Klaviyo

Governance Related to Cybersecurity Risks

Our board of directors recognizes the importance of our risk management program related to cybersecurity. As provided in the charter of the audit committee of our board of directors (“Audit Committee”), our Audit Committee serves a key function in our board of directors’ oversight of these risks and processes. Our Chief Information Security Officer (“CISO”) provides updates on the cybersecurity risks we face and our processes to address those risks to our Audit Committee on a periodic, but at least quarterly, basis. These updates may include, but are not limited to, reports of identified cybersecurity risks, status of our risk management processes, and updates regarding regulatory requirements and policies.

Our Audit Committee comprises members of our board of directors with extensive experience in the technology sector who have held leadership positions at other publicly listed companies and have expertise in various aspects of our business. Cybersecurity matters are formally raised to our co-Chief Executive Officers, Chief Financial Officer, and Chief Legal Officer through their attendance of Audit Committee meetings. These individuals are also informed of significant events and updates through direct communication from our CISO as needed. We have a process for significant decisions over identified incidents to be escalated to our board of directors for disclosure and oversight.

Our CISO leads our cybersecurity initiatives and is primarily responsible for the assessing, managing, and monitoring of the Company’s cybersecurity risks. Our CISO is a seasoned cybersecurity expert with over 20 years of experience and deep knowledge about our platform. His knowledge of cybersecurity, compliance, and risk assessment has been leveraged to develop our cybersecurity governance and risk strategy. Our CISO oversees our Security Operations and Trust team, as well as our cybersecurity related programs and matters, which are reported on regularly to our Audit Committee.

Cybersecurity Risk Management and Strategy

We have integrated cybersecurity risk management into our enterprise risk management framework in an effort to identify, assess, and manage risks from cybersecurity threats that could affect our business and information systems. We have implemented a cybersecurity program that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and International Organization for Standardization and the ISO 27001 standards.

Our cybersecurity risk assessment program includes a number of components, including monitoring and reviewing relevant intelligence sources to identify potential cybersecurity risk and threats, penetration testing and vulnerability assessments, and audits and maturity assessments. These processes are conducted periodically by both internal and external resources. For example, independent third-party experts and assessors perform our SOC 2 Type 2 examinations and

penetration testing. Our internal audit function also periodically conducts an assessment of different systems to provide our Audit Committee with information on our cybersecurity risk management processes.

We have implemented a process to address identified risks from cybersecurity threats in which our Security Risk team works in consultation with management and other key stakeholders, as appropriate, to determine the associated risks, potential impact, and the recommended course of action to address those risks. We have an incident response plan that includes escalation procedures for informing management and other key stakeholders. Our process calls for significant incidents and significant cybersecurity risks to be raised to our Audit Committee followed by notification to our board of directors.

We engage third-party service providers in the operation of our business. In an effort to mitigate risks from cybersecurity threats associated with our service providers, we perform security reviews of third-party service providers that are critical to our business or that could have an impact on our financial reporting. These security reviews may include, as appropriate, security questionnaires and vendor due diligence assessments. To monitor and manage third-party risk, we have a dedicated Security Risk team that reviews service providers’ independent attestation reports and third-party certifications.

While we have been the target and victim of cyberattacks by third parties, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that may have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. See the section titled “Risk Factors” for further detail on identified risks, including those related to cybersecurity.