If our security measures are breached or fail, resulting in unauthorized access to client data, our solution may be perceived as insecure, the attractiveness of our solution to current or potential clients may be reduced and we may incur significant liabilities.
Our solution involves the storage and transmission of the proprietary information and protected data that we receive from our clients. We rely on proprietary and commercially available systems, software, tools and monitoring, as well as other processes, to provide security for processing, transmission and storage of such information. Despite the implementation of these security measures, our systems may still be vulnerable. If our, or our clients’, security measures are breached or fail as a result of third-party action, employee negligence, error, malfeasance or otherwise, unauthorized access to client or end customer data may occur. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, and we may be unable to anticipate these techniques or implement adequate protective measures. Our security measures may not be effective in preventing these types of activities, and the security measures of our third-party data centers and service providers may not be adequate. In addition, these risks may be increased as a result of our virtual-first operating model and our third-party data centers and service providers working remotely, including as a result of the COVID-19 pandemic.
Our client contracts generally provide that we will indemnify our clients for data privacy breaches caused by our acts or omissions and the acts and omissions of our service providers. If a data privacy breach occurs, we could face contractual damages, damages and fees arising from our indemnification obligations, penalties for violation of applicable laws or regulations, possible lawsuits by affected individuals and significant remediation costs and efforts to prevent future occurrences. Insurance may not be able to cover these costs in full, in particular if the damages are large. In addition, whether there is an actual or a perceived breach of our security, the market perception of the effectiveness of our security measures could be harmed significantly and we could lose current or potential clients.
We may be liable to our clients or third parties if we make errors in providing our solution or fail to properly safeguard our clients’ confidential information.
The solution we offer is complex, and we may make errors from time to time. These may include human errors made in the course of managing the sales process for our clients as we interact with their end customers, or errors arising from our technology solution as it interacts with our clients’ systems and the disparate data contained on such systems. For example, our employees enter codes to classify their interactions with our clients’ end customers, and incorrect code entry could result in our clients’ end customer not receiving the service or solution they requested, which in turn could lead to customer dissatisfaction or termination causing our client relationships to suffer and our revenue and our clients’ revenue to decline. The costs incurred in correcting any material errors may be substantial. Any claims based on errors could subject us to exposure for damages, significant legal defense costs, adverse publicity and reputational harm, regardless of the merits or eventual outcome of such claims.
We conduct operations in a number of countries and are subject to risks of international operations.
Outside of the U.S., we conduct operations in Bulgaria, Ireland, Japan, Malaysia, the Philippines, Singapore and the United Kingdom. In 2021, approximately 45% of our revenue was related to operations located outside of the U.S. In addition, 71% of our employees are located in offices outside of the U.S. Our employees and clients in a particular country or region in the world may be impacted as a result of a variety of factors, including: geopolitical events, such as war, the threat of war, or terrorist activity; natural disasters (such as drought, flooding, wildfires, increased storm severity, and sea level rise), which may become more common as a result of climate change; power shortages or outages, major public health issues, including pandemics (such as the COVID-19 pandemic); and significant local, national or global events capturing the attention of a large part of the population. If any of these, or any other factors, disrupt a country or region where we have a significant workforce our business could be materially adversely affected.
We expect to continue our international growth, with international revenue accounting for an increased portion of total revenue in the future. Our international operations involve risks that differ from or are in addition to those faced by our U.S. operations. These risks include different employment laws and rules and related social and cultural factors; different regulatory and compliance requirements, including in the areas of privacy and data protection, anti-bribery and anti-corruption, trade sanctions, marketing and sales and other barriers to conducting business; cultural and language differences; diverse or less stable political, operating and economic environments and market fluctuations; and civil disturbances or other catastrophic events that affect business activity (including the ongoing COVID-19 pandemic). If we are not able to efficiently adapt to or effectively manage our business in markets outside of the U.S., our business prospects and operating results could be materially and adversely affected. Although we have business continuity plans in place for our operations, an extended period of civil unrest that halts or significantly impedes operations could have a material adverse effect on our business.