Kong Inc. Startup Diligence Report
Proceed only to confirmatory diligence. The case depends on proving durable enterprise API/AI platform revenue, efficient GTM, defensible open-source-to-enterprise conversion, strong security/reliability controls and a valuation/cap table that reconciles public CB Insights and Form D signals.
Kong Inc. Startup Diligence Report
Kong appears eligible for public standard diligence as an active private unicorn/Series E company. Public evidence supports CB Insights unicorn-list inclusion, active SEC Form D filings, broad API/AI product scope, public open-source repositories, selected enterprise customer stories, partner channels, 600+ employee company claim and active 2026 press/GitHub footprint. Investment-grade conclusions remain blocked by private financials, cap table, customer concentration, legal/IP, HR, security and contract gaps.
Kong competes with Apigee, Tyk, Solo/Gloo and likely hyperscaler-native API gateways, increasing pricing and distribution pressure.
Diligence request: Benchmark win/loss, price realization, attach rates, sales cycle and migration costs against named competitors.
Kong sits in critical API/AI traffic paths; defects, vulnerabilities or misconfiguration can create high-impact customer incidents.
Diligence request: Review SOC 2/ISO reports, penetration tests, CVE history, incident postmortems, SLA credits and customer security questionnaires.
No audited financial statements, cash, debt, burn, ARR, gross margin, revenue-recognition or runway data were public.
Diligence request: Request audited/management financials, bank statements, debt schedule, revenue waterfall, ARR bridge, cohort retention and board plan.
Public case studies identify customers but do not reveal top-customer ARR, concentration, NRR, churn, renewals or contract terms.
Diligence request: Request customer cohort data, top accounts by ARR, renewal pipeline, churn reasons and direct customer references.
Complete litigation, regulatory, insurance, material-contract, trademark/patent and open-source compliance schedules were not publicly verified.
Diligence request: Counsel should run docket/regulatory/IP searches and review contracts, policies, insurance and compliance reports.
Multiple Form D rounds and CB Insights funding data indicate substantial financing, but preference stack, option pool, debt and investor rights are private.
Diligence request: Request fully diluted cap table, stock plan, warrants, SAFEs/notes, debt, investor rights, liquidation waterfall and secondary transactions.
CB Insights public unicorn row shows $2B while CB profile data includes a $1.4B 2020 valuation anchor and blurred current valuation fields.
Diligence request: Reconcile all valuation claims to priced-round documents, 409A history and secondary-market transactions.
Large public open-source surfaces create maintenance, security-response and community expectations while enterprise conversion is not public.
Diligence request: Request open-source governance, security SLA, maintainer staffing, enterprise conversion funnel and support-ticket metrics.
Public evidence supports Kong as an active private unicorn/Series E company with multiple Form D financing anchors, but audited financials, ARR, cash, runway, debt, cap table and valuation support are not public.
not publicly verifiable confidence: low
No audited or management financial statements, product/geography revenue, backlog or AR aging were public; public sources only show funding, pricing and customer-marketing signals.
| Metric | Verification status | Evidence / source | Diligence request |
|---|---|---|---|
| Revenue / ARR | not_publicly_verifiable | CB profile shows Revenue $0000 View; company pricing/customer pages do not disclose ARR | Request audited financials, ARR/MRR bridge, revenue by product/channel/geography and revenue-recognition memo. |
| Gross margin / unit economics | not_publicly_verifiable | Pricing tiers are public but realized costs/prices are not | Request SKU-level gross margin, cloud costs, support costs, professional-services margin and open-source-to-paid funnel. |
| Backlog / AR aging / collections | not_publicly_verifiable | No backlog or AR schedule in public sources | Request backlog, deferred revenue, billing terms, AR aging, bad debt and collections. |
| Cash runway / debt | not_publicly_verifiable | Form D filings evidence financing but not current liquidity | Request cash, burn, budget variance, debt instruments and runway under scenarios. |
Financial statements and forecast model remain core diligence gaps.
not publicly verifiable confidence: low
Public evidence shows growth narratives around API/AI connectivity, pricing tiers and funding, but no board-approved forecast, assumptions, capital expenditure plan or external financing plan was public.
Amounts are public filing/list anchors only.
Do not imply Form D sold amount equals total round proceeds.
not publicly verifiable confidence: medium
SEC verifies Kong Inc. is a Delaware corporation formerly Mashape and has no public ticker in SEC submissions; actual share count, stockholders, options, warrants, debt and off-balance-sheet liabilities are private.
| Stakeholder / class | Evidence | Verification status | Diligence caveat |
|---|---|---|---|
| Kong Inc. common/preferred equity | SEC company feed confirms Delaware incorporation and former name Mashape Inc. | verified identity; not_publicly_verifiable capitalization | Request charter, bylaws, stock ledger, fully diluted cap table and option pool. |
| Named CB Insights unicorn-list investors | CB Insights unicorn row | verified as list entry | Confirm current holdings, pro rata, side letters, board rights and information rights. |
| 2024 Series E investor group | CB Insights embedded funding data | partially_verified | Confirm primary/secondary mix and post-money valuation. |
| Options, warrants, debt and off-balance-sheet items | No such schedules in reviewed public sources | not_publicly_verifiable | Request option, warrant, SAFE/note, debt, lease and contingent-liability schedules. |
Ownership percentages and liquidation preferences are private.
partially verified confidence: medium
Public Form D and CB Insights data establish a financing-history skeleton, but accounting policies, tax positions, debt, warrants and current fair-value basis remain private.
| Date | Round / filing | Amount / valuation | Investors / persons | Verification status | Diligence caveat |
|---|---|---|---|---|---|
| 2011-08-25 | Mashape Inc. Form D | $1,694,286 sold / $1,694,286 offered | 20 investors; Augusto Marietti, Marco Palladino and Michele Zonca listed as related persons | verified filing fact | Request early charter, founder stock and option history. |
| 2018-12-31 | Kong Inc. Form D / Series C-era public anchor | $49,699,970 sold / $54,699,973 offered | 8 investors; investor names not disclosed in Form D | verified filing fact | Request Series C purchase agreement and cap-table effects. |
| 2020-12-31 / filed 2021-01-04 | CB unicorn row and Kong Inc. Form D / Series D-era public anchor | CB list: $2B valuation; SEC: $92,999,964 sold / $100,000,000 offered; CB profile: 2020 valuation anchor $1.4B | CB list names NEA, CRV, Index Ventures; SEC Form D names related persons but not investors | partially_verified | Reconcile $2B list valuation to CB profile $1.4B anchor and financing documents. |
| 2024-08-19 / CB profile date 2024-10-10 | Kong Inc. Form D / CB Insights Series E | SEC: $79,999,961 sold / $99,999,956 offered; CB profile: $175M Series E, latest valuation blurred | CB profile includes Balderton Capital and Tiger Global Management as leads; SEC Form D lists 12 investors but not names | partially_verified | Request Series E documents, primary/secondary split and post-money valuation. |
SEC Form D amounts are exempt-offering disclosures, not audited financial statements.
Kong publicly offers a broad API/AI connectivity platform with open-source and enterprise products; technical claims and product economics require independent verification.
partially verified confidence: high
Public sources verify Kong Konnect, Gateway, AI Gateway, Insomnia, Mesh/Kuma, KIC/Operator, decK and Metering & Billing surfaces; market share, product profitability and customer adoption by SKU are not public.
| Product / SKU | Publicly described function | Evidence | Verification status | Diligence caveat |
|---|---|---|---|---|
| Kong Konnect | SaaS API management platform and unified API/AI platform control plane | Developer navigation lists Konnect as platform; pricing packages are under Kong Konnect | verified public product | Request Konnect ARR, retention, uptime and gross margin. |
| Kong Gateway | Cloud-native API Gateway for API and AI connectivity; hybrid and multi-cloud; 50K+ TPS claim | Kong Gateway product page and GitHub repo | partially_verified | Independently benchmark performance and review enterprise support obligations. |
| AI Gateway / AI Management | LLM/AI traffic governance and gateway functionality | Pricing page includes LLM support; navigation lists AI Gateway | verified public product | Request AI Gateway revenue, model-provider costs and safety controls. |
| Insomnia | Cross-platform API client for GraphQL, REST, WebSockets, SSE and gRPC | GitHub repo description and docs navigation | verified public product | Request paid conversion, cloud-storage attach and issue backlog management. |
| Kong Mesh / Kuma, KIC, Operator, decK | Service mesh, Kubernetes ingress/operator and declarative configuration ecosystem | Docs navigation and GitHub repos for Kuma/KIC/decK | verified public product surface | Request dependency map, support matrix and attach rates. |
Product-level economics and adoption are not public.
| Tier / product | Included public attributes | Verification status | Private diligence need |
|---|---|---|---|
| Konnect Free Trial | Enterprise functionality for 30 days, no Gateway limits, analytics retained 30 days | verified public packaging | Trial-to-paid conversion, activation and CAC payback. |
| Konnect Plus | Limits on serverless/hybrid/dedicated cloud gateways; API protocol support including LLMs, Kafka, WebSockets, gRPC, GraphQL | verified public packaging | Realized ASP, discounts, usage overages and margin. |
| Konnect Enterprise | No Gateway limits, developer portal scale-out, SSO/audit logs, dedicated customer success/TAM/professional services, higher SLAs | verified public packaging | Enterprise contract value, services margin, SLA credits and renewal terms. |
| Metering & Billing | API/AI monetization product surface | verified documentation | Customer adoption and revenue from metering/billing. |
Competitor price benchmarking should be performed with quote-level data.
Architecture is inferred from public product descriptions, not a validated deployment diagram.
Kong publishes enterprise customer stories and partner categories, but revenue concentration, current contract status, churn, top customers and supplier spend are not publicly verifiable.
partially verified confidence: medium
Public customer references include Verifone, Security Bank, First Abu Dhabi Bank, Rabobank, Richemont and Sky Italia, but this is not a top-15 customer list by revenue.
| Customer / reference | Quantified outcome | Verification status | Diligence request |
|---|---|---|---|
| Verifone | 20x time-to-market improvement and 75% APIM TCO reduction claimed | partially_verified company case study | Confirm current contract, ARR, renewal date and reference call. |
| Security Bank | 25% reduction in API-related incidents claimed | partially_verified company case study | Confirm deployment scope, SLA, ARR and before/after incident methodology. |
| First Abu Dhabi Bank | App delivery reduced from 7 to 3 months; operating costs cut 57% claimed | partially_verified company case study | Confirm exact product, contract status and regional regulatory requirements. |
| Rabobank / Richemont / Sky Italia | No revenue or contract size disclosed | partially_verified public video references | Request named-reference permissions and revenue contribution by account. |
Customer logos are not proof of concentration or retention.
Mixed units are intentional to show public outcome claims only.
partially verified confidence: medium
Kong publicly describes cloud, GSI, technology and channel partner categories; exact partner list, contracts and revenue contribution are private.
| Partner category | Revenue contribution | Verification status | Diligence request |
|---|---|---|---|
| Cloud providers / hyperscalers | Not disclosed | partially_verified | Request AWS/GCP/Azure marketplace agreements, co-sell pipeline, take rates and cloud-credit dependencies. |
| Global system integrators | Not disclosed | verified public partner category | Request SI partner list, referral fees, implementation margins and pipeline source. |
| Premium technology partners | Not disclosed | verified public partner category | Request integration roadmap, certification, support obligations and joint-customer counts. |
| Channel partners / VARs / regional SIs | Not disclosed | verified public partner category | Request channel contracts, margins, deal-registration data and channel conflict policy. |
No partner revenue schedule was public.
not publicly verifiable confidence: low
No revenue by customer or customer concentration data is public; public logos cannot verify whether any customer exceeds 5% of revenue.
not publicly verifiable confidence: low
No public schedule of severed customer, partner or supplier relationships was found in reviewed sources.
partially verified confidence: medium
Public evidence suggests dependencies on cloud marketplaces, open-source runtime ecosystems and LLM/model-provider integrations, but purchase amounts and supplier agreements are private.
| Supplier / dependency | Public evidence | Risk | Diligence request |
|---|---|---|---|
| AWS Marketplace / cloud hyperscalers | Pricing page includes AWS trial/buy links; partner page describes cloud providers/hyperscalers | Marketplace take rates, cloud outages and co-sell dependency | Request cloud spend, marketplace revenue, contracts and termination rights. |
| NGINX / Envoy / Kubernetes ecosystems | Gateway page cites NGINX engine; Kuma repo says built with Envoy; docs list KIC/Operator | Open-source dependency CVEs and compatibility burden | Request SBOM, dependency policy, CVE response SLAs and support matrix. |
| LLM/model providers | Pricing page supports LLMs; AI Gateway in navigation | Model-provider pricing, outages, policy changes and customer data-processing obligations | Request model-provider integrations, DPAs, spend, usage and incident history. |
| Support, observability and security vendors | Partner page mentions observability/security technology partners | Third-party outage, data processing and SLA exposure | Request vendor spend, subprocessor list, contracts and SOC reports. |
Purchase amounts by supplier are private.
Kong competes in API management, cloud-native gateway, open-source and AI Gateway markets against hyperscalers and specialist vendors; independent market share and win/loss data are not public.
partially verified confidence: medium
Public evidence verifies competition from Apigee, Tyk and Solo/Gloo, while Kong differentiates through open-source community, Konnect breadth, hybrid/multi-cloud and AI Gateway positioning; independent win/loss is required.
| Company / project | Public overlap | Public signal | Kong differentiator to verify | Sources |
|---|---|---|---|---|
| Google Cloud Apigee | Build, manage and secure APIs across environments and scale | Google says Apigee is native API management with scale, security, performance and pay-as-you-go/subscription pricing | Open-source gateway, hybrid/multi-cloud neutrality and AI Gateway differentiation | SRC-018 / SRC-010 |
| Tyk | Open-source gateway supporting REST, GraphQL, TCP and gRPC | 10,739 GitHub stars and 1,154 forks at access time | Community scale, enterprise features, performance and partner channel | SRC-019 / SRC-015 |
| Solo.io Gloo | API Gateway and AI Gateway positioning | Gloo repository describes cloud-native API Gateway and AI Gateway | Konnect control plane, installed base and AI governance features | SRC-020 / SRC-012 |
| Hyperscaler-native gateways / MuleSoft / NGINX ecosystem | API management, developer portals, policy, security and monetization | Not fully sourced in this run except Apigee; should be benchmarked | Migration cost, open-source optionality, enterprise support, pricing and multi-cloud fit | SRC-018; follow-up required |
Independent market-share and win/loss data were not public.
| Axis | Competitor pressure | Evidence strength | Diligence need |
|---|---|---|---|
| Open source/community | Tyk and Gloo also use open-source/community strategies | medium public signal | Analyze enterprise conversion, support burden and license compliance. |
| Enterprise API management breadth | Apigee and MuleSoft/hyperscalers bundle API management with cloud or integration suites | medium | Win/loss by feature, price and migration use case. |
| AI Gateway positioning | Solo/Gloo also positions as API and AI Gateway; hyperscalers add AI-native tooling | medium-low | AI Gateway ARR, usage, roadmap and differentiation proof. |
| Pricing/procurement | Apigee supports pay-as-you-go and subscription pricing | medium | Quote-level benchmarking and discount analysis. |
Scores are analyst judgments based on public evidence, not customer win/loss interviews.
Coordinates are analyst estimates based on public positioning.
Public GTM surfaces include free trial, enterprise direct sales, AWS Marketplace, partners, press/events and open-source community, but channel revenue, CAC, sales productivity and budget sufficiency are private.
partially verified confidence: medium
Kong’s public GTM spans PLG/free trial, direct enterprise, AWS Marketplace, partner categories, events, press and open-source community; realized productivity is not public.
| Channel | Likely motion | Verification status | Private metric needed |
|---|---|---|---|
| Self-serve / product-led trial | Developer/platform-team trial | verified public channel | Trial volume, activation, conversion, CAC, churn. |
| Direct enterprise sales | Enterprise account sales and customer-success management | verified public channel | Quota, sales cycle, pipeline, win rate, discounting and renewal. |
| AWS Marketplace / cloud marketplace | Marketplace procurement and co-sell | verified public channel | Marketplace revenue, take rate, private offers and cloud credits. |
| Partners / GSIs / VARs / technology alliances | Partner referral, implementation and resale | verified public channel | Partner-sourced pipeline, implementation margin and channel conflict. |
| Open-source/community/developer docs | Community-led awareness and developer adoption | verified public surface | Open-source to paid conversion, support cost and community funnel. |
No channel revenue mix was public.
| Signal | Business implication | Verification status | Diligence follow-up |
|---|---|---|---|
| Press releases / news cadence | Active narrative around agentic AI, migration and GenAI adoption | verified public announcements | Tie announcements to signed contracts, pipeline and product usage. |
| Events and conference marketing | Thought leadership and enterprise demand generation | verified public marketing surface | Request event spend, leads, conversion and attribution. |
| Customer proof / case studies | Reference selling in regulated/enterprise sectors | partially_verified | Verify current contract status and reference willingness. |
| Open-source reach | Developer awareness and inbound funnel | verified public signal | Request source-of-lead attribution and conversion from community to paid. |
Marketing spend and ROI are private.
Channel productivity is not publicly verifiable.
not publicly verifiable confidence: low
Public customer stories support reference selling but not major-customer trends, pipeline expansion or revenue concentration.
partially verified confidence: medium
Public evidence points to self-serve trial, direct sales, AWS Marketplace, partners and open-source/community as new-business avenues.
not publicly verifiable confidence: low
No sales compensation, average quota, sales cycle or new-hire productivity model is public.
| Metric | Verification status | Why it matters | Requested evidence |
|---|---|---|---|
| Sales compensation and quotas | not_publicly_verifiable | Determines CAC, productivity and scale efficiency | Sales comp plan, quota by role/region, attainment and ramp. |
| Sales cycle and pipeline | not_publicly_verifiable | Enterprise API deals can have long procurement/security cycles | Pipeline by stage, win/loss, average sales cycle and forecast accuracy. |
| CAC payback / marketing budget | not_publicly_verifiable | Valuation depends on efficient growth and retention | CAC, payback, LTV, NRR, marketing source mix and board budget. |
| Customer success and support productivity | partially_verified staffing model; not economics | Services/support intensity affects margin | Support staffing, gross margin, SLA credits and renewal playbooks. |
Private GTM model required before investment decision.
not publicly verifiable confidence: low
Public marketing activity is visible, but budget sufficiency cannot be assessed without board budget, pipeline model and cash runway.
Kong has active public repositories and a broad product roadmap in API/AI connectivity, but R&D staffing, costs, prioritization, security posture and product-level ROI are private.
partially verified confidence: medium
Public leadership and GitHub activity evidence a substantial R&D surface, but engineering headcount, allocation, velocity and security operations are private.
| Area | Evidence | Verification status | Diligence request |
|---|---|---|---|
| Product/engineering leadership | Kong leadership section | verified public roster | Request org chart, engineering headcount, attrition and roadmap ownership. |
| Core Gateway R&D | GitHub metadata | verified public activity | Request release train, security backlog and enterprise feature split. |
| Insomnia developer tool R&D | GitHub metadata | verified public activity | Review issue aging, monetization, telemetry/privacy and cloud-storage adoption. |
| Mesh/APIOps/docs ecosystem | GitHub metadata | verified public activity | Request roadmap dependencies, maintainer allocation and enterprise support policy. |
GitHub activity is not a full engineering-capacity measure.
Not a resourcing roadmap.
partially verified confidence: medium
Public pipeline signals include Ascent, AI Gateway, Metering & Billing and broader platform surfaces; timing, development cost and customer commitments are not public.
| Pipeline item | Evidence | Verification status | Follow-up |
|---|---|---|---|
| Ascent AI-powered API migration | Kong Launches Ascent to eliminate legacy API migration risk and get enterprises agentic AI-ready | verified public announcement | Request launch plan, backlog, signed pilots, pricing and delivery margin. |
| AI Gateway / AI Management | AI Gateway navigation and LLM support in pricing | verified public product | Request customer usage, model-provider integrations, safety controls and roadmap. |
| Metering & Billing / API monetization | Pricing models docs list free, flat fee, usage-based, tiered, package and dynamic pricing | verified documentation | Request customer adoption, revenue and compliance/payment-processor dependencies. |
| Event Gateway, Catalog, Developer Portal, Identity, Observability | Developer docs top navigation | verified public surface | Request SKU roadmap, revenue by product and sunset/maintenance plans. |
R&D cost, timing and expected ROI are private.
Public evidence supports founder-led leadership and a global 600+ employee workforce claim, but HRIS, compensation, attrition, employment agreements and stock-plan details are private.
partially verified confidence: medium
Kong publishes a leadership roster but not a full organization chart or reporting lines.
| Name | Public evidence | Verification status | Diligence need |
|---|---|---|---|
| Augusto Marietti | Kong about page and SEC Form D related-person list | verified public role | Employment agreement, equity, board minutes, background check. |
| Marco Palladino | Kong about page and SEC Form D related-person list | verified public role | Employment agreement, IP assignment, equity, succession. |
| Juliette Rizkallah / Gunjan Aggarwal / Joe Eskenazi / Bruce Felt | Kong about page leadership section | verified public roster | Tenure, prior roles, compensation, retention and references. |
| Reza Shafii / Saju Pillai / Ken Kim | Kong about page leadership section | verified public roster | Org ownership, roadmap and key-person dependencies. |
Full biographies, ages and employment history were not independently verified.
Actual org chart and reporting lines require company confirmation.
partially verified confidence: medium
Careers page claims 600+ employees in 25+ countries, but historical/projected headcount by function/location is not public.
| Signal | Verification status | Risk / implication | Diligence request |
|---|---|---|---|
| Global headcount | partially_verified company claim | Scale supports enterprise operations but raises management complexity | HRIS by function/location and contractor split. |
| Remote culture | partially_verified company claim | Remote operations require strong security/compliance and manager cadence | Remote work policy, security training, entity/PEO structure and employment-law review. |
| Benefits / retention | partially_verified public benefits | Benefits support retention but cost and equity dilution are unknown | Compensation bands, stock plan, refresh policy and retention analytics. |
| Projected hiring | unverified for projection | Hiring plan may affect burn and execution | Approved headcount plan, recruiting pipeline, attrition and budget. |
Headcount should be independently verified with payroll/HRIS.
600 is a lower-bound representation of 600+.
partially verified confidence: medium
Kong public about page lists senior management; detailed biographies, references and background checks were not public.
not publicly verifiable confidence: low
Public benefits include stock options for most employees, but executive compensation, employment agreements and benefit-plan costs are private.
not publicly verifiable confidence: low
Careers page says stock options are offered to most Kongers, but stock-plan size, grants, vesting and option pool are private.
not publicly verifiable confidence: low
No public employee-relations schedule, claims or investigations were available in reviewed sources.
| Topic | Verification status | Why it matters | Request |
|---|---|---|---|
| Personnel turnover last two years | not_publicly_verifiable | Attrition affects product delivery and support continuity | Monthly attrition by function/location/level and regretted-loss analysis. |
| Significant employee-relations problems | not_publicly_verifiable | Remote global workforce increases labor-law and culture risks | Employee-relations claims, investigations, settlements and counsel memos. |
| Benefit-plan retention impact | partially_verified public benefits; private outcomes | Retention programs influence dilution and morale | Benefit utilization, equity refreshes, compensation benchmarking and engagement survey. |
No private HR records were available.
not publicly verifiable confidence: low
No turnover data for the last two years was public; benefits and headcount claims provide only indirect retention signals.
Public legal diligence is incomplete. SEC filings and GitHub licenses are available, but litigation, regulatory, insurance, material-contract, IP-registration and compliance schedules require counsel and company records.
not publicly verifiable confidence: low
No comprehensive public docket search or company litigation schedule was available; pending lawsuits against Kong are not publicly verifiable in this report.
| Case / category | Verification status | Risk | Counsel request |
|---|---|---|---|
| Civil litigation against Kong Inc. | not_publicly_verifiable | Unknown damages, injunctions, customer disputes or employment claims | Run federal/state docket, arbitration, demand-letter and settlement schedule review. |
| IP/trademark/patent claims against Kong | not_publicly_verifiable | Brand, patent or OSS-compliance exposure | Run USPTO, PTAB, district court, ITC and OSS compliance review. |
| Employment/labor claims | not_publicly_verifiable | Remote/global workforce labor exposure | Request claims, settlements, investigations and employment-practices insurance. |
Do not treat this as legal clearance.
Timeline is not a legal-opinion substitute.
Heatmap reflects public-diligence evidence strength and unresolved private-data gaps.
not publicly verifiable confidence: low
No public schedule of lawsuits initiated by Kong was available.
| Matter type | Verification status | Why it matters | Counsel request |
|---|---|---|---|
| Contract/customer/supplier claims initiated by Kong | not_publicly_verifiable | May signal collections, customer disputes or supplier dependency | Request litigation schedule and material disputes. |
| IP enforcement initiated by Kong | not_publicly_verifiable | Can affect defensibility and legal spend | Run trademark/patent/copyright docket searches and request enforcement history. |
| Employment or restrictive-covenant claims | not_publicly_verifiable | May affect recruiting/retention and reputation | Request all initiated claims and threatened disputes. |
Company counsel response required.
not publicly verifiable confidence: low
Kong appears to be a software/SaaS company with a remote workforce claim, but EHS, workers-comp and employment-safety liabilities are not public.
| Agency / domain | Verification status | Potential exposure | Follow-up |
|---|---|---|---|
| Privacy/data protection | not_publicly_verifiable | API/AI traffic may process customer data; DPAs/SOC/privacy controls needed | Request privacy policies, DPAs, subprocessors, incidents and regulator correspondence. |
| Security/compliance certifications | not_publicly_verifiable | Enterprise buyers require security attestations; gaps can delay deals | Request SOC 2, ISO, pen tests, vulnerability management and incident logs. |
| Environmental and employee safety | not_publicly_verifiable | Likely lower than hardware/manufacturing, but office/remote compliance still matters | Request EHS policies, workers comp, workplace claims and global employment compliance. |
No adverse regulatory-action search should be inferred from this limited public review.
partially verified confidence: medium
Public repository licenses are visible, but official trademark, patent, copyright and assignment schedules are not fully verified.
| Asset / category | Public status | Verification status | Diligence request |
|---|---|---|---|
| Kong Gateway / Kong OSS | Apache-2.0 licensed public repo; “The API and AI Gateway” | verified public license/repo | Contributor agreements, trademark ownership, commercial modules and SBOM. |
| Insomnia | Apache-2.0 licensed public API client repo | verified public license/repo | Acquisition/IP chain, cloud-service terms, telemetry/privacy and trademark filings. |
| Kuma / decK / developer docs | Apache-2.0 for Kuma/decK; MIT for docs repo | verified public license/repo | Governance, CLA, dependency license scanning and enterprise packaging rights. |
| Trademarks, patents, copyrights | Not fully verified | not_publicly_verifiable | Official trademark/patent/copyright schedules, assignments, oppositions and license agreements. |
Open-source license facts do not prove Kong owns all marks/patents.
not publicly verifiable confidence: low
Insurance coverage, limits, exclusions and claims history are not public.
| Schedule | Verification status | Why it matters | Request |
|---|---|---|---|
| Insurance coverage | not_publicly_verifiable | Cyber/E&O/D&O coverage is critical for API infrastructure provider | Insurance certificates, policies, limits, exclusions, claims history. |
| Customer contracts / SLAs / DPAs | partially_verified packaging; private terms | SLA credits, liability caps, security terms and DPAs drive risk | Top customer MSAs, SLAs, DPAs, liability caps and security addenda. |
| Partner, marketplace and supplier contracts | partially_verified relationships; private terms | Take rates, co-sell obligations and termination rights affect revenue and resilience | Marketplace, reseller, SI, cloud, model-provider and subprocessor contracts. |
| Open-source and commercial license commitments | partially_verified | OSS obligations, indemnity and enterprise license terms affect monetization | OSS policy, CLA, third-party license scan and standard enterprise license terms. |
Legal document review is required under NDA.
not publicly verifiable confidence: low
Customer, supplier, partner, marketplace, DPA, SLA and enterprise license contracts are not public, despite public pricing/partner evidence.
not publicly verifiable confidence: low
No complete regulatory-action search was performed; public sources do not verify absence of privacy, security, employment or other agency issues.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists Kong as a unicorn with a $2B valuation, 12/31/2020 date joined, U.S./San Francisco location, Enterprise Tech industry and investors NEA, CRV and Index Ventures. | verified high | SRC-001 |
| EC-002 | CB Insights profiles Kong as founded in 2009, formerly known as Mashape, based in San Francisco, alive at Series E stage, with $345.5M total funding and a $175M last raise. | partially verified medium | SRC-002 |
| EC-003 | SEC EDGAR identifies Kong Inc. as a Delaware corporation, CIK 0001528548, formerly Mashape Inc., with San Francisco address and no public ticker symbols in the submissions JSON. | verified high | SRC-003 |
| EC-004 | Kong filed a 2024 Form D disclosing a $99,999,956 total offering amount, $79,999,961 sold, $19,999,995 remaining and 12 investors. | verified high | SRC-004 |
| EC-005 | Kong filed a 2020 Form D disclosing a $100,000,000 total offering amount, $92,999,964 sold, $7,000,036 remaining and 10 investors. | verified high | SRC-005 |
| EC-006 | Kong filed a 2018 Form D disclosing a $54,699,973 total offering amount, $49,699,970 sold, $5,000,003 remaining and 8 investors. | verified high | SRC-006 |
| EC-007 | Kong says its story began in Milan in 2009 with schoolmates Augusto Marietti and Marco Palladino; the about page lists current leadership including Augusto as CEO/co-founder and Marco as CTO/co-founder. | verified medium | SRC-007 |
| EC-008 | Kong careers page claims a remote global company with 600+ employees in 25+ countries and lists employee benefits including stock options offered to most Kongers. | partially verified medium | SRC-008 |
| EC-009 | Kong pricing page describes Konnect Free Trial, Plus and Enterprise packages, including AWS Marketplace purchase/trial paths and custom annual pricing for Enterprise. | verified medium | SRC-009 |
| EC-010 | Kong Gateway product page claims a cloud-native API gateway with 50K+ transactions per second per node, architectural flexibility across clouds/platforms/protocols and hybrid/multi-cloud positioning. | partially verified medium | SRC-010 |
| EC-011 | Kong developer navigation and homepage data list a broad platform: Konnect, Insomnia, Gateway, AI Gateway, Event Gateway, Service Mesh, Ingress Controller, Operator, Observability, Metering & Billing, Identity, Developer Portal and Catalog. | verified high | SRC-014SRC-025 |
| EC-012 | Kong pricing and product navigation explicitly include LLM and AI Gateway support as part of current packaging. | verified medium | SRC-009SRC-025 |
| EC-013 | Kong customer page lists public case studies and outcome claims for Verifone, Security Bank, First Abu Dhabi Bank and videos for Rabobank, Richemont and Sky Italia. | partially verified medium | SRC-011 |
| EC-014 | Kong partner page describes cloud providers/hyperscalers, global system integrators, premium technology partners and channel partners as partner categories. | verified medium | SRC-012 |
| EC-015 | Kong press room shows active 2026 announcements including Ascent launch and ADEO partnership, supporting operational activity and roadmap signaling. | verified medium | SRC-013 |
| EC-016 | GitHub metadata for Kong/kong describes it as “The API and AI Gateway,” Apache-2.0 licensed, with 43,584 stars, 5,150 forks, 151 open issues and a 2026-06-10 pushed_at timestamp. | verified high | SRC-015 |
| EC-017 | GitHub metadata for Kong/insomnia describes an open-source cross-platform API client for GraphQL, REST, WebSockets, SSE and gRPC, Apache-2.0 licensed, with 38,495 stars, 2,279 forks and 854 open issues. | verified high | SRC-016 |
| EC-018 | Kong developer.konghq.com repository is public, MIT licensed, pushed on 2026-06-13 and contains source code for Kong developer documentation. | verified high | SRC-017 |
| EC-019 | Kong Metering & Billing documentation supports multiple pricing models, including free, flat fee, usage-based, tiered, package and dynamic pricing. | verified high | SRC-024 |
| EC-020 | Google Cloud positions Apigee as native API management to build, manage and secure APIs with scale, security and performance, including pay-as-you-go or subscription pricing. | verified medium | SRC-018 |
| EC-021 | Tyk’s public GitHub repository describes an open-source API Gateway written in Go supporting REST, GraphQL, TCP and gRPC protocols, with 10,739 stars and 1,154 forks. | verified high | SRC-019 |
| EC-022 | Solo.io Gloo public GitHub repository describes “The Cloud-Native API Gateway and AI Gateway,” Apache-2.0 licensed, with 161 stars and 13 forks. | verified high | SRC-020 |
| EC-023 | Kuma repository is a multi-zone service mesh for containers, Kubernetes and VMs, built with Envoy, Apache-2.0 licensed, with 3,965 stars and a 2026-06-12 pushed_at timestamp. | verified high | SRC-021 |
| EC-024 | Kong/deck repository describes decK as configuration management and drift detection for Kong, Apache-2.0 licensed, pushed in 2026. | verified high | SRC-022 |
| EC-025 | Kong’s careers page publicly describes benefits including flexible time off, stock options for most Kongers, sabbatical program and virtual events. | partially verified medium | SRC-008 |
| EC-026 | Public sources reviewed did not provide investment-grade evidence of pending litigation, initiated litigation, insurance coverage, material contracts, complete IP registrations, regulatory correspondence or safety liabilities. | not publicly verifiable low | SRC-003SRC-007SRC-013SRC-015SRC-016 |
| EC-027 | Material public IP/license evidence includes Apache-2.0 licensing for Kong/kong, Kong/insomnia, Kuma and decK and MIT licensing for developer.konghq.com; trademark/patent ownership was not fully verified. | partially verified medium | SRC-015SRC-016SRC-017SRC-021SRC-022 |
| EC-028 | Public evidence supports Kong’s eligibility for diligence as an active private startup unicorn: CB Insights lists it as a unicorn and alive Series E profile; SEC has no ticker in submissions; company pages, press room, careers and GitHub repositories are active. | verified high | SRC-001SRC-002SRC-003SRC-008SRC-013SRC-015 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.