DOCU · CIK 1261333
What Docusign, Inc. told the SEC could break it.
DocuSign's disclosures flow from its role as custodian of customers' agreement and personal data. It faces increasingly frequent, sophisticated cyberattacks — including state-sponsored advanced persistent threats, phishing and AI-enabled attacks — against its platform, and because it processes personal data under GDPR and other privacy regimes, a breach could bring investigations and fines up to the greater of €20 million or 4% of global turnover, plus civil claims. Separately, about 29% of its revenue is generated outside the U.S. and it does not hedge foreign-currency transactions, leaving operating results exposed to adverse exchange-rate moves.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Cybersecurity
- cyberattacks on agreement-data platformmedium
As a custodian of customers' agreement data, DocuSign faces increasingly frequent, sophisticated cyberattacks — including state-sponsored advanced persistent threats, phishing/social engineering, and AI-enabled automated attacks — that could breach its or its providers' systems.
“We are subject to increasingly frequent and sophisticated cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics,”
SEC filing →As of 2026
Regulatory & policy
- data-protection regulation (GDPR)medium
DocuSign processes personal data subject to GDPR and other privacy regimes; a breach could trigger investigations, fines up to the greater of €20M or 4% of global turnover, orders to change processing, plus civil claims.
“Such penalties, which under GDPR may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects.”
SEC filing →As of 2026
Currency (FX)
- unhedged foreign-currency exposure (29% international revenue)low
About 29% of DocuSign's revenue is generated outside the US (and ~40% of employees), yet it has not hedged foreign-currency transactions, leaving operating results exposed to adverse FX movements amplified by geopolitical and macro volatility.
“We have not engaged in the hedging of foreign currency transactions to date, so we may not be able to effectively offset the adverse financial impacts that may result from unfavorable movements in foreign currency exchange rates, which could adversely affect our operating results.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
“We operate co-location data centers in several locations, and we also leverage public cloud infrastructure for an increasing number of services, as we continue to migrate our production services from our data center hosting facilities to Microsoft Azure Cloud, a third-party cloud provider.”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch