Crexendo (CXDO) Risk Factors

We have sold and will continue to attempt to sell to certain customer segments which may have requirements for additional privacy or security. In addition, sales may be made to customers that are subject to additional security requirements. Selling into segments with additional requirements increases potential liability which in some instances may be unlimited. While the Company believes it meets or exceeds all requirements for sales into such segments, there is no assurance that the Company systems fully comply with all requirements. Our customers can use our services to store contact and other personal or identifying information, and to process, transmit, receive, store and retrieve a variety of communications and messages, including information about their own customers and other contacts. In addition, customers may use our services to store protected health information, or PHI, that is protected under the Health Insurance Portability and Accountability Act, or HIPAA. Noncompliance with laws and regulations relating to privacy and HIPAA may lead to significant fines, penalties or civil liability.

Regulatory treatment of VoIP providers outside the United States varies from country to country, and local jurisdictions. Many times, the laws are vague, unclear and regulations are not enforced uniformly. We are licensed as a VoIP seller in Canada and are considering expanding to other countries. We also cannot control if our customers take their devices out of the United States and use them abroad. Our resellers may sell to customers who maintain facilities outside the United States. The failure by us or our customers and resellers to comply with laws and regulations could reduce our revenue and profitability. As we expand to additional countries there may be additional regulations that we are required to comply with, the failure to comply or properly assess regulations may subject us to penalties, fines and other actions which could materially affect our business.

On January 4, 2018, the FCC, released an order that largely repeals rules that the FCC had in place which prevented broadband internet access providers from degrading or otherwise disrupting a broad range of services provisioned over consumers' and enterprises' broadband internet access lines. There are efforts in Congress to prevent the order from becoming effective and a number of state attorneys general have filed an appeal of the FCC's January 4, 2018 order. Many of the largest providers of broadband services, like cable companies and traditional telephone companies, have publicly stated that they will not degrade or disrupt their customers" use of applications and services, like ours. However, there is not guarantee that they will continue to do such. If such providers were to degrade, impair, or block our services, it would negatively impact our ability to provide services to our customers, likely result in lost revenue and profits, and we would incur legal fees in attempting to restore our customers' access to our services. Broadband internet access providers may also attempt to charge us or our customers additional fees to access services like ours that may result in the loss of customers and revenue, decreased profitability, or increased costs to our offerings that may make our services less competitive. Following the adoption of the January 4, 2018 order, a number of states have passed laws establishing rules similar to those that existed prior to the effective date of the January 4, 2018 order. States have adopted a variety of approaches in attempting to preserve the rules in place prior to the order. We however cannot rely on those laws as there is legal uncertainty as to whether states that have passed such laws have the authority to do so if such laws as they could be interpreted to conflict with the January 4, 2018 order. The U.S. Department of Justice has taken the position that local authorities do not have the authority to contradict the FCC's January 4, 2018 order. We cannot predict the ultimate outcome of these disputes. President Biden and numerous Senators have criticized the current status of net neutrality, at this time we are not aware if there will be legislation that might reimpose the prior regulations.

Certain states take the position that offerings by VoIP providers are intrastate and therefore subject to state regulation. We have registered as a competitive local exchange carrier ("CLEC") in most states; however, our rates are not regulated in the same manner as traditional telephone service providers. Some states are also requiring that we register as a seller of VoIP services even though we have registered as a CLEC. Some states argue that if the beginning and desktop devices of communications are known, and if some of these communications occur entirely within the boundaries of a state, the state can regulate that offering and may therefore add additional taxes or surcharges or regulate rates in a similar matter to traditional telephone service providers. We believe that the FCC has pre-empted states from regulating VoIP providers in the same manner as providers of traditional telecommunications services. We cannot predict how this issue will be resolved or its impact on our business at this time.

Based on the outcome of examinations by relevant tax authorities, or as a result of the expiration of statutes of limitations for specific jurisdictions, it is reasonably possible that the related tax reserves for tax positions taken regarding previously filed tax returns will materially change from those recorded in our financial statements. In addition, the outcome of examinations may impact the valuation of certain deferred income tax assets (such as NOL carry-forwards) in future periods. It is not possible to estimate the impact of the amount of such changes, if any, to previously recorded uncertain tax positions.

We collect, process, store, use, and transmit personal data on a daily basis. Personal data is increasingly subject to legal and regulatory protections around the world, which vary widely in approach and which possibly conflict with one another. In recent years, for example, U.S. legislators and regulatory agencies, such as the Federal Trade Commission, as well as U.S. states have increased their focus on protecting personal data by law and regulation and have increased enforcement actions for violations of privacy and data protection requirements. California recently enacted legislation, the California Consumer Privacy Act ("CCPA") that will, among other things, require covered companies to provide new disclosures to California consumers, and afford such consumers new abilities to opt-out of certain sales of personal information, which became effective January 1, 2020. While we believe that we are not a covered entity under the law, the effects of the CCPA potentially are significant, however, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We may also from time to time be subject to, or face assertions that we are subject to, additional obligations relating to personal data by contract or due to assertions that self-regulatory obligations or industry standards apply to our practices. Washington and Massachusetts have also introduced significant privacy bills and Congress is debating federal privacy legislation, which if passed, may restrict our business operations and require us to incur additional costs for compliance. The European Commission also approved and adopted the General Data Protection Regulation ("GDPR"), its data protection law, which took effect in May 2018. A Data Protection Act substantially implementing the GDPR was enacted in the U.K., effective in May 2018. These data protection laws and regulations are intended to protect the privacy and security of personal data, including credit card information that is collected, processed, and transmitted in or from the relevant jurisdiction. We stopped hosting websites in GDPR-complaint countries or countries from which the bulk of business came from countries subject to GDPR. We also took steps to block those countries from accessing any other sites we host. While we do not currently provide services in countries where compliance would be required and are therefore not required to be compliant, if we did provide those services or otherwise were required to become complaint, implementation of and compliance with these laws and regulations may be more costly or take longer than we anticipate, or could otherwise adversely affect our business operations, which could negatively impact our financial position or cash flows. Additionally, media coverage of data breaches has escalated, in part because of the increased number of enforcement actions, investigations, and lawsuits. As this focus and attention on privacy and data protection increases, we also risk exposure to potential liabilities and costs resulting from compliance with or any failure to comply with applicable legal requirements, conflicts among these legal requirements, or differences in approaches to privacy.

All data centers, including ours, are subject to various points of failure. Problems with cooling equipment, generators, uninterruptible power supply, routers, switches, or other equipment, whether or not within our control, could result in service interruptions for our customers as well as equipment damage. Any failure or downtime could affect a significant percentage of our customers. The total destruction or severe impairment of our data center facilities could result in significant downtime of our services and the loss of customer data.

We depend on several third-party providers to provide uninterrupted and error-free service to maintain our operations. We do not have control over these providers, and some of these providers may be our competitors. We may be subject to interruptions or delays in their service and our reputation and business may be harmed. The failure of any of these third party service providers to properly maintain services may result in negative consequences to us including but not limited to: (i) cause a loss of customers, (ii) adversely affect our reputation, (iii) cause negative publicity, (iv) negatively impact our ability to acquire customers, (v) negatively impact our revenue and profitability, (vi) potential law suits for not reaching E-911 services, and (vii) potential law suits for loss of business and loss of reputation. These third-party providers include: - Internet Bandwidth Providers. We may be subject to interruptions or delays in network service. If we fail to maintain reliable bandwidth or performance that could significantly reduce customer demand for our services and damage our business. Our cloud telecommunications service (and to a lesser extent our e-commerce services) requires our customers to have an operative broadband Internet connection and an electrical power supply, which are provided by the customer's Internet service provider and electric utility company and not by us. The quality of some broadband Internet connections may be too poor for customers to use our services properly. In addition, if there is any interruption to a customer's broadband Internet service or electrical power supply, that customer will be unable to make or receive calls, including emergency calls (our E-911 service), using our service. In addition, internet backbone providers may be able to block, degrade or charge for access to, or the bandwidth use of certain of our products and services which could have a negative effect on our services and could lead to additional expenses and the loss of users. Our products and services depend on the ability of our users to access the Internet, and many of our services require significant bandwidth to work effectively. Further, customers who access our mobile application Crexmo© (or future application) through their smartphones must have a high-speed connection, to use our services. This access is provided by companies that have significant and increasing market power in the broadband and Internet access marketplace some of these providers offer products and services that directly compete with our own offerings, which give them a significant competitive advantage. - Tier 1 and non-Tier 1 Telecom suppliers for Telecom Origination and Termination Services. We depend on these companies to provide service telecom services, sourcing of Direct Inward Dialing (DID), porting of numbers and delivering telephone calls from and to endpoints and devices on our network. If we fail to maintain reliable connectivity or performance with our upstream carriers it could then significantly reduce customer demand for our services and damage our business. - A portion of our customer service responses, delivery of calls to and from PSTN and other public telephone VoIP/Wireless service providers and provision of aspects of our E-911 service . We offer our cloud telecommunications customers support 24 hours a day, seven days a week. We may rely on third parties (sometimes outside of the U.S) to respond to customer inquiries. These third-party providers generally represent us without identifying themselves as independent parties. The ability of third-party providers to provide these representatives may be disrupted due to issues outside our control. We also maintain an agreement with an E-911 provider to assist us in routing emergency calls directly to an emergency service dispatcher at the public-safety answering point ("PSAP") in the area of the customer's registered location and terminating E-911 calls. We also contract with a provider for the national call center that operates 24 hours a day, seven days a week to receive certain emergency calls and with several companies that maintain PSAP databases for the purpose of deploying and operating E-911 services. The dispatcher will have automatic access to the customer's telephone number and registered location information. If a customer moves their Crexendo service to a new location, the customer's registered location information must be updated and verified by the customer. Until that takes place, the customer will have to verbally advise the emergency dispatcher of his or her actual location at the time of an emergency 9-1-1 call. This can lead to delays in the delivery of emergency services. Interruptions in service from these vendors could also cause failures in our customers' access to E-911 services and expose us to liability. - Initiation of local number portability for our customers. We also have agreements with companies that initiate our local number portability, which allow new customers to retain their existing telephone numbers when subscribing to our services. We will need to work with these companies to properly port numbers. The failure to port numbers may subject us to loss of customers or regulatory review. - Outside contractors and third-party agents for fulfillment of certain items and critical manufacturing services. We outsource the manufacturing of certain products we sell and provide. We submit purchase orders to agents or the companies that manufacture the products. We describe, among other things, the type and quantities of products or components to be supplied or manufactured and the delivery date and other terms applicable to the products or components. Our suppliers or manufacturers potentially may not accept any purchase order that we submit. Our reliance on outside parties involves a number of potential risks, including: (i) the absence of adequate capacity, (ii) the unavailability of, or interruptions in access to, production or manufacturing processes, (iii) reduced control over delivery schedules, (iv) errors in the product, and (v) claims of third party intellectual infringement or defective merchandise. If delays, problems or defects were to occur, it could adversely affect our business, cause claims for damages to be filed against us, and negatively impact our consolidated operations and cash flows.

We sell our products primarily through direct sales and our partner channel, and we must substantially expand the number of partners and producing direct sales personnel to increase organic revenue substantially. If we are unable to expand our partner channel network and hire and retain qualified sales personnel, our ability to increase our organic revenue and grow our business could be compromised. The challenge of attracting, training, and retaining qualified candidates, may make it difficult to grow revenue. Our direct sales are driven largely by inside sales who sell our services and products to customers. Our future growth depends on our ability to develop and maintain a successful direct sales organization that identifies and closes a significant portion of sales. If we or the agents fail to do so, we may be unable to meet our revenue growth targets. Our partner sales are generated through indirect channel sales. These channels consist of master agents' independent agents (including master agents), value-added resellers, and service providers. We contract directly with the end customer. We may or may not have active involvement in the sale or may use these channel partners to identify, qualify and manage prospects throughout the sales cycle. These channels may generate an increasing portion of our revenue in the future. Our continued success requires continuing to develop and maintain successful relationships with these partners. If we fail to properly select and manage our partners, or they are not successful in their sales efforts, we may be unable to meet our revenue growth targets.

When the Company shifted away from a seminar sales model in 2011, our web services revenue was adversely impacted and has continued to decrease. Our website hosting revenue has continued to decline since we no longer sell our website development software through a seminar sales model. The Company is not actively marketing its website development software or website hosting services. Our web services segment revenue was approximately 3% of our total revenue for the year ended December 31, 2020 and may continue to decline over time as more competitors enter the website building and hosting industry.

Selling to larger enterprise customers contains inherent risks and uncertainties. Our sales cycle has become more time-consuming and expensive. The delays associated with closing and installing larger customers may impact results on a quarter to quarter basis. There may be additional pricing pressure in this market which may affect margins and profitability. Revenue recognition may be delayed for some complex transactions, all of which could harm our business and operating results. The loss of a large customer may have a material negative impact on quarterly or annual results. Multi-location users require additional and expensive customer service which may require additional expense and impact margins on enterprise sales. Enterprise customers may demand more features, integration services and customization which require additional engineering and operational time which could impact margins on an enterprise sale. Multi-location enterprise customer sales may have different requirement in different locations which may be difficult to fulfill or satisfy various interests which could result in cancellations. Enterprise customers might demand we provide service locations internationally where we may encounter technical, logistical, infrastructure and regulatory limitations on our ability to implement or deliver our services. Our inability to provide service in certain international locations may result in a cancellation of the entire contract. Further with larger enterprise customer sales, the risk of customers transporting desktop devices internationally without our knowledge may increase. We have a limited history of selling our services to larger businesses and may experience challenges in configuring and providing ongoing support for the solutions we sell to large customers. Larger customers' networks are often more complex than those of smaller customers, and the configuration of our services for these customers usually requires customer assistance. There is no guarantee that the customer will make available to us the necessary personnel and other resources for a successful configuration of services. Lack of assistance from the customers or lack of local resources may prevent us from properly configuring our services for the customers, which can in turn adversely impact the quality of services that we deliver over our customers' networks, and/or may result in delays in the implementation of our services and impact the quality and ability to continue to provide the services. This could also create a public perception that we are unable to deliver high quality of service to our customers, which could harm our reputation. In addition to the foregoing, larger customers tend to require higher levels of customer service and individual attention, which may increase our costs for implementing and delivering services.