NET

Our business involves significant risks, some of which are described below. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Quarterly Report on Form 10-K, 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes. Any of the following risks could have an adverse effect on our business, results of operations, financial condition, or prospects, and could cause the trading price of our Class A common stock to decline. Our business, results of operations, financial condition, or prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. In that event, the market price of our Class A common stock could decline, and you could lose part or all of your investment. Our Risk Factors are not guarantees that no such conditions exist as of the date of this report and should not be interpreted as an affirmative statement that such risks or conditions have not materialized, in whole or in part.

We have incurred net losses in all periods since we began operations and we may not achieve or maintain profitability in the future. We experienced net losses of $78.8 million, $183.9 million, $38.5 million and $193.4 $35.5 million for the years three months ended December March 31, 2025 and 2024, 2023, and 2022, respectively, and as of December March 31, 2024, 2025, we had an accumulated deficit of $1,102.6 $1,141.1 million. Because the markets for our products are rapidly evolving, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we continue to hire additional personnel, expand our operations and infrastructure both domestically and internationally, and continue to develop our products. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

We have experienced rapid revenue growth in recent periods, with revenue of $1,669.6 million, $1,296.7 million, $479.1 million and $975.2 $378.6 million for the years three months ended December March 31, 2025 and 2024, 2023, and 2022, respectively. However, our rate of revenue growth has slowed in recent periods and may continue to slow in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may continue to slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth.

The United States, Europe, and the United Kingdom have recently experienced historically high levels of inflation. Although inflation levels have decreased from such high levels in the United States, the United Kingdom, and Eurozone, the U.S. Federal Reserve, the European Central Bank, and the Bank of England have in the past raised, and may in the future raise or maintain, high interest rates and may implement fiscal policy interventions. Even if these interventions lower inflation, they may also reduce economic growth rates, create a an economic downturn or recession, and result in other similar or unexpected effects.

Any of the negative impacts of the conflicts in the Middle East and Ukraine and other areas of geopolitical tension around the world or any worsening or expansion of those conflicts or geopolitical tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed in this Part I, II, Item 1A “Risk Factors” of this Annual Quarterly Report on Form 10-K, 10-Q, including volatility in the trading prices of our Class A common stock. The full extent to which these factors will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of the conflicts in the Middle East and Ukraine, other areas of geopolitical tension around the world, and any economic downturns and the actions taken by governmental authorities and other third parties in response.

Our future financial performance also depends in part on our ability to continue to upgrade paying customers to higher-tier subscriptions, expand the number of products we sell to paying customers, and, to a lesser extent, to convert free customers into paying customers. Conversely, our paying customers may convert to lower-cost or free plans or reduce the number of products they purchase from us if they do not see the marginal value in paying for our higher-cost plans or for our specific products, or due to challenging macroeconomic conditions and/or reduced operating budgets, thereby impacting our ability to increase revenue. For example, we periodically have experienced a higher level of churn in our paying customer base (which is when any of our paying customers cease to be a paying customer for any reason, including any pay-as-you-go customer converting to a free subscription plan). Moreover, our free customers have no obligation to transition to paying customers at any point. In order to expand our commercial relationship with our customers, existing paying and free customers must decide that the incremental cost associated with such an upgrade in their subscription plans, the purchase of additional, or the expanded use of their currently used, products is justified by the additional functionality they would gain. For example, some of our paying customers may decide that our Enterprise plan offerings do not provide sufficient incremental value to upgrade from our pay-as-you-go offering or to continue any such previously chosen upgrade. Our customers’ decisions whether to upgrade their subscription, purchase additional, or expand current usage, of our products or to continue any such previously chosen upgrade or purchased products are driven by a number of factors, including customer satisfaction with the security, performance, and reliability of our network and products, customer security and networking issues and requirements, general economic conditions, the potential future applicability of tariffs or retaliatory measures due to tariffs on our products in certain countries, and customer reaction to the price for additional products. If our efforts to expand our relationship with our existing paying and free customers are not successful, our financial condition and results of operations may materially suffer.

Our growth strategy is dependent, in large part, upon attracting, expanding, and retaining sales to large customers. For our definition of “large customers,” see Part II, I, Item 7. 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations. Attracting, expanding, and retaining sales to large customers involve risks that may not be present, or that are present to a lesser extent, with sales to smaller customers, including:

A substantial majority of our revenue in the year three months ended December March 31, 2024 2025 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, such as our suite of Zero Trust and network services solutions and our developer suite of Cloudflare Developer Platform products, we will need our sales personnel to be proficient in selling both these newer products and features and our overall broader suite of products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted.

We have experienced, and may in the future experience, periods of rapid growth. For example, our headcount grew from 3,217 3,704 employees as of December March 31, 2022, 2024 to 3,682 4,400 employees as of December March 31, 2023, to 4,263 employees as of December 31, 2024. 2025. We also have expanded the locations where we have employees to a number of new locations around the world during the past several years. The number of customers, users, and requests on our network also has increased rapidly in recent years. While we expect to continue to expand our operations, network, and products significantly in the future, both domestically and internationally, our growth may not be sustainable. Our growth has placed, and future growth will continue to place, a significant strain on our management and our administrative, operational, and financial infrastructure. Our success will depend in part on our ability to manage this growth effectively, which will require that we continue to improve our administrative, operational, financial, and management systems and controls by, among other things:

•general political, regulatory, economic, market, and social conditions, including inflation, rising interest rates, actual or threatened tariffs and related economic retaliatory acts, actual or perceived failure or financial difficulties of financial institutions, other adverse changes in global and regional macroeconomic conditions, and other impacts of the conflicts in the Middle East and Ukraine, or other areas of geopolitical tension around the world, or any worsening or expansion of those conflicts or geopolitical tensions.

From time to time, there may be changes in our management team as a result of the hiring, departure or realignment of our senior management and other key personnel, and such changes may impact our business. Additionally, as our business grows in scale and complexity, other changes to our management team may be necessary. For example, we have hired several new members of our senior management team in the past year, recently, including our President of Revenue, our Chief Strategy Officer, and our President of Product and Engineering. Engineering, and our Chief People Officer. Any significant leadership change or senior management transition, such as these, involves inherent risks and any failure to ensure timely and suitable replacements and smooth transitions could hinder our strategic planning, business execution, and future performance. In particular, these or any future leadership transitions may result in, and in some cases have resulted in, a loss of personnel with deep institutional or technical knowledge and changes in business strategy or objectives and disruptions in our operations and relationships with existing employees and customers due to added costs, operational inefficiencies, changes in strategy, decreased employee morale and productivity, and increased turnover. We must successfully integrate our new leadership team members within our organization to achieve our operating objectives. If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to successfully attract, integrate, retain and motivate members of our senior management team and key employees, our business could be harmed.

•government demand, payment for, and continued usage of, our products may be impacted by public sector budgetary cycles, funding authorizations, government shutdowns, reductions in government headcount and functions, or government shutdowns; contract consolidation and reductions in spending;

•governments may limit public sector contracts to companies headquartered in the governments' respective jurisdictions or require us to partner partnerships with companies based in the governments’ respective jurisdictions in order for us to sell any of our products to those governments, which could result in a loss of revenue we otherwise would receive for such sales;

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (U.S. GAAP) requires our management to make estimates, assumptions, and judgments that affect the amounts reported and disclosed in our condensed consolidated financial statements and accompanying notes. We base our estimates and assumptions on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. The results of these estimates and assumptions form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant estimates, assumptions, and judgments used in preparing our condensed consolidated financial statements include those related to allowance for doubtful accounts, deferred contract acquisitions costs, the period of benefit generated from our deferred contract acquisition costs, the capitalization and estimated useful life of internal-use software, valuation of acquired intangible assets, the assessment of recoverability of intangible assets and their estimated useful lives, useful lives of property and equipment, the determination of the incremental borrowing rate used for operating lease liabilities, the valuation and recognition of stock-based compensation expense, uncertain tax positions, and the recognition and measurement of current and deferred income tax assets and liabilities. Due to geopolitical and macroeconomic uncertainties, including but not limited to the ongoing conflicts in the Middle East and Ukraine, and other areas of geopolitical tension around the world, inflationary pressures, threats of tariffs and other impediments to cross-border trade, and changes in interest rates, there is ongoing uncertainty in the global economy and financial markets. We are not aware of any specific event or circumstance that would require an update to our estimates or assumptions or a revision of the carrying value of assets or liabilities as of February 20, 2025, the date of issuance of this Annual Quarterly Report on Form 10-K. 10-Q. These estimates and assumptions may change in the future, however, as new events occur and additional information is obtained. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of industry or financial analysts and investors, resulting in a decline in the trading price of our Class A common stock.

As of December March 31, 2024, 2025, we hosted our global network and served our customers from co-location and Internet Service Provider (ISP) partner facilities located in more than 335 330 cities and over 125 countries worldwide. In addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support. While we have electronic and, to a lesser extent, physical access to the components and infrastructure of our network and co-location facilities that are hosted by third parties — including ISP-partner facilities — we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our co-location and ISP-partner facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes; weather events; floods; fires; power loss; system failures; computer viruses; physical or electronic break-ins; human error; malfeasance; or interference, including by disgruntled employees, former employees, or contractors; military conflicts; terrorism; and other catastrophic events. For example, in November 2023, our control plane and analytics services experienced an outage triggered by a power failure at one of our core data centers in the greater Portland, Oregon area, which impacted certain customers' access to some of our products and services for several days and the loss of certain customer logs. In March 2024, a subsequent power failure occurred at the same core data center in the greater Portland, Oregon area, which impacted certain customers’ access to some of our products for minutes and to our analytics services for several hours. In addition, we have experienced a route leak and a limited number of network outages involving our core and network co-location facilities over the past five years due to a variety of causes. Co-location facilities housing our network infrastructure may also be subject to local governmental or other administrative actions, changes to legal or permitting requirements, labor disputes, and litigation to stop, limit, or delay operations. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of a natural disaster or an act of war or terrorism, a decision to close the co-location facilities without adequate notice, interference with, or sabotage of, our equipment at these facilities, or other unanticipated problems at these facilities could result in interruptions or delays in the availability of our network and products, impede our ability to scale our operations, or have other adverse impacts upon our business, results of operations, and financial condition. In addition, errors or defects in our customers’ software can result in unexpected and unintentional upward spikes in their usage of our products and network, and those spikes can cause strains on, and adversely affect the availability and functioning of, our co-location facilities and our network.

We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, increased prices due to tariffs, tariffs (such as the tariffs the United States and other countries recently implemented or threatened to implement), and constraints based on the then-current availability, terms, and pricing of these components. For example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply. We may also be subject to price increases from these suppliers should they be negatively impacted by tariffs or other regulations. regulations, such as the tariffs the United States and other countries recently implemented or threatened to implement. While the network equipment and servers we purchase generally are commodity equipment and we believe an alternative supply source or location for servers on substantially similar terms could be identified quickly, our business could be adversely affected until those efforts are completed. In addition, the technology equipment industry has experienced component shortages and delivery delays in the past, and we may experience shortages or delays, including as a result of natural disasters, increased demand in the industry, military conflicts and geopolitical tensions, labor strikes, or other related conditions, or our suppliers lacking sufficient rights to supply the components in all jurisdictions in which we have co-location facilities that support our global network. For example, during 2021 and continuing through the first quarter of 2022, a global shortage of CPUs, RAM, SSDs, and other electronics resulted in supply constraints for a number of electronics firms, including manufacturers of servers. This global shortage disrupted and increased the cost, and other shortages or similar supply constraints in the future may disrupt or increase the cost, of some of our expected purchases of network equipment and servers. If our supply of certain components is disrupted or delayed or becomes more expensive, there can be no assurance that additional supplies or components can serve as adequate replacements for the existing components or that supplies will be available on terms that are favorable to us, if at all. Any disruption or delay or additional costs in the supply of our hardware components may delay the opening of new co-location facilities, limit capacity expansion or replacement of defective or obsolete equipment at existing co-location facilities, cause other constraints on our operations that could damage our customer relationships, or otherwise adversely impact our business, financial condition, or results of operations.

Our products are still evolving and it is difficult to predict customer demand and adoption rates for our product offerings. We believe that our network and cloud-based products represent a major shift from traditional solutions. Many of our potential customers, particularly large enterprises and government entities, face barriers to adopting our offerings because of their prior investment in, and the familiarity of their IT personnel with, on-premises, appliance-based solutions or other providers of cloud-based solutions. As a result, our sales process often involves extensive efforts to educate our customers about our products, particularly as we continue to pursue customer relationships with large organizations. Our customers also expect us to meet voluntary validations or adhere to industry standards and require our policies and practices to be evaluated by an independent third-party assessor. Although we currently have certain certifications and reports such as SOC2 Type 2, PCI DSS, ISO 27001, ISO 27701, and ISO 27018, C5, EU Code of Conduct, UK Cyber Essentials, ENS ENS, FedRAMP Moderate authorization and FedRAMP moderate authorization, IRAP Protected Level, we may not be successful in continuing to maintain those certifications or in obtaining other certifications. In addition, sales to government entities and other large enterprises may in particular be conditioned upon adherence to PSPC, ISMAP, IRAP, or DoD IL4 compliance in Canada, Japan, Australia, and the United States, and we do not currently have these certifications. The costs of obtaining and maintaining certification pursuant to any of these standards are significant, and any failure to obtain and maintain such certifications for our network and products could reduce demand for them, which would harm our business, results of operations, and financial condition. To the extent our competitors have, and we do not have, these certifications, we may lose the opportunity to obtain subscriptions from certain potential paying customers.

The prices of digital assets have been and may continue to be highly volatile, including as a result of various associated risks, uncertainties and events. events, and the long-term adoption of digital assets by investors, consumers, and businesses remains uncertain. Moreover, digital assets' lack of a physical form, their reliance on technology for their creation, existence, and transactional validation, and their decentralization may subject their integrity to the threat of malicious attacks and technological obsolescence. In addition, if the market value of the digital assets we hold increases significantly relative to the purchase prices, we could be deemed an "investment company" for purposes of the Investment Company Act of 1940, as amended, and may be required to institute burdensome compliance requirements, restricting our activities in a way that could adversely affect our business, financial condition, and results of operations.

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions. Many policymakers in the United States have called for a re-examination of CDA section 230 and copyright law. The Digital Services Act and Digital Markets Act have gone into effect in the European Union (EU), updating the rules governing digital services like ours and imposing additional legal requirements on certain service providers. In addition, in 2019, the EU approved a Copyright Directive that will impose imposes additional obligations on service providers and failure to comply could give rise to significant liability. Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the United Kingdom (online harms), Australia (online harms), and India (Digital India Act), as well as other new laws like them, may also expose Internet companies like us to significant liability. We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.

As a company, we strive to protect our customers’ privacy consistent with applicable law. Consequently, we generally do not provide personal information about our customers or their users without legal process. In accordance with our contractual commitments to our customers, we may need to challenge legal process requesting disclosure of personal information where such requests are inconsistent with applicable data protection laws. In addition, from time to time, government entities may seek or demand our assistance with obtaining information about our customers or their users or could request that we modify our network and products in a manner to permit access or monitoring. In light of our privacy commitments, we may legally challenge certain law enforcement requests, such as requests to provide a feed of content transiting our network, to obtain encryption keys, or to modify or weaken encryption. Despite the policies we have in place to protect consumer information, we also may face complaints from individuals who assert we have provided their information improperly to law enforcement or in response to third-party abuse complaints, or who disagree with our understanding of our legal obligations. To the extent that we do not provide assistance to, or comply with requests from, government entities or challenge those requests publicly or in court, we may experience adverse political, business, and reputational consequences. We may also face such adverse political, business, and reputational consequences to the extent that we provide, or are perceived as providing, assistance to government entities that exceeds our legal obligations. For example, we periodically receive requests for information purportedly originating from law enforcement agencies or pursuant to legal process, but which are fraudulent or improper attempts to cause us to reveal customer information. Any such disclosure could significantly and adversely impact our business and reputation.

We publish a transparency report on a semi-annual basis to provide details of law enforcement and government requests we receive. receive, as well as abuse reports that we process. Laws such as the EU’s Digital Services Act include new transparency reporting legal requirements, some of which may not apply in a straightforward manner to certain of our services and abuse processes. Any determination that our transparency report does not meet the transparency reporting requirements could raise both regulatory and brand concerns. Our transparency report also includes a list of certain actions we have not taken in response to law enforcement requests. If we are ever required by law enforcement to take one or more of the actions covered by those disclosures, then we would have to remove the applicable disclosures from our transparency report. Both the publishing of our transparency report and, conversely, the potential narrowing of the list of actions we have not taken in response to law enforcement requests could damage our business and reputation.

This is especially true regarding the cross-border transfer of data. For example, in July 2023, the European Commission adopted an adequacy decision for the new EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission, and some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties. Commission. In addition, some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties, including perceived uncertainty about the U.S. stance on the existing legal framework. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. More recently, the European Data Protection Supervisor’s finding in March 2024 that the European Commission’s use of Microsoft 365 violates the GDPR in part due to EU personal data being transferred to countries that have not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice recently released a final rule rule, which became effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We may likely will incur substantial additional costs and an investment of resources as we continue to further understand monitor the impact these new regulations will have on our and our customers’ business. business and implement changes to our practices as may be required under these regulations.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, 1977 (FCPA), the UK Bribery Act 2010, and other anti-corruption, anti-bribery, anti-money laundering, and similar laws in the United States and other countries in which we conduct activities. Anti-corruption and anti-bribery laws, which have in the past been enforced aggressively and are interpreted broadly, prohibit companies and their employees and agents from promising, authorizing, making, or offering improper payments or other benefits to government officials and others in the public sector. However, in February 2025, President Trump signed an Executive Order directing the U.S. Attorney General to pause enforcement of the FCPA by the United States Department of Justice for 180 days. Despite this Executive Order, bribery remains illegal under the FCPA, the SEC’s FCPA enforcement continues, and anti-corruption enforcement by global regulators outside of the United States has strengthened in recent years. Additionally, the FCPA has a five-year statute of limitations, meaning violations committed during this pause could be prosecuted by a new administration.

Historically, we have derived a significant portion of our revenue from outside the United States. We derived 49%, 48%, 51% and 47% 48% of our revenue from our international customers for the years three months ended December March 31, 2025 and 2024, 2023, and 2022, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into geographies around the world, but there is no guarantee that such efforts will be successful. In addition, our global network includes co-location facilities located in more than 335 330 cities and over 125 countries worldwide as of December March 31, 2024. 2025. We expect that our international sales and network activities will continue to grow in the future, as we continue to pursue opportunities in international markets and further grow our network around the world. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

•geopolitical, economic, and social uncertainties, including the potential implementation of tariffs or other costs or restrictions on the conduct of business, potential nationalization of key peering partners by foreign governments or political unrest that affects our ability to continue to work with particular peering partners, potential terrorist activities, military conflict or war, trade policies and sanctions, and the unknown impact of regional or global health crises, or epidemic or pandemic diseases;

•greater risk of unexpected changes in regulatory practices, increased costs due to tariffs, and tax laws and treaties;

As discussed in greater detail above in our risk factor titled "Our actual or perceived failure to comply with privacy, data protection, information security, and other applicable laws, regulations, and obligations could harm our business," recent changes in privacy and data protection laws in a number of countries and supranational organizations have created uncertainty around the requirements related to transfers of personal data between jurisdictions, including transfers to the United States. As a result of this uncertainty, our current and potential customers in certain regions may be concerned about whether they are able to transfer personal data to the United States in connection with the usage of our global network and products. If these concerns result in our current and potential customers in those regions reducing their usage of our products, then our results of operations could be adversely impacted. Further, In addition, we anticipate needing to identify different transfer mechanisms and/or change our use of certain standard contractual clauses in order to lawfully transfer certain personal data from those regions to the United States. Further, customer demands that we avoid transferring data to specific regions, including the United States, might require us to adapt our products and services or make it difficult to sell to customers in certain industries. This could result in substantial costs, require changes to our policies and business practices, require us to engage in additional contractual obligations, limit our ability to provide certain products in certain jurisdictions, or materially adversely affect our business and operating results.

Some of our security products involve making origin IP addresses and other operational assets of our customers more difficult for cyber attackers to target. The evolving design of our network and products may create challenges for various organizations, including governments, that seek to block certain content based on IP address “block lists” or other mechanisms. This problem is exacerbated by the fact that a single Cloudflare IP address may be used for a number of Internet properties, and the Cloudflare IP used for any one Internet property may change over time. This means that efforts by ISPs to block a single domain name may end up blocking a number of other domains or content. We have seen certain organizations react by deciding to block content that is using a Cloudflare IP address in an overbroad manner. It is also possible that organizations could react by choosing to block completely websites and other Internet properties that are using our network and/or transmitted using known Cloudflare IP addresses. Some of these blocking efforts would may be out of our control once they have been put in place and may limit our ability to provide our products on a fully global basis, which could reduce demand for our products among current or potential customers that are focused on the impacted regions or could otherwise adversely impact our business, results of operations, and financial condition.

We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of December March 31, 2024, 2025, we had 334 342 issued patents and 72 65 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included within our network in China. We must protect this proprietary information in order to realize commercial benefit from our investment.

Our Class B common stock has 10 votes per share and our Class A common stock has one vote per share. As of December March 31, 2024, 2025, our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, held in the aggregate 73.5% 72.7% of the voting power of our capital stock, with our co-founders together holding approximately 52.8% 52.2% of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively continue to control a majority of the combined voting power of our common stock and therefore are able to control all matters submitted to our stockholders for approval. This concentrated control will limit or preclude the ability of holders of Class A common stock to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

In August 2021, we issued $1,293.8 million in aggregate principal amount of the 2026 Notes and, as of December March 31, 2024, 2025, the remaining aggregate principal amount was $1,293.8 million. In addition, in May 2024, we entered into a senior secured credit agreement with a $400 million Revolving Credit Facility. Our ability to make scheduled payments of the principal of, or to refinance our indebtedness, including the 2026 Notes and any borrowings under our Revolving Credit Facility, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, the credit agreement for our Revolving Credit Facility contains restrictive covenants that limit us, and any of our future debt agreements may contain restrictive covenants that may limit or prohibit us, in each case from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.