ShiftPixy (PIXY) Risk Analysis

In connection with our business, we collect, use, transmit and store with data services vendors large amounts of personal and business information about our clients and shift employees, including payroll information, healthcare information, personal and limited business financial data, social security numbers, bank account numbers, tax information and other sensitive personal and business information. In addition, as we continue to grow the scale of our business, we will process and store with data services vendors an increasing volume of personally identifiable information of our users. Our data services vendors include PrismHR, Amazon Web Services, Microsoft OneDrive, ShareFile, Dropbox, Egnyte, Smartsheet, Sage Intacct, MasterTax, Microsoft Outlook, Microsoft Office 365, DocuSign and RightSignature. We believe these vendors implement industry standard or more stringent data security measures to protect the data that we transmit through and/or store with them. Despite our efforts to protect customer data, perceptions that the collection, use, and storage of personal information are not satisfactorily protected could inhibit sales and limit adoption of our services. In addition, the continued occurrence of high-profile data breaches provides evidence of an external environment increasingly hostile to information security. We are focused on ensuring that our operating environments safeguard and protect personal and business information, and we will devote significant resources to maintaining and regularly updating our systems and processes. The cost to maintain these safeguards is significant and may increase as we grow, which may limit our ability to employ our resources elsewhere and slow our ability to grow. Despite our efforts to maintain security controls across our business, it is possible our security controls over personal data, our training of employees and vendors on data security, and other practices we follow may not prevent the improper disclosure of customer data that we or our vendors store and manage. In addition, attacks on information technology systems continue to grow in frequency, complexity and sophistication, and we may be targeted by unauthorized parties using malicious tactics, code and viruses. We engage third party contractors who monitor our activities in a manner designed to prevent, detect and respond to data security incidents. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may be difficult to detect for long periods of time, we may be unable to anticipate these techniques or implement adequate preventive measures. In addition, hardware, software, or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise the confidentiality, integrity or availability of data or our systems. Unauthorized parties may also attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving our employees, contractors, or temporary staff. As these threats continue to evolve, we may be required to invest significant additional resources to modify and enhance our information security and controls or to investigate and remediate any security vulnerabilities. In addition, while our operating environment is designed to safeguard and protect personal and business information, we do not have the ability to monitor the implementation of similar safeguards by our clients, vendors or their respective employees, and, in any event, third parties may be able to circumvent those security measures. Any cyber-attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, theft of non-public or other sensitive information, any similar act by a malevolent party, or inadvertent acts by our own employees, could result in the disclosure or misuse of confidential or proprietary information, harm our reputation, and could have a materially adverse effect on our business operations, or that of our clients, create financial liability, result in regulatory sanction, or generate a loss of confidence in our ability to serve clients or cause current or potential clients to choose another service provider, or subject us to liability under laws that protect personal data, resulting in increased costs or loss of revenue. Although we believe that through our third party contractors we maintain an adequate program of information security and controls and any threats that we might have encountered to date have not materially impacted us, the impact of a data security incident could have a materially adverse effect on our business, results of operations and financial condition. In addition, any further security measures we may undertake to address further protections may cause higher operating expenses. We are also subject to various federal and state laws, rules and regulations relating to the collection, use, transmission and security of personal and business information. In addition, the possession and use of personal information and data in conducting our business subjects us to laws that may require notification to regulators, clients or employees in the event of a privacy breach and may impose liability on us for privacy deficiencies, including but not limited to liability under laws that protect the privacy of personal information, such as HIPAA, and regulatory penalties. These laws continue to develop, the number of jurisdictions adopting such laws continues to increase, and these laws may be inconsistent from jurisdiction to jurisdiction. The future enactment of more restrictive laws, rules or regulations could have a materially adverse impact on us through increased costs or restrictions on our businesses and noncompliance could result in regulatory penalties and significant legal liability. In addition, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. Some of the activities in which our shift workers could become involved include health care information-related responsibilities that could invoke the need for compliance with HIPAA as amended by the HITECH Act. The United States Department of Health and Human Services has issued regulations that establish uniform standards governing the conduct of certain electronic health care transactions and protect the privacy and security of protected health information used or disclosed by health care providers and other covered entities. Three principal regulations with which we are required to comply have been issued in final form under HIPAA: privacy regulations, security regulations, and standards for electronic transactions, which establish standards for common health care transactions. The privacy regulations cover the use and disclosure of protected health information by health care providers. They also set forth certain rights that an individual has with respect to his or her protected health information maintained by a health care provider, including the right to access or amend certain records containing protected health information or to request restrictions on the use or disclosure of protected health information. The security regulations establish requirements for safeguarding the confidentiality, integrity, and availability of protected health information that is electronically transmitted or electronically stored. The HITECH Act, among other things, establishes certain health information security breach notification requirements. A covered entity must notify any individual whose protected health information is breached. The HIPAA privacy and security regulations establish a uniform federal "floor" and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing protected health information. These laws contain significant fines and other penalties for wrongful use or disclosure of protected health information. Additionally, to the extent that we submit electronic health care claims and payment transactions that do not comply with the electronic data transmission standards established under HIPAA and the HITECH Act, payments to us may be delayed or denied.

Our software may experience quality or reliability problems. The highly sophisticated software we have been developing may contain bugs and other defects that interfere with their intended operation. Any defects we do not detect and fix in pre-release testing could cause reduced sales and revenue, damage to our reputation, repair or remediation costs, delays in the release of new products or versions, or legal liability. Although our license agreements typically contain provisions that limit our exposure to liability, there is no assurance these provisions will withstand legal challenge.

If a contract relating to our mission-critical software services, such as that applicable to payroll and payroll tax processing, is terminated or not renewed, and we do not have an effective replacement software, our business and revenues will suffer. Although there are other software vendors we can use, it may take time to negotiate an agreement and make any replacement software operational. Accordingly, if the software agreements that we use in our business are terminated or not renewed, our business could be seriously disrupted and our revenues significantly reduced until we locate replacement software and make it operational.

The major customer groups to whom we believe our products and services will appeal, (i.e. both clients and WSEs who rely upon shift work), may not embrace our products and services. Acceptance of our products and services will depend on several factors, including cost, ease of use, familiarity of use, convenience, timeliness, strategic partnerships, and reliability. If we fail to adequately meet our customers' needs and expectations, our product offerings may not be competitive and our ability to commence or continue generating revenues could be reduced. We also cannot be sure that our business model will gain wide acceptance among all targeted customer groups. If the market fails to continue to develop, or develops more slowly than we expect, our ability to continue generating revenues could be reduced.

Our business is susceptible to general conditions in the global economy and in the global financial markets. Further, the impacts of political unrest, including as a result geopolitical tension, such as a deterioration in the relationship between the U.S. and China or escalation in conflict between Russia and Ukraine, including any additional sanctions, export controls or other restrictive actions that may be imposed by the U.S. and/or other countries against governmental or other entities in, for example, Russia, also could lead to disruption, instability and volatility in the global markets, which may have an adverse impact on our business or ability to access the capital markets. A severe or prolonged economic downturn, including a recession or depression resulting from the ongoing COVID-19 pandemic, or political disruption could result in a variety of risks to our business and our ability to raise additional capital when needed on acceptable terms, if at all. A weak or declining economy or political disruption could also cause our customers to delay making payments for our services. Any of the foregoing could materially and adversely affect our business, financial condition, results of operations and prospects, and we cannot anticipate all of the ways in which the political or economic climate and financial market conditions could adversely impact our business.