Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Jun. 30, 2026 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy
We have established processes designed to identify, assess, manage, and respond to cybersecurity risks that could materially affect our business, operations, or financial condition. These processes are into our overall risk management activities and are documented in a set of written policies, including our Risk Assessment, Risk Management, and Governance Policy, Access Control Policy, Information Classification Policy, Asset Management Policy, Breach Notification and Data Destruction Policy, and Business Continuity Policy. These policies provide for the identification and prioritization of risks in a risk register that is updated as the risk landscape changes; the classification of our information by sensitivity with corresponding handling requirements; the provisioning of access on a least-privilege, role-based and need-to-know basis; procedures for the reporting, investigation and remediation of suspected data breaches; and the maintenance and testing of our business continuity plan.
Our information systems operate primarily on third-party cloud infrastructure. Technical safeguards include federated single sign-on with multi-factor authentication, role-based access provisioning under the principle of least privilege, periodic credential rotation and periodic access review, web application firewall protection with centralized logging for our production web and application programming interface distributions, and cross-region backup and replication of data and deployment artifacts supporting the Company’s recovery objectives. We use continuous threat detection services provided by our cloud infrastructure provider, with security findings aggregated for triage, and engage third-party providers for managed security monitoring and advisory services, including a managed security incident response service that triages security findings across our cloud accounts and reports periodically to our designated incident response contacts. We conduct internal assessments of our cloud environment and track identified findings to remediation.
. We have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. |
| Cybersecurity Risk Management Processes Integrated [Flag] | |
| Cybersecurity Risk Management Processes Integrated [Text Block] | These processes are into our overall risk management activities and are documented in a set of written policies, including our Risk Assessment, Risk Management, and Governance Policy, Access Control Policy, Information Classification Policy, Asset Management Policy, Breach Notification and Data Destruction Policy, and Business Continuity Policy |
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance
Our Board of Directors (the “Board”) oversees risks from cybersecurity threats as part of its general oversight of our risk management activities. The Board has not delegated responsibility for the oversight of risks from cybersecurity threats to a separate committee of the Board.
Our Executive Vice President of Engineering & Platform is responsible for our cybersecurity program and reports to our Chief Executive Officer on cybersecurity matters. The Chief Executive Officer informs the Board of significant cybersecurity risks and of material cybersecurity incidents. Management reports to the Board on cybersecurity matters annually, covering the threat environment relevant to our business, the status of open security matters, the results of assessments and remediation activities, and our security program and resourcing, and reports to the Board outside that cycle where the significance of a matter warrants.
Our cybersecurity program is overseen by senior management, including Brian Wenhold, our Executive Vice President of Engineering & Platform. Mr. Wenhold has served in that capacity since January 2026 and previously served as our Vice President of Engineering beginning in October 2025. He is responsible for our information security program, for evaluating information security risks, for overseeing our relationships with our managed security and security advisory providers, and for directing our response to cybersecurity incidents, serving as incident commander for incidents requiring a coordinated response.
Mr. Wenhold has more than 28 years of experience in software engineering and technology leadership and has served as incident commander for cybersecurity incident response since 2002, across five organizations in enterprise and regulated environments. He holds a Bachelor of Science in Computer Engineering from the University of Central Florida. As principal engineer for the platform organization of an automotive technology company, he designed identity and access management, key and secrets management, and network security controls. He has owned a SOC 2 compliance program, including control design, evidence collection and remediation across engineering functions; has worked with the Payment Card Industry Data Security Standard at multiple organizations; and has led HIPAA compliance and HITRUST e1 certification efforts for a nonprofit technology platform. He has presented security posture, security program roadmaps and security and compliance audit findings to boards of directors, executive leadership and government stakeholders. Mr. Wenhold communicates with the Chief Executive Officer, the General Counsel and other members of senior management regarding significant cybersecurity risks, emerging threats and cybersecurity incidents.
Assessment and Oversight
We evaluate our cybersecurity controls through internal assessments of our cloud environment and identity controls, through monitoring and triage performed by our managed security incident response provider. Identified findings are tracked to remediation and reported to management and to the Board. We review and update our cybersecurity policies and procedures in response to evolving threats, technological developments, and changes in its business operations. |
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors (the “Board”) oversees risks from cybersecurity threats as part of its general oversight of our risk management activities. The Board has not delegated responsibility for the oversight of risks from cybersecurity threats to a separate committee of the Board |
| Cybersecurity Risk Role of Management [Text Block] | Our Executive Vice President of Engineering & Platform is responsible for our cybersecurity program and reports to our Chief Executive Officer on cybersecurity matters. The Chief Executive Officer informs the Board of significant cybersecurity risks and of material cybersecurity incidents. Management reports to the Board on cybersecurity matters annually, covering the threat environment relevant to our business, the status of open security matters, the results of assessments and remediation activities, and our security program and resourcing, and reports to the Board outside that cycle where the significance of a matter warrants |
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our cybersecurity program is overseen by senior management, including Brian Wenhold, our Executive Vice President of Engineering & Platform. Mr. Wenhold has served in that capacity since January 2026 and previously served as our Vice President of Engineering beginning in October 2025. He is responsible for our information security program, for evaluating information security risks, for overseeing our relationships with our managed security and security advisory providers, and for directing our response to cybersecurity incidents, serving as incident commander for incidents requiring a coordinated response |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Mr. Wenhold has more than 28 years of experience in software engineering and technology leadership and has served as incident commander for cybersecurity incident response since 2002, across five organizations in enterprise and regulated environments. He holds a Bachelor of Science in Computer Engineering from the University of Central Florida. As principal engineer for the platform organization of an automotive technology company, he designed identity and access management, key and secrets management, and network security controls. He has owned a SOC 2 compliance program, including control design, evidence collection and remediation across engineering functions; has worked with the Payment Card Industry Data Security Standard at multiple organizations; and has led HIPAA compliance and HITRUST e1 certification efforts for a nonprofit technology platform |