What Cloudflare, Inc. told the SEC could break it.

Cloudflare is highly dependent on its two co-founders — CEO Matthew Prince and President Michelle Zatlyn — who are on at-will employment with no guaranteed tenure.

“Our future success is substantially dependent on our ability to attract, integrate, retain, and motivate the members of our management team and other key employees throughout our organization. In particular, we are highly dependent on the services of our co-founders, Matthew Prince, our Chief Executive Officer, and Michelle Zatlyn, our President.”

Much of Cloudflare's global network infrastructure is maintained through a single core co-location facility in the Portland, Oregon area; the Amsterdam facility provides only partial redundancy, leaving the Portland site as the primary dependency.

“much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S.”

Cloudflare voluntarily self-disclosed to OFAC that its products were used by persons on the SDN list (including counter-terrorism and counter-narcotics programs) and received payments from some; the disclosure remains under ongoing OFAC review.

“Specifically, we identified that our products were used by, or for the benefit of, certain individuals and entities included in OFAC's Specially Designated Nationals and Blocked Persons List, including entities identified in OFAC's counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions. A small number of these parties made payments to us in connection with their use of our products. The voluntary self-disclosure, which we may supplement as appropriate, remains under an ongoing review by OFAC.”

Cloudflare relies on a limited number of server suppliers on a purchase-order basis with no long-term contracts; disruption or tariff-driven price increases from those suppliers could increase costs with no guaranteed alternative supply.

“Our reliance on these suppliers exposes us to risks, including reduced control over production costs, increased prices due to tariffs (such as the tariffs the United States and other countries recently implemented or threatened to implement), increased prices and constraints based on the then-current availability with an increased demand, terms, and pricing of these components. For example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply.”