NAVN · CIK 0001639723
What Navan, Inc. told the SEC could break it.
Navan's disclosures reflect a travel-and-expense platform dependent on relationships and infrastructure it doesn't own. Its travel-management business hinges on maintaining and expanding supplier relationships with airlines and hotels to offer broad global inventory at competitive prices, and its entire platform runs on third-party cloud infrastructure, so an outage or loss of those providers would impair delivery. Its footprint is meaningfully international — about 38% ($266.4M) of fiscal 2026 revenue came from outside the U.S., with subsidiaries across the UK, EU, Israel, India, and APAC — adding FX, data-privacy, and geopolitical exposure. That business also carries specific regulatory weight: airline-industry accreditation such as the ARC, plus multi-jurisdiction data-privacy regimes like GDPR and Singapore's PDPA.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Supplier concentration
- Travel Management depends on airline/hotel supplier relationshipshigh
Navan's Travel Management offerings depend on maintaining and expanding relationships with travel suppliers (airlines, hotels) to provide broad global inventory at optimal prices.
“Our Travel Management offerings depend on our relationships with suppliers. The success of our Travel Management offerings depends on our ability to maintain and expand our relationships with our suppliers to offer our customers an unrivaled range of global travel inventory at optimal prices.”
SEC filing →As of 2026 - entire platform hosted on third-party cloud infrastructurelow
All of Navan's offerings run on third-party cloud infrastructure providers; outages, interruptions or loss of those providers would impair platform delivery.
“We host our platform using third-party cloud infrastructure services. All of our offerings utilize resources operated by us through these providers.”
SEC filing →As of 2026
Geographic concentration
- 38% of revenue international; subsidiaries across UK/EU/Israel/India/APACmedium
About 38% ($266.4M) of FY2026 revenue came from outside the U.S., with subsidiaries in the UK, France, Israel, Singapore, India, UAE and Australia and employees in 15+ countries — exposing Navan to FX, data-privacy and geopolitical risk.
“Revenue generated from customers outside of the United States was $266.4 million, or 38% of our revenue, $221.0 million, or 41% and $184.8 million or 46% of our revenue, for the years ended January 31, 2026, 2025 and 2024, respectively.”
SEC filing →As of 2026
Regulatory & policy
- travel-industry accreditation (ARC) & data-privacy regulationmedium
Navan's travel-management business is subject to airline-industry accreditation requirements (e.g., the ARC) and multi-jurisdiction data-privacy regimes (GDPR, Swiss FADP, Singapore PDPA), raising compliance and licensing risk.
“Our travel management business is subject to registration and licensing requirements imposed by airline industry-established organizations, including agent accreditation requirements imposed by the Airlines Reporting Corporation, or the ARC, in the United States”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch