AppFolio (APPF) Risk Analysis

The market for cloud-based business management solutions has relatively low barriers to entry and is global, highly competitive and continually evolving in response to a number of factors, including changes in technology, operational requirements, and laws and regulations. We compete with both other real estate industry cloud-based solution providers and providers of broad cloud-based solutions across multiple industries. We also face competition from numerous cloud-based solution providers that focus almost exclusively on one or more point solutions. Our competitors include established vendors, as well as newer entrants in the market. Our established competitors may have greater name recognition, longer operating histories, and significantly greater resources, which allows them to respond more quickly and effectively to new or changing opportunities or challenges, technologies, operational requirements and industry standards. Our competitors who are new entrants to the market, and generally smaller, may have more nimble operations due to having fewer products and less overhead and may be willing to take legal and operational risks, which allows them to launch products and meet customer demand more quickly and efficiently. Regardless of size, our current and potential competitors may develop, market and sell new technologies with comparable functionality to our solutions, which could cause us to lose customers, slow the rate of growth of new customers and/or cause us to decrease our prices to remain competitive. If we are unable to differentiate ourselves from our competitors and drive value for our customers or otherwise compete effectively against any of these competitive threats, our business, financial condition and results of operations could be harmed. In addition, we have introduced and expect to continue to introduce variations to our pricing model that are intended to provide broader usage and better align the cost of our services to the value they provide our customers. Although we believe that these pricing changes will increase customer adoption and revenue, it is possible that they will not and may make our services less appealing, which could negatively impact our business, revenue, and operating results.

Maintaining and enhancing our brands is critical to achieving widespread awareness and acceptance of our solutions as well as maintaining and expanding our customer base, which is a key component of our strategy. We expect the importance of brand recognition will increase, as competition for our products and services increases. If we do not continue to build awareness of our brands, we will be at a competitive disadvantage compared to companies whose brands are, or become, more recognizable than ours. Maintaining and enhancing our brands requires us to make substantial investments, and these investments may not result in commensurate increases in our revenue. In addition, new and existing technologies, industry trends, and laws that restrict online advertising or that affect our ability to customize and target advertising may require us to significantly increase our marketing costs to generate and capture demand and maintain our brand awareness, level of sales, and operating results. Moreover, our efforts to maintain and enhance our brands could be impacted by negative publicity or reputational harm from adverse events, such as lawsuits, customer or third-party-service provider disputes, or cybersecurity incidents. If we fail to successfully maintain and enhance our brands, or if we make investments that are not offset by increased revenue, our operating results could be adversely affected.

Customer demands are constantly changing in response to new technology and other market factors. To compete effectively, we must identify and innovate in the right technologies, accurately predict our customers' evolving needs, and continually improve our own technology platform. If we fail to execute against any of the foregoing, our business, financial condition and operating results may be harmed. In addition, the widespread adoption of quickly evolving disruptive technology products, such as generative AI, may significantly impact the real estate industry, even if such products are not specifically designed to apply directly to the real estate industry. The adoption of such new technologies could significantly reduce the number or demand of our customers, thereby reducing our revenue, which could materially impact our business, financial condition and operating results.

Our business involves the storage and transmission of sensitive and proprietary data and personal information collected by or on behalf of our customers, the personal information of our employees, customers, and prospective customers and our proprietary financial, operational and strategic information. Cyber attacks, malicious Internet-based activity, online and offline fraud, and other similar activities may threaten the confidentiality, integrity, and availability of our information technology systems, or those of the third parties upon which we rely, along with the proprietary, confidential, and sensitive data stored in or processed by such systems. As our business grows, the number of individuals using our products, as well as the amount of information we collect, store, and process is increasing, and our brands are becoming more widely recognized, which makes us a greater target for malicious activity. We have incurred, and expect to continue to incur, significant expenses in connection with our efforts to keep our systems, products and networks protected and up to date. However, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. Furthermore, no security program can entirely eliminate the risk of human error, such as an employee or contractor's failure to follow one or more security protocols, which has previously occurred and we expect will occur again despite our efforts to train our employees and contractors on cybersecurity issues and enforce our security protocols. Additionally, with many of our employees continuing to work remotely, we face an increased risk of attempted security breaches and incidents. Therefore, despite our significant efforts to keep our systems, products and networks protected and up to date, we may be unable to anticipate new modes for cyber attacks, detect security incidents or react to them in a timely manner, or implement adequate preventive measures, any of which may expose us to a risk of loss, harm to our reputation, litigation, fines, penalties, and potential liability. Computer malware, ransomware, viruses, social engineering (deepfakes, phishing, smishing and vishing attacks), denial of service or other attacks, employee theft or misuse, and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud service providers. The sophistication of these malicious attacks has also increased, and it appears that cyber crimes and cyber criminal networks, some of which may be state-supported, have been provided substantial resources and may target U.S. enterprises or our customers and their use of our products. Furthermore, the risk of state-supported and geopolitical-related cyber attacks may increase in connection with ongoing global geopolitical tensions. In the past, we have had to take corrective action against cyber attackers to protect our cloud environment. If our security measures are, or are believed to have been breached or otherwise to have failed as a result of third-party action, employee error, malfeasance or otherwise, our reputation could be damaged, our business may suffer, and we could incur significant liability. In addition, some of our third-party service providers also collect, store or process our sensitive information and our customers' data on our behalf. These service providers have been, and continue to be, subject to similar threats of cyber attacks and other malicious Internet-based activities. Our contracts with these third parties may not provide us with adequate remedies in the event of such an incident which could also expose us to risk of loss, litigation, fines, penalties, and potential liability as well as reputational damage. If our security measures, or the security measures of our third-party service providers, are breached as a result of wrongdoing or malicious activity on the part of our employees, our third-party service providers' employees, our customers' employees, or any third party, or as a result of any human error or neglect, product defect or otherwise, and this results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access to personal data or other sensitive information, we could incur liability to our customers, employees, and to individuals or organizations whose information was being stored by us or our customers, as well as due to fines, penalties, or actions from payment processing networks or by governmental bodies. If we experience a widespread security breach, our insurance coverage may not offset liabilities actually incurred and insurance may not continue to be available to us on reasonable terms, or at all. In addition, security breaches could result in reputational damage, adversely affect our ability to attract new customers and cause existing customers to reduce or discontinue the use of our products and solutions. Furthermore, the perception by our current or potential customers that our products could be vulnerable to exploitation or that our security measures are inadequate, even in the absence of a particular problem or threat, could reduce market acceptance of our products and solutions and cause us to lose customers.

Our tax filings are subject to reviews and audits in various jurisdictions and the positions or assumptions we take may be challenged. Although we believe our tax positions are reasonable, it is possible that tax authorities may disagree with certain positions we have taken and an adverse outcome of such a review or audit could have a negative effect on our financial position and operating results. In addition, defending our tax positions or disputing the positions taken by tax authorities may be costly and a distraction to management, which may affect our operating results.

We collect, store, process, and transmit personal information relating to our employees, customers, prospective customers, and other individuals. Our customers use our platform to store and transmit a significant amount of personal information relating to their customers, vendors, employees and other industry participants. Federal, state, and foreign government bodies and agencies have adopted, and are increasingly adopting, laws and regulations regarding the collection,use, processing, security and transmission of personal information. For example, the California Consumer Privacy Act ("CCPA") requires certain privacy related disclosures and provides California consumers rights with respect to their personal information, including the right to request deletion of their personal information, the right to receive the personal information on record for them, the right to know what categories of personal information generally are maintained about them, as well as the right to opt-out of certain sales of personal information and sharing personal information for certain advertising purposes. The CCPA also granted a new state agency, the California Privacy Protection Agency, powers to adopt and enforce regulations interpreting the CCPA. In addition, the CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. In addition to California, we are currently subject to comprehensive privacy laws across multiple states and in 2025 will be subject to new comprehensive privacy laws in Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee. These laws and regulations have increased, and will likely continue to increase, the complexity of our data collection and processing practices and policies and the cost of compliance to deliver our services. Additionally, we may incur substantial costs and expenses related to an increased exposure to regulatory enforcement and/or litigation. Despite our efforts, we cannot guarantee that we will be able to maintain full compliance with constantly evolving, and sometimes conflicting, data privacy laws in the jurisdictions in which we operate. If our privacy or data security measures fail to comply with current or future laws and regulations, we may be subject to claims, legal proceedings or other actions by individuals or governmental authorities based on privacy or data protection regulations and our privacy commitments to customers or others. In addition to government regulation, privacy advocates and industry groups may propose various self-regulatory standards that may legally or contractually apply to our business. As new laws, regulations and industry standards take effect and we offer new services, we will need to understand and comply with various new requirements, which may impede our plans for growth or result in significant additional costs. These laws, regulations and industry standards have had, and will likely continue to have, negative effects on our business, including by increasing our costs and operating expenses, and/or delaying or impeding our deployment of new or existing core functionality or Value Added Services. Failure to comply with these laws, regulations and industry standards could result in negative publicity, subject us to fines or penalties, expose us to litigation, or result in demands that we modify or cease existing business practices. Furthermore, privacy concerns may cause residents, vendors, employees and other industry participants to resist providing the personal information necessary to allow our customers to use our applications effectively, which could reduce overall demand for our services. Any of these outcomes could adversely affect our business and operating results.

Our customers use our products to manage critical aspects of their businesses. Any errors, defects or other disruptions in our products, or the products of our third-party service providers upon which certain of our products are dependent, may result in loss of or damage to our customers' data and disruption to our customers' businesses, which could harm our reputation and subject us to potential liability. Such product problems could be caused by a variety of factors, including infrastructure changes, power or network outages, fire, flood or other natural disasters, human or software errors, viruses, security breaches, fraud or other malicious activity, spikes in customer usage or distributed denial of service attacks. In addition, we provide continuous updates to our products and these updates may contain undetected errors, defects or other disruptions when first introduced. In the past, we have discovered errors, defects, or other disruptions in our updates after they have been released, and similar problems may arise in the future. Real or perceived errors, defects, or other disruptions in our products or the products of our third-party service providers upon which certain of our products are dependent, could result in negative publicity, reputational harm, loss of customers, delay in market acceptance of our products and solutions, loss of competitive position, withholding or delay of payment to us, claims by customers for losses sustained by them and potential litigation or regulatory action. In any such event, we may be required to expend additional resources to help correct the problem or we may choose to expend additional resources to take corrective action even when not required. The costs incurred in correcting any material errors, defects or other disruptions could be substantial. In addition, we may not carry insurance sufficient to offset any losses that may result from claims arising from errors, defects or other disruptions in our products.

Our success and future growth depend, in part, upon the continued services of our executive officers and other key employees. To execute our growth plan and achieve our strategic objectives, we must continue to retain and hire highly qualified and motivated personnel across our organization. In particular, to continue to enhance our products and solutions, add new and innovative core functionality and/or Value Added Services, as well as develop new products, it will be critical for us to maintain and, over time, grow the current skill set and abilities of our research and product development organization. Further, for us to achieve broader market acceptance of our products and solutions, grow our customer base, and pursue new markets consistent with our strategic plan, we will need to maintain and, over time, grow the current skill set and abilities of our sales, marketing and customer service and support organizations. Competition for personnel is intense within our industry and there continues to be upward pressure on the compensation paid to these professionals. Retaining, identifying, recruiting, and training qualified personnel is difficult and requires a significant investment of time and resources. Many of the companies with which we compete for experienced personnel have greater name recognition and financial resources than we have. As a result, we may have greater difficulty retaining and hiring skilled personnel than our competitors. In addition, existing and prospective employees often consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, we are unable to offer equity awards in competitive amounts, or if the price of our Class A common stock experiences significant volatility, this may adversely affect our ability to retain and recruit highly skilled employees. If we are unable to retain and attract the personnel necessary to execute our growth plan, we may be unable to achieve our strategic objectives and our operating results may suffer. In addition, from time-to-time there may be changes in our management team that may be disruptive to our business.

Some of our property management customers require their renters to purchase rental insurance policies. Through wholly owned subsidiaries, we make rental insurance policies available to these renters and, if our customers so elect, add uncovered units to a qualifying liability to landlord insurance policy via a licensed insurance broker. If our property management customers stop requiring renters to purchase rental insurance policies because of regulatory or competitive pressures, demand for our insurance-related risk mitigation products may decline and our revenues and operating results could be adversely affected.

Adverse global and regional economic conditions, including, but not limited to, recessionary or inflationary pressures, tightening in the credit markets, extreme volatility or distress in the financial markets, supply chain issues, reduced consumer confidence or economic activity, government fiscal and tax policies, geopolitical events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services or cause us to experience increased costs that could negatively affect our operating results.

Our business operations are subject to interruption by natural disasters, flooding, fire, power shortages, health epidemics, terrorism, political unrest, telecommunications failure, vandalism, cyber-attacks, geopolitical instability, war, the effects of climate change (such as drought, wildfires, hurricanes, and increased storm severity) and other events beyond our control. Although we maintain crisis management and disaster response plans, such events could make it difficult or impossible for us to deliver our services to our customers, decrease demand for our services, and cause us to incur substantial expense. Our insurance may not be sufficient to cover losses or additional expenses that we may sustain. The majority of our research and development activities, offices, information technology systems, and other critical business operations are located near major seismic faults in California. Customer data could be lost, significant recovery time could be required to resume operations and our financial condition and operating results could be adversely affected in the event of a major natural disaster or catastrophic event. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards or expectations regarding the environmental impacts of our business.