DBX · CIK 1467623
What Dropbox, Inc. told the SEC could break it.
Dropbox's flagged risks are the structural dependencies of a cloud-storage business. It relies on its leased co-location infrastructure and third-party datacenters such as AWS, so a disruption there or a failure to renew those services would hit its operations. Leadership and control are concentrated in co-founder and CEO Andrew Houston — described as critical to its vision and strategy, with insiders holding 81.4% of voting power — and, with about 44% of revenue earned internationally, it faces evolving rules like the EU's Digital Services Act, which carries fines of up to 6% of annual turnover.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Supplier concentration
- third-party datacenters (AWS) and co-location facilitiesmedium
Dropbox depends on its leased co-location infrastructure and third-party datacenters such as AWS; disruption or failure to renew these services could adversely affect the business.
“We depend on our infrastructure and third-party datacenters, and any disruption in the operation of these facilities or failure to renew the services could adversely affect our business.”
SEC filing →As of 2026
Key person
- founder-CEO Andrew Houston dependencelow
Dropbox depends on key personnel, particularly co-founder/CEO Andrew W. Houston, who is critical to its vision, strategy, culture and offerings (insiders also hold 81.4% of voting power).
“In particular, Andrew W. Houston, our Chief Executive Officer and one of our co-founders, is critical to our vision, strategic direction, culture, and offerings.”
SEC filing →As of 2026
Regulatory & policy
- EU Digital Services Act (fines up to 6% of turnover)low
The EU Digital Services Act imposes new content/compliance obligations with fines up to 6% of annual turnover, with uncertain impacts on Dropbox's subscriptions and operating costs (44% of revenue is international).
“For example, on November 17, 2022, the Digital Services Act (“DSA”) entered into force in the EU and includes new obligations to limit the spread of illegal content and illegal products online, increase the protection of minors, and provide users with more choice and transparency and allows for fines of up to 6% of annual turnover.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
Amazon Web Services (Amazon.com, Inc.)
“We host our services and serve all of our users using a combination of our own custom-built infrastructure that we lease and operate in co-location facilities and third-party datacenter services such as Amazon Web Services.”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch