Entrepreneur
Stay in the game long enough, and every software investor has encountered the red flag: “This business is 100% dependent on Shopify, Salesforce or Amazon.” Investors are right to be cautious. For well-documented reasons spanning concentration risk, customer acquisition fragility, API vulnerability, margin exposure, and more, such dynamics pose material risk to a startup.
And yet, platform dependency isn’t binary — it exists on a spectrum.
What is platform risk?
Platform risk describes a company’s reliance on a 3rd party ecosystem, be it for distribution, infrastructure, monetization or otherwise. For a startup, tying yourself to an existing giant can shortcut growth by way of accelerated distribution (think built-in access to large customer bases, which can dramatically lower CAC and limit the need for outbound sales), superior product experience (deep integrations with a single platform can lead to improved UX vs. being a standalone tool) and instant legitimacy (users often prefer tools marked as ‘approved’ or ‘recommended’ by their core platform provider). Large, public SaaS businesses like Klaviyo, Veeva and Jamf all benefited from such effects in their early days.
The ‘risk’ in platform risk arises when underlying platform fundamentals are changed, often without warning. Examples span Meta’s API throttling post-Cambridge Analytica scandal, Apple’s sudden privacy changes following its 2021 App Tracking Transparency update, and Shopify’s launch of native products in categories once dominated by partners.
Without proper risk mitigation, a company’s unit economics, or even its fundamental value proposition, can be upended overnight.
If platform dependency is dynamic by nature, avoiding it outright can mean forgoing opportunities to generate differentiated returns. The question then becomes how to stratify risk, identify downside protection, and ultimately refine willingness to pay.
Related: Top Cyber Risks of 2025: Supply Chains, Geopolitics, and Cybercrime
When evaluating businesses with platform dependency, I find the following five questions can help calibrate interest level:
1. Are incentives aligned with the underlying platform?
If a business positively impacts the economics of its underlying platform, the risk of pricing compression may be lower. Veeva provides an interesting case study. Originally built on Salesforce’s platform, Veeva sold into life sciences, a vertical Salesforce was not actively pursuing at the time.
By bringing net new customers into the Salesforce ecosystem, as well as paying Salesforce substantial licensing fees tied to Veeva customer usage, Veeva created a win-win, non-competitive relationship with its underlying platform. Over time, this symbiosis nurtured an active, collaborative relationship between parties, with both companies publicly praising a partnership built on mutual commercial benefit.
2. Who owns the end-user relationship?
If the underlying platform owns the end-user, disintermediation risk is high. The classic case here is Zynga and Meta. In its IPO filings, Zynga revealed that virtually all of its traffic and monetization ran through Meta, with Meta controlling the user relationship and key rules of engagement.
When Meta required Zynga to use Facebook Credits as its primary payment system (compressing Zynga’s margins) and shifted its News Feed algorithm (reducing Zynga’s viral distribution model), Zynga’s daily active users nearly halved within 12 months.
Because Zynga never owned its players’ emails or billing rails, it was unable to effectively shift users off-platform in response.
Related: SaaS vs. Custom Software — Which Is Best for Your Business?
3. Does the product embed itself deeply in workflows, or just sit on a feature layer?
The deeper a business embeds itself in the mission-critical workflows of its end-users, the less likely it can be easily replaced by its underlying platform.
Atlassian’s relationship with Microsoft is a good example. While Microsoft could have disintermediated Atlassian’s Jira product by folding lightweight project management features into Teams or Azure DevOps, Atlassian strategically extended Jira into Confluence (documentation), Bitbucket (code) and 3rd-party developer integrations (e.g., CI/CD, observability, test automation) over time.
With Jira serving as a system of record at the heart of daily engineering workflows, Atlassian has fortified its stickiness – migration would mean an extremely costly exercise of uprooting sprint histories, backlog workflows and compliance-tracked audit trails.
4. Does the underlying platform have a history of developing its 3rd party ecosystem?
Not all platforms are created equal. Some platforms, such as Shopify, have famously nurtured their 3rd party ecosystems, deliberately creating alignment between themselves and their vendors. In the case of Shopify, examples span favorable Partner Programs (providing certifications, co-marketing and revenue-sharing opportunities for top vendors), robust developer tooling and API access (allowing partners to build sophisticated products beyond surface-level plugins), and a vibrant App Store (giving developers a direct channel to reach Shopify merchants).
5. Does the CEO have a defined strategy to derisk the business over time?
While the questions above can help an investor triangulate interest level, perhaps the most useful data point is management’s forward strategy (or lack thereof). While platform risk exists on a spectrum, any level of dependency inherently leaves a business exposed to policy changes, economic shifts and disintermediation.
Without a thoughtfully defined plan to evolve beyond dependency, whether that be by owning the customer relationship, investing in proprietary infrastructure, diversifying revenue streams, or expanding into adjacent platforms, such risk will compound with scale. As a result, hearing the top-down strategic thought needed to successfully diversify over time is paramount.
Platform dependency shouldn’t be inherently disqualifying, but rather one of many variables used to evaluate an investment. By understanding where a company sits on the risk spectrum (and ensuring management has a thoughtful plan to evolve beyond it), what initially presents as a red flag may actually be an opportunity for outsized, risk-adjusted returns.
Stay in the game long enough, and every software investor has encountered the red flag: “This business is 100% dependent on Shopify, Salesforce or Amazon.” Investors are right to be cautious. For well-documented reasons spanning concentration risk, customer acquisition fragility, API vulnerability, margin exposure, and more, such dynamics pose material risk to a startup.
And yet, platform dependency isn’t binary — it exists on a spectrum.
What is platform risk?
Platform risk describes a company’s reliance on a 3rd party ecosystem, be it for distribution, infrastructure, monetization or otherwise. For a startup, tying yourself to an existing giant can shortcut growth by way of accelerated distribution (think built-in access to large customer bases, which can dramatically lower CAC and limit the need for outbound sales), superior product experience (deep integrations with a single platform can lead to improved UX vs. being a standalone tool) and instant legitimacy (users often prefer tools marked as ‘approved’ or ‘recommended’ by their core platform provider). Large, public SaaS businesses like Klaviyo, Veeva and Jamf all benefited from such effects in their early days.
The ‘risk’ in platform risk arises when underlying platform fundamentals are changed, often without warning. Examples span Meta’s API throttling post-Cambridge Analytica scandal, Apple’s sudden privacy changes following its 2021 App Tracking Transparency update, and Shopify’s launch of native products in categories once dominated by partners.
Read the full article here
