# AvePoint, Inc.: Form 10-K for the period ended Dec 31, 2025 - Company: [AvePoint, Inc.](/companies/avpt.md) (CIK 1777921) - Form: 10-K - Filed: 2026-02-26 - Accepted by EDGAR: Feb 26, 2026, 17:12 ET - Period: 2025-12-31 - Accession: 0001437749-26-005907 - Inline XBRL: yes - Main document: https://www.sec.gov/Archives/edgar/data/1777921/000143774926005907/avpt20251231_10k.htm - All documents and exhibits: https://www.sec.gov/Archives/edgar/data/1777921/000143774926005907/ ## Figures reported in this filing Standardized XBRL line items for the period ended 2025-12-31. | Line item | Period | Value | XBRL concept | | --- | --- | ---: | --- | | Revenue | 12 months, 2025-01-01 to 2025-12-31 | $419.5m | us-gaap:RevenueFromContractWithCustomerExcludingAssessedTax | | Cost of revenue | 12 months, 2025-01-01 to 2025-12-31 | $108.8m | us-gaap:CostOfGoodsAndServicesSold | | Gross profit | 12 months, 2025-01-01 to 2025-12-31 | $310.7m | us-gaap:GrossProfit | | Research and development | 12 months, 2025-01-01 to 2025-12-31 | $52.6m | us-gaap:ResearchAndDevelopmentExpense | | Operating income | 12 months, 2025-01-01 to 2025-12-31 | $33.0m | us-gaap:OperatingIncomeLoss | | Income tax | 12 months, 2025-01-01 to 2025-12-31 | $5.4m | us-gaap:IncomeTaxExpenseBenefit | | Net income | 12 months, 2025-01-01 to 2025-12-31 | $34.8m | us-gaap:NetIncomeLoss | | Diluted EPS | 12 months, 2025-01-01 to 2025-12-31 | $0.15 | us-gaap:EarningsPerShareDiluted | | Basic EPS | 12 months, 2025-01-01 to 2025-12-31 | $0.17 | us-gaap:EarningsPerShareBasic | | Diluted shares (weighted) | 12 months, 2025-01-01 to 2025-12-31 | 229,293,000 shares | us-gaap:WeightedAverageNumberOfDilutedSharesOutstanding | | Operating cash flow | 12 months, 2025-01-01 to 2025-12-31 | $85.3m | us-gaap:NetCashProvidedByUsedInOperatingActivities | | Capital expenditure | 12 months, 2025-01-01 to 2025-12-31 | $3.7m | us-gaap:PaymentsToAcquirePropertyPlantAndEquipment | | Share repurchases | 12 months, 2025-01-01 to 2025-12-31 | $49.8m | us-gaap:PaymentsForRepurchaseOfCommonStock | | Cash and equivalents | at 2025-12-31 | $481.1m | us-gaap:CashAndCashEquivalentsAtCarryingValue | | Current assets | at 2025-12-31 | $625.3m | us-gaap:AssetsCurrent | | Total assets | at 2025-12-31 | $789.2m | us-gaap:Assets | | Current liabilities | at 2025-12-31 | $273.7m | us-gaap:LiabilitiesCurrent | | Total liabilities | at 2025-12-31 | $310.5m | us-gaap:Liabilities | | Shareholders' equity | at 2025-12-31 | $478.7m | us-gaap:StockholdersEquityIncludingPortionAttributableToNoncontrollingInterest | ## Business As filed, 51,293 characters. ### Company Overview AvePoint is a global provider of modern data protection, enabling organizations to secure, govern, and operationalize data at scale across major cloud ecosystems. Customers rely on the AvePoint Confidence Platform to reduce risk, improve operational efficiency, and accelerate digital transformation as they adopt cloud collaboration and artificial intelligence ("***AI***")-driven advanced tools and workflows. As organizations embed AI into core business processes, data becomes both a strategic asset and a growing source of risk. AI can amplify the impact of poor data hygiene, including sensitive data exposure, compliance failures, and operational disruption. Enterprises increasingly require a modern data foundation where data is discoverable, classified, governed, protected, and recoverable by design. ### The Enterprise Challenges We Address Our solutions are designed to address four pervasive and interconnected enterprise data challenges: - Legacy and fragmented data that limits visibility, governance, and AI readiness; - Overexposed data that increases security, privacy, and regulatory risk; - Digital sprawl that drives operational complexity and rising total cost of ownership; and - Data loss and interruption, which threaten business continuity and organizational resilience. By addressing these challenges through an integrated platform, we enable organizations to reduce risk, lower complexity, and accelerate time-to-value from their data. ### Platform Model and Recurring Revenue Dynamics Our platform model is designed to deliver compounding customer value over time, which supports durable recurring revenue. As customers increase adoption across workloads, users, geographies, and use cases, they gain improved visibility, cleaner data, stronger governance, and enhanced resilience outcomes and capabilities that become more valuable as data volumes and AI usage grow. This dynamic supports a reinforcing model: broader platform adoption improves data trust and control, which increases platform utility and drives additional use cases and module adoption over time. And in turn, this improved platform penetration increases switching costs and supports ongoing improvements in gross and net retention metrics, as AvePoint becomes more strategic and embedded within our customers. ### Our Platform #### AvePoint Confidence Platform The AvePoint Confidence Platform is a comprehensive and integrated set of solutions that empowers technology teams including: IT operations, development operations, and cybersecurity to govern and secure the digital workplace. Built on a Platform-as-a-Service (PaaS) architecture, the platform combines modularity with tailored functionality to address operational challenges and manage data effectively across a broad set of cloud and content ecosystems. These include major hyperscalers and enterprise applications such as Microsoft, Salesforce, Google, AWS, Box, and Dropbox, as well as other collaboration, identity and developer platforms such as Docusign, Confluence, GitHub, Jira, Okta, Bitbucket, Smartsheet and Monday.com. Through connections and extensions to existing cloud services, the platform is designed to provide flexibility, consolidate point solutions, and accelerate customer return on investment. #### Suites The AvePoint Confidence Platform consists of three interconnected suites: - **Control Suite**: Automates data governance, enforces policies, and optimizes SaaS investments, enables expense management and reduction, and provides insight into access, risk, and entitlements across collaborative platforms. - **Resilience Suite:** Supports business continuity and compliance through Backup-as-a-Service, ransomware recovery, lifecycle management, and classification-driven protection. - **Modernization Suite:** Modernizes legacy systems and processes into AI-ready, SaaS-based experiences to accelerate employee engagement, digital transformation, and productivity. #### Packaging We deliver our capabilities through modular suites designed to meet customers at their maturity level and expand over time. We have begun packaging the suite capabilities of the AvePoint Confidence Platform into tiered bundles to simplify selling and adoption using a "good-better-best" model aligned to customer profiles and a clear growth path. While we expect these bundles will continue to evolve as they become more popular in the market, today they are focused primarily on the capabilities of the Control and Resilience suites, and are offered as follows: - **"Essentials" bundle (Tier 1): ■** Control: Establishes the baseline for data security, compliance, productivity, and AI readiness with tools to streamline data governance, simplify data management, and enhance security. ■ Resilience: Protects cloud data from external attacks and insider threats with better visibility into data being backed up to recover faster. - **"Plus" bundle (Tier 2): ■** Control: Supports proactive and persistent data security measures by automating governance, delegating administration and reducing costs. ■ Resilience: Provides comprehensive, automated backup with granular recovery capabilities for the most crucial customer workloads. - **"Complete" bundle (Tier 3): ■** Control: Offers the most strategic approach to data security aimed at mitigating risks and driving AI transformation. ■ Resilience: Provides complete protection of the entire cloud estate with data optimization capabilities to more effectively manage data risk. 6 ### Strategic Use Cases Customers typically begin with one strategic use case and expand across additional capabilities as requirements mature. Key use cases include: - **AI Confidence and Readiness**: Improve data quality, security, governance, and adoption to accelerate AI-driven innovation while reducing exposure, regulatory, and integrity risks. - **Ransomware Protection and Disaster Recovery**: Protect and rapidly recover critical workloads across major ecosystems to reduce downtime and limit the operational and financial impact of cyber incidents. - **Cloud ROI and Optimization**: Reduce waste by rightsizing licenses, reclaiming redundant storage, consolidating solutions/vendors, and automating workflows. - **Operational Governance**: Operationalize governance through automated provisioning, lifecycle management, and policy enforcement across clouds. - **Security Posture Management**: Discover, monitor, and control AI agents to strengthen compliance, security, and trust as organizations scale AI. - **Agentic AI Governance**: Discover, monitor, and control AI agents to strengthen compliance, security, and trust as organizations scale AI. - **Regulatory Compliance and Information Lifecycle**: Automate information lifecycle management - from classification to retention and disposition - while maintaining auditable controls and reducing data bloat. - **Cloud Transformation and Modernization**: Execute secure, high-fidelity migrations with permission mapping and in-flight clean-up. Surface user analytics to drive adoption post-cutover, rationalize legacy data, and unlock the full value of cloud investments. - **Multi-Tenant Management**: Manage multiple tenants at scale with consistent baselines, cross-tenant policy automation, and unified reporting. Reduce tickets, prove value with measurable outcomes, and deliver repeatable, profitable managed services. ### Our Technology and Architecture We believe platform architecture matters because it determines how effectively organizations can discover, govern, protect, and recover data across distributed, multi-cloud environments. We believe the following attributes and characteristics of our platform architecture allow us to offer a differentiated approach to modern data security and business intelligence. #### Rich Inventory of Data Characteristics Rather than merely storing logs, our platform creates a dynamic inventory of data characteristics synthesized from unstructured data streams. In the modern enterprise, data is rarely static, it flows from business applications and generative AI tools in high-volume, unstructured formats such as collaborative communications, automated agent outputs, and complex document metadata. - **Defining Unstructured Data**: This includes the high-volume, diverse outputs of modern work: emails, chat logs, call transcriptions, sensor data, digital workspace, access controls, productivity cloud services documents (i.e. M365 files, Google Workspace files, Adobe files, Docusign, GitHub, Atlassian, etc.), and AI-generated outputs. - **The Evolution of Attributes**: As this data is processed, its attributes (such as sensitivity, intent, and lineage) change in real-time. - **The Governance Imperative**: Because unstructured data is often the first place sensitive information or threats appear, it must be governed and managed in near real-time. By capturing how the business environment operates on corporate data as it happens, our platform provides superior insights into business outcomes that traditional, static databases often miss. #### Modern Data Protection Architecture & Interoperability The AvePoint Confidence Platform serves as a foundational layer within any data protection framework. We do not just reside within the network; we act as the authoritative control plane for policy management and real-time remediation. By maintaining interoperability across hybrid-cloud environments, we enforce strict identity verification and "least privilege" access at the data layer. If a data characteristic shifts - signaling a potential breach or policy violation - the platform is designed to trigger immediate remediation, ensuring that trust is never assumed and always verified. #### Elastic Data Engine & AI Threat Layer We have engineered a layered architecture designed for massive scale and proactive defense. This engine is specifically tuned to identify and neutralize threats inherent to the AI era: - **Business Logic Layer**: Defines the specific security and operational rules required by the organization. - **Elastic Scaling Data Abstraction Layer**: Decouples logic from physical storage, allowing the system to expand instantly to meet massive data surges without performance degradation. - **AI-Specific Remediation**: Our proprietary algorithms are designed to catch emergent threats including: - **The "Zero-Trust" AI Foundation**: Neutralizing the existential risk of AI-driven data leaks by enforcing automated, real-time "Least-Privilege" security. - **Autonomous Agent Governance**: Preventing "Shadow AI" through a centralized command-and-control layer for autonomous agents and Copilots. - **AI Data Integrity & Hallucination Defense**: Maximizing AI ROI by purging the "Data Debt" that causes model inaccuracy and corporate liability. - **Unified Multi-SaaS AI Guardrails**: Harmonizing security and compliance across the fragmented, multi-vendor AI landscape. - **Mission-Critical AI Resilience**: Guaranteeing the uptime integrity of AI-integrated business processes through ultra-high-speed recovery. #### Application Programming Interface ("API")-Driven Automation and Orchestration The AvePoint Confidence Platform provides a robust API framework that functions as the connective tissue for security operations. - **Integration**: Seamlessly connects with existing IT stacks, SIEMs, and SOAR platforms. - **Orchestration**: Automatically triggers the response mechanism for incident and problem resolution systems. By orchestrating the end-to-end lifecycle of a security event, we reduce "Mean Time to Repair" (MTTR) and ensure consistent policy enforcement at a scale human operators cannot achieve manually. - **Integration layer**: Primary connectors (e.g., M365, Salesforce, Google, AWS, Box/Dropbox) and what "deep integration" means in practice. - **Discovery/classification layer**: Metadata, labeling/sensitivity, ownership/lineage, scanning approach. - **Policy and automation engine**: Access governance, lifecycle actions, retention/disposition, workflow automation. - **Protection and recovery services**: Backup architecture, recovery workflows, ransomware recovery/testing (where applicable). - **Analytics/insights**: Risk posture, usage optimization, compliance reporting. ### Security, Compliance, and Trust We support customer requirements for security and compliance through our operational controls, certifications, and global service delivery footprint. - **Encryption and Key Management**: All customer data is encrypted both in transit (using TLS 1.2 or greater) and at rest (using AES-256). We support advanced key management strategies, including Bring Your Own Key (BYOK) for enterprise customers requiring granular control over data access. - **Global Sovereignty**: To comply with increasingly fragmented data privacy laws (such as the General Data Protection Regulation (“***GDPR”)),*** we offer multi-geo tenancy, allowing customers to specify exactly which regional data centers house their data and metadata. - **Certifications and Authorization**: We maintain a comprehensive compliance portfolio, including SOC 2 Type II attestation, ISO 27001/27017/27018 certifications, and compliance with HITRUST CSF v11.0.1., CSA STAR, and IRAP. Furthermore, our authorization under FedRAMP (moderate) validates our ability to serve U.S. federal agencies, serving as a strong proxy for security maturity to the broader market. Lastly, in 2025 we achieved Information System Security Management and Assessment Program (ISMAP) certification in Japan, one of the most comprehensive government security standards in the world. - **Operational Controls**: We employ strict Role-Based Access Control (RBAC), continuous vulnerability scanning, and a secure software development lifecycle (SDLC) to minimize risk and ensure auditability across all platform operations. 8 ### Customer Support and Success Our customer success approach is proactive and relationship-focused, designed to help customers rapidly deploy and realize value from the AvePoint Confidence Platform and ensure strong customer retention and expansion. This includes: - onboarding and enablement model, adoption reviews, technical success coverage - support tiers and escalation/incident response posture - premium unified support services, which provide technical on-site support to optimize and allow for tight integration of our solutions to our customers' expansive multi-cloud infrastructure We maintain a Net Promoter Score above 50, an elite benchmark in B2B SaaS and at a level typically associated with best-in-class customer satisfaction and loyalty, per CustomerGauge benchmarking data. ### Market Opportunity Global data volumes continue to grow rapidly, with unstructured data representing approximately 80% of all data, as well as a significant portion of the increase. Enterprises face rising regulatory pressure, expanding cybersecurity threats, and, more recently, ongoing operational complexity from multi-cloud environments and SaaS business application and AI agent sprawl. These trends create a large and rapidly growing market for secure, automated, and AI-ready data governance and resilience solutions. Historically, the most significant shifts in software came from how business applications were built and delivered. This trend continues today with advanced AI, where instead of manually building every workflow and interface, organizations increasingly use agentic tools to translate business requirements and policies into working software components and automated processes. This shift makes the data and policy layers, on which those AI tools rely to reason and act safely, even more critical. And in turn, modern data platforms like the AvePoint Confidence Platform become structurally even more important, because they provide the governance framework classification, access controls, retention, auditability, and resilience that transforms enterprise data into a secure, high-quality signal for AI. Furthermore, as organizations seek to leverage AI to reduce expenses and optimize performance, agentic architectures only deliver real efficiency when they operate on trusted data and enforce consistent rules. The result is a durable foundation for modern data protection – the more software becomes AI-assisted and automated, the more valuable a holistic governance and resilience platform becomes, because it serves as the central command for enterprise data performance. While today our focus is primarily on the data governance and security categories, we expect to capture spend from other areas of the broader data management opportunity, including data integration and intelligence, identity and access management, security analytics, cloud application protection and advanced AI tooling. We are also seeing growing instances of these spend categories beginning to converge, which we believe positions us well as a platform offering for managing critical data. ### Our Growth Strategy Our aggressive pursuit of the enormous long-term market opportunity we see includes the following growth strategies: - **Accelerate Customer Adoption and Retention.** We constantly seek to increase customer satisfaction, decrease time to value, reduce customer churn and set up successful land and expand opportunities. To do so, we have made significant investments in our customer success program and in technology which provides additional telemetry to enhance our understanding of how customers use our solutions. We are also adding AI-enhanced customer interactions and tailored usage across all personas of the organization. We believe these investments will deepen our relationships with existing customers. - **Expand the AvePoint Confidence Platform Offerings.** We have built a differentiated platform that addresses a number of strategic use cases, and we plan to introduce new and adjacent products to extend our data management value proposition and to improve the functionality of existing products and features, with a particular focus on AI ready solutions that transform and enrich data and span multiple cloud vendors. - **Broaden our Market Presence.** We sell to organizations of all sizes, in all regions of the world, and across a broad array of industries. We have seen strong new customer growth, especially in the small business segment, by leveraging our global partner ecosystem, and through the expansion of our direct sales force both in regions where we have an established presence and in new markets where cloud adoption is growing. - **Continue Scaling our Partner and Channel Ecosystem**. The ongoing cultivation of our strategic relationships with partners will support the continued penetration of markets in which we previously lacked presence, and those in which we have a presence that can be expanded. The continued scaling of this ecosystem, especially our focus on Managed Service Providers (“***MSPs”***), offers particular value in our pursuit of small and mid-sized customers and will be a critical component of our ability to continue driving profitable growth going forward. - **Opportunistically Pursue Strategic Acquisitions and Investments**. While the large majority of our current offerings were built organically, we have completed six acquisitions since 2022, and we expect that strategic acquisitions and investments will be an important growth driver for our business. This may include acquiring or investing in businesses or products with complementary technologies and/or functionality to our existing product offerings, or that reduce the time or costs required to develop new technologies, augment our engineering workforce, improve our internal business and operating systems, and enhance our technological capabilities. ### Go-to-Market Strategy We sell to organizations of all sizes and across geographies and industries. Our go-to-market strategy combines a direct sales force with indirect routes to market, including a broad partner ecosystem. We sell subscriptions to customers through our channel partners primarily using a two-tier, indirect fulfillment model. We also offer our SaaS products via the marketplaces of our technology alliance partners, including Google Cloud Platform ("***GCP***"), Microsoft Azure, ("***Azure***") and Amazon Web Services ("***AWS").*** As of December 31, 2025, we served more than 28,000 end customers across more than 100 countries, with no customer representing more than 10% of billings or accounts receivable for the years ended December 31, 2025 and 2024. We classify our customer base by size and geography: - **Small Business (“SMB”) segment.** Companies with fewer than 500 user seats that we serve primarily through channel partners, especially MSPs, as discussed below. As of December 31, 2025, the SMB segment accounted for 20% of our total annual recurring revenue. - **Mid-Market segment.** Companies with greater than 500 but fewer than 5,000 user seats that we increasingly serve through channel partners. As of December 31, 2025, the Mid-market segment accounted for 28% of our total annual recurring revenue. - **Enterprise segment.** Companies with greater than 5,000 user seats that we primarily serve through our direct sales teams. As of December 31, 2025, the Enterprise segment accounted for 52% of our total annual recurring revenue. ### Indirect Routes to Market and Partner Ecosystem We leverage a global channel partner program that includes approximately 6,000 managed service providers, value added resellers, and system integrators. Our solutions are available in more than 100 software marketplaces globally and our technology alliance partners, including GCP Marketplace, Azure Marketplace, and AWS Marketplace, support procurement and provisioning efficiencies and enabling scalable distribution, particularly through MSPs. We provide MSPs with a special edition of the Confidence Platform called the *Elements* edition, tailored for their unique needs. The *Elements* edition of the Confidence Platform enables MSPs to seamlessly manage multiple clients, clouds and tenants to drive more efficient revenue growth, and reflects our ongoing focus on this important route to market. Our channel partners collectively help maximize our technological expertise and, importantly, our geographic coverage, by building awareness of our products and brand, generating customer leads, implementing our solutions, and providing critical value-added services. They are especially critical in our focus on the small business and mid-market customers who collectively represent an enormous market opportunity for us. ### Strategic Partnerships Hyperscalers and ecosystem providers are important partners and provide an opportunity to scale across global data centers. We maintain strategic partnerships with Microsoft, Google, and AWS that incorporate technology, sales, and marketing initiatives. ### Research And Development We continuously seek to develop new offerings and enhance existing offerings and support customer deployments. We use agile development methodologies and focus on delivering high-quality products and adapting to evolving market requirements. We believe expanding functionality and introducing adjacent products is critical to customer success and reinforces the breadth of our solutions. ### Intellectual Property We rely on a combination of trade secrets, copyrights, and trademarks to establish and protect our intellectual property rights. We also rely on contractual protections, such as license, assignment, and confidentiality agreements, and technical measures. We pursue the registration of domain names, trademarks, and service marks in the United States and in various jurisdictions outside the United States. We control access to and use of our proprietary technology and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, customers, and partners, and our software is protected by U.S. and international intellectual property laws. We require our employees, consultants, and other third parties to enter into confidentiality and proprietary rights agreements and control access to software, documentation, and other proprietary information. Our policy is to require employees and independent contractors to sign agreements assigning to us any inventions, trade secrets, works of authorship, developments, and other processes generated by them on our behalf and agreeing to protect our confidential information. In addition, we generally enter into confidentiality agreements with our vendors and customers. ### Competition We primarily face competition according to the use cases we target. Our main competitors fall into the following categories: - Data protection and legacy backup vendors; - Vendors primarily focused on cybersecurity, data security posture management, threat detection, data classification, and other data security subcategories; and - Smaller cloud and data management vendors that offer products that compete with some of our capabilities. However, we believe that our platform architecture and approach to modern data protection make us unique among companies offering overlapping point solutions. These advantages include the breadth of functionality offered in a single integrated platform, ease of use, scalability, security protocols, integration breadth, time-to-value, and total cost of ownership. ### Seasonality Our quarterly revenue can fluctuate and does not necessarily grow sequentially when measuring any one fiscal quarter’s revenue against another. Historically, our first quarter has been our lowest revenue quarter and our fourth quarter has been our highest revenue quarter, however those results are not necessarily indicative of future quarterly revenue or full year results. Additionally, the timing of new product and service introductions can significantly impact revenue. Lastly, the mix of revenues in any given quarter can cause fluctuations in our reported results, due to differing revenue recognition principles, as discussed further below. ### Human Capital The success of our people is the success of our Company, making our talent strategy a core focus of our operations. We received accolades designating us as a “best place to work” in 2024, including recognition from Inc. Magazine and Forbes. Our key human capital objectives include attracting and developing top talent, engaging our team in an environment where they thrive, and integrating our core values into our operating practices. Our values are long-held beliefs that guide the behaviors of our global teams and are foundational to our present and future success. These are not ‘statements on a wall’ but a true representation of how we act as a team: - **Agility:** We value quick, informed decision-making to meet and exceed customer expectations. We subscribe to a growth mindset, which contributes to our entrepreneurial and learning spirit. - **Passion:** Drive and energy are contagious here; we are not just going through the motions. We do things that are impactful and, as a result, amplify our customers’ success. - **Teamwork:** We are invested in the success of our colleagues, partners, customers, and communities. We do this by promoting global collaboration and taking pride in helping, sharing, mentoring, and coaching each other. #### Team As of December 31, 2025, we had 3,443 employees globally. A large percentage of our employees have technical and professional backgrounds and undergraduate and/or advanced degrees. Our professional staff includes programmers, data and computer scientists, electrical and mechanical engineers, software and hardware specialists, project managers, sales and marketing professionals, and a multi-disciplinary support infrastructure. None of our employees are represented by a labor union with respect to their employment. We are not aware of any employment circumstances that are likely to disrupt our work efforts. See the section titled “*Risk Factors”* (Part I, Item 1A of this Annual Report) for a discussion of the risks related to the loss of key personnel or our inability to attract and retain qualified personnel. #### Recruitment and Internal Mobility We want to attract a pool of diverse and exceptional candidates and support their career growth once they join our team. We seek to hire based on proven experience and potential, providing opportunities to develop in critical operational areas. In our evaluation and career development efforts, we emphasize internal mobility opportunities as a core strategy to drive professional development. Our goal is a long-term, upward-bound career for every colleague, which also drives our retention efforts. Our talent acquisition team directly recruits highly skilled and talented people, and we encourage and incentivize employee referrals for open positions. #### Rewards We strive to provide globally a competitive suite of pay, comprehensive benefits, and services. We incentivize performance through a combination of competitive base pay, performance-based cash incentives and long-term incentives in the form of equity and cash. We believe this combination fosters a strong sense of ownership, aligns the interests of employees with our stockholders, and increases stockholder value and our overall success. ### Environmental, Social and Governance Matters We recognize the importance of environmental, social and governance (“***ESG”***) matters and how they impact our customers, employees, community partners, and stockholders. We believe appropriately prioritizing ESG issues is an important component of corporate social responsibility and comprehensive fiscal management. In addition, we believe that strong ESG programs and practices are critical to attracting the best talent, executing on our corporate strategies, maintaining a robust supplier and channel partner base, and innovating to meet our consumers’ evolving expectations. The disclosure below describes the goals of our ESG program to allow our stakeholders to be informed about our progress and future direction. ### 1\. Environmental Across our 32 offices, we strive to reduce our environmental footprint, operate more efficiently, and engage our personnel in social initiatives that directly impact their lives. To fulfill our aim of integrating environmental sustainability into everything we do, we have implemented numerous projects across our operations to limit our environmental impact, such as implementing paperless campaigns, the encouragement of recycling and elimination of paper products, the sourcing of office resources from sustainable sources, and the recycling of physical IT assets. In addition, we also strive to make operational decisions with attention to environmental impact and have LEED certified offices in the United States and maintain other energy certifications and maximization projects in our offices abroad. As a software company, we were an early mover to transition from traditional on-premises software solutions to software-as-a-service and hybrid deployments. Not only does cloud computing help meet the needs of our customers, but it also has tremendous benefits to the environment, including greater energy efficiency, lower carbon emissions, and reduced carbon footprints. In furtherance of our goals to reduce unnecessary use, we review the data on the environmental impact of physical server providers and only use server providers who publish such data. ### 2\. Social As a global company, we have a tremendous opportunity – and responsibility – to do good. We strive to exemplify our core values of agility, passion and teamwork every day to ensure the success of our colleagues, customers, partners, and stakeholders as well as make a positive impact in the communities where we live and work. To do this, we are committed to creating and empowering access to a variety of opportunities as described below: Our organization employs talent from many different backgrounds, experiences, and identities. Diversity and inclusion drive our success and is at the core of how we hire, communicate and collaborate to deliver value and excellence. We are committed to fostering an environment where people can bring their whole selves to work and feel a sense of belonging. Through our employee resource groups, internal mobility opportunities across the countries in which we operate, and external partnerships with underrepresented minority networks, we continue to work toward creating a workforce that represents the diversity of our customers and communities. #### Supporting Agents of Change: Our Talent We are committed to investing in our people and nurturing a growth mindset across our organization. Our talent development philosophy builds upon the idea that business growth and success come from a culture of collaboration and creativity, and that our people should feel empowered to craft their careers, make an impact, and own their futures. Our portfolio of learning and development programs equips our leaders and managers with the skills and confidence to lead high-performing teams, and supports our individual contributors with the tools and resources to contribute impactfully in their roles from the moment they join AvePoint. #### Responsible Use of Artificial Intelligence At AvePoint, we recognize that AI continues to rapidly transform the business landscape. As such, we are committed to the safe, ethical, and responsible use of AI both within our company and for the broader technology industry. We have implemented robust training, policies, and procedures to ensure our employees are educated on the responsible use of AI. Further demonstrating our commitment, AvePoint is a founding member of the AI Trust Foundation, a non-profit membership organization designed to be the leading voice for promoting beneficial AI through education and outreach at all levels of society. Through internal governance and external collaboration, we aim to set the standard for acceptable and responsible use of AI. In 2024, AvePoint implemented a board-approved Responsible AI Charter, to establish a set of guidelines and principles for the responsible and ethical use, development, and deployment of AI within our organization, and to ensure consistency with similar company AI policies and practices, particularly data privacy and confidentiality protections. This Responsible AI Charter is a key component of AvePoint’s commitment to ensuring that AI is developed and deployed in a way that respects human values, rights, and dignity. AvePoint, as a leader in cloud data management and governance, recognizes its responsibility to use AI in an ethical and responsible manner. ### 3\. Corporate Governance #### Social Responsibility Support from the Top At AvePoint, our corporate governance practices support our core values of agility, passion, and teamwork. These practices provide a framework for the proper operation of our company, consistent with our stockholders’ best interests and the requirements of law. We are committed to managing our affairs consistent with the highest principles of business ethics and with the corporate governance requirements of both Nasdaq and applicable law. In keeping with these principles: - A majority of our Board members are independent of AvePoint and its management; - All members of our three Board committees—the Audit Committee, the Compensation Committee, and the Nominating and Governance Committee—are independent of AvePoint and its management; - We have a transparent and publicly available Code of Ethics and Business Conduct that outlines our corporate policies to which all employees, officers and directors must adhere; - We have a corporate compliance training program which requires and monitors trainings given on an annual basis; and - The charters of our Board committees clearly establish their respective roles and responsibilities. #### Management of Corporate Governance Resources In 2025, we continued taking significant steps to reinforce our commitment to corporate governance and ethical practices, aligning with our strategic priorities. We completed our yearly review of all corporate governance policies, seeking to ensure they are in line with current industry standards, regulatory requirements and our values, and address emerging issues. Our extensive list of corporate policies is publicly available on our website at the following web address, https://www.avepoint.com/ir/governance/governance-documents. We strive to continue to demonstrate transparency and accountability, fostering trust and confidence among investors, customers, and the broader community. Our ongoing initiatives in 2025 underscored our commitment to robust corporate governance, ethical business practices, and employee empowerment. As a result of our continued process improvements, we again received an ESG Prime Label from Institutional Shareholder Services (ISS), meaning our common stock will qualify for responsible investment based on our improved score on their ESG Corporate Rating Report. By proactively reviewing, updating, and communicating our policies, we demonstrated our dedication to transparency, accountability, and responsible stewardship in pursuit of its strategic objectives. #### Earning the World’s Trust As a global company which is responsible to employees, stockholders, and customers, our vision for AvePoint is to build an environment in which we earn trust and confidence every day through enabling collaboration and innovation through our commitment to privacy, security, and transparency. #### Commitment to powering proactive data security programs We understand the importance of security and operational risk management and are committed to providing organizations with relevant metrics which help them make decisions that are proactive rather than reactive. When done in conjunction with policies, education and measurement, organizations can balance collaboration and transparency with data protection and privacy. We seek to earn trust not just with robust security and privacy practices, but with the way we operate and organize our business. #### Aligning to clear privacy principles We have a policy of transparency regarding our data collection, use, retention and sharing practices. It is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk. We use this foundation and discipline to develop market-leading privacy and security products and deliver world class customer service. Our software, processes and services have obtained industry-leading security and privacy certifications. We have obtained three ISO certifications that attest to our compliance with the highest standards of information security and privacy. These certifications are based on the ISO 27001, ISO 27017, and ISO 27701 standards, which cover the requirements for an information security management system (ISMS), cloud security, and privacy information management system (PIMS), respectively. Further attestations include SOC 2 Type II, compliance with HITRUST CSF v11.0.1., Information Security Registered Assessors (IRAP) Program, FedRAMP, and more. Our achievement of these certifications and attestations showcases our dedication to protecting personal data and complying with privacy regulations. This certification solidifies our position as a trusted partner for organizations seeking robust privacy information management systems. By adopting ISO standards, we empower businesses to navigate privacy requirements across jurisdictions effectively, ensuring the security of sensitive information and fostering trust in the digital realm. We also seek to align our supply chain to similar standards of privacy and security. To that end, we have implemented a rigorous program to assess the privacy and security policies and procedures of our own vendors and suppliers so that our stakeholders receive a consistent approach to privacy and security matters. #### Advancing cybersecurity Cybersecurity is a central challenge for companies around the world as they continue on the digital transformation. Ransomware attacks have become one of the top security threats for organizations, especially as increased collaboration can lead to more vulnerabilities. The cost to recover stolen data can be millions of dollars, in addition to substantial reputational damage. AvePoint Ransomware Detection, and its Ransomware Warranty for MSPs, which primarily serves small business clients, gives assurance that companies will be protected. #### Strengthening our offerings by first strengthening ourselves We have built a resilient, scalable and secure IT environment by investing in complementary industry leading technology and security solutions, in addition to utilizing our own software platform. In addition, we have built a corporate culture in which privacy and security are enablers of productivity, collaboration and trust; we balance the free flow of information with the risk of inappropriate access and/or disclosure; and we implement a risk-based approach to privacy and security that will allow us to maintain not only legal and regulatory compliance in the jurisdictions in which we operate, but also to facilitate business and innovation at AvePoint. #### Commitment to accessibility for all We understand that technology is an enabler so long as it is accessible and available to persons with varying abilities or personal preferences. AvePoint is committed to developing accessible technology as we value diverse experiences, backgrounds and perspectives among our employees, and across our customers and partners, and see them as a competitive advantage. ### Compliance with Material Government Regulations We are subject to many U.S. federal and state and foreign laws and regulations that involve matters central to our business, including laws and regulations that involve data privacy and data protection, intellectual property, advertising, marketing, health and safety, competition, consumer protection, taxation, anti-bribery, anti-money laundering and corruption, economic or other trade prohibitions or sanctions, environmental protection regulations, and securities law compliance. Our business may also be affected by the adoption of any new or existing laws or regulations or changes in laws or regulations that adversely affect our business. Many relevant laws and regulations are still evolving and may be interpreted, applied, created or amended in a manner that could harm our business, and new laws and regulations may be enacted, including in connection with the restriction or prohibition of certain content or business activities. We are subject to certain U.S. federal, state, local and foreign laws and regulations regarding data privacy and the collection, storage, sharing, use, processing, disclosure and protection of personal information and other data from users, employees or business partners, including the GDPR, the California Consumer Privacy Act, and the Virginia Consumer Data Protection Act. These laws expand the rights of individuals to control how their personal data is processed, collected, used and shared, create new regulatory and operational requirements for processing personal data, increase requirements for security and confidentiality and provide for significant penalties for non-compliance. There are also a number of legislative proposals recently enacted or pending before the U.S. Congress, various state legislatures and foreign governments concerning content regulation and data protection that could affect us. These and other laws and regulations that may be enacted, or new interpretation of existing laws and regulations, may require us to modify our data processing practices and policies and to incur substantial costs in order to comply. In addition, we are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “***FCPA”***). The FCPA prohibits corporations and individuals from engaging in improper activities to obtain or retain business or to influence a person working in an official capacity. It prohibits, among other things, providing, directly or indirectly, anything of value to any foreign government official, or any political party or official thereof, or candidate for political influence to improperly influence such person. Similar laws exist in other countries, such as the UK, that restrict improper payments to persons in the public or private sector. Many countries have laws prohibiting these types of payments within the respective country. Historically, technology companies have been the target of FCPA and other anti-corruption investigations and penalties. We are further subject to U.S. and foreign laws and regulations that restrict our activities in certain countries and with certain persons. These include the economic sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control and the export control laws administered by the U.S. Commerce Department’s Bureau of Industry. The foregoing description does not include an exhaustive list of the laws and regulations governing or impacting our business. See the discussion contained in the “*Risk Factors”* section (Part I, Item 1A of this Annual Report) for information regarding how actions by regulatory authorities or changes in legislation and regulation in the jurisdictions in which we operate may have a material adverse effect on our business. ### Information About Our Executive Officers | Name | Age | Position | | --- | ---: | --- | | **Xunkai Gong** | 63 | Executive Chairman and Director | | **Tianyi Jiang** | 51 | Chief Executive Officer and Director | | **Brian Michael Brown** | 53 | Chief Legal and Compliance Officer, Secretary, and Director | | **James Caci** | 61 | Chief Financial Officer | ***Xunkai Gong*** was appointed as our Executive Chairman and a director in July of 2021, and previously served as our predecessor company’s Chairman and Co-Chief Executive Officer alongside Dr. Jiang from 2008 to 2021, Chief Executive Officer from 2001 to 2008 and director from 2001 to 2021. Mr. Gong holds a master’s degree in computer engineering from the University of the Chinese Academy of Sciences, a master’s degree in computer science from Southern University and Agricultural and Mechanical College at Baton Rouge, and a bachelor’s degree in electrical and electronics engineering from Dalian University of Technology. ***Tianyi Jiang*** was appointed as our Chief Executive Officer and a director in July of 2021, and previously served as our predecessor company’s Co-Chief Executive Officer alongside Mr. Gong from 2008 to 2021 and director from 2005 to 2021. Dr. Jiang holds a doctorate and a master’s degree in data mining from New York University, in addition to a bachelor’s degree and a master’s degree in electrical and computer engineering from Cornell University. ***Brian Michael Brown*** was appointed as our Chief Legal and Compliance Officer, Secretary of the Board and a director in July of 2021, and previously served as our predecessor company’s General Counsel and Chief Operating Officer from 2004 to 2021 and director from 2008 to 2021. Mr. Brown holds a bachelor’s degree from the University of Michigan and a Juris Doctor from Michigan State University. ***James Caci*** was appointed as our Chief Financial Officer in August of 2021 and previously served as our predecessor company’s Chief Financial Officer from 2010 to 2013. From April 2020 to August of 2021, Mr. Caci held the position of Chief Financial Officer at Brand Value Accelerator, LLC, an industry leading digital commerce services firm. From March 2016 to April 2020, Mr. Caci served as the Chief Financial Officer of Nicopure Labs. Mr. Caci brings more than 25 years of experience leading the strategic finance operations at both public and privately held SaaS and IT service companies. Mr. Caci holds a bachelor’s degree from Montclair State University and is a certified public accountant. Additional information regarding our executive officers is set forth in the Proxy Statement to be filed in connection with our 2026 Annual Meeting of Stockholders within 120 days of the end of the fiscal year ended December 31, 2025. ### Corporate Information Our principal executive offices are located at 525 Washington Blvd, Suite 1400, Jersey City, NJ 07310, and our telephone number is (201) 793-1111. Our principal operating offices are located at Riverfront Plaza, West Tower, 901 E Byrd St, Suite 900, Richmond, VA 23219, and our telephone number for that office is (804) 372-8080. All correspondence should be directed to our principal operating offices in Richmond, Virginia. ### Available Information Our Internet address is https://www.avepoint.com/. At our Investor Relations website, https://www.avepoint.com/ir, we provide, and make available free of charge, a variety of information for investors, including, but not limited to: - Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and any amendments to those reports, as soon as reasonably practicable after we electronically file that material with or furnish it to the SEC at www.sec.gov. - Announcements of investor conferences, speeches, presentations, and events at which our executives discuss our products, services, competitive strategies, and other aspects of our business. - Press releases on quarterly results, product and service announcements, legal developments, and national and international news. - Corporate governance information including our articles of incorporation, bylaws, governance guidelines, committee charters, code of ethics and business conduct, whistleblower “open door” policy for reporting accounting and legal allegations, global corporate social responsibility initiatives, and other governance-related policies. - Other news and announcements that we may post from time to time that investors might find useful or interesting, including news with respect to our business strategies, financial results, and metrics for investors. In addition to these channels, we use social media to communicate to the public. It is possible that the information we post on social media could be deemed to be material to investors. We encourage investors, the media, and others interested in AvePoint to review the information we post on the social media channels listed on our Investor Relations website. The information found on our main website or our Investor Relations website is not part of this or any other report we file with, or furnish to, the SEC, for the purposes of Section 18 of the Exchange Act or otherwise subject to the liabilities of that section, nor shall it be deemed incorporated by reference in any filing under the Securities Act except as shall be expressly set forth by specific reference in such filing, and you should not consider any information contained on, or that can be accessed through, our website as part of this Annual Report or in deciding whether to purchase our common stock. ## Risk factors As filed, 37,587 characters. - Potential changes in trade relations arising from policy initiatives implemented by the current administration or by a successor administration; - Compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations; - Unexpected changes in laws, regulatory requirements, taxes, or trade laws; - More stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, particularly in Europe, including the GDPR, the EU Data Act, and the EU AI Act; - Differing labor regulations, especially in Europe, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations; - Challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs; - Difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems, and regulatory systems; - Increased travel, real estate, infrastructure, and legal compliance costs associated with international operations; - Currency exchange rate fluctuations and the resulting effect on revenue and expenses, and the cost and risk of entering into hedging transactions if we elect to do so in the future; - Limitations on the ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries; - Laws and business practices favoring local competitors or general preferences for local vendors; - Limited or insufficient intellectual property protection or difficulties enforcing our intellectual property; - Political instability or terrorist activities; - Exposure to liabilities under anti-corruption and anti-money laundering laws, including the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the UK Bribery Act of 2010, the UK Proceeds of Crime Act 2002, and similar laws and regulations in other jurisdictions; - Compliance with laws and regulations for foreign operations, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on the ability to sell our software in certain foreign markets, and the risks and costs of non-compliance; - Heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements; and - Adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash. In addition, certain of our customers or resellers may operate in, or have dealings with, countries subject to sanctions or embargos imposed by the U.S. government, foreign governments, or the United Nations or other international organizations. These sanctions or embargos may result from the multiple ongoing conflicts where the outcomes and consequences are not possible to predict, but could include regional instability and geopolitical shifts, and could materially adversely affect global trade, currency exchange rates, regional economies and the global economy. These conflicts and any actions taken in response could increase our costs, disrupt our supply chain, reduce our sales and earnings, impair our ability to raise additional capital when needed on acceptable terms, if at all, or otherwise adversely affect our business, financial condition, and results of operations. These conflicts and any actions taken in response could also result in the aforementioned impacts on the business of our customers, resellers or any other service providers on which we rely. Any of these risks could harm our international operations, reduce our revenue from outside the United States or increase our operating costs, harming our business, results of operations and financial condition and growth prospects. There can be no assurance that all of our employees, independent contractors and partners will comply with the formal policies we will implement, or applicable laws and regulations. Violations of laws or key control policies by employees, independent contractors and partners could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our software and services and could harm our business and results of operations. If we invest substantial time and resources to expand our international operations and is unable to do so successfully, our business and operating results will suffer. ***We are exposed to fluctuations in currency exchange rates, which could negatively affect our revenue and earnings.*** We conduct a significant number of transactions and hold cash in currencies other than the U.S. Dollar. Changes in the values of major foreign currencies relative to the U.S. Dollar may significantly affect our total assets, revenue, operating results and cash flows, which are reported in U.S. Dollars. ***We may acquire or invest in companies, which may divert management’s attention and result in additional dilution to stockholders. We may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions.*** We may evaluate and consider potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, products, and other assets in the future. An acquisition, investment or business relationship may result in unforeseen operating difficulties and expenditures. In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products, personnel, or operations of the acquired companies. Key personnel of the acquired companies may choose not to work for us, their software may not be easily adapted, or we may have difficulty retaining the customers of any acquired business due to changes in ownership, management, or otherwise. Acquisitions may also disrupt our business, divert our resources and require significant management attention that would otherwise be available for the development of our existing business. The anticipated benefits of any acquisition, investment, or business relationship may not be realized or we may be exposed to unknown risks or liabilities. ***We intend to continue investing in research and development, and to the extent such research and development investments do not translate into new products or material enhancements to our products, or if we do not use those investments efficiently, our business and results of operations would be harmed.*** A key element of our strategy will be to invest significantly in our research and development efforts to develop new products and enhance our existing products to address additional applications and markets. If we do not spend our research and development budget efficiently or effectively on compelling innovation and technologies, our business may be harmed and we may not realize the expected benefits of our strategy. Moreover, research and development projects can be technically challenging and expensive. The nature of these research and development cycles may cause us to experience delays between the time we incur expenses associated with research and development and the time we are able to offer compelling products and generate revenue, if any, from such investment. Additionally, anticipated customer demand for a product or service being developed could decrease after the development cycle has commenced, and we would nonetheless be unable to avoid substantial costs associated with the development of any such product or service. If we expend a significant amount of resources on research and development and our efforts do not lead to the successful introduction or improvement of products that are competitive in our current or future markets, it would harm our business and results of operations. ***If our products and services fail to perform properly, or if we fail to develop enhancements to resolve performance issues, we could lose customers, become subject to performance or warranty claims, or incur significant costs.*** Our operations will be dependent upon our ability to prevent system interruption. The applications underlying our products and services are inherently complex and may contain material defects or errors, which may cause disruptions in availability or other performance problems. Also, our software will be installed and used in a variety of computing environments with different operating system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed. In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software. While we have not historically experienced any defects, errors, disruptions in service, cyber-attacks, or other performance problems with our software that materially influenced our sales performance, there is no assurance that such defects, problems or events will not occur in the future, whether in connection with the day-to-day operation, upgrades or otherwise. Any of these occurrences could result in loss of customers, lost or delayed market acceptance and sales of our products and services, delays in payment by customers, injury to our reputation and brand, legal claims, including warranty and service claims, diversion of resources, including through increased service and warranty expenses or financial concessions, and increased insurance costs. We may discover defects in our products and services that could result in data unavailability, unauthorized access, loss, corruption, or other harm to our customers’ data. Despite testing we may not be able to detect and correct defects or errors before release. Consequently, we or our customers may discover defects or errors after our products and services have been deployed. We expect to implement bug fixes and upgrades as part of our regularly scheduled system maintenance. If we do not complete this maintenance according to schedule or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, customers could terminate their contracts, delay or withhold payment, or cause us to issue credits, make refunds, or pay penalties. The costs incurred or delays resulting from the correction of defects or errors in our software or other performance problems may be substantial and could harm our operating results. Moreover, customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand. Any of these real or perceived errors, compatibility issues, failures or bugs in our software could result in negative publicity, reputational harm, loss of or delay in market acceptance, loss of competitive position or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. ### Risks Related to our Common Stock ***Transfer between our common stock traded on the SGX-ST and our common stock traded on Nasdaq may adversely affect the liquidity and/or trading price of each other and price variations may occur between these two markets.*** Our common stock is currently traded on Nasdaq and the Main Board of Singapore Exchange Securities Trading Limited (the “**SGX-ST”**). Subject to compliance with U.S. securities laws and procedures of The Central Depository (Pte) Limited (“**CDP”**) holders of our common stock may use CDP’s procedures for cross border securities transfers via The Depository Trust Company to transfer common stock traded on the SGX-ST to Nasdaq. Any holder of common stock traded on Nasdaq may also transfer such interests for trading on the SGX-ST. In the event that a substantial number of shares of common stock are exchanged between these markets, the liquidity and trading price of our common stock on the SGX-ST and common stock on Nasdaq may be adversely affected. Additionally, trading in our common stock on these markets will be made in different currencies and take place at different times (resulting from different time zones, different trading days and different public holidays in the United States and Singapore). The trading prices of our common stock on these two markets may differ due to these and other factors. Any decrease in the price of our common stock on one of these markets could cause a decrease in the trading price of our common stock on the other market. On the other hand, investors could also seek to sell or buy our common stock to take advantage of any price differences between the markets through a practice referred to as arbitrage. Any arbitrage activity could create unexpected volatility in the trading price of our common stock. ***The time required for the transfer between our common stock traded on the SGX-ST and our common stock traded on Nasdaq might be longer than expected and investors might not be able to settle or effect any sale of their securities during this period, and the transfer involves costs.*** There is no direct trading or settlement between Nasdaq and the SGX-ST. CDP both acts as central depositary for the SGX-ST and is a DTC participant and facilitates settlement between the two markets via its procedures for cross border securities transfers via DTC. In addition, the time differences between Singapore and New York, unforeseen market circumstances, temporary closure of the facilities offered by CDP for cross border securities transfers via DTC, the procedures of a stockholder’s brokers in Singapore and/or the United States, or other factors may delay the transfer of common stock from trading on the SGX-ST to Nasdaq (and vice versa). Investors will be prevented from settling or effecting the sale of their securities during such periods of delay. In addition, there is no assurance that any transfer of common stock from trading on the SGX-ST to Nasdaq (and vice versa) will be completed in accordance with the timelines that stockholders may anticipate. Furthermore, CDP and other DTC participants are entitled to charge holders fees for cross border securities transfers via DTC. Brokers in Singapore and/or the United States may charge additional fees. As a result, stockholders who transfer common stock from the SGX-ST to Nasdaq (and vice versa) may not achieve the anticipated level of economic return. ### Risks Related to Data Privacy and Cybersecurity ***To the extent our security measures are compromised, our products and services may be perceived as not being secure. This may result in customers curtailing or ceasing their use of our products and services, our reputation being harmed, the incurrence of significant liabilities, and harm to our results of operations and growth prospects.*** Our operations may, in some cases, involve the storage, transmission, and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer “hackers,” malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks. Sophisticated nation-states and nation-state supported actors now engage in such attacks, including advanced persistent threat intrusions. The growth in state sponsored cyber activity showcases the increasing sophistication of cyber threats and could dramatically expand the global threat landscape. While no single company can thwart a nation state attack, we work to implement and continuously improve security-aware software development, operational management, and threat-mitigation practices that are essential to the strong protection of services and data. AvePoint has experience spanning multiple decades of building enterprise software and running online services around the world. We implement a robust defense-in-depth security strategy based on the principle of “assume breach.” We work to continuously strengthen threat detection, response, and defense, conduct continuous security monitoring, and practice security incident response to validate and improve the security of our software and services. Rigorous third-party audits verify that we adhere to strict security controls such as the ones contained in the ISO/IEC 27001 standard mandate. We are audited once a year for ISO/IEC 27001, 27017 and 27701 compliance by a third-party accredited certification body, which provides independent validation that security controls are in place and operating effectively. We have security measures in place designed to protect us and our customers’ confidential and sensitive information and prevent data loss, but such measures cannot provide absolute security and may not be effective to prevent a security breach, including as a result of employee error, theft, misuse or malfeasance, third-party actions, unintentional events or deliberate attacks by cyber criminals, any of which may result in someone obtaining unauthorized access to our customers’ data, our data, our intellectual property and/or other confidential or sensitive business information. Importantly, the scope of our internal information controls and security measures is limited to the scope of our information security management system (“**ISMS”**). All of the legal entities (and each of their respective employees) within our global corporate structure are contractually bound to the ISMS, but failure by any of our subsidiaries or affiliates (or employees thereof) to abide by the terms and conditions imposed by our ISMS could result in increased vulnerabilities, decreased integrity of our assets, and ultimately, liability, loss of business, and loss of customer confidence. The ISMS applies to the use of information, network resources, and electronic and computing devices to conduct business or interact with internal networks and business systems, whether owned or leased by us, our employees, or a third party. All employees, contractors, consultants, as well as our affiliates and subsidiaries are responsible for exercising good judgment regarding appropriate use of information, electronic devices, and network resources in accordance with the ISMS, as well as local laws and regulation. While we have policies and procedures to address global compliance with the ISMS, our employees and agents could violate these policies and applicable law, for which we may be ultimately held responsible. We are taking further steps to assess globally managed departmental systems to ensure ISMS standards are maintained. Based on the results of that analysis, if, as, and when necessary, we will subsequently implement a remediation plan that will include tools, training, and education to ensure (A) repeatable procedures are being implemented that protect the confidentiality, availability, and integrity of assets from threats and vulnerabilities in accordance with the ISMS standards and protocols, and (B) that vulnerability testing is being performed, measured, and documented across our global operations landscape. Outside of the ISMS and the internal security measures and data protections we have developed (and continue to improve), third parties may attempt to fraudulently induce employees, contractors or users to disclose information, including user names and passwords, to gain access to our customers’ data, our data or other confidential or sensitive information, and we may be the target of email scams that attempt to acquire personal information or our assets. Because techniques used to sabotage or obtain unauthorized access to systems change frequently and generally are not recognized until successfully launched against a target, we may be unable to anticipate these techniques, react in a timely manner or implement adequate preventative measures. We devote significant financial and personnel resources to implement and maintain security measures; however, such resources may not be sufficient, and as cybersecurity threats develop, evolve and grow more complex over time, it may be necessary to make significant further investments to protect our data and infrastructure. If our security measures are compromised as a result of third-party action, employee or customer error, malfeasance, stolen or fraudulently obtained log-in credentials, or otherwise, our reputation and business could be damaged and we could incur significant liability. As we rely on third-party and public-cloud infrastructure, it depends in part on third-party security measures to protect against unauthorized access, cyberattacks, and the mishandling of customer data. A cybersecurity event could have significant costs, including regulatory enforcement actions, litigation, litigation indemnity obligations, remediation costs, network downtime, increases in insurance premiums, and reputational damage. These risks, as well as the number and frequency of cybersecurity events globally, may also be heightened during times of geopolitical tension or instability between countries. ***We store confidential company information and sensitive data, including personal information of our customers and employees, which may in turn contain third-party personal or other confidential information. If the security of this information is compromised or is otherwise accessed without authorization, our reputation may be harmed, and we may be exposed to liability and loss of business.*** We may in some cases transmit or store personal and other confidential information of our partners, customers, and third parties (e.g. if the customer uses our products to create backups of their information) on storage space owned or provided by us. While we have in the past taken, and intend to take, steps to protect personal information and other confidential information that we have access to, including information we may obtain through our customer support services or customer usage of our products, we will not proactively monitor (or may not even be able to access) the content that our customers upload or process otherwise or the information provided to us through the use of our products and services. Therefore, we will not control the substance of the content on our storage space owned or provided by us, which may include personal or other confidential information. We will also use third-party service providers and sub-processors to help us deliver services to our customers. Such service providers and sub-processors may store personal information and/or other confidential information. Such information may be the target of unauthorized access or subject to security breaches as a result of third-party action, exploitation of artificial intelligence, employee error, malfeasance or otherwise. Any of these could result in the loss of information, litigation, indemnity obligations, damage to our reputation and other liability or harm our business, financial condition, and results of operations. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. Even if such a data breach did not arise out of our action or inaction, or if it were to affect one or more of our competitors or customers’ competitors, rather than us, the resulting concern could negatively affect our customers and our business. Concerns regarding data privacy and security may cause some customers to stop using our products and services and fail to renew their subscriptions. In addition, failures to meet our customers’ expectations with respect to security and confidentiality of their data and information could damage our reputation and affect our ability to retain customers, attract new customers, and grow our business. Our potential failure to comply with legal or contractual requirements around the security of personal information could lead to significant fines and penalties, as well as claims by customers, affected data subjects, or other stakeholders. These proceedings or violations could force us to spend money in defense or settlement of these proceedings, result in the imposition of monetary liability or injunctive relief, divert management’s time and attention, increase our costs of doing business, and harm our reputation and the demand for our platform. If credit card information is stored in our systems or transmitted, stored or otherwise processed via our products and services and our security measures fail to protect credit card information adequately, we could be liable to our partners, the payment card associations, our customers or affected credit card holders. We could be subject to fines and face regulatory or other legal action, and our customers could end their relationships with us. The limitations of liability in our contracts may not be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. Insurers could deny coverage as to any future claim. We seek to cap the liability to which we are exposed in the event of losses or harm to our customers, including those resulting from security incidents, but we cannot be certain that we will obtain these caps or that these caps, if obtained, will be enforced in all instances. The successful assertion of one or more large claims against us, or changes in insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our business, financial condition, and results of operations. Furthermore, the cybersecurity insurance we maintain may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover our remediation expenses or any claim against us for loss of data or other indirect or consequential damages. Defending any suit based on or related to any data loss or system disruption, regardless of its merit and available insurance coverage, could be costly and divert management’s attention. We will also be subject to federal, state, and foreign laws regarding cybersecurity and the protection of data. Many jurisdictions have enacted laws requiring companies to notify individuals of security breaches involving certain types of personal information. Our agreements with certain customers and partners will require us to notify them of certain security incidents. Some jurisdictions and customers require us to safeguard personal information or confidential information using specific measures. If we fail to observe these requirements, our business, operating results, and financial condition could be harmed. ***Successful cyberattacks or data breaches at other technology companies, service providers, retailers, and other participants within our industry, whether or not we are impacted, could lead to a general loss of customer confidence that could negatively affect us, including harming the market perception of the effectiveness of our security measures, which could result in reduced use of our products and services.*** Our industry is prone to cyber-attacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our and our counterparts’ within the industry respective ability to provide service. Our products and services (and those of our partners and competitors within the industry) involve the collection, storage, processing, and transmission of a large amount of data. Any failure by those institutions and participants in our industry to prevent or mitigate security breaches and improper access to or disclosure of data or user data, including personal information, content, or payment information from users, or information from marketers, could result in the loss, modification, disclosure, destruction, or other misuse of such data, which could indirectly harm our business and reputation and diminish our competitive position within the market generally. In addition, computer malware, viruses, social engineering (such as spear phishing attacks), scraping, and general hacking continue to be prevalent in our industry, and while we anticipate that such events may occur on our systems in the future, the impact on those within our industry has already adversely impacted the market’s perception of the effectiveness of our and our partners’ security measures and countermeasures. Such breaches and attacks on our counterparts within the industry and within our market may cause, among other things, interruptions to the provision of service, degradation of the user experience, the loss of user confidence and trust in our products, or result in financial harm to us. ### Risks Related to Intellectual Property ***We will rely on third-party proprietary and open source software for our products and services. The inability to obtain third-party licenses for such software, obtain them on favorable terms, or adhere to the license terms for such software or any errors or failures caused by such software could harm our business, results of operations and financial condition.*** Some of our offerings will include software or other intellectual property licensed from third parties. It may be necessary in the future to renew licenses relating to various aspects of these applications or to seek new licenses for existing or new applications. Necessary licenses may not be available on acceptable terms or under open source licenses permitting redistribution in commercial offerings, if at all. The inability to obtain certain licenses or other rights or to obtain such licenses or rights on favorable terms could result in delays in product releases until equivalent technology can be identified, licensed or developed, if at all, and integrated into our products and services, which could harm our business, results of operations and financial condition. Third parties may allege that additional licenses are required for our use of their software or intellectual property, which it may be unable to obtain on commercially reasonable terms or at all. The inclusion in our offerings of software or other intellectual property licensed from third parties on a non-exclusive basis could limit our ability to differentiate our offerings from those of our competitors. Failure to properly adhere to the license terms for software or other intellectual property might have negative effects, such as revocation of the license grant, penalties, added license fees or other liabilities. To the extent that our products and services depend upon the successful operation of third-party software, any undetected errors or defects in such third-party software could impair the functionality of our products and services, delay new feature introductions, result in a failure of products and services, and injure our reputation. A significant portion of our products will incorporate open source software, and we expect to incorporate open-source software into other offerings or products in the future. Such open source software is generally licensed by its authors or other third parties under open-source licenses. Little legal precedent governs the interpretation of these licenses; therefore, the potential impact of these terms on our business is unknown and may result in unanticipated obligations regarding our technologies. If a distributor of open source software were to allege that we had not complied with our license, we could be required to incur significant legal expenses. In addition, if the license terms for the open source code change we may be forced to re-engineer our software or incur additional costs. If we combine our proprietary software with open source software or utilizes open-source software in a certain manner, under some open source licenses, we could be in breach of the license if we did not release the source code of our proprietary software. Releasing the source code could substantially help competitors develop products that are similar to or better than ours and could help malevolent actors detect security weaknesses to develop and deploy attacks, including malware, against our products and systems. ***If we are unable to protect our intellectual property, the value of our brands and other intangible assets may be diminished, and our business may be adversely affected.*** We rely and expect to continue to rely on a combination of confidentiality, assignment, and license agreements with our employees, consultants, and third parties with whom we have relationships, as well as trademark, copyright, patent, trade secret, and domain name protection laws, to protect our proprietary rights. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge proprietary rights held by us, and pending and future trademark and patent applications may not be approved. In addition, effective intellectual property protection may not be available in every country in which we operate or intend to operate our business. In any or all of these cases, we may be required to expend significant time and expense in order to prevent infringement or to enforce our rights. Although we have generally taken measures to protect our proprietary rights, there can be no assurance that others will not offer products or concepts that are substantially similar to ours and compete with our business. ### Risks Related to Financial Reporting ***As a public company, we are obligated to develop and maintain proper and effective internal control over financial reporting in order to comply with Section 404 of the Sarbanes-Oxley Act. We may not complete our analysis of our internal control over financial reporting in a timely manner, these internal controls may not be determined to be effective, and our independent registered public accounting firm may issue an adverse opinion, which may adversely affect investor confidence in us and, as a result, the value of our common stock.*** Our management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP. We aim to comply with and perform the evaluations needed to comply with Section 404 of the Sarbanes-Oxley Act (“***SOX”***). We may need to undertake various additional costly and time-consuming actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff, which may adversely affect our business, financial condition, and results of operations. We may not be able to complete our evaluation, testing and any required remediation in a timely manner. If we are unable to assert that our internal control over financial reporting is effective and our independent registered public accounting firm is unable to attest to management’s assessment of the effectiveness of our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, which would cause the price of our common stock to decline, and we may be subject to investigation or sanctions by the SEC. We are required, pursuant to Section 404 of SOX, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting as of December 31, 2025. This assessment is required to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting, including any existing material weakness, if not remediated. We are also required to disclose changes made in our internal control and procedures on a quarterly basis. In addition, our independent auditor is required to attest to management’s assessment of the effectiveness of our internal control over financial reporting. Additionally, the existence of any material weakness, or any significant deficiency requires management to devote significant time and incur significant expense to remediate any such material weaknesses or significant deficiencies and management may not be able to remediate any such material weaknesses or significant deficiencies in a timely manner. The existence of any material weakness in our internal control over financial reporting could also result in errors in our financial statements that could require us to restate our financial statements, cause us to fail to meet our reporting obligations and cause stockholders to lose confidence in our reported financial information, all of which could materially and adversely affect our business and stock price. ### Items 1B and 1C ## Cybersecurity As filed, 10,410 characters. At AvePoint, cybersecurity risk management is an important part of our overall risk management efforts. We have a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk. Our operations *may,* in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer “hackers,” malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although we believe them to have been immaterial, there can be *no* guarantee that in the future such cyberattacks will *not* be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are *not* fully mitigated, and we continuously work to enhance our information security program and risk management efforts. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, *first*- and *third*-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage *third*-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, *third*-party privacy assessor. We have certified against, and demonstrated conformance to, the latest International Organization for Standardization’s (“***ISO”***) information security management system audit using the *27001:2022, 27701:2019,* and *27017:2015* frameworks. Successfully achieving these *three* certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our *three* ISO certifications add to the Company’s overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC *2* Type II, compliance with HITRUST CSF *v11.0.1.,* CSA STAR, IRAP, FedRAMP, and ISMAP. Our privacy and security program dictates a governance structure whereby we: - Regularly engage senior management on data privacy and security issues; - Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; - Train each of our employees on all privacy and security expectations; - Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; - Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint; - Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; - Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; - Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as *third* parties who provide services on our behalf, to treat customer information and data with care; - Complete several cyber-specific audits per year; and - Engage consultants and other *third* parties in connection with our cybersecurity practices. Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees. In addition, we maintain specific policies and practices governing our *third*-party security risks, including our *third*-party risk assessment (“***TPRA”***) process. Under our TPRA process, we gather information from certain *third* parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require *third* parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that *may* impact our data. Our Chief Risk, Privacy and Information Security Officer (“CISO”) leads the Company’s privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine. including being featured in the "CSO Hall of Fame". In addition, our CISO oversees teams across the Company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the Company’s senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the Company’s privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies. **Disclosure of the Board’s Roles and Responsibilities** Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. ### Nominating and Corporate Governance Committee Our Nominating and Corporate Governance Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CISO and Chief Compliance Officer, among other executives, provide periodic reports to our Nominating and Corporate Governance Committee and also meet with our Nominating and Corporate Governance Committee to discuss any material events when they arise. The periodic reports are designed to keep our Nominating and Corporate Governance Committee abreast of the Company’s cybersecurity practices, as well as risks and trends in cybersecurity threats. Our Nominating and Corporate Governance Committee also has discussions with management focused on evaluating our exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable our Nominating and Corporate Governance Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to our Nominating and Corporate Governance Committee typically include information on any incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. Our Nominating and Corporate Governance Committee seeks these updates to facilitate proactive governance and to address emerging cybersecurity issues with management. In 2025, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K. ### Items 2, 3, and 4 ## Properties As filed, 1,394 characters. We and our subsidiaries are obligated under various non-cancelable operating leases for office space and other facilities. The initial terms of the leases expire on various dates through 2030. As of December 31, 2025, we had 296,677 square feet of leased office space across the United States, Australia, Canada, China, France, Germany, Japan, Netherlands, the Philippines, Singapore, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, Vietnam and Malaysia. The table below shows a summary of the square footage of our office and other facilities owned and leased domestically and internationally as of December 31, 2025: *(Square feet in thousands)* | Location | Owned | Leased | Total | | --- | ---: | ---: | ---: | | U.S. | — | 43.1 | 43.1 | | International | — | 253.6 | 253.6 | | Total | — | 296.7 | 296.7 | ### Our Principal Offices Our principal executive offices are located in Jersey City, New Jersey, United States, and consist of 15,467 square feet under a lease that expires in 2030. Our principal operating offices are located in Richmond, Virginia, United States, and consist of 11,965 square feet under a lease that expires in 2027. ### Additional Space We believe that our current facilities are adequate to meet our needs for the immediate future and that suitable additional space will be available to accommodate any expansion of our operations as needed. ## Legal proceedings As filed, 389 characters. In the normal course of business, we may be involved in various claims, negotiations, and legal actions. Except for such claims that arise in the normal course of business, as of and for the fiscal quarter and the fiscal year ended December 31, 2025, we are not a party to any material asserted, ongoing, threatened, or pending claims, suits, assessments, proceedings, or other litigation. ## Management's discussion and analysis As filed, 33,740 characters. | | | | --- | --- | | Gross Profit and Gross Margin | Gross profit is revenue less cost of revenue, and gross margin is gross profit as a percentage of revenue. Gross profit has been and will continue to be affected by various factors, including the mix of our revenue, the costs associated with third-party cloud-based hosting services for our cloud-based subscriptions, and the extent to which we expand our customer support and services organizations. We expect that our gross margin will fluctuate from period to period depending on the interplay of these various factors; however, we anticipate that it will increase over the long term as we expect SaaS revenue will continue to increase as a percentage of total revenue. | | Sales and Marketing | Sales and marketing expenses consist primarily of personnel-related expenses for sales, marketing and customer success personnel, stock-based compensation expense, sales commissions, marketing programs, travel-related expenses, overhead costs, depreciation and amortization. We focus our sales and marketing efforts on creating sales leads and establishing and promoting our brand. Incremental sales commissions for new customer contracts are deferred and amortized ratably over the estimated period of our relationship with such customers. We plan to continue our investment in sales and marketing by hiring additional sales and marketing personnel, executing our go-to-market strategy globally, and building our brand awareness. | | General and Administrative | General and administrative expenses consist primarily of personnel-related expenses for finance, legal and compliance, human resources, and IT personnel, as well as stock-based compensation expense, external professional services, overhead costs, other administrative functions, depreciation and amortization. | | Research and Development | Research and development expenses consist primarily of personnel-related expenses incurred for our engineering and product and design teams, as well as stock-based compensation expense, overhead costs, depreciation and amortization. We have a geographically dispersed research and development presence in the United States, China, Singapore and Vietnam. We believe this provides a strategic advantage, allowing us to invest efficiently in both new product development and increasing our existing product capabilities. We believe delivering expanding product functionality is critical to enhancing the success of existing customers while new product development further reinforces our breadth of software solutions. | | Other Income (Expense), net | Other income (expense), net consists primarily of interest income and realized gains and losses for securities, foreign currency remeasurement gains and losses, and fair value adjustments on earn-out and warrant liabilities. | | Income Taxes | We are subject to income taxes in the U.S. (federal and state) and numerous foreign jurisdictions. Tax laws, regulations, administrative practices, principles, and interpretations in various jurisdictions may be subject to significant change, with or without notice, due to economic, political, and other conditions. The foreign jurisdictions in which we operate have different statutory tax rates than those of the United States. Accordingly, our effective tax rate could be affected by the relative proportion of foreign to domestic income, use of foreign tax credits, changes in the valuation of our deferred tax assets and liabilities, applicability of any valuation allowances, and changes in tax laws in jurisdictions in which we operate. On July 4, 2025, the legislation known as the One Big Beautiful Bill Act (the "OBBBA"), was signed into law. The OBBBA includes various provisions, such as the permanent extension of certain expiring provisions of the Tax Cuts and Jobs Act, modifications to the international tax framework and the restoration of favorable tax treatment for certain business provisions. The OBBBA has multiple effective dates, with certain provisions effective in 2025 and others implemented through 2027. The Company has evaluated the provisions of the OBBBA and reflected the impact that is currently determinable in the consolidated financial statements. The Company continues to assess the full implications of the legislation. Any additional income tax effects will be recognized in the consolidated financial statements in the period in which the OBBBA is enacted into law or when additional authoritative guidance becomes available. | 42 ### Results of Operations The below period-to-period comparison of operating results are not necessarily indicative of results for future periods. ### Comparison of the Years Ended December 31, 2025 and December 31, 2024 #### Revenue The components of AvePoint’s revenue during the years ended December 31, 2025 and 2024 were as follows: *(in thousands, except percentages)* | Revenue: | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | SaaS | $319,167 | $230,667 | $88,500 | 38.4% | | Term license and support | 41,386 | 44,560 | (3,174) | (7.1)% | | Services | 53,839 | 44,036 | 9,803 | 22.3% | | Maintenance | 5,105 | 11,219 | (6,114) | (54.5)% | | Total revenue | $419,497 | $330,482 | $89,015 | 26.9% | Total revenue increased 26.9% to $419.5 million for the year ended December 31, 2025 , primarily due to an increase in SaaS revenue, which increased 38.4% to $319.2 million, and represented 76% of total revenue, up from 70% of total revenue in the prior year. Total revenue growth was also due to an increase in Services revenue, which grew 22.3% to $53.8 million. The increases in SaaS and Services revenue were, partially offset by an expected decrease in both term license and support and maintenance revenue. While SaaS revenue growth was again driven by consistently strong customer demand for our SaaS solutions, Services revenue is expected to fluctuate as the services generally are not recurring in nature. Additionally, maintenance revenue, which is tied to the sale of perpetual licenses, is expected to continue declining, as we no longer offer these products to new customers. Additionally, existing maintenance customers have and will continue to transition to SaaS and term licenses, which will further support the continued decline in maintenance revenue. Revenue by geographic area during the years ended December 31, 2025 and 2024 was as follows: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | North America | $164,808 | $135,870 | $28,938 | 21.3% | | EMEA | 134,312 | 99,256 | 35,056 | 35.3% | | APAC | 120,377 | 95,356 | 25,021 | 26.2% | | Total | $419,497 | $330,482 | $89,015 | 26.9% | For the year ended December 31, 2025, North America revenues increased 21.3% to $164.8 million, driven by a 34.7%, or $35.1 million, increase in SaaS revenue, partially offset by a $6.2 million combined net decrease in term license and support, services and maintenance revenue. EMEA revenues increased by 35.3% to $134.3 million, driven by a 43.1%, or $36.0 million, increase in SaaS revenue, partially offset by a $0.9 million combined net decrease in term license and support, services and maintenance revenue. APAC revenues increased 26.2% to $120.4 million, primarily driven by a 37.7%, or $17.4 million, increase in SaaS revenue, a 26.3%, or $9.3 million, increase in services revenue, and a $2.5 million increase in term license and support revenue, partially offset by a $4.2 million decrease in maintenance revenue. On a constant currency basis, EMEA revenues increased 29.7%, while EMEA SaaS revenues increased 37.0%. On a constant currency basis, APAC revenues increased 25.1%, while APAC SaaS revenues increased 37.5%. ### Non-GAAP Financial Measures In addition to our financial results determined in accordance with GAAP, we disclose non-GAAP cost of revenue, non-GAAP gross profit, non-GAAP gross margin, non-GAAP sales and marketing expense, non-GAAP general and administrative expense, non-GAAP research and development expense, non-GAAP operating income and non-GAAP operating margin. We believe these non-GAAP measures provide investors with additional insight into our operational performance and into trends affecting our business. Management uses these non-GAAP financial measures to understand and compare operating results across accounting periods, for internal budgeting and forecasting purposes, and to evaluate financial performance. Non-GAAP financial measures should not be considered as an alternative to operating income, operating margin or any other performance measures derived in accordance with GAAP as measures of performance. Non-GAAP financial measures should not be considered in isolation or as a substitute for analysis of our results as reported under GAAP. #### Cost of Revenue, Gross Profit, and Gross Margin Cost of revenue, gross profit, and gross margin during the years ended December 31, 2025 and 2024 were as follows: *(in thousands, except percentages)* | Cost of revenue: | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | SaaS | $57,302 | $41,544 | $15,758 | 37.9% | | Term license and support | 1,360 | 1,584 | (224) | (14.1)% | | Services | 49,764 | 38,757 | 11,007 | 28.4% | | Maintenance | 375 | 641 | (266) | (41.5)% | | Total cost of revenue | $108,801 | $82,526 | $26,275 | 31.8% | | Gross profit | 310,696 | 247,956 | 62,740 | 25.3% | | Gross margin | 74.1% | 75.0% | — | — | | GAAP cost of revenue | $108,801 | $82,526 | $26,275 | 31.8% | | Stock-based compensation expense | (1,512) | (1,315) | (197) | 15.0% | | Amortization of acquired intangible assets | (1,433) | (961) | (472) | 49.1% | | Non-GAAP cost of revenue | $105,856 | $80,250 | $25,606 | 31.9% | | Non-GAAP gross profit | 313,641 | 250,232 | 63,409 | 25.3% | | Non-GAAP gross margin | 74.8% | 75.7% | — | — | Cost of revenue increased 31.8% to $108.8 million for the year ended December 31, 2025, driven primarily by a $12.2 million increase in aggregated hosting costs resulting from increased SaaS revenue and a $11.0 million increase in personnel costs. #### Operating Expenses #### Sales and Marketing Sales and marketing expenses during the years ended December 31, 2025 and 2024 were as follows: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | Sales and marketing | $144,026 | $122,869 | $21,157 | 17.2% | | Percentage of revenue | 34.3% | 37.2% | — | — | | GAAP sales and marketing | $144,026 | $122,869 | $21,157 | 17.2% | | Stock-based compensation expense | (10,098) | (8,965) | (1,133) | 12.6% | | Amortization of acquired intangible assets | (532) | (459) | (73) | 15.9% | | Non-GAAP sales and marketing | $133,396 | $113,445 | $19,951 | 17.6% | | Non-GAAP percentage of revenue | 31.8% | 34.3% | — | — | Sales and marketing expenses increased 17.2% to $144.0 million for the year ended December 31, 2025, primarily driven by a $17.5 million increase in personnel costs, which included additional headcount and other investments in the business to respond to strong customer demand for our solutions and provide support for future growth. The continued decline in sales and marketing expenses as a percentage of revenue reflects the ongoing scaling of the Company’s channel strategy as well as consistent improvements in overall sales efficiency. #### General and Administrative General and administrative expenses during the years ended December 31, 2025 and 2024 were as follows: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | General and administrative | $81,050 | $69,222 | $11,828 | 17.1% | | Percentage of revenue | 19.3% | 20.9% | — | — | | GAAP general and administrative | $81,050 | $69,222 | $11,828 | 17.1% | | Stock-based compensation expense | (19,556) | (20,483) | 927 | (4.5)% | | Secondary listing costs | (2,941) | — | (2,941) | (100.0)% | | Discontinuation of growth equity fund | (1,917) | — | (1,917) | (100.0)% | | Non-GAAP general and administrative | $56,636 | $48,739 | $7,897 | 16.2% | | Non-GAAP percentage of revenue | 13.5% | 14.7% | — | — | General and administrative expenses increased 17.1% to $81.1 million for the year ended December 31, 2025. The increase was primarily driven by a $7.2 million increase in personnel costs, a $2.9 million of costs related to the Company’s secondary listing on the SGX-ST, and $1.9 million of net costs related to the discontinuation of the Company’s participation in A3 Ventures Fund 1, L.P. (the "***Fund").*** #### Research and Development Research and development expenses during the years ended December 31, 2025 and 2024 were as follows: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | Research and development | $52,585 | $48,699 | $3,886 | 8.0% | | Percentage of revenue | 12.5% | 14.7% | — | — | | GAAP research and development | $52,585 | $48,699 | $3,886 | 8.0% | | Stock-based compensation expense | (8,149) | (8,296) | 147 | (1.8)% | | Non-GAAP research and development | $44,436 | $40,403 | $4,033 | 10.0% | | Non-GAAP percentage of revenue | 10.6% | 12.2% | — | — | Research and development expenses increased 8.0% to $52.6 million for the year ended December 31, 2025, primarily driven by a $2.2 million increase in personnel costs, which included additional headcount and ongoing investment in the development of new offerings and enhancements to existing offerings, and a $0.7 million increase in training and development costs. #### Income Tax Provision Income tax provision during the years ended December 31, 2025 and 2024 was as follows: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | Change Amount% | | | --- | ---: | ---: | ---: | ---: | | Income tax expense | $5,381 | $4,743 | $638 | 13.5% | Income tax expense for the year ended December 31, 2025 was $5.4 million as compared to $4.7 million for the year ended December 31, 2024. The effective tax rate, which equals the income tax provision divided by pretax income (loss) from continuing operations, was 13.3% for the year ended December 31, 2025, compared to (19.4)% for the year ended December 31, 2024. The change in effective tax rates for the year ended December 31, 2025, as compared to the year ended December 31, 2024, was primarily due to the mix of pre-tax income (loss) results by jurisdictions taxed at different rates than 21%, a permanent item recorded for stock-based compensation, GILTI and changes in the valuation allowance in the U.S. and certain foreign jurisdictions. The amount of the valuation allowance, however, could be reduced in the near term. The exact timing will be based on the level of profitability that we are able to achieve and our visibility into future results. Such a release would increase our effective tax rate in subsequent periods but would not affect cash paid for income taxes. ### Non-GAAP Operating Income and Non-GAAP Operating Margin The following table presents a reconciliation of non-GAAP operating income from the most comparable GAAP measure, operating income, for the periods presented: *(in thousands, except percentages)* | | Year Ended December 31, 2025 | 2024 | | --- | ---: | ---: | | GAAP operating income | $33,035 | $7,166 | | GAAP operating margin | 7.9% | 2.2% | | Add: | | | | Stock-based compensation | 39,315 | 39,059 | | Amortization of acquired intangible assets | 1,965 | 1,420 | | Secondary listing costs | 2,941 | — | | Discontinuation of growth equity fund | 1,917 | — | | Non-GAAP operating income | $79,173 | $47,645 | | Non-GAAP operating margin | 18.9% | 14.4% | Non-GAAP operating income and non-GAAP operating margin are non-GAAP financial measures that our management uses to assess our overall performance. We define non-GAAP operating income as GAAP operating income plus the following items: stock-based compensation, the amortization of acquired intangible assets, the costs associated with our secondary listing on the SGX-ST, and the costs associated with the discontinuation of our participation in the Fund. We define non-GAAP operating margin as non-GAAP operating income divided by revenue. We believe non-GAAP operating income and non-GAAP operating margin provide our management and investors consistency and comparability with our past financial performance and facilitate period-to-period comparisons of operations, as these metrics eliminate the effects of stock-based compensation, which has had historical volatility from period to period due to mark-to-market securities, and of acquired intangible assets, which are unrelated to current operations and are neither comparable to the prior period nor predictive of future results. While the amortization expense of acquired intangible assets is excluded from certain non-GAAP measures, the revenue related to acquired intangible assets is reflected in such measures as those assets contribute to revenue generation. The elimination of the effect of variability caused by stock-based compensation expense and the amortization of acquired intangible assets, both of which are non-cash expenses, and the one-time nature of the costs associated with our secondary listing on the SGX-ST and the net costs associated with the discontinuation of our participation in the Fund, provides a better representation as to the overall operating performance of the Company. We use non-GAAP financial measures (a) to evaluate our historical and prospective financial performance and trends as well as our performance relative to our peers, (b) to set and approve spending budgets, (c) to allocate resources, (d) to measure operational profitability and the accuracy of forecasting, and (e) to assess financial discipline over operational expenditures. GAAP operating margin for the years ended December 31, 2025 and 2024 was 7.9% and 2.2%, respectively. Non-GAAP operating margin for the years ended December 31, 2025 and 2024 was 18.9% and 14.4%, respectively. The increase in both GAAP and non-GAAP operating margins was attributable to the Company’s revenue growth (in part benefitting from the continued scaling of the Company’s channel partner strategy) as well as to the Company’s continued focus on expense management, while GAAP operating margins also improved due to the Company’s ongoing management of stock-based compensation expense, which represented less than 10% of total revenue in the year ended December 31, 2025. ### Liquidity and Capital Resources As of December 31, 2025, we had $481.1 million in cash and cash equivalents and no outstanding debt. Our short-term liquidity needs primarily include working capital for sales and marketing, research and development, and continued innovation. We also have letters of credit issued in the amount of $1.0 million as security for operating leases, and $5.4 million as security for customer contingency agreements. In addition, we extended a credit facility with a remaining commitment of $1.5 million, and a committed $50.0 million to the Fund. Our long-term capital requirements will depend on many factors, including our growth rate, levels of revenue, the expansion of sales and marketing activities, market acceptance of our platform, the results of business initiatives, and the timing of new product introductions. Refer to “*Note 12 - Commitments and Contingencies”* for more information regarding the purchase commitments. We also maintain a loan and security agreement (the “***Loan Agreement”***), dated November 3, 2023, with HSBC Bank USA, National Association (“***HSBC”),*** as lender, for a revolving line of credit of up to $30.0 million with an accordion feature that provides up to $20.0 million of additional borrowing capacity we may draw upon at our request. The line bears interest at a rate equal to term SOFR plus 3.0% to 3.3% depending on the Consolidated Total Leverage Ratio (as defined in the Loan Agreement). The line carries an unused fee equal to 0.5%. The line will mature on November 3, 2026. We are required to maintain a minimum Consolidated Fixed Charge Coverage Ratio (as defined in the Loan Agreement) as well as a maximum Consolidated Total Leverage Ratio, tested by HSBC each quarter. Pursuant to the Loan Agreement, we pledged, assigned and granted HSBC a security interest in all shares of our subsidiaries, future proceeds, and assets as security for our obligations under the Loan Agreement. As of December 31, 2025, we are compliant with all covenants and had no borrowings outstanding under the Loan Agreement. We believe that our existing cash and cash equivalents, our cash flows from operating activities, and our borrowing capacity under our Loan Agreement will be sufficient to meet our working capital and capital expenditure needs and debt service obligations for at least the next twelve months. In the future, we may attempt to raise additional capital through equity or debt financing. The sale of additional equity would be dilutive to our stockholders. Additional debt financing could result in increased debt service obligations and more restrictive financial and operational covenants. ### Cash Flows The following table sets forth a summary of our cash flows for the periods indicated. *(in thousands)* | | Year Ended December 31, 2025 | 2024 | | --- | ---: | ---: | | Net cash provided by operating activities | $85,257 | $88,894 | | Net cash used in investing activities | (20,200) | (2,601) | | Net cash provided by (used in) financing activities | 123,991 | (15,537) | 48 #### Operating Activities Net cash provided by operating activities for the year ended December 31, 2025, was $85.3 million, reflecting our net income of $35.1 million, adjusted for non-cash items of $60.5 million and net cash outflows of $10.4 million from changes in our operating assets and liabilities. The main considerations for non-cash items were stock-based compensation, operating lease right-of-use asset expense and depreciation and amortization. The main considerations of changes in operating assets and liabilities that resulted in cash inflows related to an increase in deferred revenue that is partially offset by an increase in accounts receivable as a result of business growth. This was offset by cash outflows related to an increase in deferred contract costs and operating lease liabilities. Net cash provided by operating activities for the year ended December 31, 2024, was $88.9 million, reflecting our net loss of $29.1 million, adjusted for non-cash items of $89.3 million and net cash inflows of $28.8 million from changes in our operating assets and liabilities. The main considerations for non-cash items were stock-based compensation, operating lease right-of-use asset expense and mark to market adjustments on earnout and warrant liabilities. The main considerations of changes in operating assets and liabilities that resulted in cash inflows related to an increase in deferred revenue that is partially offset by an increase in accounts receivable as a result of business growth. This was partially offset by cash outflows related to an increase in deferred contract costs and operating lease liabilities. #### Investing Activities Net cash used in investing activities for the year ended December 31, 2025, was $20.2 million, primarily consisting of $14.9 million paid in a business acquisition, $3.7 million of purchases of property and equipment, and $1.6 million in software development. Net cash used in investing activities for the year ended December 31, 2024, was $2.6 mill ion, primarily consisting of $3.0 million of purchases of property and equipment, $1.8 million in the purchase of investments, $1.8 million investment in notes, and $1.2 million in software development, partially offset by the release of $5.4 million of certificates of deposit that were replaced by a sublimit of our line of credit. #### Financing Activities Net cash provided by financing activities for the year ended December 31, 2025, was $124.0 million, primarily consisting of $168.2 million of proceeds from the exercises of warrants and, $17.7 million of proceeds from the exercises of stock options, partially offset by $49.8 million in purchases of common stock and $12.1 million to repurchase the noncontrolling interest in MaivenPoint Pte. Ltd. Net cash used in financing activities for the year ended December 31, 2024, was $15.5 million, primarily consisting of $33.1 million in purchases of common stock, $6.1 million in the redemption of the redeemable noncontrolling interest of MaivenPoint, and $4.0 million in the purchase of public warrants, partially offset by $17.2 million of proceeds from the exercising of warrants, and $11.0 million of proceeds from the exercising of stock options. #### Indebtedness #### Credit Facility We maintain a line of credit under the Loan Agreement with HSBC, as lender. See “*Note 9 – Line of Credit”* in Part II, Item 8 “*Financial Statements and Supplementary Data”* of this Annual Report. The Loan Agreement provides for a revolving line of credit of up to $30.0 million, with an additional $20.0 million accordion feature for additional capital we may draw upon at our request. Borrowings under the line bear interest at a rate equal to term SOFR plus 3.0% to 3.3% depending on the Consolidated Total Leverage Ratio. The line carries an unused fee at a rate equal to 0.5%. Any borrowings under the Loan Agreement will be used for general corporate purposes. On a consolidated basis with our subsidiaries, we are required to maintain a minimum Consolidated Fixed Charge Coverage Ratio as well as a maximum Consolidated Total Leverage Ratio, tested by HSBC each quarter. Pursuant to the Loan Agreement, we pledged, assigned, and granted HSBC a security interest in all shares of our subsidiaries, future proceeds, and certain assets as security for our obligations under the Loan Agreement. Our line of credit under the Loan Agreement will mature on November 3, 2026. To date, we are in compliance with all covenants under the Loan Agreement. We have not at any time, including as of and for the fiscal year ending as of December 31, 2025, borrowed under the Loan Agreement. The description of the Loan Agreement is qualified in its entirety by the full text of such agreement, a copy of which is attached as an exhibit to this Annual Report. #### Leasing Obligations We are obligated under various non-cancelable operating leases for office space and other facilities. The initial terms of the leases expire on various dates through 2032. During the years ended December 31, 2025 and 2024, total rent expense for facilities amounted to $9.2 million and $7.2 million, respectively. As of December 31, 2025, letters of credit have been issued in the amount of $1.0 million as security for operating leases. The letters of credit are secured by a sublimit of our line of credit (refer to “*Note 9 - Line of Credit”* for further details). ### Operating Segment Information We operate in one segment. Our products and services are sold throughout the world, through direct and indirect sales channels. Our chief operating decision maker (the “***CODM”***) is our Chief Executive Officer. The CODM makes operating performance assessment and resource allocation decisions on a global basis. The CODM does not receive discrete financial information about asset allocation, expense allocation, or profitability by product or geography. See “*Note 18 – Segment Information”* (Part II, Item 8 of this Annual Report) for more information. ### Critical Accounting Estimates Preparation of these financial statements requires us to make estimates and assumptions that affect the reported amounts of assets and liabilities and the disclosure of contingent assets and liabilities. We also make estimates and assumptions on the reported revenue generated and reported expenses incurred during the reporting periods. Our estimates are based on our historical experience and on various other factors that our management believes are reasonable under the circumstances. The results of these estimates form the basis for making judgments about the carrying value of assets and liabilities that are not readily apparent from other sources. Actual results may differ from these estimates. While our significant accounting policies are described in more detail in the section titled “*Note - 2 Summary of Significant Accounting Policies”* (Part II, Item 8 of this Annual Report), we believe the following critical accounting policies are most important to understanding and evaluating our reported financial results. #### Revenue Recognition We derive revenue from four primary sources: SaaS, term license and support, services, and maintenance. Many of our contracts with customers include multiple performance obligations. Our products and services generally do not require a significant amount of integration or interdependency; therefore, our products and services are generally not combined. We allocate the transaction price for each contract to each performance obligation based on the relative standalone selling price (“***SSP”***) for each performance obligation within each contract. We use judgment in determining the SSP for products and services. For substantially all performance obligations except term licenses, we are able to establish the SSP based on the observable prices of products or services sold separately in comparable circumstances to similar customers. We typically establish an SSP range for our products and services which is reassessed on a periodic basis or when facts and circumstances change. Term licenses are sold only as a bundled arrangement that includes the rights to a term license and support. In determining the SSP of license and support in a term license arrangement, we utilize observable inputs and consider the value relationship between support and term license when compared to the value relationship between support and perpetual licenses, the average economic life of our products, and software renewals rates. Using a combination of the relative fair value method or the residual value method, the SSP of the performance obligations in an arrangement is allocated to each performance obligation within a sales arrangement. ### Economic Conditions, Challenges, and Risks The markets for software and cloud-based services are dynamic and highly competitive. Our competitors are developing new software while also deploying competing cloud-based services for consumers and businesses. Customer preferences evolve rapidly, and choices in hardware, products, and devices can and do influence how users access services in the cloud, and in some cases, the user’s choice of which suite of cloud-based services to use. We must continue to evolve and adapt to keep pace with this changing environment. The investments we are making in infrastructure, research and development, marketing, and geographic expansion will continue to increase our operating costs and may decrease our operating margins. Our success is highly dependent on our ability to attract and retain qualified employees. We hire a mix of university and industry talent worldwide. We compete for talented individuals globally by offering an exceptional working environment, broad customer reach, scale in resources, the ability to grow one’s career across many different products and businesses, and competitive compensation and benefits. Additionally, demand for our software and service is correlated to global macroeconomic and geopolitical factors, which remain dynamic and currently include multiple ongoing conflicts where the outcomes and consequences are not possible to predict, but could include regional instability and geopolitical shifts, and could materially adversely affect global trade, currency exchange rates, regional economies and the global economy. These in turn could increase our costs, disrupt our supply chain, reduce our sales and earnings, impair our ability to raise additional capital when needed on acceptable terms, if at all, or otherwise adversely affect our business, financial condition, and results of operations. Our international operations provide a significant portion of our total revenues and expenses. Many of these revenues and expenses are denominated in currencies other than the U.S. dollar. As a result, changes in foreign exchange rates may significantly affect revenue and expenses. Refer to the section titled “*Risk Factors”* (Part I, Item 1A of this Annual Report) for a discussion of these factors and other risks. ### Seasonality Our quarterly revenue can fluctuate and does not necessarily grow sequentially when measuring any one fiscal quarter’s revenue against another. Historically, our first quarter has been our lowest revenue quarter and our fourth quarter has been our highest revenue quarter, however those results are not necessarily indicative of future quarterly revenue or full year results. Additionally, the timing of new product and service introductions can significantly impact revenue. Lastly, the mix of revenues in any given quarter can cause fluctuations in our reported results, due to differing revenue recognition principles. ### Recently Issued and Adopted Accounting Pronouncements For information about recent accounting pronouncements, see “*Note 2 - Summary of Significant Accounting Policies”* in Part II, Item 8 “*Financial Statements and Supplementary Data”* of this Annual Report. ## Market risk As filed, 2,633 characters. ### Interest Rate Risk We had cash and cash equivalents, marketable securities, and short-term deposits of $481.3 million as of December 31, 2025, which we hold for working capital purposes. Our cash and cash equivalents are held in cash deposits and money market funds. Due to the short-term nature of these instruments, we do not believe that we have any material exposure to changes in the fair value of our investment portfolio due to changes in interest rates. Declines in interest rates, however, would reduce our future interest income. The effect of a hypothetical 10% change in interest rates would not have a material negative impact on our consolidated financial statements. As of December 31, 2025, we had no outstanding obligations under our line of credit with HSBC under the Loan Agreement. To the extent we enter into other long-term debt arrangements in the future, we would be subject to fluctuations in interest rates which could have a material impact on our future financial condition and results of operation. ### Foreign Currency Exchange Risk We have foreign currency risks related to our revenue denominated in currencies other than the U.S. Dollar, primarily consisting of the Euro, the Singapore Dollar, the Japanese Yen, the Australian Dollar and the British Pound Sterling. Our revenues therefore benefit from a weakening of the U.S. Dollar relative to these currencies and, conversely, are adversely affected by a strengthening of the U.S. Dollar relative to these currencies. We also have foreign currency risks related to operating expenses denominated in a number of currencies other than the U.S. Dollar. Our expenses are therefore adversely affected from a weakening of the U.S. Dollar relative to these currencies and, conversely, benefit by a strengthening of the U.S. Dollar relative to these currencies. Revenues denominated in the U.S. Dollar as a percentage of total revenues were approximately 36% for the year ended December 31, 2025. Expenses denominated in the U.S. Dollar as a percentage of total expenses were approximately 50% for the year ended December 31, 2025. A hypothetical 10% increase in the U.S. Dollar against other currencies would have resulted in a decrease in income from operations of approximately $7.4 million for the twelve months ended December 31, 2025. This analysis disregards that rates can move in opposite directions and that losses from one geographic area may be offset by gains from another geographic area. ### Concentration of Credit Risk We deposit our cash with financial institutions, and, at times, such balances may exceed federally insured limits. ## Controls and procedures As filed, 6,610 characters. ### Evaluation of Disclosure Controls and Procedures Under the supervision and with the participation of our management, including our Chief Executive Officer (in his capacity as “***Principal Executive Officer”***) and our Chief Financial Officer (in his capacity as “***Principal Financial and Accounting Officer”***), we conducted an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e)) under the Exchange Act, as of the end of the period covered by this Annual Report. Based upon that evaluation, our Principal Executive Officer and Principal Financial and Accounting Officer concluded that our disclosure controls and procedures were effective as of December 31, 2025. #### Management’s Report on Internal Control over Financial Reporting Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. Our system of internal control was designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes, in accordance with GAAP. Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting based on the criteria set forth in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (the “***COSO framework”***). Based on management’s assessment, our Principal Executive Officer and Principal Financial and Accounting Officer concluded that our internal control over financial reporting was effective as of December 31, 2025 to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. GAAP. Our independent registered public accounting firm, Deloitte & Touch LLP, has issued an audit report with respect to our internal control over financial reporting, which appears in Part II, Item 9A in this Annual Report on Form 10-K. ### Changes in Internal Control over Financial Reporting There have not been any changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the fourth quarter ended December 31, 2025, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. ### Items 9A ### Report of Independent Registered Public Accounting Firm To the stockholders and the Board of Directors of AvePoint, Inc. ### Opinion on Internal Control over Financial Reporting We have audited the internal control over financial reporting of AvePoint, Inc. and subsidiaries (the "Company") as of December 31, 2025, based on criteria established in *Internal Control — Integrated Framework (2013)* issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025, based on criteria established in *Internal Control — Integrated Framework (2013)* issued by COSO. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), consolidated financial statements as of and for the year ended December 31, 2025, of the Company and our report dated February 26, 2026, expressed an unqualified opinion on those financial statements. ### Basis for Opinion The Company's management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company's internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. ### Definition and Limitations of Internal Control over Financial Reporting A company's internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. #### /s/ Deloitte & Touche LLP New York, New York February 26, 2026 ### Items 9B, 9C Filed Feb 26, 2026. Source: SEC EDGAR, the filing index for accession 0001437749-26-005907. Last ingested by Listed: Nov 5, 2026, 17:33 ET. No prices; not investment advice.