunctive relief, divert

18

management’s time and attention, increase our costs of doing business, and materially adversely affect our reputation and the demand for our CaaS platform.

Further, our insurance coverage, including coverage for errors and omissions and cyber liability, may not continue to be available on acceptable terms or may not be available in sufficient amounts to cover one or more large claims. Our insurers could deny coverage as to any future claim and our cyber liability coverage may not adequately protect us against any losses, liabilities and costs that we may incur. The successful assertion of one or more large claims against us, or changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have an adverse effect on our business, financial condition, and results of operations.

We are also subject to federal, state, and foreign laws regarding cybersecurity and the protection of data. Many jurisdictions have enacted laws requiring companies to notify individuals of security breaches involving certain types of personal information. Our agreements with certain customers and partners require us to notify them of certain security incidents. Some jurisdictions and customers require us to safeguard personal information or confidential information using specific measures. If we fail to observe these requirements, our business, operating results, and financial condition could be adversely affected.

A cyberattack, security breach or other unauthorized access or interruption to our information technology systems or those of our third-party service providers could delay or interrupt service to our customers and their customers, harm our reputation or subject us to significant liability.

Cybersecurity threats, privacy breaches, insider threats or other incidents and malicious internet-based activity continue to increase, evolve in nature and become more sophisticated. Information security risks for companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, as well as nation-state and nation-state-supported actors.

Many companies that provide services similar to ours have also reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic. In addition, in the past, some of our customers have been subject to distributed denial of service attacks (“DDoS”), a technique used by hackers to take an internet service offline by overloading its servers. Our CaaS platform may be subject to similar DDoS attacks in the future. In addition, because we leverage third-party partners and service providers, including cloud, software, data center and other critical technology vendors to deliver our solutions, we rely heavily on the data security practices and policies adopted by these third-party service providers. Our ability to monitor our third-party service providers’ data security is limited. A vulnerability in our third-party service providers’ software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions. In addition, we may also become liable in the event our third-party service providers and subprocessors are subject to security breaches, privacy breaches or other cybersecurity threats. We cannot guarantee that any similar incidents may not occur again and adversely affect our operations. We and our third-party service providers and partners may be unable to anticipate or prevent techniques used in the future to obtain unauthorized access or to sabotage systems and cannot guarantee that applicable recovery systems, security protocols, network protection mechanisms and other procedures are or will be adequate to prevent network and service interruption, system failure or data loss. Since techniques used to obtain unauthorized access change frequently and the sophistication and size of DDoS and other cybersecurity attacks is increasing, we may be unable to implement adequate preventative measures or stop the attacks while they are occurring. Any actual or perceived DDoS attack or other security breach or incident could delay or interrupt service to our customers and their customers, could result in loss, compromise, corruption or disclosure of confidential information, intellectual property and sensitive and personal data or data we rely on to provide our solutions, may deter consumers from visiting our customers’ shops, damage our reputation and brand, expose us

19

to a risk of litigation, indemnity obligations and damages for breach of contract, cause us to incur significant liability and financial loss and be subject to regulatory scrutiny, investigations, proceedings and penalties, and require us to expend significant capital and other resources to alleviate problems caused by any such DDoS attack or other security breach or incident and implement additional security measures.

In addition, some jurisdictions, including Brazil and all 50 states in the United States, have enacted laws requiring companies to notify individuals of data security breaches involving certain types of personal data, and our agreements with certain customers require us to notify them in the event of a security incident. Such mandatory disclosures could lead to negative publicity and may cause our customers to lose confidence in the effectiveness of our data security measures. Moreover, if a high-profile security breach occurs with respect to another SaaS provider, customers may lose trust in the security of the SaaS business model generally, which could adversely impact our ability to retain existing customers or attract new ones. In addition, if our security measures fail to protect information adequately, we could be liable to our business partners, our customers, their end-consumers and consumers with whom we have a direct relationship. We could be subject to fines and higher transaction fees, we could face regulatory or other legal action, and our customers could end their relationships with us. The limitations of liability in our contracts may not be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

We currently do maintain cybersecurity insurance, and in the event we were to seek to obtain such insurance coverage, it may not be available on acceptable terms or may not be available in sufficient amounts to cover one or more large claims in connection with cybersecurity liabilities. Insurers could also deny coverage as to any future claim.

We are also subject to federal, state and foreign laws regarding cybersecurity and the protection of data. See the risk factor entitled “—Evolving global laws, regulations and standards, privacy regulations, cross-border data transfer restrictions, and data localization requirements may limit the use and adoption of our services, expose us to liability, or otherwise adversely affect our business.”

We depend on third-party data hosting and transmission services. Increases in cost, interruptions in service, latency, or poor service from our third-party data center providers could impair the delivery of our CaaS platform, which could result in customer or shopper dissatisfaction, damage to our reputation, loss of customers, limited growth, and reduction in revenue.

We currently serve the majority of our CaaS platform functions from third-party data center hosting facilities operated by Amazon Web Services, located in Virginia. Our CaaS platform is deployed to multiple data centers within this geography, with additional geographies available for disaster recovery. Our operations depend, in part, on our third-party providers’ protection of these facilities from natural disasters, power or telecommunications failures, criminal acts, or similar events (such as the COVID-19 pandemic). If any third-party facility’s arrangement is terminated, or its service lapses, we could experience interruptions in our CaaS platform, latency, as well as delays and additional expenses in arranging new facilities and services.

A significant portion of our operating cost is from our third-party data hosting and transmission services. If the costs for such services increase due to vendor consolidation, regulation, contract renegotiation or otherwise, we may not be able to increase the fees for our ecommerce platform or professional services to cover the changes. As a result, our operating results may be significantly worse than forecasted. Our servers may be unable to achieve or maintain data transmission capacity sufficient for timely service of increased traffic or order processing. Our failure to achieve or maintain sufficient and performant data transmission capacity could significantly reduce demand for our CaaS platform.

Our customers often draw many shoppers over short periods of time, including from new product releases, holiday shopping seasons and flash sales. These events significantly increase the traffic on our servers and the volume of transactions processed on our CaaS platform. Despite precautions taken at our data centers, spikes in

20

usage volume, or a natural disaster, an act of terrorism, vandalism or sabotage, closure of a facility without adequate notice, or other unanticipated problems (such as the COVID-19 pandemic) could result in lengthy interruptions or performance degradation of our CaaS platform. Any damage to, or failure of, the systems of our third-party providers could result in interruptions to our CaaS platform. Even with current and planned disaster recovery arrangements, our business could be harmed. If we experience damage or interruption, our insurance policies may not adequately compensate us for or protect us against any losses, liabilities and costs that we may incur. These factors in turn could further reduce our revenue, subject us to liability, cause us to issue credits, or cause customers to terminate their subscriptions, any of which could materially adversely affect our business.

We rely on third-party proprietary and open source software for our CaaS platform. Our inability to obtain third-party licenses for such software, or obtain them on favorable terms, or any errors, bugs, defects or failures caused by such software could adversely affect our business, results of operations and financial condition.

Some of our offerings include software or other intellectual property licensed from third parties. It may be necessary in the future to renew licenses relating to various aspects of these applications or to seek new licenses for existing or new applications. Necessary licenses may not be available on acceptable terms or under open source licenses permitting redistribution in commercial offerings, if at all. Our inability to obtain certain licenses or other rights or to obtain such licenses or rights on favorable terms could result in delays in product releases until equivalent technology can be identified, licensed or developed, if at all, and integrated into our CaaS platform, which therefore may have a material adverse effect on our business, results of operations and financial condition. In addition, third parties may allege that additional licenses are required for our use of their software or intellectual property. We may be unable to obtain such licenses on commercially reasonable terms or at all. The inclusion in our offerings of software or other intellectual property licensed from third parties on a non-exclusive basis could limit our ability to differentiate our offerings from those of our competitors. To the extent that our CaaS platform depends upon the successful operation of third-party software, any undetected errors, bugs, defects or failures in such third-party software could impair the functionality of our CaaS platform, delay new feature introductions, result in a failure of our CaaS platform, which could adversely affect our business, results of operations and financial condition.

Our use of open source software could subject us to possible litigation or cause us to subject our CaaS platform to unwanted open source license conditions that could negatively impact our sales.

A portion of our CaaS platform incorporates open source software, and we expect to incorporate open source software into other offerings or solutions in the future. Such open source software is generally licensed by its authors or other third parties under open source licenses. Little legal precedent governs the interpretation of these licenses; therefore, the potential impact of these terms on our business is unknown and may result in unanticipated obligations regarding our technologies. If a distributor of open source software were to allege that we had not complied with its license, we could be required to incur significant legal expenses. If we combine our proprietary software with open source software or utilize open source software in a certain manner, we could, under certain open source licenses, be required to disclose part or all of the source code of our proprietary software publicly and to allow further modification and redistribution on potentially unfavorable terms or at no cost, or otherwise be limited in the licensing of our services. This could provide an advantage to our competitors or other entrants to the market, allow them to create similar products with lower development effort and time, and ultimately result in a loss of sales for us.

We rely on computer hardware, purchased or leased, and software licensed from and services rendered by third parties in order to run our business.

We rely on computer hardware, purchased or leased, and software licensed from and services rendered by third parties in order to run our business, which we have incorporated into our products. Third-party hardware, software and services may not continue to be available on commercially reasonable terms, or at all. Some of our

21

agreements with our licensors may be terminated by them for convenience, or otherwise provide for a limited term. Any loss of the right to use or any failures of third-party hardware, software or services could result in delays in our ability to run our business until equivalent hardware, software or services are developed by us or, if available, identified, obtained and integrated, which could be costly and time-consuming and may not result in an equivalent solution, any of which could cause an adverse effect on our business and operating results. Further, customers could assert claims against us in connection with service disruptions or cease conducting business with us altogether. Even if not successful, a claim brought against us by any of our customers would likely be time-consuming and costly to defend and could seriously damage our reputation and brand, making it harder for us to sell our solutions.

Our growth depends in part on the success of our strategic relationships with third parties.

We anticipate that the growth of our business will continue to depend on third-party relationships, including strategic partnerships and relationships with our service providers and suppliers, consultants, app developers, theme designers, referral sources, resellers, payments processors, installation partners and other partners. In addition to growing our third-party partner ecosystem, we have entered into agreements with, and intend to pursue additional relationships with, other third parties, such as shipping partners and technology and content providers. Identifying, negotiating and documenting relationships with third parties requires significant time and resources as does integrating third-party technology and content. Some of the third parties that sell our services have direct contractual relationships with the customers, and in these circumstances, we risk the loss of such customers if those third parties fail to perform their contractual obligations, including in the event of any such third party’s business failure. Our agreements with providers of cloud hosting, technology, content and consulting services are typically non-exclusive and do not prohibit such service providers from working with our competitors or from offering competing services. In particular, we have limited providers of cloud hosting services. These third-party providers may choose to terminate their relationship with us or to make material changes to their businesses, products or services in a manner that is adverse to us.

The success of our CaaS platform depends, in part, on our ability to integrate third-party applications, themes and other offerings into our third-party ecosystem. Third-party developers may also change the features of their offering of applications and themes or alter the terms governing the use of their offerings in a manner that is adverse to us. If third-party applications and themes change such that we do not or cannot maintain the compatibility of our CaaS platform with these applications and themes, or if we fail to provide third-party applications and themes that our customers desire to add to their businesses, demand for our CaaS platform could decline. If we are unable to maintain technical interoperation, our customers may not be able to effectively integrate our CaaS platform with other systems and services they use. We may also be unable to maintain our relationships with certain third-party vendors if we are unable to integrate our CaaS platform with their offerings. In addition, third-party developers may refuse to partner with us or limit or restrict our access to their offerings.

Partners may also impose additional restrictions on the ability of third parties like us and our customers to access or use data from their consumers. Such changes could functionally limit or terminate our ability to use these third-party offerings with our CaaS platform, which could negatively impact our solution offerings and harm our business. If we fail to integrate our CaaS platform with new third-party offerings that our customers need for their businesses, or to adapt to the data transfer requirements of such third-party offerings, we may not be able to offer the functionality that our customers and their clients expect, which would negatively impact our offerings and, as a result, harm our business.

Further, our competitors may effectively incentivize third-party developers to favor our competitors’ products or services, which could diminish our prospects for collaborations with third-parties and reduce subscriptions to our CaaS platform. In addition, providers of third-party offerings may not perform as expected under our agreements or under their agreements with our customers, and we or our customers may in the future have disagreements or disputes with such providers. If any such disagreements or disputes cause us to lose access to products or services from a particular supplier, or lead us to experience a significant disruption in the supply of products or

22

services from a current supplier, especially a single-source supplier, they could have an adverse effect on our business and operating results.

We could incur substantial costs in protecting or defending our proprietary rights. Failure to adequately protect our rights could impair our competitive position and we could lose valuable assets, experience reduced revenue, and incur costly litigation.

Our success is dependent, in part, upon protecting our proprietary technology. We rely on our confidentiality, non-compete, non-solicitation and nondisclosure agreements and a combination of trade secret laws, contractual provisions, trademarks, service marks, copyrights, and patents in an effort to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. We make business decisions about when to seek patent protection for a particular technology and when to rely upon trade secret protection. The approach we select may ultimately prove to be inadequate.

Our patents or patents issued in the future may not provide us with competitive advantages, or may be successfully challenged by third parties. Any of our patents, trademarks, or other intellectual property rights may be challenged or circumvented by others or invalidated through administrative process or litigation. Others may independently develop similar products, duplicate any of our solutions or design around our patents, or adopt similar or identical brands for competing platforms. Legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our CaaS platform and use information that we regard as proprietary to create products and services that compete with ours. Some license provisions restricting unauthorized use, copying, transfer, and disclosure of our intellectual property may be unenforceable under the laws of jurisdictions outside the United States.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our CaaS platform and proprietary information may increase. Moreover, effective trademark, copyright, patent, and trade secret protection may not be available or commercially feasible in every country in which we conduct business. Further, intellectual property law, including statutory and case law, particularly in the United States, is constantly developing. Changes in the law could make it harder for us to enforce our rights.

We enter into confidentiality and invention assignment agreements with our employees and consultants to protect our proprietary technologies. We enter into confidentiality agreements with strategic and business partners. As such, these agreements may not be effective in controlling access to and distribution of our proprietary information since they do not prevent our competitors or partners from independently developing technologies that are equivalent or superior to our CaaS platform.

We may be required to spend significant resources to monitor, protect, and enforce our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights and protect our trade secrets. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming, and distracting to management. Such litigation could result in the impairment or loss of portions of our intellectual property. Enforcement of our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property. An adverse determination of any litigation proceedings could put our intellectual property at risk of being invalidated or interpreted narrowly. An adverse determination could risk the issuance or cancellation of pending patent and trademark filings. Because of the substantial discovery required in connection with intellectual property litigation, our confidential or sensitive information could be compromised by disclosure in litigation. Litigation could result in public disclosure of results of hearings, motions, or other interim developments. If securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock.

In addition, our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the

23

implementation of our CaaS platform, impair the functionality of our CaaS platform, delay introductions of new functionality to our CaaS platform, result in the substitution of inferior or more costly technologies into our CaaS platform, or injure our reputation. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Policing unauthorized use of our technologies, trade secrets, and intellectual property may be difficult, expensive, and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. If we fail to meaningfully protect our intellectual property and proprietary rights, our business, operating results, and financial condition could be adversely affected.

If we fail to execute invention assignment agreements with our employees and contractors involved in the development of intellectual property or are unable to protect the confidentiality of our trade secrets, the value of our products and our business and competitive position could be harmed.

We generally enter into confidentiality and invention assignment agreements with our employees, consultants and third parties upon their commencement of a relationship with us. However, we may not enter into such agreements with all employees, consultants and third parties who have been involved in the development of our intellectual property. In addition, these agreements may not provide meaningful protection against the unauthorized use or disclosure of our trade secrets or other confidential information, and adequate remedies may not exist if unauthorized use or disclosure were to occur. The exposure of our trade secrets and other proprietary information would impair our competitive advantages and could have a material adverse effect on our business, financial condition and results of operations. In particular, a failure to protect our proprietary rights may allow competitors to copy our technology, which could adversely affect our pricing and market share. Further, other parties may independently develop substantially equivalent know-how and technology.

In addition to contractual measures, we try to protect the confidential nature of our proprietary information using commonly accepted physical and technological security measures. Such measures may not, for example, in the case of misappropriation of a trade secret by an employee or third party with authorized access, provide adequate protection for our proprietary information. Our security measures may not prevent an employee or consultant from misappropriating our trade secrets and providing them to a competitor, and recourse we take against such misconduct may not provide an adequate remedy to protect our interests fully. Unauthorized parties may also attempt to copy or reverse engineer certain aspects of our products that we consider proprietary. Enforcing a claim that a party illegally disclosed or misappropriated a trade secret can be difficult, expensive and time-consuming, and the outcome is unpredictable. Even though we use commonly accepted security measures, trade secret violations are often a matter of state law, and the criteria for protection of trade secrets can vary among different jurisdictions. In addition, trade secrets may be independently developed by others in a manner that could prevent legal recourse by us. We also have agreements with our employees, consultants and third parties that obligate them to assign their inventions to us, however these agreements may not be self-executing, not all employees or consultants may enter into such agreements, or employees or consultants may breach or violate the terms of these agreements, and we may not have adequate remedies for any such breach or violation. If any of our intellectual property or confidential or proprietary information, such as our trade secrets, were to be disclosed or misappropriated, or if any such information was independently developed by a competitor, it could have a material adverse effect on our competitive position, business, financial condition, results of operations and prospects.

Evolving global laws, regulations and standards, privacy regulations, cross-border data transfer restrictions, and data localization requirements may limit the use and adoption of our services, expose us to liability, or otherwise adversely affect our business.

Federal, state, or foreign governmental bodies or agencies have in the past adopted, and may in the future adopt, laws and regulations affecting the use of the internet as a commercial medium. These laws and regulations could impact taxation, internet neutrality, tariffs, content, copyrights, distribution, electronic contracts and other

24

communications, consumer protection, and the characteristics and quality of services. Legislators and regulators may make legal and regulatory changes, or apply existing laws, in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices. These laws and regulations and resulting increased costs could materially harm our business, results of operations, and financial condition.

Our products and services rely heavily on the collection and use of information, including personal information. Because we store, process, and use data, some of which contains personal information, we are subject to complex and evolving federal, state, and foreign laws and regulations regarding privacy and data protection. Both in the United States and abroad, these laws and regulations governing data privacy are constantly evolving. In the United States, in addition to certain regulations at the federal level, each state has its own statutory approach to privacy regulation, and recently states such as California have been very active in pursuing new regulations that are typically more restrictive than other jurisdictions. The application and interpretation of these laws and regulations are often uncertain, particularly in the new and rapidly evolving industry in which we operate. Continually implementing up-to-date data security tools and procedures and maintaining privacy standards that comply with ever-changing privacy regulations in multiple jurisdictions is challenging. If we are found to have breached any consumer protection laws or regulations in any such market, we may be subject to enforcement actions that require us to change our business practices in a manner which may negatively impact our revenue, as well as expose ourselves to litigation, fines, civil and/or criminal penalties and adverse publicity that could cause our end customers to lose trust in us, negatively impacting our reputation and business in a manner that harms our financial position.

In recent years, there has been an increase in attention to and regulation of data protection and data privacy across the globe, including the Federal Trade Commission (“FTC”)’s increasingly active approach to enforcing data privacy in the United States, as well as the enactment of the European Union’s General Data Protection Regulation (“GDPR”), which took effect in May 2018, the United Kingdom’s transposition of GDPR into its domestic laws following its withdrawal from the European Union, and the California Consumer Privacy Act (“CCPA”), which took effect in January 2020.

In the United States, the CCPA, contains detailed requirements regarding collecting and processing personal information, restrict the use and storage of such information, and govern the effectiveness of consumer consent. Further, the CCPA requires covered companies to provide new disclosures to California consumers, provide such consumers new ways to opt-out of certain sales of personal information, and allow for a new cause of action for data breaches. Such laws could restrict our customers’ ability to run their businesses; for example, by limiting their ability to effectively market to interested shoppers. This could reduce our revenue and the general demand for our services. CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The effects of CCPA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply. Additionally, a new privacy law, the California Privacy Rights Act (the “CPRA”), amending and expanding CCPA, was approved by California voters in the November 3, 2020 election. The CPRA will create additional obligations relating to consumer data beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement beginning July 1, 2023. These laws and regulations could restrict our ability to store and process personal data (in particular, our ability to use certain data for purposes such as risk or fraud avoidance, marketing or advertising), to control our costs by using certain vendors or service providers, and to offer certain services in certain jurisdictions.

Such laws and regulations are often inconsistent and may be subject to amendment or re-interpretation, which may cause us to incur significant costs and expend significant effort to ensure compliance. For example, the European Court of Justice recently invalidated the U.S.-EU Privacy Shield as a basis for transfers of personal data from the EU to the U.S. and introduced requirements to carry out risk assessments in relation to use of other data transfer mechanisms. This may increase regulatory and compliance burdens and may lead to uncertainty about or interruptions of personal data transfers from Europe to the United States (and beyond). Use of other data

25

transfer mechanisms now involves additional compliance steps and in the event any court blocks personal data transfers to or from a particular jurisdiction on the basis that certain or all such transfer mechanisms are not legally adequate, this could give rise to operational interruption in the performance of services for customers and internal processing of employee information, greater costs to implement alternative data transfer mechanisms that are still permitted, regulatory liabilities, or reputational harm. Our response to these requirements globally may not meet the expectations of individual customers, their shoppers, or other stakeholders, which could reduce the demand for our services. Some customers or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.

In Europe, the GDPR introduced stringent requirements (which will continue to be interpreted through guidance and decisions over the coming years) and require organizations to erase an individual’s information upon request, implement mandatory data breach notification requirements, additional new obligations on service providers and strict protections on how data may be transferred outside of the European Economic Area (“EEA”). Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. Because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with such laws even in jurisdictions where we have no local entity, employees or infrastructure. Some of these laws include strict localization provisions that require certain data to be stored within a particular region or jurisdiction. We rely on a globally distributed infrastructure in order to be able to provide our services efficiently, and consequently may not be able to meet the expectations of customers who are located in or otherwise subject to such localization requirements, which may reduce the demand for our services. Further, following the United Kingdom’s withdrawal from the European Union, and the end of the related transition period, as of January 1, 2021, companies may be subject to both GDPR and the United Kingdom GDPR (“UK GDPR”), which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure. Currently there is a four to six-month grace period agreed in the European Union and United Kingdom Trade and Cooperation Agreement, ending June 30, 2021 at the latest, whilst the parties discuss an adequacy decision. The European Commission published a draft adequacy decision on February 19, 2021. If adopted, the decision will enable data transfers from European Union member states to the United Kingdom for a four-year period, subject to subsequent extensions.

Our failure to comply with these and additional laws or regulations could expose us to significant fines and penalties imposed by regulators, as well as legal claims by our customers, or their shoppers, or other relevant stakeholders. Similarly, many of these laws require us to maintain an online privacy policy and terms of service that disclose our practices regarding the collection, processing, and disclosure of personal information. If these disclosures contain any information that a court or regulator finds to be inaccurate or inadequate, we could also be exposed to legal or regulatory liability. Any such proceedings or violations could force us to spend money in defense or settlement, result in the imposition of monetary liability or demanding injunctive relief, divert management’s time and attention, increase our costs of doing business, and materially adversely affect our reputation.

We are subject to governmental export and import controls that could impair our ability to compete in international markets and subject us to liability if we violate the controls.

Our CaaS platform is subject to U.S. export controls, including the Export Administration Regulations and economic sanctions administered by the U.S. Treasury Department’s Office of Foreign Assets Control. We incorporate encryption technology into our CaaS platform. These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations, including by license, a license exception or other appropriate government authorizations.

26

Furthermore, our activities are subject to U.S. economic sanctions laws and regulations that prohibit the shipment of certain products and services to countries, governments, and persons targeted by U.S. embargoes or sanctions. The current administration has been critical of existing trade agreements and may impose more stringent export and import controls. Obtaining the necessary export license or other authorization for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities even if the export license ultimately may be granted. While we take precautions to prevent our CaaS platform from being exported in violation of these laws, including obtaining authorizations for our CaaS platform, performing geolocation IP blocking and screenings against U.S. and other lists of restricted and prohibited persons, we cannot guarantee that the precautions we take will prevent violations of export control and sanctions laws. Violations of U.S. sanctions or export control laws can result in significant fines or penalties and possible incarceration for responsible employees and managers could be imposed for criminal violations of these laws.

If our partners fail to obtain appropriate import, export or re-export licenses or permits, we may also be adversely affected, through reputational harm as well as other negative consequences, including government investigations and penalties. We presently incorporate export control compliance requirements into our strategic partner agreements; however, no assurance can be given that our partners will comply with such requirements.

Various countries regulate the import and export of certain encryption and other technology, including import and export licensing requirements. Some countries have enacted laws that could limit our ability to distribute our CaaS platform or could limit our customers’ ability to implement our CaaS platform in those countries. Changes in our CaaS platform or future changes in export and import regulations may create delays in the introduction of our CaaS platform in international markets, prevent our customers with international operations from launching our CaaS platform globally or, in some cases, prevent the export or import of our CaaS platform to certain countries, governments, or persons altogether. Various governmental agencies have proposed additional regulation of encryption technology, including the escrow and government recovery of private encryption keys. Any change in export or import regulations, economic sanctions, or related legislation, or change in the countries, governments, persons, or technologies targeted by such regulations, could limit our ability to export or sell our CaaS platform to existing or potential customers with international operations. Any decreased use of our CaaS platform or limitation on our ability to export or sell our CaaS platform would adversely affect our business, operating results, and prospects.

We are subject to anti-corruption, anti-bribery, anti-money laundering, and similar laws. Non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the UK Bribery Act of 2010, the UK Proceeds of Crime Act 2002, and other anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years. These laws are interpreted broadly to prohibit companies and their employees and third-party intermediaries from authorizing, promising, offering, or providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. As we increase our international sales and business and sales to the public sector, we may engage with partners and third-party intermediaries to market our services and to obtain necessary permits, licenses, and other regulatory approvals. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

While we have policies and procedures to address compliance with such laws, our employees and agents could violate our policies and applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.

27

Noncompliance with anti-corruption, anti-bribery, or anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage, and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be materially harmed. Responding to any action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees. Enforcement actions and sanctions could further harm our business, results of operations, and financial condition.

Security breaches, denial of service attacks, or other hacking and phishing attacks on our systems or other security breaches, including internal security failures, could harm our reputation or subject us to significant liability, and adversely affect our business and financial results.

We operate in an industry that is prone to cyber-attacks. Failure to prevent or mitigate security breaches and improper access to or disclosure of our data, customer data, or the data of their consumers, could result in the loss or misuse of such data, which could harm our business and reputation. The security measures we have integrated into our internal networks and platforms, which are designed to prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks and platforms against certain attacks. In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. As a result, we may be unable to anticipate these techniques or implement adequate preventative measures to prevent an electronic intrusion into our networks. While we have established a cyber-attack remediation plan to enable us to assess and respond to such attacks, there can be no assurance that the measures set forth under such plan will be adequate in all circumstances nor that they will be effective in mitigating, or allowing us to recover from, the effects of such attacks. In addition, we have insurance coverage, but this coverage may be insufficient to compensate us for all liabilities that we may incur.

Our customers’ storage and use of data concerning their stores and restaurants and their consumers is essential to their use of our CaaS platform, which stores, transmits and processes our customers’ proprietary information and personal information relating to them and their clients. If a security breach were to occur, as a result of third-party action, employee error, breakdown of our internal security processes and procedures, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data was disrupted, we could incur significant liability to our customers and to individuals whose information was being stored by our customers, and our CaaS platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Our CaaS platform and third-party applications available on, or that interface with, our CaaS platform may be subject to DDoS, a technique used by hackers to take an internet service offline by overloading its servers, and we cannot guarantee that applicable recovery systems, security protocols, network protection mechanisms and other procedures are or will be adequate to prevent network and service interruption, system failure or data loss. In addition, computer malware, viruses, and hacking and phishing attacks by third parties are prevalent in our industry. We have experienced such attacks in the past and may experience such attacks in the future. As a result of our increased visibility, we believe that we are increasingly a target for such breaches and attacks.

Moreover, our CaaS platform and third-party applications available on, or that interface with, our CaaS platform could be breached if vulnerabilities in our CaaS platform or third-party applications are exploited by unauthorized third parties or due to employee error, breakdown of our internal security processes and procedures, malfeasance, or otherwise. Further, third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as usernames, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities in order to gain access to our data

28

or our customers’ data. Since techniques used to obtain unauthorized access change frequently and the size and severity of DDoS attacks and security breaches are increasing, we may be unable to implement adequate preventative measures or stop DDoS attacks or security breaches while they are occurring. In addition to our own platforms and applications, some of the third parties we work with may receive information provided by us, by our customers, or by our customers’ clients through web or mobile applications integrated with US. If these third parties fail to adhere to adequate data security practices, or in the event of a breach of their networks, our own and our customers’ data may be improperly accessed, used or disclosed.

Any actual or perceived DDoS attack or security breach could damage our reputation and brand, expose us to a risk of litigation and possible liability and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the DDoS attack or security breach. Some jurisdictions have enacted laws requiring companies to notify individuals and authorities of data security breaches involving certain types of personal or other data and our agreements with certain customers and partners require us to notify them in the event of a security incident. Similarly, if our suppliers experience data breaches and do not notify us or honor their notification obligations to authorities or users, we could be held liable for the breach. We may not be in a position to assess whether a data breach at one of our suppliers would trigger an obligation or liability on our part. Such mandatory disclosures are costly, could lead to negative publicity, and may cause our customers to lose confidence in the effectiveness of our data security measures. Moreover, if a high-profile security breach occurs with respect to another SaaS provider, customers may lose trust in the security of the SaaS business model generally, which could adversely impact our ability to retain revenue from existing customers or attract new customers. Similarly, if a high-profile security breach occurs with respect to a retailer, commerce as a service or eCommerce platform, customers may lose trust in eCommerce more generally, which could adversely impact our customers’ businesses. Any of these events could harm our reputation or subject us to significant liability, and materially and adversely affect our business and financial results.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our operating results.

Our customer subscription and partner and services contracts are primarily denominated in U.S. dollars, and therefore substantially all of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar could increase the real cost of our CaaS platform to our customers outside of the United States, which could adversely affect our operating results. In addition, an increasing portion of our operating expenses is incurred and an increasing portion of our assets is held outside the United States. These operating expenses and assets are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully hedge against the risks associated with currency fluctuations, our operating results could be adversely affected.

Our insurance costs may increase significantly, we may be unable to obtain the same level of insurance coverage and our insurance coverage may not be adequate to cover all possible losses we may suffer.

We generally renew our insurance policies annually. If the cost of coverage becomes too high or if we believe certain coverage becomes inapplicable, we may need to reduce our policy limits, increase retention amounts or agree to certain exclusions from our coverage to reduce the premiums to an acceptable amount or to otherwise reduce coverage for certain occurrences. On the other hand, we may determine that we either do not have certain coverage that would be prudent for our business and the risks associated with our business or that our current coverages are too low to adequately cover such risks. In either event, we may incur additional or higher premiums for such coverage than in prior years.

Among other factors, national security concerns, catastrophic events, pandemics such as the COVID-19 pandemic, or any changes in any applicable statutory requirement binding insurance carriers to offer certain types of coverage could also adversely affect available insurance coverage and result in, among other things, increased premiums on available coverage (which may cause us to elect to reduce our policy limits or not renew our

29

coverage) and additional exclusions from coverage. As cyber incidents and threats continue to evolve, we may be required to expend additional, perhaps significant, resources to continue to update, modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents. Although we maintain and monitor our information technology systems and we have insurance coverage for protecting against cyber security risks, such systems and insurance coverage may not be sufficient to protect against or cover all the losses we may experience as a result of any cyber-attacks.

We may suffer damage due to a casualty loss (such as fire, natural disasters, pandemics and acts of war or terrorism) or other losses, such as those related to labor, professional liability or certain actions or inactions by our management, directors, employees or others, that could severely disrupt its business or subject us to claims by third parties who are injured or harmed. Although we maintain insurance that we believe to be adequate, such insurance may be inadequate or unavailable to cover all the risks to which our business and assets may be exposed, including risks related to certain litigation. Should an uninsured loss (including a loss that is less than the applicable deductible or that is not covered by insurance) or loss in excess of insured limits occur, it could have a significant adverse impact on our business, results of operations or financial condition.

Our ability to use our net operating losses and certain other attributes may be subject to certain limitations.

As of December 31, 2021, we had approximately $17.5 million of U.S. federal and $18.1 million of state net operating losses, respectively. Certain of our U.S. federal and state net operating loss carryforwards may be carried forward indefinitely, while other of these loss carryforwards are subject to expiration (beginning in 2032). It is possible that we will not generate taxable income in time to use these net operating loss carryforwards before their expiration (or that we will not generate taxable income at all). Under legislative changes made in December 2017, as modified by the Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”) in March 2020, U.S. federal net operating loss carryforwards generated in taxable periods beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such net operating loss carryforwards in taxable years beginning after December 31, 2020, is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to these federal tax laws.

In addition, the federal and state net operating loss carryforwards and certain tax credits may be subject to significant limitations under Section 382 and Section 383 of the U.S. Internal Revenue Code of 1986, as amended (the “Code”), respectively, and similar provisions of state law, including limitations that may result from the consummation of the Business Combination. Under those sections of the Code, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change attributes, such as research tax credits, to offset its post-change income or tax may be limited. In general, an “ownership change” will occur if there is a cumulative change in our ownership by “5-percent shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. We have not yet determined whether the Business Combination will give rise to an “ownership change” for purposes of Section 382 and Section 383 of the Code. Furthermore, we may have experienced ownership changes in the past and may experience ownership changes in the future as a result of subsequent shifts in our stock ownership (some of which shifts are outside our control). As a result, our ability to use our pre-change federal NOLs and other tax attributes to offset future taxable income and taxes could be subject to limitations. For these reasons, we may be unable to use a material portion of our NOLs and other tax attributes, which could adversely affect our future net income and cash flows.

Changes to applicable tax laws and regulations or exposure to additional income tax liabilities could affect our business and future profitability.

Nogin is a U.S. corporation and thus is subject to U.S. corporate income tax on its worldwide income. Further, since our operations and customers are located throughout the United States, we are subject to various U.S. state and local taxes. U.S. federal, state, local and non-U.S. tax laws, policies, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us and may have an adverse effect on our

30

business and future profitability. For example, several tax proposals have been set forth that would, if enacted, make significant changes to U.S. tax laws. Such proposals include an increase in the U.S. income tax rate applicable to corporations (such as Nogin). Congress may consider, and could include, some or all of these proposals in connection with tax reform that may be undertaken (including with retroactive effect). We are unable to predict whether these or similar changes will be enacted and, if enacted, how soon any such changes could take effect. The passage of any legislation as a result of these proposals and other similar changes in U.S. federal income tax laws could adversely affect our business and future profitability.

We may be subject to additional obligations to collect and remit sales tax and other taxes. We may be subject to tax liability for past sales, which could harm our business.

State, local and foreign jurisdictions have differing rules and regulations governing sales, use, value added, and other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of such taxes to our ecommerce platform in various jurisdictions is unclear. These jurisdictions’ rules regarding tax nexus are complex and vary significantly. As a result, jurisdictions in which we have not historically collected or accrued sales, use, value added, or other taxes could assert our liability for such taxes. Our liability for these taxes and associated penalties could exceed our original estimates. This could result in substantial tax liabilities and related penalties for past sales. It could also discourage customers from using our SaaS platform or otherwise harm our business and operating results.

If we experience material weaknesses in the future or otherwise fail to maintain an effective system of internal controls in the future, our business could be adversely affected, and we may not be able to accurately report our financial condition or results of operations, which may adversely affect investor confidence in us and, as a result, the value of our common stock.

As a result of becoming a public company, we are required, under Section 404 of the Sarbanes-Oxley Act, to furnish annual reports by management on, among other things, the effectiveness of our internal control over financial reporting. This assessment needs to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. A material weakness is a deficiency or combination of deficiencies in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual and interim financial statements will not be detected or prevented on a timely basis. If we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal controls are effective. The effectiveness of our controls and procedures may be limited by a variety of factors, including:

Pursuant to the Sarbanes-Oxley Act and the rules and regulations promulgated by the SEC, we are required to furnish in our annual report our management’s report regarding the effectiveness of our internal control over financial reporting. The report will include, among other things, an assessment of the effectiveness of our internal control over financial reporting as of the end of our fiscal year, including a statement as to whether or not our internal control over financial reporting is effective. This assessment must include disclosure of any material weaknesses in our internal control over financial reporting identified by management. While we believe our internal control over financial reporting is currently effective, the effectiveness of our internal controls in future periods is subject to the risk that our controls may become inadequate because of changes in conditions. Establishing, testing and maintaining an effective system of internal control over financial reporting requires significant resources and time commitments on the part of our management and our finance staff, may require additional staffing and infrastructure investments and would increase our costs of doing business.

31

In addition, under the federal securities laws, our auditors may in the future be required to express an opinion on the effectiveness of our internal controls. If we are unable to confirm that our internal control over financial reporting is effective, or if, in the future, our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline. In addition, we could become subject to investigations by the applicable stock exchange, the SEC or other regulatory authorities, which could require additional management attention and which could adversely affect our business.

Risks Related to our Common Stock

Our issuance of additional shares of common stock, warrants or convertible securities may dilute your ownership interest in us and could adversely affect our stock price.

From time to time in the future, we may issue additional shares of our common stock, warrants or other securities convertible into common stock pursuant to a variety of transactions, including acquisitions. Additional shares of our common stock may also be issued upon exercise of outstanding stock options and warrants. The issuance by us of additional shares of our common stock, warrants or other securities convertible into our common stock would dilute your ownership interest in us and the sale of a significant amount of such shares in the public market could adversely affect prevailing market prices of our common stock and warrants. Subject to the satisfaction of vesting conditions and the expiration of our lock-up, shares issuable upon exercise of options will be available for resale immediately in the public market without restriction.

In the future, we expect to obtain financing or to further increase our capital resources by issuing additional shares of our capital stock or offering debt or other equity securities, including senior or subordinated notes, debt securities convertible into equity, or shares of preferred stock. Issuing additional shares of our capital stock, other equity securities, or securities convertible into equity may dilute the economic and voting rights of our existing stockholders, reduce the market price of our common stock and warrants, or both. Debt securities convertible into equity could be subject to adjustments in the conversion ratio pursuant to which certain events may increase the number of equity securities issuable upon conversion. Preferred stock, if issued, could have a preference with respect to liquidating distributions or a preference with respect to dividend payments that could limit our ability to pay dividends to the holders of our common stock. Our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, which may adversely affect the amount, timing or nature of our future offerings. As a result, holders of our common stock and warrants bear the risk that our future offerings may reduce the market price of our common stock and warrants and dilute their percentage ownership.

Future sales, or the perception of future sales, of our common stock and warrants by us or our existing securityholders in the public market could cause the market price for our common stock and warrants to decline.

The sale of substantial amounts of shares of our common stock or warrants in the public market, or the perception that such sales could occur, could harm the prevailing market price of shares of our common stock and warrants. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate.

In connection with the Business Combination, Nogin Stockholders are subject to certain restrictions on transfer with respect to the shares of common stock issued as part of the merger consideration beginning at Closing and ending on February 26, 2023, subject to certain price-based releases.

Upon the expiration or waiver of the lock-up provisions described above, shares held by certain of our stockholders will be eligible for resale, subject to, in the case of certain stockholders, volume, manner of sale and other limitations under Rule 144.

32

As restrictions on resale end, the market price of shares of our common stock and warrants could drop significantly if the holders of these shares or warrants sell them or are perceived by the market as intending to sell them. These factors could also make it more difficult for us to raise additional funds through future offerings of our shares of common stock or other securities.

In addition, the shares of our common stock reserved for future issuance under the Nogin, Inc. 2022 Incentive Award Plan (the “2022 Incentive Plan”) will become eligible for sale in the public market once those shares are issued, subject to provisions relating to various vesting agreements, lock-up provisions and, in some cases, limitations on volume and manner of sale applicable to affiliates under Rule 144, as applicable. The number of shares reserved for future issuance under the 2022 Incentive Plan is equal to (i) 5,102,948 shares plus (ii) an annual increase for ten years on the first day of each calendar year beginning on January 1, 2023, equal to the lesser of (A) 15% of the aggregate number of shares of our common stock outstanding on the final day of the immediately preceding calendar year and (B) such smaller number of shares as is determined by our board of directors. The maximum number of shares of common stock that may be issued pursuant to the exercise of incentive stock options to purchase shares of our common stock (“ISOs”) granted under the 2022 Incentive Plan is equal to 56,132,428 shares. We expect to file one or more registration statements on Form S-8 under the Securities Act to register shares of our common stock or securities convertible into or exchangeable for shares of our common stock issued pursuant to our equity incentive plans. Any such Form S-8 registration statements will automatically become effective upon filing. Accordingly, shares registered under such registration statements will be available for sale in the open market.

The requirements of being a public company, including compliance with the reporting requirements of the Exchange Act, the requirements of the Sarbanes-Oxley Act and the requirements of Nasdaq, may strain our resources, increase our costs and distract management, and we may be unable to comply with these requirements in a timely or cost-effective manner.

As a public company, we are subject to laws, regulations and requirements, certain corporate governance provisions of the Sarbanes-Oxley Act, related regulations of the SEC and the requirements of Nasdaq, which we were not required to comply as a private company. As a newly public company, complying with these statutes, regulations and requirements occupies a significant amount of time of our board of directors and management and significantly increases our costs and expenses. For example, we have had to institute a more comprehensive compliance function, comply with rules promulgated by Nasdaq, prepare and distribute periodic public reports in compliance with our obligations under the federal securities laws, establish new internal policies, such as those relating to insider trading. We have also had to retain and rely on outside counsel and accountants to a greater degree in these activities. In addition, being subject to these rules and regulations has made it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. As a result, it may be more difficult for us to attract and retain qualified individuals to serve on our board of directors or as executive officer.

We are an “emerging growth company” and the reduced disclosure requirements applicable to emerging growth companies may make our common stock less attractive to investors.

We are an “emerging growth company,” as defined in the JOBS Act. As an emerging growth company, we may follow reduced disclosure requirements and do not have to make all of the disclosures that public companies that are not emerging growth companies do. We will remain an emerging growth company until the earlier of (a) the last day of the fiscal year in which we have total annual gross revenues of $1.235 billion or more; (b) the last day of the fiscal year following the fifth anniversary of the date of the completion of the initial public offering of SWAG; (c) the date on which we have issued more than $1.0 billion in nonconvertible debt during the previous three years; or (d) the date on which we are deemed to be a large accelerated filer under the rules of the SEC, which means the market value of our common stock that is held by non-affiliates exceeds $700.0 million as of the prior June 30th. For so long as we remain an emerging growth company, we are permitted and intend to rely

33

on exemptions from certain disclosure requirements that are applicable to other public companies that are not emerging growth companies. These exemptions include:

In addition, the JOBS Act provides that an emerging growth company can take advantage of an extended transition period for complying with new or revised accounting standards. This allows an emerging growth company to delay the adoption of certain accounting standards until those standards would otherwise apply to private companies. We have elected to use the extended transition period for complying with new or revised accounting standards; and as a result of this election, our financial statements may not be comparable to companies that comply with public company effective dates.

We may choose to take advantage of some, but not all, of the available exemptions for emerging growth companies. We cannot predict whether investors will find our common stock less attractive if we rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our share price may be more volatile.

Anti-takeover provisions in our governing documents and under Delaware law could make an acquisition of us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Our certificate of incorporation, our bylaws and Delaware law each contain provisions that could have the effect of rendering more difficult, delaying, or preventing an acquisition deemed undesirable by our board of directors. Among other things, our certificate of incorporation and/or our bylaws include the following provisions:

34

These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management. As a Delaware corporation, we are also subject to provisions of Delaware law, including Section 203 of the DGCL, which prevents interested stockholders, such as certain stockholders holding more than 15% of our outstanding common stock, from engaging in certain business combinations unless (i) prior to the time such stockholder became an interested stockholder, the board of directors approved the transaction that resulted in such stockholder becoming an interested stockholder, (ii) upon consummation of the transaction that resulted in such stockholder becoming an interested stockholder, the interested stockholder owned at least 85% of our common stock, or (iii) following board approval, such business combination receives the approval of the holders of at least two-thirds of our outstanding common stock not held by such interested stockholder at an annual or special meeting of stockholders.

Any provision of our certificate of incorporation, our bylaws or Delaware law that has the effect of delaying, preventing or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Our certificate of incorporation and our bylaws provide that the Court of Chancery of the State of Delaware is, to the fullest extent permitted by applicable law, the sole and exclusive forum for substantially all disputes between us and our stockholders, which limits our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

Our certificate of incorporation and our bylaws provide that, unless we consent in writing to the selection of an alternative forum, the (a) Court of Chancery (the “Chancery Court”) of the State of Delaware (or, in the event that the Chancery Court does not have jurisdiction, the federal district court for the District of Delaware or other state courts of the State of Delaware) shall, to the fullest extent permitted by applicable law, be the sole and exclusive forum for: (i) any derivative action, suit or proceeding brought on our behalf; (ii) any action, suit or proceeding asserting a claim of breach of fiduciary duty owed by any of our directors, officers, or stockholders to us or to our stockholders; (iii) any action, suit or proceeding asserting a claim arising pursuant to the DGCL, our certificate of incorporation or our bylaws; or (iv) any action, suit or proceeding asserting a claim governed by the internal affairs doctrine; and (b) subject to the foregoing, the federal district courts of the United States is the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act. Notwithstanding the foregoing, such forum selection provisions shall not apply to suits brought to enforce any liability or duty created by the Exchange Act or any other claim for which the federal courts of the United States have exclusive jurisdiction. The choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees, which may discourage such lawsuits against us and our directors, officers, and other employees. Alternatively, if a court were to find the choice of forum provision contained in our certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations, and financial condition.

Additionally, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. As noted above, our certificate of incorporation and our bylaws provide that the federal district courts of the United States shall have jurisdiction over any action arising under the Securities Act. Accordingly, there is uncertainty as to whether a court would enforce such provision. Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder.

The market price of our common stock may be volatile or may decline regardless of our operating performance. You may lose some or all of your investment.

The market price of our common stock is likely to be volatile. The stock market recently has experienced extreme volatility. This volatility often has been unrelated or disproportionate to the operating performance of

35

particular companies. You may not be able to resell your shares at an attractive price due to a number of factors such as those listed in this section and the following:

These broad market and industry factors may materially reduce the market price of our common stock, regardless of our operating performance. In addition, price volatility may be greater if the public float and trading volume of our common stock is low. As a result, you may suffer a loss on your investment.

In the past, following periods of market volatility, stockholders have instituted securities class action litigation. If we were involved in securities litigation, it could have a substantial cost and divert resources and the attention of management from our business regardless of the outcome of such litigation.

As a public reporting company, we are subject to rules and regulations established from time to time by the SEC regarding our internal control over financial reporting. If we fail to establish and maintain effective internal control over financial reporting and disclosure controls and procedures, we may not be able to accurately report our financial results or report them in a timely manner.

We are subject to the rules and regulations established from time to time by the SEC and Nasdaq. These rules and regulations require, among other things that we establish and periodically evaluate procedures with respect to our

36

internal control over financial reporting. Reporting obligations as a public company are likely to place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel.

In addition, as a public company, we are required to document and test our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal control over financial reporting.

We do not intend to pay dividends on our common stock for the foreseeable future.

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain all available funds and future earnings, if any, to fund the development and growth of the business, and therefore, do not anticipate declaring or paying any cash dividends on common stock in the foreseeable future. Any future determination related to our dividend policy will be made at the discretion of our board of directors after considering our business prospects, results of operations, financial condition, cash requirements and availability, debt repayment obligations, capital expenditure needs, contractual restrictions, covenants in the agreements governing current and future indebtedness, industry trends, the provisions of Delaware law affecting the payment of dividends and distributions to stockholders and any other factors or considerations the board of directors deems relevant.

If securities analysts do not publish research or reports about us, or if they issue unfavorable commentary about us or our industry or downgrade our common stock, the price of our common stock could decline.

The trading market for our common stock depends, in part, on the research and reports that third-party securities analysts publish about us and the industries in which we operate. We may be unable or slow to attract research coverage, and if one or more analysts cease coverage of us, the price and trading volume of our securities would likely be negatively impacted. If any of the analysts that may cover us change their recommendation regarding our common stock adversely, or provide more favorable relative recommendations about our competitors, the price of our common stock would likely decline. If any analyst that may cover us ceases covering us or fails to regularly publish reports on us, we could lose visibility in the financial markets, which could cause the price or trading volume of our common stock to decline. Moreover, if one or more of the analysts who cover us downgrades our common stock, or if our reporting results do not meet their expectations, the market price of our common stock could decline.

Our ability to timely raise capital in the future may be limited, or may be unavailable on acceptable terms, if at all. Our failure to raise capital when needed could harm our business, operating results and financial condition. Debt issued to raise additional capital may reduce the value of our common stock.

We have funded our operations since inception primarily through equity financings, debt, and payments by our customers for use of our CaaS platform and related services. We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business.

We intend to continue to make investments to support our business and may require additional funds. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. If we incur debt, the debt holders could have rights senior to holders of our common stock to make claims on our assets. The terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. As a result, our stockholders bear the risk of future issuances of debt securities reducing the value of our common stock.

37

We have been notified by Nasdaq of our failure to comply with certain continued listing requirements and, if we are unable to regain compliance with all applicable continued listing requirements and standards of Nasdaq, our securities could be delisted.

On December 2, 2022, we received a written notice (the “Notice”) from the Listing Qualifications Department of Nasdaq notifying us that, based on the closing bid price of our common stock for the 30 consecutive trading days preceding the notice, the Company no longer complied with the minimum bid price requirement for continued listing on The Nasdaq Global Market. Nasdaq Listing Rule 5450(a)(1) requires listed securities to maintain a minimum bid price of $1.00 per share (the “Minimum Bid Price Requirement”), and Nasdaq Listing Rule 5810(c)(3)(A) provides that a failure to meet the Minimum Bid Price Requirement exists if the deficiency continues for a period of 30 consecutive trading days.

We have been provided an initial compliance period of 180 calendar days to regain compliance with the Minimum Bid Price Requirement. To regain compliance, the closing bid price of our common stock must be at least $1.00 per share for a minimum of 10 consecutive trading days prior to May 31, 2023, and we must otherwise satisfy The Nasdaq Global Market’s requirements for listing.

If we do not regain compliance by May 31, 2023, we may be eligible for an additional 180 calendar day compliance period if we elect (and meet the listing standards) to transfer to The Nasdaq Capital Market to take advantage of the additional compliance period offered on that market. To qualify, we would be required, among other things, to meet the continued listing requirement for market value of publicly held shares as well as all other standards for initial listing on The Nasdaq Capital Market, with the exception of the Minimum Bid Price Requirement, and would need to provide written notice of our intention to cure the bid price deficiency during the second compliance period. If we do not regain compliance within the compliance period(s), including any extensions that may be granted by Nasdaq, our securities will be subject to delisting.

Such a delisting would likely have a negative effect on the price of the securities and would impair your ability to sell or purchase the securities when you wish to do so. In the event of a delisting, we can provide no assurance that any action taken by us to restore compliance with listing requirements would allow our securities to become listed again, stabilize the market price or improve the liquidity of our securities. Additionally, if our securities become delisted from Nasdaq for any reason, the liquidity and price of our securities may be more limited than if our securities were quoted or listed on Nasdaq or another national securities exchange. You may be unable to sell your securities unless a market can be established or sustained.

Risks Related to our Convertible Notes

The issuance of shares of our common stock pursuant to our Convertible Notes may result in significant dilution to our stockholders.

The conversion of our outstanding Convertible Notes, issued on August 26, 2022, could result in the issuance of a significant number of shares of our common stock. Currently, the $65.5 million principal amount of convertible notes is convertible at a price of $11.50 per share, which would result in the issuance of 5,695,651 shares of our common stock upon the conversion of the Convertible Notes in full. In addition, the conversion price is subject to adjustments set forth in the indenture, including conversion rate resets (x) on September 26, 2023 and September 26, 2024 and (y) following the consummation of certain equity and equity-linked offerings by Nogin and sales of certain equity and equity-linked securities by certain stockholders of Nogin.

Due to the variable nature of the adjustments of the conversion price and the formula that sets certain conversion prices of these securities based on a discount to the then-current market price, we could issue a significant number of shares of our common stock upon conversion of the Convertible Notes, which may result in significant dilution to our stockholders and could negatively impact the trading price of our common stock.

38

Our obligations to the holders of our Convertible Notes are secured by a security interest in substantially all of our assets, if we default on those obligations, the convertible noteholders could foreclose on our assets.

Our obligations under our outstanding Convertible Notes, issued on August 26, 2022, are secured by a security interest in substantially all of our assets. As a result, if we default on our obligations under such Convertible Notes, the collateral agent on behalf of the holders of the Convertible Notes could foreclose on the security interests and liquidate some or all of our assets, which would harm our business, financial condition and results of operations and could require us to reduce or cease operations and you may lose all or part of your investment.

Events of default under the convertible notes include: (i) failure by us to pay principal when due; (ii) failure by us to pay interest when due (if not cured within thirty (30) days); (iii) uncured conversion failure; (iv) failure to deliver a fundamental change notice when due; (v) a default in our successor obligations; (vi) a default pursuant to our covenant obligations (that is not cured within thirty (30) days); (vii) a default pursuant to certain other obligations (that is not cured within sixty (60) days); (viii) the occurrence of certain defaults with respect to any one or more mortgages, agreements or other instruments under which there is outstanding at least an aggregate of $5.0 million of indebtedness of Nogin or any of its subsidiaries; (ix) any guarantee ceases to be in full force and effect or any guarantor denies its obligations under its guarantee; (x) final judgment for the payment of money aggregating in excess of $5.0 million are rendered against Nogin or any subsidiary and not bonded or discharged within 60 days; (xi) the commencement by Nogin or any subsidiary of a voluntary case or proceeding under any applicable federal, state or foreign bankruptcy, insolvency, reorganization or other similar law; (xii) the entry by a court of a decree, order, judgment or other similar document in respect of Nogin or any subsidiary of a voluntary or involuntary case or proceeding under any applicable federal, state or foreign bankruptcy, insolvency, reorganization or other similar law (and such order or decree remains unstayed and in effect for at least sixty (60) days); (xiii) any provision of any note document shall at any time for any reason cease to be valid and binding or enforceable; and (xiv) any security document shall for any reason (other than pursuant to the express terms thereof or due to any failure or omission of the collateral agent) fail or cease to create a separate valid and perfected and, except to the extent permitted by the terms thereof, first priority lien.

39