XML 64 R29.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management framework designed to protect the confidentiality, integrity, and availability of our critical systems and information.
Our information security controls and practices are reviewed against globally recognized standards: ISO 27001, ISO 27017, ISO 27701, ISO 27018, and SOC 2 Type II. Our commitment also extends to maintaining a PCI DSS certification for payment transaction security, risk assessments, training for employees, and other safeguards and controls.
Generally, we design and assess our cybersecurity risk management framework based on the cybersecurity frameworks of the Center for Internet Security (CIS), and our application security is based on Open Worldwide Application Security Project (OWASP) frameworks. While we may not always meet every technical standard, specification and requirement specified in these frameworks and standards at all times, we use these frameworks and standards to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management framework is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management framework include, but are not limited to:
•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
•a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
•internal and external testing of our cybersecurity posture;
•security tools deployed in our information technology environment to protect the confidentiality, integrity, and availability of our critical systems and information and monitor cybersecurity threats;
•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;
•processes to integrate cybersecurity risk management within the company’s product and software development processes;
•cybersecurity awareness training of our employees;
•a bug bounty program;
•a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
•a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.
We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risks Related to Privacy, Data and Cybersecurity.” However, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our cybersecurity risk management framework is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management framework include, but are not limited to:
•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
•a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
•internal and external testing of our cybersecurity posture;
•security tools deployed in our information technology environment to protect the confidentiality, integrity, and availability of our critical systems and information and monitor cybersecurity threats;
•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;
•processes to integrate cybersecurity risk management within the company’s product and software development processes;
•cybersecurity awareness training of our employees;
•a bug bounty program;
•a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
•a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity Governance
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information technology
risks. Our audit committee oversees management’s implementation of our cybersecurity risk management program.
Our audit committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our audit committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant.

Our audit committee chair reports to the full board of directors regarding its activities, including those related to cybersecurity. Our audit committee chair also receives more specific briefings from management on our cybersecurity risk management efforts. The full board of directors also periodically receives briefings from on our cyber risk management program.

The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization.
Our management team, including the CISO, who holds over 15 years of experience in information technology and cybersecurity and has extensive experience in assessing, identifying, and managing cybersecurity-related risks and implementing cybersecurity-related policies and strategies, and the Chief Technology Officer, who has over 25 years of experience in information technology in connection with its cybersecurity process, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management framework and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team’s experience includes working in management roles related to cybersecurity, risk, and data privacy in various leading global companies and in military roles, as well as industry certifications such as ISC², CISSP, and MCSE.
Our management team stays informed about and monitors efforts designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools that we deploy.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information technology
risks. Our audit committee oversees management’s implementation of our cybersecurity risk management program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our audit committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our audit committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant.
Cybersecurity Risk Role of Management [Text Block] The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our management team, including the CISO, who holds over 15 years of experience in information technology and cybersecurity and has extensive experience in assessing, identifying, and managing cybersecurity-related risks and implementing cybersecurity-related policies and strategies, and the Chief Technology Officer, who has over 25 years of experience in information technology in connection with its cybersecurity process, are responsible for assessing and managing our material risks from cybersecurity threats.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our management team, including the CISO, who holds over 15 years of experience in information technology and cybersecurity and has extensive experience in assessing, identifying, and managing cybersecurity-related risks and implementing cybersecurity-related policies and strategies, and the Chief Technology Officer, who has over 25 years of experience in information technology in connection with its cybersecurity process, are responsible for assessing and managing our material risks from cybersecurity threats.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our audit committee chair reports to the full board of directors regarding its activities, including those related to cybersecurity. Our audit committee chair also receives more specific briefings from management on our cybersecurity risk management efforts. The full board of directors also periodically receives briefings from on our cyber risk management program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true