Our services involve the storage and transmission of our customers’ and our customers' customers'customers’ customers’ proprietary and other sensitive data, including financial, informationhealth and other personally identifiablepersonal information. While we haveWe can provide no assurances that our security measures designed to protect our customers’ and our customers’ customers’ data will be effective. Our services and underlying infrastructure may in place, they maythe future be materially breached or compromised as a result of efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states. Our security measures could also be compromised by employee error or malfeasance, which could result in someone obtaining unauthorized access to, or denying authorized access to our IT systems, our customers’ data or our data, including our intellectual property and other confidential business information. Additionally, third parties may attemptthe following:

In the normal course of business, we are and have been the target of malicious cyberattack attempts and have experienced other security incidents. Although, to temporarily deny customers accessdate, such identified security events have not been material or significant to us, including to our services.reputation or business operations, or had a material financial impact, there can be no assurance that future cyberattacks will not be material or significant. Additionally, as our market presence grows, we may face increased risks of cyberattack attempts or security threats.

A security breach or incident could expose usresult in unauthorized parties obtaining access to, a risk of loss or inappropriate use of proprietary and sensitive data, or the denial of authorized access to, this data.our IT systems or data, or our customers’ systems or data, including intellectual property and proprietary, sensitive or other confidential information. A security breach could also result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to increases in insurance premiums and legal, regulatory and financial exposure and liability. Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including those arising from third-party hardware or software, may result in additional financial burdens due to additional direct and indirect costs, for examplesuch as additional infrastructure capacity spending to mitigate any system degradation and the reallocation of resources from development activities.

For example, in April 2022, we learned a threat actor had obtained unauthorized access to several databases on Heroku, a Salesforce platform-as-a-service. The threat actor downloaded stored customer security credentials and passwords for logging into GitHub, a third-party code hosting service used by both Heroku and Heroku customers. The threat actor also was able to download passwords for a subset of customer user accounts and access the encryption key. While we do not believe this incident materially affected our business or financial results, there is no assurance that such circumstances or other similar incidents in the future could not result from remediation efforts.in a material adverse effect on our business.

Because our services are complex and incorporate a variety of hardware, proprietary software, third-party and third-partyopen-source software, our services may have errors or defects that could result in unanticipated downtime for our subscribers and harm to our reputation and our business. Our customers may also use our services in unanticipated ways that may cause a disruption in services for other customers attempting to access their data. Cloud services frequently contain undetected errors when first introduced or when new versions or enhancements are released. We may also encounter difficulties integrating acquired technologies into our services and in augmenting the technologies to meet the quality standards that are consistent with our brand and reputation. As a result, our services may have errors or defects resulting from the complexities of integrating acquisitions.

Since our customers use our services for important aspects of their business, any errors, defects, disruptions in service or other performance problems could hurt our reputation and may damage our customers’ businesses. As a result, customers could elect to not renew our services or delay or withhold payment to us. We could also lose future sales or customers may make warranty or other claims against us, which could result in an increase in our allowance for doubtful accounts, an increase in collection cycles for accounts receivable or the expense and risk of litigation.

We currently serve our customers from third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries. We also rely on computer hardware purchased or leased from, software licensed from, and cloud computing platforms provided by, third parties in order to offer our services, including database software, hardware and data from a variety of vendors. Any disruption or damage to, or failure of our systems generally, including the systems of our third-party platform providers, could result in interruptions in our services.services and harm our business. We have from time to time experienced interruptions in our services and such interruptions may occur in the future. The COVID-19 pandemic disrupted and continues to disrupt the supply chain of hardware needed to maintain these third-party systems or to run our business, which affects our and our suppliers’ operations. In addition, supply chain disruptions due to geopolitical developments in Europe and indirect effects have further complicated existing supply chain constraints. As we increase our reliance on these third-party systems, particularly with respect to third-party cloud computing platforms, our exposure to damage from service interruptions may increase. Interruptions in our services may cause us to issue credits or pay penalties, cause customers to make warranty or other claims against us or to terminate their subscriptions, and adversely affect

We use a range of disaster recovery and business continuity arrangements. For many of our offerings, our production environment and customers’ data are replicated in near real-timereal time in a separate facility located elsewhere. Certain offerings, including some offerings of companies added through acquisitions, may be served through alternate facilities or arrangements. We do not control the operation of any of these facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of destruction or vandalism andor similar misconduct, as well as local administrative actions (including shelter-in-place or similar orders), changes to legal or permitting requirements and litigation to stop, limit or delay operation. In addition, supply chain disruptions due to geopolitical developments in Europe may also lead to power disruptions in regions where our facilities are located. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of any of the foregoing events or risks, or a natural disaster or public health emergency, an act of terrorism, a decision to close the facilities without adequate notice or other unanticipated problems or operational failures at these facilities could result in lengthy interruptions in our services.services, and no assurance can be provided that any such interruptions would be remediated without significant cost or in a timely manner or at all.

If we do not accurately plan for our infrastructure capacity requirements and we experience significant strains on our data center capacity, our customers could experience performance degradation or service outages that may subject us to financial liabilities, result in customer losses and harm our reputation and business. WhenAs we add data centers and add capacity and continue to move to cloud computing platform providers, we may move or transfer our data and our customers’ data.data from time to time. Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our services, which may damage our business.

Any of these risks could harm our business or negatively impact our results of operations. In addition, to facilitate acquisitions or investments, we may seek additional equity or debt financing, which may not be available on terms favorable to us or at all, which may affect our ability to complete subsequent acquisitions or investments, and which may affect the risks of owning our common stock. For example, if we finance acquisitions by issuing equity or convertible or other debt securities or loans, our existing stockholders may be diluted, or we could face constraints related to the provisionterms of, services overand repayment obligation related to, the Internet is evolving, as federal, stateincurrence of indebtedness that could affect the market price of our common stock.

Our ability to acquire other businesses or technologies, make strategic investments or integrate acquired businesses effectively may be impaired by trade tensions and increased global scrutiny of foreign governmentsinvestments and acquisitions and investments in the technology sector. For example, several countries, including the United States and countries in Europe and the Asia-Pacific region, are considering or have adopted restrictions of varying kinds on transactions involving foreign investments and acquisitions. Antitrust authorities in a number of countries have also reviewed acquisitions and investments in the technology industry with increased scrutiny. Governments may continue to adopt or tighten restrictions of this nature, some of which may apply to acquisitions, investments or integrations of businesses by us, and such restrictions or government actions could negatively impact our business and financial results.

Our future success also depends in part on our ability to sell additional features and services, more subscriptions or enhanced editions of our services to our current customers. This may also require increasingly sophisticated and costly sales efforts that are targeted at senior management. Similarly, the rate at which our customers purchase new or modifyenhanced services depends on a number of factors, including general economic conditions and customer receptiveness to any price changes related to these additional features and services.

The Internet has experienced a variety of outages and other delays as a result of damages to portions of its infrastructure, denial-of-service attacks or related cyber incidents, and it could face outages and delays in the future, potentially reducing the availability of the Internet to us or our customers for delivery of our Internet-based services. Any resulting interruptions in our services or the ability of our customers to access our services could result in a loss of potential or existing customers and harm our business.

Any of these factors could negatively impact our services to enable Salesforce and/or our customers to meet the new legal requirements,business and results of operations. The above factors may also increase our potential liability exposure through higher potential penalties for non-compliance. Further, laws such as the European Union’s proposed e-Privacy Regulation are increasingly aimed at the use of personal information for marketing purposes, and the tracking of individuals’ online activities. These new or proposed laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions. These and other requirements could reduce demand for our services, require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and process data or, in some cases,negatively impact our ability to offersuccessfully expand into emerging market countries, where we have little or no operating experience, where it can be costly and challenging to establish and maintain operations, including hiring and managing required personnel, and difficult to promote our services in certain locationsbrand, and where we may not benefit from any first-to-market advantage or our customers' ability to deploy our solutions globally. For example, ongoing legal challenges in Europe to the mechanisms allowing companies to transfer personal data from the European Economic Area to the United States could result in further limitations on the ability to transfer data across borders, particularly if governments are unable or unwilling to reach new or maintain existing agreements that support cross-border data transfers, such as the EU-U.S. and Swiss-U.S. Privacy Shield framework. Additionally, certain countries have passed or are considering passing laws requiring local data residency. The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoptionotherwise succeed.

In addition, larger customers and governmental entities often demand more configuration, integration services and features. As a result of these factors, these sales opportunities often require us to government activity, privacy advocacydevote greater sales support and professional services resources to individual customers, driving up costs and time required to complete sales and diverting our own sales and professional services resources to a smaller number of larger transactions, while potentially requiring us to delay revenue recognition on some of these transactions until the technical or implementation requirements have been met.

Pricing and packaging strategies for enterprise and other industry groups have establishedcustomers for subscriptions to our existing and future service offerings may not be widely accepted by other new or existing customers. Our adoption of such new pricing and packaging strategies may establish new self-regulatory standardsharm our business.

For large enterprise customers, professional services are often performed by us, a third party, or a combination of our own staff and a third party. Our strategy is to work with third parties to increase the breadth of capability and depth of capacity for delivery of these services to our customers. If a customer is not satisfied with the quality of work performed by us or a third party or with the type of services or solutions delivered, we could incur additional costs to address the situation, the profitability of that may place additional burdens onwork might be impaired, and the customer’s dissatisfaction with our services could damage our ability to provideobtain additional work from that customer. In addition, negative publicity related to our customer relationships, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current or prospective customers.

Our success depends substantially upon the continued services of our executive officers and other key members of management, particularly our chief executive officer. From time to time, there may be changes in our management team resulting from the hiring, departure or realignment of executives. For example, in January 2023, Bret Taylor, our former co-CEO and Vice Chair of our board of directors, resigned from these positions with our company. Such changes may be disruptive to our business. We are also substantially dependent on the continued service of our existing development and operations personnel because of the complexity of our services globally. and technologies. Our executive officers, key management, development or operations personnel could terminate their employment with us at any time. Effective succession planning for management is important to our long-term success. If we do not develop adequate succession planning for our key personnel, the loss of one or more of our key employees or groups of employees could seriously harm our business.

Our customers expect usdepend on our support organization to meet voluntary certification and other standards established by third parties, such as TRUSTe. If we areresolve technical issues relating to our applications. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services across our varying and diverse offerings. Outsourced provision of technical support may be suddenly and adversely impacted by unforeseen events, for example, as occurred when certain business process outsourced service providers were delayed in effectively servicing our customers due to conditions related to the COVID-19 pandemic. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on our applications and business reputation and on positive recommendations from our existing customers. Any failure to maintain these certificationshigh-quality technical support, or meet these standards, ita market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to providesell our solutionsservice offerings to certainexisting and prospective customers, and our business, operating results and financial position.

We derive a significant portion of our revenue from subscriptions to our CRM enterprise cloud computing application services, and we expect this will continue for the foreseeable future. Our efforts to expand our services beyond the CRM marketcurrent service offerings may not succeed and may reduce our revenue growth rate. TheIn addition, the markets for certain of our offerings remain relatively new and it is uncertain whether our efforts, and related investments, will ever result in significant revenue for us. Further, the introduction of significant platform changes and upgrades including our conversion to our new Lightning platform, and introduction of new services beyond the CRM market, may not be successful, and early stage interest and adoption of such new services may not result in long term successrevenue growth.

In July 2021, we completed our acquisition of Slack, our largest acquisition to date. Slack is a relatively new category of business technology in a rapidly evolving market for software, programs and tools used by knowledge workers. We may not succeed in enhancing and improving the features, integrations and capabilities of Slack, or significanteffectively introduce compelling new features, integrations and capabilities that reflect or anticipate the changing nature of the market which may result in an inability to attract new users and organizations and increase revenue for us.

If we are unable to develop enhancements to, and new features for, our existing or new services that keep pace with rapid technological developments, our business could be harmed. For example, we may be required to continuously enhance our AI offerings to improve the quality of recommendations provided to our customers. The success of enhancements, new features and services depends on several factors, including the timely completion, introduction and market acceptance of the feature, service or enhancement by customers, administrators and developers, as well as our ability to seamlessly integrate all of our product and service offerings.offerings and develop adequate selling capabilities in new markets. Failure in this regard may significantly impair our revenue growth as well as negatively impact our operating results if the additional costs are not offset by additional revenues. In addition, because our services are designed to operate over various network technologies and on a variety of mobile devices, operating systems and computer hardware and software platforms using a standard browser, we will need to continuously modify and enhance our services to keep pace with changes in Internet-related hardware, software, communication, browser, app development platform and database technologies.technologies, as well as continue to maintain and support our services on legacy systems. We may not be successful in either developing these modifications and enhancements or in bringing them to market timely. Furthermore, uncertainties

Additionally, if we fail to anticipate or identify significant Internet-related and other technology trends and developments early enough, or if we do not devote appropriate resources to adapting to such trends and developments, our business could be harmed. Uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, including text messaging capabilities, or changes in customer usage patterns thereof could increase our research and development or service delivery expenses.expenses or lead to our increased reliance on certain vendors. Any failure of our services to operate effectively with future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and harm our business.

We believe that the brand identities we acquirehave developed, including associations with trust, customer success, innovation, performance and equality and sustainability have significantly contributed to the success of our business. Maintaining and enhancing the Salesforce brand and our other brands is critical to expanding our base of customers, partners and employees. Our brand strength, particularly for our core services, depends largely on our ability to remain a technology leader and to continue to provide high-quality innovative products, services and features in a secure, reliable manner that enhances our customers’ success even as we scale and expand our services. In order to maintain and enhance the strength of our brands, we have made and may in the future make substantial investments to expand or improve our product offerings and services, or we may enter new markets that may be accompanied by initial complications or ultimately prove to be unsuccessful.

We manage a portfolio of strategic investments in both privately held and publicly traded companies focused primarily on enterprise cloud companies, technology startups and system integrators. Our investments range from early to late stage companies, including investments made concurrent with a company’s initial public offering. We invest in companies that we believe are digitally transforming their industries, improving customer experiences, helping us expand our solution ecosystem or supporting other corporate initiatives. We continually evaluate our investments in privately held and publicly traded companies. In certain cases, our ability to sell these investments may be impacted by contractual obligations to hold the securities for a set period of time after a public offering. In addition, the financial success of our investment in any company is typically dependent on a liquidity event, such as a public offering, acquisition or other favorable market event reflecting appreciation to the cost of our initial investment. All of our investments are therefore subject to a risk of partial or total loss of invested capital.

Policies we adopt or choose not to adopt on social and ethical issues, especially regarding the use of our products, may be unpopular with some of our employees or with our customers or potential customers, which has in the past impacted and may in the future impact our ability to attract or retain employees and customers. We also may choose not to conduct business with potential customers or discontinue or not expand business with existing customers due to these policies. Further, actions taken by our customers and employees, including through the use or misuse of our products or new technologies for illegal activities or improper information sharing, may result in reputational harm or possible liability. For example, we have been subject to allegations in legal proceedings that we should be liable for the use of certain of our products by third parties. Although we believe that such claims lack merit, legal proceedings can be lengthy, expensive and disruptive to our operations and the outcome of any claims or litigation, regardless of the merits, is inherently uncertain. Regardless of outcome, these types of claims could cause reputational harm to our brand or result in liability.

We are increasingly building AI into many of our offerings. As with many innovations, AI and our Customer 360 platform present additional risks and challenges that could affect their adoption and therefore our business. For example, the development of AI and Customer 360, the latter of which provides information regarding our customers’ customers, presents emerging ethical issues. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment, or in other social contexts, we may experience brand or reputational harm, competitive harm or legal liability. Data practices by us or others that result in controversy could also impair the acceptance of AI solutions. This in turn could undermine the decisions, predictions or analysis AI applications produce, subjecting us to competitive harm, legal

We have established and publicly announced ESG goals, including our commitments to advancing racial and gender equality within our workforce and reducing greenhouse gas emissions. These statements reflect our current plans and aspirations and are not realizeguarantees that we will be able to achieve them. Our failure to accomplish or accurately track and report on these goals on a timely basis, or at all, could adversely affect our reputation, financial performance and growth, and expose us to increased scrutiny from the expected businessinvestment community as well as enforcement authorities.

Standards for tracking and reporting ESG matters continue to evolve. Our selection of voluntary disclosure frameworks and standards, and the acquisitionsinterpretation or application of those frameworks and standards, may change from time to time or differ from those of others. This may result in a lack of consistent or meaningful comparative data from period to period or between Salesforce and other companies in the same industry. In addition, our processes and controls may not comply with evolving standards for identifying, measuring and reporting ESG metrics, including ESG-related disclosures that may be required of public companies by the SEC, and such standards may change over time, which could prove difficultresult in significant revisions to integrate, disrupt our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future.

If our ESG practices do not meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business dilute stockholder valuepartner, acquiror or service provider could be negatively impacted. Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Regulation related to the provision of services over the Internet is evolving, as federal, state and foreign governments continue to adopt new, or modify existing, laws and regulations addressing data privacy, cybersecurity, data protection, data sovereignty and the market valuecollection, processing, storage, hosting, transfer and use of data, generally. In some cases, data privacy laws and regulations, such as the European Union’s (“EU”) General Data Protection Regulation (“GDPR”), impose obligations directly on Salesforce as both a data controller and a data processor, as well as on many of our common stock.

Although we monitor the regulatory, judicial and legislative environment and have invested in addressing these developments, these laws may require us to make additional changes to our practices and services to enable us or our customers to meet the new legal requirements, and may also increase our potential liability exposure through new or higher potential penalties for noncompliance, including as a result of penalties, fines and lawsuits related to data breaches. Furthermore, privacy laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions. These and other requirements are causing increased scrutiny among customers, particularly in the public sector and highly regulated industries, and may be perceived differently from customer to customer. These developments could reduce demand for our services, require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and process data or, in some cases, impact our ability or our customers' ability to offer our services in certain locations, to deploy our solutions, to reach current and prospective customers, or to derive insights from customer data globally. For example, on July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework, one of the mechanisms that allowed companies, including Salesforce, to transfer personal data from the European Economic Area (“EEA”) to the United States. Even if the CJEU decision upheld the Standard Contractual Clauses (“SCCs”) as an adequate transfer mechanism, the data exporters are now also required when relying on SCCs to conduct a transfer risk assessment to verify if anything in the law and/or practices of the destination country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred to the EU standard of essential equivalence. Where no supplementary measure is suitable, the data exporter should avoid, suspend or terminate the transfer. Depending on how the CJEU’s decision is enforced, the cost and complexity of providing our services in certain markets may increase. While the EU and U.S. governments have recently advanced the EU-U.S. Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision, it is uncertain whether this framework will be overturned in court like the previous two EU-U.S. bilateral cross-border transfer frameworks. As a result, regulators may be inclined to continue to interpret the CJEU’s decision, and the logic behind it, as significantly restricting certain cross-border transfers. Certain countries outside of the EEA (e.g., China and India) have also passed or are considering passing laws requiring varying degrees of local data residency. By way of further example, statutory damages available through a private right of action for certain data breaches under the CPRA and potentially other states’ laws, may increase our and our customers’ potential liability and the demands our customers place on us.

The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoption of our services, reduce overall demand for our services, make such investmentsit more difficult to meet expectations from our commitments to customers and acquisitionsour customers’ customers, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation, or slow the pace at which we close sales transactions, in particular where customers request specific warranties and unlimited indemnity for noncompliance with privacy laws, any of which could harm our business. In September 2021, Salesforce announced the Hyperforce EU Operating Zone, which is expected to enable storage and processing of customer data solely within the EU. This EU service may enhance our ability to attract and retain customers operating in the future. Acquisitions and investments involve numerous risks, including:

Furthermore, the uncertain and shifting regulatory environment and trust climate may seek additional equity or debt financing,raise concerns regarding data privacy and cybersecurity, which may cause our customers or our customers’ customers to resist providing the data necessary to allow our customers to use our services effectively. In addition, new products we develop or acquire in connection with

Our customers and potential customers conduct business in a variety of industries, including financial services, the public sector, healthcare and telecommunications. Regulators in certain industries have adopted and may in the future adopt regulations or interpretive positions regarding the use of cloud computing and other outsourced services. The costs of compliance with, and other burdens imposed by, industry-specific laws, regulations and interpretive positions may limit our customers’ use and adoption of our services and reduce overall demand for our services. Compliance with these regulations may also require us to devote greater resources to support certain customers, which may increase costs and lengthen sales cycles. For example, some financial services regulators have imposed guidelines for use of cloud computing services that mandate specific controls or require financial services enterprises to obtain regulatory approval prior to outsourcing certain functions. In the United States, a cybersecurity Executive Order released in May 2021 may heighten future compliance and incident reporting standards in order to obtain certain public sector contracts. If we are unable to comply with these guidelines or controls, or if our customers are unable to obtain regulatory approval to use our services where required, our business may be harmed. In addition, an inability to satisfy the standards of certain voluntary third-party certification bodies that our customers may expect, such as an attestation of compliance with the Payment Card Industry (PCI)(“PCI”) Data Security Standards, may have an adverse impact on our business and results. If in the future we are unable to achieve or maintain industry-specific certifications or other requirements or standards relevant to our customers, it may harm our business and adversely affect our results.

Further, in some cases, industry-specific, regionally-specific or product-specific laws, regulations or interpretive positions may also apply directlyimpact our ability, as well as the ability of our customers, partners and data providers, to us as a service provider.collect, augment, analyze, use, transfer and share personal and other information that is integral to certain services we provide. The interpretation of many of these statutes, regulations and rulings is evolving in the courts and administrative agencies and an inability to comply may have an adverse impact on our business and results. This impact may be particularly acute in countries that have passed or are considering passing legislation that requires data to remain localized “in country,” as this may impose financial costs on companies required to store data in jurisdictions not of their choosing and to use nonstandard operational processes that add complexity and are difficult and costly to integrate with global processes. This is also true with respect to the global proliferation of laws regulating the financial services industry, including its use of cloud services. In Europe, the Digital Operational Resilience Act (DORA), which aims to ensure the resilience of the EU financial sectors, including through mandatory risk management, incident reporting, resilience testing and third-party outsourcing restrictions, was formally adopted by the Council of the EU in November 2022. The UK is advancing similar legislation and other countries may follow. Further, countries are considering legal frameworks on AI, which is a trend that may increase now that the European Commission has proposed the first such framework. Any failure or perceived failure by usSalesforce to comply with such requirements could have an adverse impact on our business. For example, there

There are various statutes, regulations and rulings relevant to the direct email marketing and text-messaging industries, including the Telephone Consumer Protection Act (TCPA)(“TCPA”) and related Federal Communication Commission (FCC) orders, which impose significant restrictions on the ability to utilize telephone calls and text messages to mobile telephone numbers as a means of communication, when the prior consent of the person being contacted has not been obtained. We are,have been, and may in the future be, subject to one or more class-action lawsuits, as well as individual lawsuits, containing allegations that one of our businesses or customers violated the TCPA. A determination that we or our customers violated the TCPA or other communications-based statutes could expose us to significant damage awards that could, individually or in the aggregate, materially harm our business.

We are involved in various legal matters arising from the normal course of business activities. These may include claims, suits, government investigations and other proceedings involving alleged infringement of third-party patents and other intellectual property rights, as well as commercial, corporate and securities, labor and employment, class actions, wage and hour, antitrust, data privacy and other matters.

The software and Internet industries are characterized by the existence of a large number ofmany patents, trademarks, trade secrets and copyrights and by frequent litigation based on allegations of infringement or other violations of intellectual property rights. We

Our exposure to risks associated with various claims, including claims related to the use of intellectual property as well as securities and related stockholder derivative claims, may be increased as a result of acquisitions of other companies. For example, we are subject to ongoing securities class action litigation and related stockholder derivative claims brought against Tableau and Slack that remain outstanding, and as to which we may ultimately be subject to liability or settlement costs. Additionally, we may have a lower level of visibility into the development process with respect to intellectual property or the care taken to safeguard against infringement risks with respect to the acquired companycompanies or technology.technologies. In addition, third parties have made claims in connection with our acquisitions and may do so in the future, and they may also make infringement and similar or related claims after we have acquired technology that had not been asserted prior to our acquisition.

The outcome of any claims or litigation, regardless of the merits, is inherently uncertain. Any claims andor lawsuits, and the disposition of such claims and lawsuits, whether through settlement or licensing discussions, or litigation, could be time-consuming and expensive to resolve, divert management attention from executing our business plan, result in efforts to enjoin our activities, lead to attempts on the part of other parties to pursue similar claims and, in the case of intellectual property claims, require us to change our technology, change our business practices, pay monetary damages or enter into short- or long-term royalty or licensing agreements.

Any adverse determination or settlement related to intellectual property claims or other litigation could prevent us from offering our services to others, could be material to our financial condition or cash flows, or both, or could otherwise adversely affect our operating results.results, including our operating cash flow in a particular period. In addition, depending on the nature and timing of any such dispute, an unfavorable resolution of a legal matter could materially affect our current or future results of operations or cash flows in a particular quarter.period.

If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, affecting our brand, causing us to incur significant expenses and harming our business. Any of our patents, trademarks or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. While we have many U.S. patents and pending U.S. and international patent applications, we may be unable to obtain patent protection for the technology covered in our patent applications or the patent protection may not be obtained quickly enough to meet our business needs. In addition, our existing patents and any patents issued in the future may not provide us with competitive advantages, or may be successfully challenged by third parties. Similar uncertainty applies to our U.S. and international trademark registrations and applications. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain, and we also may face proposals to change the scope of protection for some intellectual property rights in the U.S. and elsewhere. Effective patent, trademark, copyright and trade secret protection may not be available to us in every country in which our services are available.available and legal changes and uncertainty in various countries’ intellectual property regimes may result in making conduct that we believe is lawful to be deemed violative of others’ rights. The laws of some foreign countries may not be as protective of intellectual property rights as those in the U.S., and mechanisms for enforcement of intellectual property rights may be inadequate. Also, our involvement in standard settingstandard-setting activity, our contribution to open source projects, various competition law regimes or the need to obtain licenses from others may require us to license our intellectual property.property in certain circumstances. Accordingly, despite our efforts, we may be unable to prevent third parties from using our intellectual property.

We may be required to spend significant resources and expense to monitor and protect our intellectual property rights. We may initiate claims or litigation against third parties for infringement of our proprietary rights or to establish the validity of our proprietary rights. If we fail to protect our intellectual property rights, it could impact our ability to protect our technology and brand. Furthermore, any litigation, whether or not it is resolved in our favor, could result in significant expense to us, cause us to divert time and resources from our core business, and harm our business.

Our continued success dependscontracts with federal, state, local and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration and performance. We may be subject to audits and investigations

Our solutions are subject to export and import controls where we conduct our business activities, including the U.S. Commerce Department’s Export Administration Regulations, U.S. Customs regulations, U.S. supply chain regulations and various economic and trade sanctions regulations established by the U.S. Treasury Department’s Office of Foreign Assets Control. If we fail to comply with applicable trade laws, we and certain of our employees could be subject to substantial civil or criminal penalties, including the possible loss of trade privileges; fines, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers. Obtaining necessary authorizations, including any required licenses, may be time-consuming, requires expenditure of corporate resources, is not guaranteed, and may result in the delay or loss of sales opportunities or the ability to realize value from certain acquisitions or engagements. Acquisitions may also subject us to successor liability and other integration compliance risks. Furthermore, U.S. export control laws and economic sanctions may prohibit or limit the transfer of certain products and services to U.S. embargoed or sanctioned countries, governments and parties. We can provide no assurance that any of the precautions we take to prevent our solutions from being provisioned or provided to U.S. sanctions targets in violation of applicable regulations will be effective, and, accordingly, our solutions could be provisioned or provided to those targets, including by our resellers or other third parties, which could have negative consequences for our business, including government investigations, penalties and reputational harm. Changes in our solutions or trade regulations may create delays in the introduction, sale and deployment of our solutions in international markets or prevent the export or import of our solutions to certain countries, governments or persons altogether. Any decreased use of our solutions or limitation on our ability to maintainexport or sell our solutions may adversely affect our business, financial condition and enhanceresults of operations. Import and export control regulations in the United States and other countries are subject to change and uncertainty, including as a result of geopolitical developments and relations between the United States and China, the United States and Russia and war in Europe.

We believegenerally recognize revenue from customers ratably over the terms of their subscription and support agreements, which are typically 12 to 36 months. As a result, most of the revenue we report in each quarter is the result of subscription and support agreements entered into during previous quarters. Consequently, a decline in new or renewed subscriptions in any one quarter may not be reflected in our revenue results for that the brand identities we have developed have significantly contributed to the success of our business. Maintaining and enhancing the Salesforce brand and our other brands are critical to expanding our base of customers, partners and employees. Our brand strengthquarter but will depend largely on our ability to remain a technology leader and continue to provide high-quality innovative products, services, and features securely, reliably and in a manner that enhances our customers' success. In order to maintain and enhance our brands, we may be required to make substantial investments that may later prove to be unsuccessful. In addition, positions we take on social issues may be unpopular with some customers or potential customers, which maynegatively impact our ability to attract or retain such customers. Our brand is also associated with our public commitments to sustainabilityrevenue in future quarters. Accordingly, the effect of significant downturns in sales and equality, and any perceived changes in our dedication to these commitments could adversely impact our relationships with our customers. In addition, we have secured the naming rights to facilities controlled by third parties, such as office towers and a transit center, and any negative events or publicity arising from these facilities could adversely impact our

Due to the unpredictability of future general economic and they could terminate their employment with us at any time. The lossfinancial market conditions, including from the global economic impact of one or moregeopolitical conflict in Europe, the pace of change and innovation in enterprise cloud computing services, the impact of foreign currency exchange rate fluctuations, the growing complexity of our key employees or groups could seriously harmbusiness, including the use of multiple pricing and packaging models and the increasing amount of revenue from software license sales, and our business.

We are also committed to a sustainable, low-carbon future, advancing equality and diversity, and fostering employee success. We try to integrate social good into everything we do. All of these goals align with our long-term growth strategy and financial and operational priorities.

In addition to invest for futureour focus on top line growth include the continuation of the expansionlevers, we are also focused on reducing our operating expenses to improve our operating margin. For example, in January 2023, we announced a restructuring plan (the “Plan”) intended to reduce operating costs, improve operating margins, and continue advancing our ongoing commitment to profitable growth. The Plan includes a reduction of our data center capacity, whether internally or throughworkforce by approximately 10 percent and select real estate exits and office space reductions within certain markets. We expect to see improvements in our operating expenses across all operating categories, with the use of third parties, the hiring of additional personnel, particularlymost opportunity in direct sales other customer-related areas and research and development, the expansion of domestic and international selling and marketing activities, specifically inexpense and general and administrative expenses. We plan to continue to grow and innovate our top markets, the continued development of our brands, the addition of distribution channels, the upgrade of our service offerings, the continued development of services including Community Cloud, Industry Cloudsbusiness and Success Cloud, the integration of new and acquired technologies such as Commerce Cloud, artificial intelligence technologies and Salesforce

While we continue to see growth strategy,in our total revenues, macroeconomic factors have impacted our business and our customers’ businesses in ways that are difficult to isolate and quantify. Beginning in July 2022, we are delivering innovative solutionssaw more measured buying behavior from our customers resulting in stretched sales cycles, additional approval layers required from our customers and deal compression. These trends continued in the second half of fiscal 2023. Slower growth in new categories, including analytics, e-commerce, artificial intelligence, IoT and collaborative productivity tools. We drive innovation organicallyrenewal business, particularly if sustained, impacts our remaining performance obligation, revenues and our ability to a lesser extent through acquisitions, such as our July 2016 acquisition of Demandware, Inc. (“Demandware”), a digital commerce leader. We have a disciplinedmeet financial guidance and thoughtful acquisition process where we routinely surveylong-term targets.

In addition, the industry landscape across a wide range of companies. As a resultexpanding global scope of our aggressive growth plansbusiness and integrationthe heightened volatility of global markets, expose us to the risk of fluctuations in foreign currency markets. Foreign currency fluctuations negatively impacted revenues by approximately four percent in the fiscal year ended January 31, 2023 and negatively impacted our previously acquired businesses, we have incurred significant expenses from equity awards and amortization of purchased intangibles, which have reduced our operating income. We remain focused on improving operating margins in fiscal 2019 and beyond.

Subscription and support revenues include subscription fees from customers accessing our enterprise cloud computing services (collectively, "Cloud Services"), software license revenues from the sales of term and perpetual licenses, and support revenues from customers paying for additionalthe sale of support and updates beyond the standard support that is included in the basic subscription fees; and (2)fees or related professional services such as process mapping, project management, implementation services and other revenue. “Other revenue” consists primarilyto the sales of training fees. Subscription and support revenues accounted for approximately 93 percentsoftware licenses. Our Cloud Services allow customers to use our multi-tenant software without taking possession of our total revenues for fiscal 2018. Subscription revenues are driven primarily by the number of paying subscribers, varying service types, the price of our service and renewals. We define a “customer” as a separate and distinct buying entity (e.g., a company, a distinct business unit of a large corporation, a partnership, etc.) that has entered into a contract to access our enterprise cloud computing services. We define a “subscription” as a unique user account purchased by a customer for use by its employees or other customer-authorized users, and we refer to each such user as a “subscriber.” The number of paying subscriptions at each of our customers ranges from one to hundreds of thousands. None of our customers accounted for more than five percent of our revenues during fiscal 2018 and 2017.

The revenue growth rates of each of our service offerings, as described below in “Results of Operations,” fluctuate from quarter to quarter and Commerce Cloudover time. Additionally, we manage the total balanced product portfolio to deliver solutions to our customers and, as a result, the revenue result for fiscal 2018, approximately $253.4 million was attributed to Commerce Cloud.

Our growth in revenues is also impacted by attrition. Attrition represents the reduction or loss of the annualized value of our contracts with customers. We calculate our attrition rate at a point in time on a trailing twelve-month basis as we introduce new featuresof the end of each month. As of January 31, 2023, our attrition rate, excluding MuleSoft, Tableau and functions within each offeringSlack, was below 7.5 percent. Beginning in the first quarter of fiscal 2024, Mulesoft and refine our allocation methodology for changesTableau will be included in our business,attrition rate calculation, which we do not expect it to be practicalslightly increase our attrition rate going forward.

We continue to adjust historical revenue results by service offering for comparability. Accordingly, comparisonsmaintain a variety of revenue performance by core service offering over time may not be meaningful.

Our remaining performance obligation represents all future revenue balance on our consolidated balance sheets doesunder contract that has not represent the total contract value of annual or multi-year, non-cancelable subscription agreements. Unbilled deferredyet been recognized as revenue is an operational measure thatand includes unearned revenue and unbilled amounts. Our current remaining performance obligation represents future billingsrevenue under our subscription agreementscontract that have not been invoiced and, accordingly, are not recorded in deferred revenue. Unbilled deferred revenue amounts by quarter are reflected in the table below. Our typical contract length is between 12 and 36 months. We expect that the amount of unbilled deferred revenue will change from quarter to quarter for several reasons, including the specific timing, duration and size of large customer subscription agreements, varying billing cycles of subscription agreements, the specific timing of customer renewals, foreign currency fluctuations, the timing of when unbilled deferred revenue isexpected to be recognized as revenue in the next 12 months.

Remaining performance obligation is not necessarily indicative of future revenue growth and changesis influenced by several factors, including seasonality, the timing of renewals, average contract terms, foreign currency exchange rates and fluctuations in customer financial circumstances.new business growth. Remaining performance obligation is also impacted by acquisitions. Unbilled portions of the remaining performance obligation denominated in foreign currencies are revalued each period based on the period end exchange rates. For multi-year subscription agreements billed annually, the associated unbilled deferred revenue isbalance and corresponding remaining performance obligation are typically high at the beginning of the contract period, zero just prior to renewal, and increasesincrease if the agreement is renewed. Low unbilled deferred revenueremaining performance obligation attributable to a particular subscription agreement is often associated with an impending renewal andbut may not be an indicator of the likelihood of renewal or future revenue from such customer. Accordingly, we expect thatChanges in contract duration or the amounttiming of aggregate unbilled deferred revenue will change from year-to-year depending in part upondelivery of professional services can impact remaining performance obligation as well as the numberallocation between current and dollar amount of subscription agreements at particular stages in their renewal cycle. Such fluctuations are not a reliable indicator of future revenues. Unbilled deferred revenue does not include minimum revenue commitments from indirect sales channels, as we recognize revenue, deferred revenue, and any unbilled deferred revenue upon sell-through to an end user customer. Unbilled deferred revenue also does not include any estimates for overage billings above a customer's minimum commitment.non-current remaining performance obligation.