Salesforce.com 2014 Annual Report Download - page 15

first introduced or when new versions or enhancements are released. We have from time to time found defects in
our service and new errors in our service may be detected in the future. In addition, our customers may use our
service in unanticipated ways that may cause a disruption in service for other customers attempting to access
their data. As we acquire companies, we may encounter difficulty in incorporating the acquired technologies into
our service and maintaining the quality standards that are consistent with our brand and reputation. Since our
customers use our service for important aspects of their business, any errors, defects, disruptions in service or
other performance problems could hurt our reputation and may damage our customers’ businesses. As a result,
customers could elect to not renew, or delay or withhold payment to us, we could lose future sales or customers
may make warranty or other claims against us, which could result in an increase in our provision for doubtful
accounts, an increase in collection cycles for accounts receivable or the expense and risk of litigation.
Interruptions or delays in service from our third-party data center hosting facilities could impair the
delivery of our service and harm our business.
We currently serve our customers from third-party data center hosting facilities located in the United States
and other countries. Any damage to, or failure of, our systems generally could result in interruptions in our
service. Interruptions in our service may reduce our revenue, cause us to issue credits or pay penalties, cause
customers to terminate their subscriptions and adversely affect our attrition rates and our ability to attract new
customers. Our business will also be harmed if our customers and potential customers believe our service is
unreliable.
As part of our current disaster recovery arrangements, our production environment and all of our customers’
data is currently replicated in near real-time in a facility located in the United States. Companies and products
added through acquisition may be temporarily served through alternate facilities. We do not control the operation
of any of these facilities, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power
loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional
acts of vandalism and similar misconduct. Despite precautions taken at these facilities, the occurrence of a
natural disaster or an act of terrorism, a decision to close the facilities without adequate notice or other
unanticipated problems at these facilities could result in lengthy interruptions in our service. Even with the
disaster recovery arrangements, our service could be interrupted.
As we continue to add data centers and add capacity in our existing data centers, we may move or transfer
our data and our customers’ data. Despite precautions taken during this process, any unsuccessful data transfers
may impair the delivery of our service.
If our security measures are breached and unauthorized access is obtained to a customer’s data or our
data or our IT systems, our service may be perceived as not being secure, customers may curtail or stop using
our service and we may incur significant legal and financial exposure and liabilities.
Our service involves the storage and transmission of customers’ proprietary information, and security
breaches could expose us to a risk of loss of this information, litigation and possible liability. These security
measures may be breached as a result of third-party action, including intentional misconduct by computer
hackers, employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our
customers’ data or our data, including our intellectual property and other confidential business information, or
our IT systems. Additionally, third parties may attempt to fraudulently induce employees or customers into
disclosing sensitive information such as user names, passwords or other information in order to gain access to our
customers’ data or our data or IT systems. Because the techniques used to obtain unauthorized access, or to
sabotage systems, change frequently and generally are not recognized until launched against a target, we may be
unable to anticipate these techniques or to implement adequate preventative measures. In addition, our customers
may authorize third-party technology providers to access their customer data. Because we do not control our
customers and third-party technology providers, or the processing of such data by third-party technology
providers, we cannot ensure the integrity or security of such transmissions or processing. Malicious third-parties
may also conduct attacks designed to temporarily deny customers access to our services. Any security breach
11