Back to GetFilings.com





- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

------------------------

FORM 10-K

/X/ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d)
OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBER 31, 1999

COMMISSION FILE NUMBER: 000-26223

------------------------

TUMBLEWEED COMMUNICATIONS CORP.

(Exact name of registrant as specified in its charter)



DELAWARE 94-3336053
(State of other jurisdiction (I.R.S. Employer
of incorporation or Identification No.)
organization)


700 SAGINAW DRIVE

REDWOOD CITY, CA 94063

(Address of principal executive offices, including zip code)

Registrant's telephone number, including area code (650) 216-2000

SECURITIES REGISTERED PURSUANT TO SECTION 12(b) OF THE ACTS:
None

SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT:
Common Stock, $0.001 Par Value per Share

INDICATE BY CHECK MARK WHETHER THE REGISTRANT (1) HAS FILED ALL REPORTS
REQUIRED BY SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 DURING
THE PRECEDING 12 MONTHS (OR FOR SUCH SHORTER PERIOD THAT THE REGISTRANT WAS
REQUIRED TO FILE SUCH REPORTS), AND (2) HAS BEEN SUBJECT TO SUCH FILING
REQUIREMENTS FOR THE PAST 90 DAYS. YES /X/ NO / /

INDICATE BY CHECK MARK IF DISCLOSURE OF DELINQUENT FILERS PURSUANT TO ITEM
405 OF REGULATION S-K IS NOT CONTAINED HEREIN, AND WILL NOT BE CONTAINED, TO THE
BEST OF REGISTRANT'S KNOWLEDGE, IN DEFINITIVE PROXY OR INFORMATION STATEMENTS
INCORPORATED BY REFERENCE IN PART III OF THIS FORM 10-K OR ANY AMENDMENT TO THIS
FORM 10-K. / /

THE APPROXIMATE AGGREGATE MARKET VALUE OF THE COMMON STOCK HELD BY
NON-AFFILIATES OF THE REGISTRANT, BASED UPON THE LAST SALE PRICE OF THE COMMON
STOCK REPORTED ON THE NASDAQ NATIONAL MARKET ON FEBRUARY 29, 2000 WAS
APPROXIMATELY $1,947,214,012.

THE NUMBER OF SHARES OF COMMON STOCK OUTSTANDING AS OF FEBRUARY 29, 2000 WAS
25,621,237.

DOCUMENTS INCORPORATED BY REFERENCE

Certain parts of the Tumbleweed Communications Corp. Proxy Statement relating to
the annual meeting of stockholders to be held on May 15, 2000 (the "Proxy
Statement") are incorporated by reference into Part III of this Annual Report on
Form 10-K.

- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------

SPECIAL NOTE ON FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements within
the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the
Securities Exchange Act of 1934, which are subject to the "safe harbor" created
by those sections. The forward-looking statements are based on Tumbleweed
Communications Corp.'s current expectations and projections about future events,
including, but not limited to, implementing its business strategy; attracting
and retaining customers; obtaining and expanding market acceptance of the
products and services it offers; forecasts of Internet usage and the size and
growth of relevant markets; rapid technological changes in its industry and
relevant markets; and competition in its market. Discussions containing such
forward-looking statements may be found in "Management's Discussion and Analysis
of Financial Condition and Results of Operations." In some cases,
forward-looking statements can be identified by terminology such as "may,"
"will," "should," "could," "predicts," "potential," "continue," "expects,"
"anticipates," "future," "intends," "plans," "believes," "estimates," and
similar expressions. These forward-looking statements are based on current
beliefs, expectations and assumptions and involve certain risks and
uncertainties that could cause actual results, levels of activity, performance,
achievements and events to differ materially from those implied by such
forward-looking statements. These forward-looking statements are made as of the
date of this Annual Report on Form 10-K. Tumbleweed disclaims any obligation to
update these forward-looking statements or to explain the reasons why actual
results may differ. The risks and uncertainties under the caption "Management's
Discussion and Analysis of Financial Condition and Results of Operations--Risks
and Uncertainties" contained herein, among other things, should be considered in
evaluating Tumbleweed's prospects and future financial performance.

TUMBLEWEED COMMUNICATIONS CORP.
1999 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS



PAGE
--------

PART I

Item 1 Business.................................................... 4

Item 2 Properties.................................................. 16

Item 3 Legal Proceedings........................................... 15

Item 4 Submission of Matters to a Vote of Security Holders......... 16

PART II

Item 5 Market For The Registrant's Common Equity And Related
Stockholder Matters....................................... 17

Item 6 Selected Financial Data..................................... 18

Item 7 Management's Discussion And Analysis of Financial Condition
And Results of Operations................................. 21

Item 8 Financial Statements And Supplementary Data................. 37

Item 9 Changes In And Disagreements With Accountants On Accounting
And Financial Disclosure.................................. 61

PART III

Item 10 Directors And Executive Officers............................ 61

Item 11 Executive Compensation...................................... 63

Item 12 Security Ownership of Certain Beneficial Owners And
Management................................................ 63

Item 13 Certain Relationships And Related Transactions.............. 63

PART IV

Item 14 Exhibits, Financial Statement Schedules And Reports on Form
8-K....................................................... 64


TRADEMARKS

Tumbleweed-Registered Trademark-, WorldSecure-Registered Trademark- and
Worldtalk-Registered Trademark- are registered trademarks and Integrated
Messaging Exchange-TM-, IME-TM-, Messaging Management System (MMS)-TM-,
WorldSecure/Mail-TM-, Secure Inbox-TM-, Secure Envelope-TM-, Tumbleweed IME
Platform-TM-, Tumbleweed IME Applications-TM-, IME Statements-TM-, IME
Developer-TM-, IME Messenger-TM-, IME Personalize-TM-, and IME Alert-TM- are
trademarks of Tumbleweed Communications Corp.

3

PART I

ITEM 1--BUSINESS.

OVERVIEW

Tumbleweed is a leading provider of advanced e-mail solutions for business
communications. Our products and services enable businesses to create secure,
managed, online communication channels, leveraging established e-mail networks
and enterprise applications. With Tumbleweed's Integrated Messaging Exchange
(IME) we combine an open, scalable messaging software platform, a suite of
applications for specific business processes, and a broad range of professional
services capabilities to provide a secure channel for both sending and receiving
business critical information online.

On January 31, 2000, Tumbleweed acquired Worldtalk and Worldtalk became a
wholly owned subsidiary of Tumbleweed. Worldtalk's WorldSecure/Mail products are
now offered by Tumbleweed under the Tumbleweed Messaging Management System (MMS)
brand. With Tumbleweed MMS, we allow enterprises to protect and control their
Internet communication by automatically filtering, monitoring and archiving
messaging traffic, and by dynamically routing sensitive messages and documents
through appropriate channels.

Using the Tumbleweed MMS and Tumbleweed IME solutions, either together or
separately, businesses are able to create, enhance and control significant new
channels for secure communication with their customers and partners over the
Internet. When combined, Tumbleweed IME and Tumbleweed MMS can be used both to
create a sophisticated online communication channel and to selectively route
e-mail traffic over this channel without requiring any changes in user behavior
or existing e-mail applications.

INDUSTRY BACKGROUND

Internet-based e-mail has quickly claimed its place as one of the most
ubiquitous and useful forms of business communications. International Data
Corporation estimates that the number of electronic mailboxes will grow from
approximately 315 million as of July 1999 to over 750 million by 2005.
International Data Corporation further estimates that the number of e-mail
messages sent worldwide will grow from 5.3 billion per day in 1999 to more than
26 billion per day by 2005.

Despite the low cost, convenience, immediacy and reach of e-mail, using it
as a platform for the delivery of business applications requires security and
functionality that standard Internet e-mail cannot provide. Thus, business
processes which may in part be automated and online still rely on physical
delivery when outbound communication is involved. To develop new, secure
channels for interactive communication, businesses require efficient,
cost-effective solutions that leverage their investment in e-mail and the
Internet. These solutions will allow businesses to capture the additional
opportunities afforded by the new communication channels while simultaneously
reducing operational cost.

Businesses also need solutions for managing business communications already
being conducted online using standard Internet e-mail. Although most businesses
have well-developed policies regarding how offline business communications
should be handled, corresponding policies for Internet communication are often
not well established, resulting in risk and exposure to financial liability.
Businesses seek a reliable means for managing the flow of online communications
in light of security, confidentiality, archiving, regulatory and ethical
considerations.

TUMBLEWEED'S PRODUCTS

Tumbleweed offers two complementary product lines. Tumbleweed's Integrated
Messaging Exchange (IME), our messaging solution, combines advanced security,
tracking and personalization features in a single, comprehensive messaging
environment. Tumbleweed IME uses public networks to provide efficient business
communications over the Internet. Tumbleweed IME enables businesses to

4

build a proactive communication channel through an integrated online solutions,
resulting in the secure delivery of sensitive information to anyone, anywhere,
anytime. Tumbleweed's Messaging Management System (MMS), formerly named
WorldSecure/Mail, enables businesses to define and enforce Internet
communication policies and manage their corporate intellectual assets by
filtering content, archiving messages and applying security to e-mail traffic.
Tumbleweed is also developing products that fully integrate its IME and MMS
technologies, providing a comprehensive security and policy solution for
messaging.

TUMBLEWEED'S INTEGRATED MESSAGING EXCHANGE (IME)

Tumbleweed's IME combines an advanced software platform and customized
applications to establish a vital Internet communication channel between a
business and its customers, suppliers and partners. This channel enables
businesses both to greatly expand and exploit the communication power of e-mail
and to fully integrate existing business processes with the Internet. Once
established, the IME channel can be used to securely send sensitive information
to anyone with Internet access. When sensitive information is flowing over
Tumbleweed's IME, deliveries can be personalized, tracked and archived, making
business communication more secure.

Tumbleweed IME enables businesses to deliver secure and personalized
outbound information in a variety of ways. This information can be distributed
within e-mail messages, on the Internet via the Tumbleweed Secure Inbox, a
protected repository for receiving and managing secure online communications, or
through a combination of both e-mail and the Internet. IME has the unique and
patented capability of taking an e-mail message recipient to a unique web page
that is relevant to that recipient. In addition to being a vehicle for secure
online communication services, Tumbleweed IME provides features to manage
personalized content, track recipient transactions such as receipt or response,
and integrate the system into existing back-office processes.

We sell Tumbleweed IME and related services to service providers that
provide their customers with secure, reliable and trackable communication
services for a fee. We also sell Tumbleweed IME products and services directly
to enterprises in selected strategic markets, such as the banking, financial
services, telecommunications and healthcare industries, enabling them to offer
Tumbleweed-based services to their employees, customers, suppliers and partners.
The Tumbleweed IME solution provides the following benefits to our customers:

- COMPREHENSIVE TECHNOLOGY. Tumbleweed IME is designed to provide a secure,
efficient and cost-effective method for communicating important
information online. Our solution contains all of the core technology,
integration tools and professional services necessary to incorporate
advanced messaging features into existing environments. Tumbleweed IME can
be modified to meet the unique communication needs of specific customers,
and can easily be integrated into existing environments. Because
Tumbleweed has multiple IME applications available for use with the IME
Platform, additional services can be added to an IME environment, enabling
businesses to deliver several types of information over a single channel.

- MULTI-LEVEL SECURITY. In many cases, the reason business-critical
information is not communicated online is the lack of security features
available in existing e-mail solutions. Through our innovative and unique
implementation of industry-standard security technologies, we are able to
offer secure online communication services to anyone with e-mail and
Internet access. Depending on the needs of the sender, security features
can include encryption during transmission and storage, password
protection for user authentication, or for highly sensitive communication,
certificate-based signing and additional encryption features. Any level of
security can easily be employed without requiring the sender and recipient
to have the same messaging software.

- EASY, UNIVERSAL ACCESS. A successful advanced communication system must be
able to reach anyone on the Internet. Tumbleweed IME is based on open
Internet standards, and requires no

5

proprietary desktop software, protocols, or networks. Anyone with an
e-mail account and web access can use our solution to both send and
receive messages regardless of which e-mail system they use or the format
of the information included. Similarly, Tumbleweed IME can be integrated
with an enterprise's existing back office systems to enable automated
communication. Because no new application or user interface is needed,
there is no costly training or desktop deployment associated with our
solution.

- PERSONALIZED COMMUNICATION. Communication of important business
information such as transaction confirmations or account statements
requires message customization for specific recipients. Using Tumbleweed
IME, businesses can automatically generate unique messages for each
individual, personalized with recipient-specific information and
preferences. In addition, our solution allows senders to create messages
targeting specific recipient preferences, demographics and communication
history. Tumbleweed IME also enables our customers to easily incorporate
marketing promotions into their business communication.

- SCALABLE ARCHITECTURE. Tumbleweed IME is designed to accommodate a variety
of online communication applications, ranging from small corporate
deployments to large enterprise installations supporting global service
offerings. Our scalable architecture allows customers to accommodate high
transaction volumes and implement desired levels of redundancy. Tumbleweed
IME components can be distributed across multiple servers, allowing for an
increasingly high volume of transactions while maintaining high standards
of performance, reliability and security. The ability to seamlessly handle
increasing transaction volumes is a key consideration for customers in
deploying an enterprise-class online communication system.

TUMBLEWEED IME PLATFORM AND APPLICATIONS

The Tumbleweed IME Platform includes the core functionality necessary for
preparing, securing, delivering and tracking electronic communications, and
provides the foundation on which businesses can build one or a series of online
communication applications. Because advanced services require high performance
and scalability, the Tumbleweed IME Platform has been designed to efficiently
handle millions of secure messages daily. The Tumbleweed IME Platform's flexible
architecture supports distributed execution of software components, allowing
customers to expand the service as their requirements grow. This scalability,
combined with advanced security and tracking features, enables customers to use
our technology as the foundation for a variety of online communication services.
Once installed, the IME Platform can be used for an array of
applications--allowing businesses to quickly develop and deploy multiple
services without having to re-invent or re-architect their environments.

Using the Tumbleweed IME Platform as a foundation, Tumbleweed IME
Applications integrate with e-mail and legacy systems, interact with existing
applications, and automate transactions and exchanges to provide a complete
internal and external communications solution for the enterprise. These
applications are built to integrate with and enhance specific business
processes. Current Tumbleweed IME Applications include:

IME MESSENGER. IME Messenger supports one-to-one communication between
individuals. Unlike regular e-mail, IME Messenger provides the secure, reliable
delivery and tracking required for confidential correspondence and group
collaboration. Using IME Messenger, businesses gain the control and security
associated with overnight delivery services without the expense and time
constraints.

IME STATEMENTS. IME Statements offers businesses an online alternative for
delivering sensitive, time-critical business documents--statements, invoices,
remittances, transaction confirmations, and other types of correspondence. Using
IME Statements, businesses can extract information directly from back-office
systems, format it automatically, and deliver it to customers or partners
securely via the Internet.

6

IME PERSONALIZE. IME Personalize extends secure IME-based customer
communications by automatically including targeted messages, personalized for
individual customers based on their behavior and preferences. Using IME
Personalize, businesses can save promotional dollars, improve response rates,
and attract and retain customers with a higher level of customer service.

IME ALERT. IME Alert enables businesses to proactively send customers
sensitive, business-critical information about news and events as they occur.
Customers can subscribe to a personalized set of secure, real-time notifications
based on conditions of interest to them.

IME DEVELOPER. IME Developer includes all of the tools necessary to
integrate secure, online communications into already established e-commerce
systems. IME Developer includes Server and Remote APIs, as well as sample code
and complete documentation.

FUTURE TUMBLEWEED IME APPLICATIONS. We plan to introduce additional
applications targeted at strategic industries such as insurance, banking,
manufacturing and healthcare. We also plan to introduce additional applications
to address specific business processes, such as direct marketing and security
policy management. Because the foundation for these applications will be the
Tumbleweed IME platform, we can take advantage of its numerous integration and
customization features to rapidly develop and deploy applications optimized for
specific industries or business processes.

TUMBLEWEED MESSAGING MANAGEMENT SYSTEM (MMS)

Tumbleweed MMS is a comprehensive solution for managing intellectual
property as it travels over the Internet. Tumbleweed MMS allows businesses to
control both the processes and pathways involved, through options for routing,
filtering, monitoring and archiving digital messages and documents. By defining
what is allowed in, what is allowed out, and how deliveries are secured and
sent, enterprises can enforce their communication policies, enhance their
corporate citizenship in the digital realm, and protect their intellectual
assets and system resources.

Tumbleweed MMS secures e-mail systems for e-business. A comprehensive
solution for centralized control over e-mail communications in and out of an
enterprise, MMS enables businesses to set policies for e-mail usage, security
and the treatment of corporate information assets. Tumbleweed MMS then enforces
those policies globally, when necessary dynamically creating secure
communication channels over the Internet to guarantee that confidential
information is delivered securely.

Tumbleweed MMS allows administrators and policy-makers to define and enforce
security policies to ensure the safe and efficient use of corporate e-mail
systems. While other solutions provide encryption, reporting or filtering
capabilities, only Tumbleweed MMS enables companies to apply virus scanning,
content control, access control, encryption, archiving and digital signature
policies universally across the enterprise.

Using a graphical, wizard-based interface, organizations can set MMS
policies that implement a wide range of e-mail countermeasures. These
countermeasures are applied to all messages that pass through a corporate
firewall, protecting networks and information assets, and allowing companies to
monitor and archive all Internet e-mail communications. The Tumbleweed MMS
solution provides the following benefits to our customers:

- IDENTIFICATION AND HANDLING OF SENSITIVE DIGITAL INFORMATION: Using
lexicons of keywords, Tumbleweed MMS scans messages and attachments
looking for specific information. For example, Tumbleweed MMS can screen
for confidential information, such as credit card numbers, medical
information, or legal advice; proprietary material, like business plans,
contracts, and sales figures; attachment types that are likely to carry
corporate assets or confidential information; or industry-specific
terminology, like "guaranteed return" in financial services, or diagnostic
codes in healthcare. When a policy violation is detected, Tumbleweed

7

MMS can apply any combination of countermeasures to protect the
information, the business relationship, and the company.

- MULTI-LEVEL SECURITY: With Tumbleweed MMS Security Manager, organizations
can create policies that automatically encrypt potentially sensitive
information traveling to and from certain servers using the S/MIME public
key of each organization. This allows companies to create S/MIME Virtual
Private Networks (VPNs) with longer-term business partners, such as law
firms, insurance companies, or suppliers. Tumbleweed MMS handles all
digital certificates at the server level, eliminating the need to deploy
desktop encryption or manage individual public keys. It is also
transparent to end users, allowing organizations to enforce encryption
policies centrally, while users continue to send messages as they would
normally would.

- DYNAMIC ROUTING BASED ON POLICY: Because business relationships are
dynamic, it doesn't always make sense to establish an S/MIME VPN, or
assume that all parties have S/MIME public keys and S/MIME-compatible
e-mail clients. But security solutions are only effective if they apply to
everyone within an organization, and everyone sending e-mail into that
organization. For ad-hoc communication with individuals, or short-term
communication with business partners or customers, Tumbleweed MMS policies
can transparently redirect messages to a secure delivery system, such as
Tumbleweed IME. Messages that are routed via Tumbleweed IME can be read by
any addressee with e-mail and Internet access. No special keys are
required. Recipients can also reply to messages using the same secure
channel, making Tumbleweed MMS an effective solution that ensures secure
two-way communication between a company and the outside world.

Our MMS products are useful in a wide variety of markets. For
example,Tumbleweed MMS solutions allow target organizations to comply with
corporate and ethical standards, federal and other governing regulations, and to
offer a higher level of service to their customers and partners. Three key
vertical market segments targeted by Tumbleweed MMS are:

- Legal--As more and more lawyers utilize Internet e-mail, their law firms
must define and enforce security policies in an effort to protect client
documents, shield privileged legal advice, and safeguard intellectual
property. Tumbleweed MMS solutions give legal firms the ability to protect
their e-mail networks while ensuring the privacy and integrity of e-mail
between lawyers and their clients and among lawyers via the encryption of
e-mail.

- Healthcare--Healthcare firms use Internet e-mail to communicate with
governmental agencies such as the FDA, or with clients, partners and
networks of doctors. Healthcare companies have identified information
security breaches as major threats to their businesses. Tumbleweed MMS
solutions in the healthcare industry are enabling a better level of
service to providers and physicians by allowing the safe exchange of
sensitive and confidential information, such as patient files, medical
claims, and information on eligibility and beneficiary status. Tumbleweed
MMS is making it possible for firms to set policies to ensure
doctor-patient confidentiality, regulate and secure Internet e-mail usage,
and protect patient records, hospital records, and hospital policies,
among other sensitive information, via the encryption of e-mail.

- Financial--Firms in the financial industry need to protect financial
information, secure communications with clients, and comply with
government regulations. Tumbleweed MMS solutions allow financial
institutions to leverage the Internet for the e-mail exchange of business-
critical information. Through the development and enforcement of corporate
security policies, Tumbleweed MMS solutions extend SEC regulations and
compliance to e-mail systems.

TUMBLEWEED PROFESSIONAL SERVICES

Our professional services organization provides all of the consulting,
integration engineering, custom application development training and educational
services and support necessary to build a unique online communication system
based on Tumbleweed's products, including initial planning,

8

business process analysis, security assessment, implementation services, data
center design, operational planning, training, quality assurance/accreditation,
installation, deployment and ongoing support.

The following are examples of the professional services we offer:

CUSTOM APPLICATION DEVELOPMENT, which extends the functionality of
Tumbleweed solutions with custom engineering. The result is a unique online
communication solution that can be deployed to precisely meet a company's
business needs.

INTEGRATION CONSULTING, which provides the development work required to
integrate Tumbleweed solutions with existing technology infrastructure,
including legacy systems, customer databases, support systems, and billing
systems.

DATA CENTER DESIGN AND INSTALLATION, which assists customers in designing
communication services based on Tumbleweed products, including determining
hardware requirements, backup processes and failure systems, and physically
implementing our solution in the customer's data center. Our professional
services organization also provides ongoing support of the customer's data
center.

TECHNICAL TRAINING AND SUPPORT, which provides the customer with formal
training in the administration and operation of Tumbleweed products and use of
the Tumbleweed IME application programming interfaces.

Professional services are performed for an additional fee and are offered in
conjunction with the licensing or deployment of Tumbleweed's products.

Tumbleweed's products are generally deployed in business-critical
environments, where highly responsive customer support is critical to the
continuing success of the deployed solution. We maintain a centralized technical
support group that is responsible for first-line and second-line customer
support as well as distribution of products and documentation updates. This
group works closely with our professional services and product development
organizations in order to ensure continuity in the areas of problem resolution
and priority response.

Maintenance and support contracts, which are typically for twelve months,
are offered concurrently with the initial license of a Tumbleweed product. These
contracts may be renewed annually and are generally priced at a percentage of
the list price of the licensed software. We also offer customer support
24 hours a day, 7 days a week, for those customers requiring around the clock
support. Pricing for such support is negotiated separately and is in addition to
the standard fees.

STRATEGY

Tumbleweed's objective is to be the leading provider of online business
communication services. Key elements of our strategy are to:

ESTABLISH TUMBLEWEED IME AS THE LEADING APPLICATION PLATFORM FOR SECURE
ONLINE COMMUNICATION SERVICES. We intend to establish Tumbleweed IME as the
standard platform upon which to build business-critical messaging applications.
Rather than designing Tumbleweed IME as a point-solution for a specific
application, we have designed it to be a broad-based application development
platform. As such, Tumbleweed IME can be extended to include a number of
different applications and includes support for a comprehensive, open
application programming interface. This application programming interface allows
us, and our customers, to rapidly build vertical, business-specific applications
on top of our Tumbleweed IME technology.

ESTABLISH TUMBLEWEED MMS AS THE LEADING APPLICATION IN STRATEGIC INDUSTRY
MARKETS. Through our Tumbleweed MMS direct sales force, we are pursuing key
accounts in strategic markets. These strategic markets initially include the
legal, banking, financial services, telecommunications and healthcare
industries. Through our direct sales force in each strategic market, we have
begun to secure key accounts and we intend to expand our business to other
similar customers within these markets. Our

9

successes in the strategic markets are intended to provide leverage to our
channel of service providers as they, in turn, pursue business in those
industries.

INCREASE THE AMOUNT OF E-MAIL TRAFFIC WE MANAGE AND ADD VALUE TO CUSTOMERS'
MANAGEMENT OF E-MAIL TRAFFIC. We intend to increase the amount of e-mail
traffic we manage by

- increasing sales to new customers,

- further penetrating our installed base of IME customers by selling them
additional IME and MMS products and applications,

- further penetrating our installed base of MMS customers, particularly by
selling them IME products and applications,

- using policies defined and enforced in our MMS products to drive secure
messaging traffic over IME, particularly in products that integrate IME
and MMS technology,

- increasing the marketing of Tumbleweed solutions, and

- increasing our support of the marketing efforts of our customers.

Importantly, we intend not to simply increase traffic but to add value by
providing our customers with tools to protect and manage their intellectual
property assets carried by online business communications systems.

CULTIVATE A CHANNEL OF KEY SERVICE PROVIDERS. We intend to leverage our
channel of service providers to expand our business into new strategic industry
markets as well as to pursue additional general purpose transactions. Service
providers fall into two major categories. First, some of our service providers
license Tumbleweed products in order to be able to provide additional
value-added services to their customers. These service providers include Pitney
Bowes Inc., Nippon Telegraph and Telephone Corporation, United Parcel Service,
the member posts of the International Post Corporation Technology, S.C. and
Hikari Tsushin, Inc., a major e-mail outsourcing service provider in Japan.
Second, some of our service providers license Tumbleweed products in order to be
able to provide additional value-added services to their customers in distinct
industries. These service providers include Toyo Information Systems Co., Ltd.
and UPAQ Ltd., electronic transferors of large, industrial file types. Our
service provider customers are helping to rapidly expand the market for secure
online communications through their brand recognition, extensive sales and
marketing resources and substantial services competencies.

ESTABLISH TUMBLEWEED IME AS THE INTERNATIONAL STANDARD FOR SECURE ONLINE
COMMUNICATION. We intend to establish Tumbleweed IME as an international
standard for secure online communication services by developing a significant
base of enterprise and service provider customers. We also intend to accomplish
this by capturing business with the national postal authorities. The national
postal authorities present a strategic business opportunity for Tumbleweed.
Postal authorities are highly trusted service providers in their respective
geographies and are uniquely able to dictate national standards for certified
online communication.

CREATE RECURRING TRANSACTION-BASED REVENUE STREAMS. To create a
predictable, recurring revenue stream, we intend to generate revenue based on
the volume of messaging sent through Tumbleweed IME and Tumbleweed MMS.
Tumbleweed products may be used by a particular customer on-site at the customer
premises or used as an outsourced service. In addition, Tumbleweed's MMS
products may be configured to screen e-mail messages for sensitive content and
automatically route those messages through Tumbleweed IME. In each case,
customers are charged a software license fee plus any related professional
service fees, supplemented by transaction-based fees. The amount of these
transaction fees varies depending on customer usage as evidenced by the volume
of messages sent through Tumbleweed IME and Tumbleweed MMS.

10

EXPAND INTO ACCOUNTS AFTER FIRST SECURING BUSINESS-CRITICAL
APPLICATIONS. The sophistication of the Tumbleweed IME and Tumbleweed MMS
systems enable us to first target those business-critical applications that
require the highest degrees of security and tracking within an enterprise.
Having secured these high-value applications, we can then expand our focus to
include other messaging applications within the same enterprise. Customers
benefit through the ability to use Tumbleweed solutions as the foundation for
all of their enterprise messaging needs, from high-end to low-end applications.
Our ability to address the entire spectrum of an enterprise's communication
service needs should enable us to compete favorably against those companies
whose technologies are only suited to lower-end communications applications.

PROVIDE COMPREHENSIVE PROFESSIONAL SERVICES. Our full outsourcing services
enable our customers to reduce their cost of ownership and deployment time of
our solutions, thereby helping reduce our sales cycle to those enterprises.
Enterprise customers have the option of deploying Tumbleweed products either on
their premises or outsourcing the deployment to Tumbleweed. We complement our
outsourcing services with a full breadth of professional and consulting
services. These services are comprehensive, end-to-end, and designed to help
customers implement Tumbleweed IME-based applications and Tumbleweed MMS as
rapidly as possible. The services include business-specific applications
consulting, software development, training and education and complete technical
support.

CUSTOMERS AND MARKETS

Our customers are businesses for which Tumbleweed IME has created new
opportunities to bring existing communications and business processes online.
These customers fall into two broad categories. Service providers use
Tumbleweed IME to provide secure, outsourced, online communications services to
their business customers. Examples of service providers include United Parcel
Service, Nippon Telegraph & Telephone Corporation, and Pitney Bowes, Inc.
Enterprise customers utilize Tumbleweed IME to provide secure online
communications services originating within their own enterprise to employees,
suppliers, and customers. Examples of enterprise customers include The Chase
Manhattan Bank, American Express Travel Related Services Company, Inc., Datek
Online Holdings Corp., and the European Union--Joint Research Centre.

Service providers and enterprise customers share many common attributes with
respect to software requirements, the professional services necessary to
integrate and implement a solution, and the potential for transaction-based fees
paid based on usage of Tumbleweed IME. Although both service providers and
enterprise customers are using Tumbleweed IME to provide secure online
communications services outside the boundaries of their enterprise, the
principal distinction between the two groups is market focus. Service providers
offer the service on a fee-for-use basis, while enterprise customers typically
provide the improved communication services in order to gain business advantage
through improved cost, speed, and/or interactivity.

We have developed multiple channels of distribution worldwide for our
Tumbleweed MMS products. Our distribution strategy addresses the requirements of
small companies and large enterprises alike and matches the appropriate sales
and distribution channels to our product offerings. In North America, we have
relied primarily on direct field sales, telesales, our professional services
organization and value added resellers and their service organizations for the
license, support and installation of our products. Internationally, sales are
directed by non-exclusive distributors and value added resellers acting in
concert with Tumbleweed MMS sales personnel. Tumbleweed MMS customers include
Bell Atlantic, Merrill Lynch, Chevron, Nike, Time Warner, Blue Cross/Blue
Shield, Mass Mutual, Best Foods, Gymboree, Safeway, Kimberly-Clark, and Robert
Half.

11

SALES

We maintain a direct IME sales force that focuses on signing additional
service providers and key enterprise customers in strategic industries, as well
as further penetrating existing accounts by selling them new Tumbleweed
applications. Our sales force is comprised of domestic and international sales
groups. Offices in the U.S. currently include Redwood City, California, Santa
Clara, California, New York, New York, Mount Laurel, New Jersey, Los Angeles,
California, San Ramon, California, Chicago, Illinois, Redmond, Washington,
Reston, Virginia, and Dallas, Texas. We currently have international offices in
Munich, Germany, Hurst, United Kingdom, Tokyo, Japan, Paris, France, Chatswood,
Australia, Amersfoot, The Netherlands, and Stockholm, Sweden. Our sales force
includes field sales engineers and inside sales personnel who support the
account executives. Field sales engineers assist our account executives with
technical presentations, customer requirements analysis and initial solution
designs. Our inside sales personnel assist the account executives in managing
their customer relationships. Our sales effort is augmented by the sales forces
of our service providers.

Our direct Tumbleweed MMS field sales force primarily targets medium to
large-sized organizations with enterprise-wide implementations, while our
Tumbleweed MMS telesales group typically targets smaller organizations with less
complex implementations. Leads for the direct sales force are generated through
a combination of industry trade show participation, seminars, direct mail and
telemarketing programs, Internet download evaluation copies, requests for
proposals from prospects and customer and channel referrals. The direct sales
force also works with value added resellers (VARs) to sell Tumbleweed MMS
products. The typical sales cycle can range from several weeks to six months,
but may be significantly longer for large sales. We also sell software upgrades
and annual maintenance agreements directly to customers, as well as through our
VARs and international distributors.

MARKETING

Our marketing efforts are organized around three primary areas: product
marketing, product management, and marketing communications. Product marketing
identifies target markets and customer opportunities, then develops the
positioning, programs, and materials to reach customers and support sales
activities. Product marketing is also responsible for branding, corporate
identity, and the Tumbleweed website.

Product management translates customer and market requirements into product
plans and works with engineering to ensure completion. Product management also
trains salespeople on product information and competition. Marketing
communications drives overall market awareness of Tumbleweed and our products
through public relations, industry analyst relationships, product reviews,
editorial promotion, industry events and executive speaking engagements.

GOVERNMENTAL REGULATION

We are not currently subject to direct regulation by any domestic or foreign
governmental agency, other than regulations applicable to businesses generally,
and laws or regulations directly applicable to access to online commerce.
However, due to the increasing popularity and use of the Internet and other
online services, it is possible that a number of laws and regulations may be
adopted with respect to the Internet or other online services covering issues
such as user privacy, Internet transaction taxation, pricing, content,
copyrights, distribution and characteristics and quality of products and
services. Furthermore, the growth and development of the market for online
commerce may prompt calls for more stringent consumer protection laws that may
impose additional burdens on those companies conducting business online. For
example, the Federal Communications Commission could determine through one of
its ongoing proceedings that the Internet is subject to regulation. Among other
possible courses of action, the FCC may determine that Internet service
providers are subject to

12

certain access charges or fees for carrying Internet traffic over the public
switched telephone network. The adoption of any additional laws or regulations
may decrease the growth of the Internet or other online services, which could,
in turn, decrease the demand for our products and services and increase our cost
of doing business, or otherwise have a material adverse effect on our business,
financial condition and results of operations.

Permits or licenses may be required from federal, state, local or foreign
governmental authorities to operate or to sell some products on the Internet. We
may not be able to obtain these permits or licenses. We may be required to
comply with future national and/or international legislation and statutes
regarding conducting commerce on the Internet in all or specific countries
throughout the world. It may not be possible to comply with this legislation or
these statutes on a commercially reasonable basis, if at all. See "Risks and
Uncertainties--Additional Government Regulation Relating to the Internet May
Increase Costs of Doing Business or Require Changes in Our Business Model;
and--Tumbleweed May Have Liability for Internet Content."

In addition, our products rely on encryption and authentication technology
licensed from third parties to provide the security and authentication necessary
to achieve secure transmission of confidential information. Exports of software
products utilizing encryption technology are generally restricted by the U.S.
and various foreign governments. We have obtained approval to export the
following products within the IME product line: IME Server 3.1, Desktop 3.1,
Receive Applet 3.1 and Remote API 3.2. We have obtained approval to export the
following products within the MMS product line: MMS WorldWide/56 4.3 and MMS
Strong WorldWide/128 4.3. We are not exporting other hardware, software or
technology that is subject to export control under U.S. law. However, the list
of countries and products for which exports are restricted and the related
regulatory policies could be revised in the future, and we may not be able to
obtain required government approvals. See "Risks and Uncertainties--Tumbleweed's
Products Are Subject to Export Controls, and Tumbleweed May be Unable to Obtain
Necessary Approvals."

INTELLECTUAL PROPERTY

We have filed fourteen utility patent applications and one design patent
application with the U.S. Patent and Trademark Office and may seek other patents
in the future. To date, a utility patent relating to our fundamental web-based
delivery method has issued, as well as a design patent relating to the user
interface of our products. We have also filed thirteen patent applications in
foreign jurisdictions.

We regard our patents and similar intellectual property as critical to our
success, and rely on patent law and confidentiality and/or license agreements
with our employees, customers, partners and others to protect our proprietary
rights. We are also pursuing the registration of key trademarks and service
marks in the U.S. and internationally. Despite these precautions, it may be
possible for unauthorized third parties to copy particular portions of our
products or reverse engineer or obtain and use information that we regard as
proprietary. Some end-user license provisions protecting against unauthorized
use, copying transfer and disclosure of the licensed program may be
unenforceable under the laws of some jurisdictions and foreign countries. In
addition, the laws of some foreign countries do not protect proprietary rights
to the same extent as do the laws of the U.S. Our means of protecting our
proprietary rights in the U.S. or abroad may not be adequate and competing
companies may independently develop similar technology. In particular, we are
currently engaged in litigation to enforce our intellectual property rights,
which may not be successful and in any event will result in substantial
expenditures of resources to pursue. See "Legal Proceedings."

The status of U.S. patent protection in the software industry is not well
defined and will evolve as the U.S. Patent and Trademark Office grants
additional patents. Our patent applications may not be issued with the scope of
the claims sought by us, if at all. Our products may infringe patents issued to

13

third parties. In addition, because patent applications in the U.S. are not
publicly disclosed until the patent is issued, applications may have been filed
by third parties that relate to our software products.

Third parties could claim infringement by us with respect to current or
future products or services. We may increasingly be subject to claims of
intellectual property infringement as the number of our competitors grows and
the functionality of their products and services increasingly overlap with ours.
Any of these claims, with or without merit, could be time consuming to defend,
result in costly litigation, divert management's attention and resources, limit
use of our services or require us to enter into royalty or license agreements. A
successful claim of product infringement against us could harm our business and
prospects.

We license certain key technology used in the Tumbleweed MMS products from
other companies. We have applied for a patent in regard to certain aspects of
the Tumbleweed MMS technology. In addition, we rely on trade secret, copyright
and trademark laws, nondisclosure and other contractual agreements and technical
measures, to protect our technology. We also believe that factors such as the
technological and creative skills of our personnel, as well as new product
developments and enhancements, are essential to establishing and maintaining a
technology leadership position. We generally enter into confidentiality and/or
license agreements with our employees, distributors and customers. We limit
access to and distribution of our software, documentation and other proprietary
information. Many of our products are shipped with a software security lock,
which initially limits software access to authorized users. In addition, we
restrict third party access to our source code, except in connection with source
code escrow arrangements. The steps we take may not prevent misappropriation of
our technology, and such protections do not preclude competitors from developing
products with functionality or features similar to the Tumbleweed MMS products.
Furthermore, third parties may independently develop competing technologies that
are substantially equivalent or superior to our MMS technologies. The loss of
any significant third-party license or the inability to license additional
technology as required, could harm our business and prospects.

COMPETITION

Broadly speaking, Tumbleweed IME is an alternative to traditional mail and
courier delivery services, such as those offered by Federal Express Corporation,
United Parcel Service or the U.S. Postal Service, and to general purpose e-mail
applications and services. As such, we compete with these options. Ultimately,
we believe that the Internet will become the primary solution for secure online
communication services. Within this area, our direct competition comes from
other secure online communication service providers of various sizes, some of
which have products that are intended to compete directly with our products.
Examples of secure online communication service providers include Automatic Data
Processing, Inc., Critical Path, Inc., Differential Inc. (now known as
Receipt.com), e-Parcel, LLC, PostX Corporation, and ZixIt Corporation. On
November 4, 1999, Critical Path, Inc. announced that it had entered into a
definitive agreement to acquire The docSpace Company, Inc., and on March 9, 2000
announced that the acquisition had been completed. This acquisition may
significantly increase the competitive pressures we face particularly because
Tumbleweed has filed a patent infringement lawsuit against The docSpace Company,
Inc. See "--Legal Proceedings." In addition, companies with which we do not
presently directly compete may become competitors in the future, either through
the expansion of our products and services or through their product development
in the area of secure online communication services. These companies could
include America Online, Inc./Netscape Communications Corporation, International
Business Machines Corporation/ Lotus Development Corporation, Microsoft
Corporation and VeriSign, Inc.

The market for our Tumbleweed MMS products is intensely competitive and
subject to rapid changes. The enterprise security market is characterized by
various products and solutions that compete with our Internet content security
and policy management solutions. These include products offered by Content
Technologies, Ltd. (which is partially owned by Integralis Technology, Ltd.)
Trend Micro

14

Incorporated, SRA International, and TenFour AB. We anticipate competition in
the future from other companies in the enterprise security market as the
industry continues to grow.

We believe that the competitive factors affecting the market for our
Tumbleweed MMS products and services include: product functionality and
features; product quality and documentation, performance and price; ease of
product integration with disparate e-mail and groupware solutions; quality of
customer support services, customer training; hardware platforms supported;
vendor and product reputation; and the strength of sales channels. The relative
importance of each of these factors depends upon the specific customer
environment. Although we believe that our products and services currently
compete favorably with respect to such factors, there can be no assurance that
we can maintain our competitive position against current and potential
competitors.

The market for secure online communication services is new, rapidly evolving
and highly competitive. The level of competition is likely to increase as
current competitors improve their offerings and as new participants enter the
market. Many of our current and potential competitors have longer operating
histories, larger customer bases, greater brand recognition and significantly
greater financial, marketing and other resources than us and may enter into
strategic or commercial relationships with larger, more established and
well-financed companies. Some of our competitors may be able to enter into these
strategic or commercial relationships on more favorable terms. Additionally,
these competitors have research and development capabilities that may allow them
to develop new or improved products that may compete with product lines we
market and distribute. New technologies and the expansion of existing
technologies may increase competitive pressures on us. Furthermore, one of our
service provider customers currently offers to end-users the choice between
Tumbleweed's products and the products of one of our competitors, and other
current and future customers may also offer end-users a similar choice.
Increased competition may result in reduced operating margins as well as loss of
market share and brand recognition. We may be unable to compete successfully
against current and future competitors, and competitive pressures faced by us
could harm our business and prospects.

EMPLOYEES

As of February 29, 2000, we employed 224 people worldwide, including 65 in
engineering, 79 in sales, 37 in professional services, 15 in marketing and 28 in
corporate management and administration. Our employees are not represented by
any collective bargaining organization. We have never experienced a work
stoppage and consider our relations with our employees to be good. See "Risks
and Uncertainties--If Tumbleweed Loses the Services of Key Management Personnel,
including Co-Founders or Key Sales Executives, Tumbleweed's Ability to Develop
Its Business and Secure Customer Relationships Will Suffer"; and "--Tumbleweed
May Be Unable to Recruit or Retain Qualified Personnel, Which Could Harm
Business and Product Development."

YEAR 2000 ISSUES

We currently are not aware of any significant Year 2000 problems in any of
our critical systems and products. However, the success to date of our Year 2000
efforts cannot guarantee that a Year 2000 problem affecting third parties upon
which we rely will not become apparent in the future that could harm our
business.

ITEM 2--PROPERTIES.

We lease approximately 40,000 square feet for our corporate headquarters
located in Redwood City, California under a lease with a term of five years
commencing June 8, 1999. We also lease approximately 30,000 square feet of
office space in Santa Clara, California, the former headquarters of Worldtalk,
under a lease scheduled to terminate in September 2005. We also maintain
domestic sales

15

offices in Redwood City, California, Santa Clara, California, New York, New
York, Mount Laurel, New Jersey, Los Angeles, California, San Ramon, California,
Chicago, Illinois, Redmond, Washington, Reston, Virginia, and Dallas, Texas and
international offices in Munich, Germany, Hurst, United Kingdom, Tokyo, Japan,
Paris, France, Chatswood, Australia, Amersfoot, The Netherlands, and Stockholm,
Sweden.

ITEM 3--LEGAL PROCEEDINGS.

On March 3, 1999, we sued The docSpace Company, Inc. alleging infringement
of our U.S. Patent No. 5,790,790. In its answer, docSpace raised counterclaims
alleging, among other things, antitrust violations and unfair competition. On
May 3, 1999, docSpace filed a summary judgment motion of non-infringement. On
May 27, 1999, the court granted Tumbleweed's request to continue docSpace's
summary judgment motion pending further discovery and indicated that docSpace's
motion would be rescheduled. On July 14, 1999, the court issued a scheduling
order stating that it would conduct a hearing on the proper interpretation of
the claims of Tumbleweed's patent on September 24, 1999, and a hearing on any
motions for summary judgement on the issue of infringement on November 1, 1999.
The court also ordered that discovery on all issues other than claim
construction and infringement would be stayed pending resolution of these
issues. The court later rescheduled the claim interpretation hearing, which
occurred on November 19, 1999.

On December 9, 1999, the court issued an order based on the claims
construction hearing essentially adopting Tumbleweed's interpretation of the
patent claims. On March 12, 2000, the court scheduled a hearing on the
infringement issue for June 5, 2000, to allow us time to complete discovery on
this issue and file a motion for summary judgment that the docSpace systems
infringe our patent. docSpace has indicated that it intends to refile its
non-infringement motion.

In the meantime, on November 4, 1999, Critical Path, Inc. announced that it
had entered into a definitive agreement to acquire docSpace, and on March 9,
2000 announced that the acquisition had been consummated. See "Competition." We
intend to continue the litigation until all remaining issues are resolved. We
believe that we will prevail on the merits of this patent infringement lawsuit
and that docSpace's counterclaims are meritless.

ITEM 4--SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS.

No matters were submitted to a vote of Tumbleweed's stockholders during the
fourth quarter of fiscal 1999.

16

PART II

ITEM 5--MARKET FOR REGISTRANT'S COMMON EQUITY AND RELATED STOCKHOLDER MATTERS.

Tumbleweed's common stock is traded on the Nasdaq National Market under the
symbol "TMWD." The table below sets forth, during the periods indicated, the
high and low sales price for Tumbleweed's common stock as reported on the Nasdaq
National Market.



PRICE RANGE
-------------------
HIGH LOW
-------- --------

Year ended December 31, 1999................................ $89.50 $10.25
Third Quarter (beginning August 6, 1999).................... $30.50 $10.25
Fourth Quarter.............................................. $89.50 $17.75


As of February 29, 2000, there were approximately 228 holders of record of
Tumbleweed's common stock.

DIVIDEND POLICY

Tumbleweed has not declared or paid any cash dividends on its common stock
during any period for which financial information is provided in this Annual
Report on Form 10-K. Tumbleweed currently intends to retain future earnings, if
any, to fund the development and growth of its business and does not anticipate
paying any cash dividends on its common stock in the foreseeable future.

USE OF PROCEEDS.

On August 11, 1999, we completed an initial public offering of our common
stock, $0.001 par value. The managing underwriters in the offering were Credit
Suisse First Boston, Hambrecht & Quist LLC and ING Barings LLC. The shares of
common stock sold in the offering were registered under the Securities Act of
1933, as amended, on a Registration Statement on Form S-1 (No. 333-79687). The
Registration Statement was declared effective by the Securities and Exchange
Commission on August 5, 1999.

On August 6, 1999, we commenced the offering. The offering terminated on
August 24, 1999 after we had sold all of the 4,219,592 shares of common stock
registered under the Registration Statement (including 219,592 shares sold
pursuant to the exercise of the underwriters' over-allotment option). The
initial public offering price was $12 per share for an aggregate initial public
offering of $50,635,104. After deducting the underwriting discounts and
commissions and the offering expenses, the net proceeds to us from the offering
were approximately $45,800,000.

From August 5, 1999, the date our Registration Statement was declared
effective, until December 31, 1999, we financed our operations from cash
available prior to our initial public offering, and did not use any of the net
proceeds from our initial public offering. We may use a portion of the net
proceeds to acquire complementary products, technologies or businesses; however,
we currently have no commitments or agreements with respect to any such
transactions.

17

ITEM 6--SELECTED FINANCIAL DATA.

SELECTED HISTORICAL FINANCIAL INFORMATION (UNAUDITED)



YEAR ENDED DECEMBER 31,
----------------------------------------------------
1999 1998 1997 1996 1995
-------- -------- -------- -------- --------
(IN THOUSANDS, EXCEPT PER SHARE DATA)

HISTORICAL CONSOLIDATED STATEMENT OF OPERATIONS
DATA:
Revenue......................................... $ 5,777 $ 2,015 $ 729 $ 597 $ 818
Gross profit.................................... 3,398 1,084 621 458 586
Operating expenses(1)........................... 20,890 7,823 5,477 1,679 609
Operating loss.................................. (17,492) (6,739) (4,856) (1,221) (23)
Net loss........................................ (16,416) (6,590) (4,691) (1,180) (16)
Net loss per share--basic and diluted........... (1.44) (1.74) (1.41) (0.33) --

Shares used in calculating basic and diluted
loss per share................................ 11,373 3,797 3,331 3,598 4,035

Dividends declared.............................. -- -- -- -- --




DECEMBER 31,
----------------------------------------------------
1999 1998 1997 1996 1995
-------- -------- -------- -------- --------
(IN THOUSANDS, EXCEPT PER SHARE DATA)

HISTORICAL CONSOLIDATED BALANCE SHEET DATA:
Cash and cash equivalents............................ $51,657 $ 698 $6,310 $2,670 $ 81
Total assets......................................... 61,980 1,725 7,115 2,939 206
Long-term debt, excluding current installments....... 882 369 -- -- --
Total stockholders' equity........................... 54,452 501 6,270 2,652 141


- ------------------------

(1) Includes stock compensation expense of $3.5 million, $673,000, $246,000, and
$24,000 for the years ended December 31, 1999, 1998, 1997 and 1996,
respectively.

18

SELECTED QUARTERLY FINANCIAL DATA

(UNAUDITED)



QUARTERS ENDED
---------------------------------------------------
DECEMBER 31, SEPTEMBER 30, JUNE 30, MARCH 31,
------------ ------------- -------- ---------
(IN THOUSANDS, EXCEPT PER SHARE DATA)

FISCAL 1999

REVENUE(1):
License........................................ $ 1,501 $ 827 $ 564 $ 518
Services....................................... 433 540 241 172
Transaction fees............................... 457 318 203 3
Sale of technology............................. -- -- -- --
------- ------- ------- -------
Total revenue................................ 2,391 1,685 1,008 693

COST OF REVENUE(1):
License........................................ 107 75 44 46
Services....................................... 689 665 447 228
Transaction fees............................... 34 24 15 5
------- ------- ------- -------
Total cost of revenue........................ 830 764 506 279
------- ------- ------- -------
GROSS PROFIT..................................... 1,561 921 502 414

OPERATING EXPENSES(1):
Research & development......................... 1,631 1,262 1,058 814
Sales & marketing.............................. 3,693 2,610 1,733 1,055
General & administrative....................... 1,219 1,216 831 274
Stock compensation............................. 1,106 1,105 958 325
------- ------- ------- -------
Total operating expenses..................... 7,649 6,193 4,580 2,468
------- ------- ------- -------

OPERATING LOSS................................... (6,088) (5,272) (4,078) (2,054)
OTHER INCOME (EXPENSE), NET...................... 754 399 121 (2)
------- ------- ------- -------
LOSS BEFORE TAXES................................ (5,334) (4,873) (3,957) (2,056)
PROVISION FOR TAXES.............................. 60 96 40 --
------- ------- ------- -------
NET LOSS......................................... $(5,394) $(4,969) $(3,997) $(2,056)
======= ======= ======= =======
NET LOSS PER SHARE--BASIC & DILUTED.............. $ (0.25) $ (0.34) $ (0.90) $ (0.50)
======= ======= ======= =======
WEIGHTED AVERAGE SHARES--BASIC & DILUTED......... 21,601 14,797 4,438 4,092
======= ======= ======= =======


- ------------------------

(1) Certain revenue, cost of revenue, and operating expense amounts in
previously reported quarterly results for fiscal 1999 have been reclassified
to conform with the presentation of those revenues and expenses for the
fiscal year ended December 31, 1999 reported herein. All amounts
reclassified were not significant.

19

SELECTED QUARTERLY FINANCIAL DATA

(UNAUDITED)



QUARTERS ENDED
---------------------------------------------------
DECEMBER 31, SEPTEMBER 30, JUNE 30, MARCH 31,
------------ ------------- -------- ---------
(IN THOUSANDS, EXCEPT PER SHARE DATA)

FISCAL 1998

REVENUE:
License........................................ $ 130 $ 195 $ 256 $ 304
Services....................................... 305 276 183 146
Transaction fees............................... -- -- -- --
Sale of technology............................. -- 110 110 --
------- ------- ------- -------
Total revenue................................ 435 581 549 450

COST OF REVENUE:
License........................................ 32 61 60 41
Services....................................... 201 265 150 121
Transaction fees............................... -- -- -- --
------- ------- ------- -------
Total cost of revenue........................ 233 326 210 162
------- ------- ------- -------
GROSS PROFIT..................................... 202 255 339 288

OPERATING EXPENSES:
Research & development......................... 652 500 412 457
Sales & marketing.............................. 805 929 1,234 1,081
General & administrative....................... 223 278 304 275
Stock compensation............................. 236 178 172 87
------- ------- ------- -------
Total operating expenses..................... 1,916 1,885 2,122 1,900
------- ------- ------- -------

OPERATING LOSS................................... (1,714) (1,630) (1,783) (1,612)
OTHER INCOME (EXPENSE), NET...................... (6) 28 46 81
------- ------- ------- -------
LOSS BEFORE TAXES................................ (1,720) (1,602) (1,737) (1,531)
PROVISION FOR TAXES.............................. -- -- -- --
------- ------- ------- -------
NET LOSS......................................... $(1,720) $(1,602) $(1,737) $(1,531)
======= ======= ======= =======
NET LOSS PER SHARE--BASIC & DILUTED.............. $ (0.43) $ (0.42) $ (0.46) $ (0.42)
======= ======= ======= =======
WEIGHTED AVERAGE SHARES--BASIC & DILUTED......... 3,969 3,849 3,736 3,628
======= ======= ======= =======


20

ITEM 7--MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS
OF OPERATIONS.

THE FOLLOWING DISCUSSION SHOULD BE READ IN CONJUNCTION WITH THE CONSOLIDATED
FINANCIAL STATEMENTS AND THE RELATED NOTES. THE FOLLOWING DISCUSSION CONTAINS
FORWARD-LOOKING STATEMENTS THAT REFLECT THE COMPANY'S PLANS, ESTIMATES AND
BELIEFS. THE COMPANY'S ACTUAL RESULTS COULD DIFFER MATERIALLY FROM THOSE
DISCUSSED IN THE FORWARD-LOOKING STATEMENTS. FACTORS THAT COULD CAUSE OR
CONTRIBUTE TO THESE DIFFERENCES INCLUDE, BUT ARE NOT LIMITED TO, THOSE DISCUSSED
BELOW AND THOSE LISTED UNDER "RISK FACTORS."

THE COMPANY

Tumbleweed Communications Corp. ("the Company") is a leading provider of
internet infrastructure for business messaging worldwide. The Company developed
the Tumbleweed Integrated Messaging Exchange, or Tumbleweed IME, a comprehensive
set of products and services that enables businesses to use e-mail and the Web
for secure, trackable online communication. In addition to the Company's core
IME technology, the Company offers applications aimed at specific vertical
markets and common business processes, and an extensive development toolkit for
building customized online services. Tumbleweed IME is a scalable, feature rich
communication solution, and serves as the foundation for online business
services offered by the Company's customers.

On January 31, 2000, the Company completed the acquisition of Worldtalk
Communications Corp. ("Worldtalk"), a leading provider of Internet security and
policy management solutions that enable organizations to define and manage
electronic mail and web security usage policies to manage the risks and
liabilities associated with Internet communications. WorldSecure customers
include Bell Atlantic, Merrill Lynch, Chevron, Nike, Time Warner, Blue
Cross/Blue Shield, Mass Mutual, Best Foods, Gymboree, Safeway, Kimberly-Clark,
and Robert Half.

The Company's revenue consists of (i) license fees, (ii) service fees, and
(iii) transaction fees. License revenue consists of initial license fees and the
sale of distribution rights. License revenue typically is recognized upon the
later of customer acceptance or shipment of the software. Revenue from the sale
of distribution rights is recognized upon the execution of a distribution
agreement. Service fee revenue consists of consulting fees and support and
maintenance fees. Consulting fees related to installation are recognized upon
acceptance of the installation while all other consulting fees are recognized
based on percentage of completion. Support and maintenance fees are paid for
ongoing customer support as well as for the right to receive future upgrades to
the Company's products during the term of the maintenance agreement. Revenue
from support and maintenance is recognized ratably over the period the support
is provided. Transaction fees are based on the volume of transactions by the
Company's customers, and the related revenue is recognized based on payment
schedules and transaction reports from the Company's customers. A number of the
Company's contracts include minimum transaction volume requirements. In these
cases, the minimum guaranteed revenue is recognized when fees are due and
payable during those months where transaction volume does not exceed the
designated minimums.

Historically, the Company's revenue has been concentrated among a few
customers, but the customer base contributing to revenue is diversifying. In
1999, the Company's top five customers contributed 36% of total revenue, down
from 73% in 1998. In addition, the constituency of that list is evolving. The
Company expects that the principal revenue-generating customers as a group will
continue to comprise a significant portion of revenue. However, the trend in
diversification of the Company's customer base is expected to continue as the
Company adds new customers and experiences further growth in revenue from
existing customers.

A substantial portion of the Company's revenue relates to international
customers or operations. Most of the Company's contracts are denominated in U.S.
dollars. However, a contract between the Company's 50% owned Japanese
subsidiary, Tumbleweed Communications K.K. ("TKK"), and Hikari Tsushin is
denominated in Japanese yen, and, in the future, an increasing number of
contracts may be

21

denominated in foreign currencies. The Company currently does not have hedging
or similar arrangements to protect the Company against foreign currency
fluctuations. Therefore, the Company increasingly may be subject to currency
fluctuations, which could harm the Company's operating results in future
periods.

Development costs incurred in the research and development of new technology
and enhancements to existing technology are expensed as incurred until
technological feasibility in the form of a working model has been established.
To date, capitalized costs for software development have not been material.

During the three years ended December 31, 1999, the Company recorded
aggregate deferred stock compensation expense of $9.4 million ($9.7 million on a
historical basis) in connection with the grant of certain stock options which
were granted at exercise prices less than the deemed fair value on the grant
date. The deferred stock compensation expense is amortized on an accelerated
basis over the vesting period of the options, which is generally four years. Of
the total deferred stock compensation expense, $3.5 million, $673,000, and
$246,000 was amortized in the years ended December 31, 1999, 1998 and 1997,
respectively, and the Company expects that approximately $3.0 million,
$1.5 million and $806,000 will be amortized during 2000, 2001 and 2002
thereafter, respectively.

The Company moved into an expanded headquarters facility in Redwood City,
California and into an expanded sales office in the United Kingdom in
June 1999. Also, during 1999, the Company opened sales offices in Illinois,
Virginia, France, Germany, The Netherlands and Australia. This expansion
contributed to higher facilities-related expenses during 1999.

In September 1999, Hikari Tsushin purchased a 50% ownership interest in TKK,
reducing the Company's ownership from 100% to 50%. Both Hikari Tsushin and the
Company have equal board representation corresponding to their equal equity
ownership shares. Accordingly, the Company's consolidated financial statements
for 1999 reflect fully consolidated results from TKK for the first eight months
of 1999, and the Company's equity share of the net loss from TKK for the
remaining four months of 1999.

The Company's future net income and cash flow will be affected by the
Company's ability to apply net operating losses for federal tax reporting
purposes against taxable income in future periods due to a cumulative change in
ownership for income tax purposes, as defined in Section 382 of the Internal
Revenue Code, arising from the sale of stock in prior offerings.

In March of 1994, the Company sold a technology known as Envoy to
Novell, Inc. pursuant to an asset transfer, and the Company thereafter effected
a substantial distribution to its stockholders. In connection with this sale,
the Company retained the rights to derivative payments from various agreements
that were acquired by Novell, Inc. for specified periods of time. The proceeds
from this asset transfer were used for general corporate purposes, including the
initial development of Tumbleweed IME. Virtually all of the Company's revenue
recognized before June of 1997, which marked the initial launch of Tumbleweed
IME, was derived from these agreements. The Company ceased recognizing revenue
under these agreements in the first quarter of 1997, and the Company does not
anticipate recognizing any additional revenue under these agreements in the
future because the Company believes that Novell, Inc. has discontinued
distribution of products utilizing Envoy technology. As a result, revenue
recognized for periods before June of 1997 is not indicative of the Company's
operating results in subsequent periods. In addition, in 1998 and 1997, the
Company recognized revenue derived from a sale of ancillary technology to a
third party. The Company does not anticipate recognizing revenue from similar
sales in the future.

22

ACQUISITION OF WORLDTALK

In January 2000, the Company acquired Worldtalk Communications Corp.
("Worldtalk") in a tax-free stock-for-stock transaction. Upon completion of the
transaction, Worldtalk became a wholly owned subsidiary of the Company.
Worldtalk is a leading provider of Internet content security and policy
management solutions. Worldtalk's WorldSecure policy management platform enables
organizations to define and manage electronic mail and web security and usage
policies, reducing the risk and liabilities associated with Internet
communications. Worldtalk's products include WorldSecure/ Mail, software that
provides Windows NT-based electronic mail firewall and policy management,
WorldSecure Web, a Windows NT-based content security product. WorldSecure/Mail
is now being marketed as Tumbleweed's Messaging Management System (MMS). The
Company expects that the acquisition of Worldtalk will extend the Company's lead
in secure messaging, one of the fastest growing segments of the messaging
market, and poise the Company to become a leader in e-mail content filtering,
another rapidly growing sector in messaging.

Upon completion of the acquisition, each Worldtalk share of common stock was
converted into 0.26 of a share of the Company's common stock. A total of
3,798,398 shares of the Company's Common Stock were issued as a result of the
acquisition for 14,609,374 shares of Worldtalk common stock. The business
combination will be accounted for as a pooling of interests and, accordingly,
the Company's historical financial statements presented in future reports will
be restated to include the accounts and results of operations of Worldtalk. (See
Note 10 of Notes to Consolidated Financial Statements.)

23

RESULTS OF OPERATIONS

YEARS ENDED DECEMBER 31, 1999 AND 1998

REVENUE. Revenue is comprised of license revenue, services revenue and
transaction fees revenue. Total revenue increased 187% to $5.8 million in 1999
from $2.0 million in 1998 due to increases in license revenue, services, and
transaction revenue. License revenue increased 285% to $3.4 million in 1999 from
$885,000 in 1998 due to bringing new customers into production and to additional
license fees paid by existing customers. The number of customers contributing to
license revenue grew from 14 during 1998 to 21 in 1999. Services revenue
increased 52% to $1.4 million in 1999 from $910,000 in 1998. The increase in
services revenue was due to an increase in contract development work by the
Company's professional services organization, and, to a lesser extent, increases
in maintenance fees. Transaction fees revenue was $981,000 in 1999 compared to
$0 in 1998. The increase in transaction fees revenue resulted from minimum
transaction fee payments made by new customers who launched IME-based services
and, to a lesser extent, transaction fee payments from existing customers.

COST OF REVENUE. Cost of revenue is comprised of license cost, services
cost and transaction fees cost. License cost is primarily comprised of royalties
paid to third parties for software licensed by the Company for inclusion in the
Company's products. Services cost is comprised primarily of personnel and
overhead costs related to customer support and contract development projects.
Transaction fees cost is primarily comprised of royalties paid to third parties
for software licensed by the Company for inclusion in the Company's products and
hardware and band-width costs associated with hosting IME servers for some
customers. Cost of revenue increased 156% to $2.4 million in 1999 from $931,000
in 1998. License cost increased 40% to $272,000 in 1999 from $194,000 in 1998.
License costs increased primarily due to increased sales of products containing
software licensed from third parties. The increase was not in direct proportion
to the increase in license revenue as some of the agreements with third parties
contain fixed minimum payments. Services cost increased 175% to $2.0 million in
1999 from $737,000 in 1998. The increase was primarily due to increased
personnel costs supporting an increase in new contract development projects and
an increase in facilities-related expenses. Transaction fees cost was $78,000 in
1999 compared to $0 in 1998. The increase in transaction fees cost resulted from
royalties due on transaction fees revenue and, to a lesser extent, depreciation
expense and connectivity costs incurred in generating transaction revenue.

RESEARCH AND DEVELOPMENT EXPENSES. Research and development expenses are
comprised of engineering and related costs associated with the development of
Tumbleweed IME applications, quality assurance and testing. Research and
development costs increased 136% to $4.8 million in 1999 from $2.0 million in
1998. The increase was primarily due to increased head count supporting
development of the Tumbleweed IME platform and new applications developed for
our target markets, increases in average salaries for development personnel, and
increased facilities related expenses. The Company expects that research and
development expenses will increase in absolute dollars in future periods due to
increased personnel required to support new projects that will allow the Company
to expand the functionality of the core IME platform, increase the number of
vertical applications built for the Company's target markets and integrate with
a wider array of third party software packages.

SALES AND MARKETING EXPENSES. Sales and marketing expenses are comprised of
salaries, commissions, travel expenses and costs associated with trade shows,
advertising and other marketing efforts. Sales and marketing expenses increased
125% to $9.1 million in 1999 from $4.0 million in 1998. The increase in sales
and marketing expenses was primarily due to increased sales staffing, incentive
compensation costs and an expense of $127,000 associated with the issuance of a
vested warrant to a customer in exchange for marketing and publicity assistance.
The Company expects that sales and marketing expenses will increase in absolute
dollars in future periods as the Company expands into new

24

target markets and geographic areas. The Company plans to significantly increase
the number of its sales and marketing personnel worldwide in 2000.

GENERAL AND ADMINISTRATIVE EXPENSES. General and administrative expenses
consist primarily of personnel and support costs for our finance, legal,
information systems and human resources departments as well as professional
fees. General and administrative expenses increased 228% to $3.5 million in 1999
from $1.1 million in 1998. The increase in general and administrative expenses
was due to an increase in legal fees corresponding to the patent infringement
lawsuit the Company brought against The docSpace Company, Inc., which is still
pending, as well as increased staffing expenses and professional fees. The
Company expects that general and administrative expenses will increase in
absolute dollars in future periods as the Company continues to grow its
infrastructure.

OTHER INCOME, NET. Other income, net, is primarily comprised of interest
income earned on investment securities. Other income, net, increased 754% to
$1.3 million in 1999 from $149,000 in 1998 due to increased cash balances
invested in money market accounts and commercial paper. The increase in cash
balances available for investment in 1999 resulted from proceeds from the
issuance of equity securities, including common stock issued in the Company's
initial public offering completed in August 1999.

YEARS ENDED DECEMBER 31, 1998 AND 1997

REVENUE. Total revenue increased 176% to $2.0 million in 1998 from $729,000
in 1997. Approximately one-half of the revenue in 1997 was derived from prior
agreements relating to the Company's Envoy technology that was sold to
Novell, Inc. License revenue increased 147% to $885,000 in 1998 from $359,000 in
1997 due to increases in initial license fees from customers. Services revenue
increased 264% to $910,000 in 1998 from $250,000 in 1997 due to increases in
custom development work performed for the Company's customers. The Company has
recognized revenue from Tumbleweed IME commencing with its launch in July 1997.

COST OF REVENUE. Cost of revenue increased 762% to $931,000 in 1998 from
$108,000 in 1997. License cost increased 208% to $194,000 in 1998 from $63,000
in 1997 due to increased royalty costs associated with the addition of licensed
technology from third parties and costs which correspond to increases in license
revenue. Services cost increased 1,538% to $737,000 in 1998 from $45,000 in 1997
due to increased personnel costs to support new projects associated with the
launch of Tumbleweed IME.

RESEARCH AND DEVELOPMENT EXPENSES. Research and development expenses
increased 10% to $2.0 million in 1998 from $1.8 million in 1997. The increase
was primarily due to increased staffing.

SALES AND MARKETING EXPENSES. Sales and marketing expenses increased 56% to
$4.0 million in 1998 from $2.6 million in 1997. The increase was primarily due
to increased staffing as well as increased spending on marketing programs
associated with the launch of Tumbleweed IME.

GENERAL AND ADMINISTRATIVE EXPENSES. General and administrative expenses
increased 36% to $1.1 million in 1998 from $792,000 in 1997. The increase was
primarily due to increased personnel and professional fees.

LIQUIDITY AND CAPITAL RESOURCES

Since inception, the Company has financed its operations primarily through
the issuance of equity securities. On December 31, 1999, the Company had
$51.7 million in cash and cash equivalents.

25

Net cash used by operating activities for 1999 was $10.4 million. Cash used
in operating activities was primarily the result of a net operating loss, offset
by certain non-cash charges and increases in accounts payable and accrued
liabilities.

Net cash used in investing activities for 1999 was $4.3 million. Net cash
used in investing activities was primarily the result of capital expenditures
related to increased facilities expansion.

Net cash provided by financing activities for 1999 was $65.6 million. Cash
provided by financing activities was primarily attributable to net proceeds from
the issuance of equity securities to investors, including the Company's initial
public offering of common stock completed in August 1999 and the Company's
Series C Preferred Stock financing completed in February 1999.

As of December 31, 1999, the Company's principal commitments consisted of
obligations outstanding under equipment and operating leases. The Company's
equipment leases require payment of rental fees to third party leasing providers
at interest rates of approximately 12.8%. In most cases, the Company has no
obligations to purchase the equipment at the end of the term. The Company
anticipates a substantial increase in capital expenditures consistent with
potential growth in operations, infrastructure and personnel.

In June 1999, the Company entered into an operating lease covering
approximately 40,000 square feet of office space in Redwood City, California.
The lease is for a term of five years at an initial monthly rent of
approximately $49,000 which increased to $96,000 monthly in October 1999. The
Company has subleased approximately 19,000 square feet of the facility through
two short-term subleases of 6 and 18 months. The Company expects that both
subleases will terminate in the second quarter of 2000. The Company plans to
utilize the 19,000 square feet for internal expansion and additional personnel
associated with the Worldtalk acquisition.

The Company has a $1.5 million revolving credit facility, which expires in
July 2000, with a bank. Borrowings under the revolving credit facility bear
interest at the prime rate plus 0.5%, with interest payable monthly. At
December 31, 1999, there were no outstanding borrowings under the revolving
credit facility. Under the terms of the revolving credit facility, availability
is based on outstanding accounts receivable, of which $1.0 million was available
to the Company at December 31, 1999. In addition, the Company has two equipment
loan facilities totaling $1,750,000 with the same bank. The first equipment loan
in the amount of $750,000 expires in December 2001 and the second equipment loan
in the amount of $1.0 million expires in December 2002. Borrowings under both
equipment loan facilities bear interest at the prime rate plus 0.75% and are due
and payable in 36 equal monthly installments. As of December 31, 1999, total
borrowings under these equipment loan facilities were $1.3 million in the
aggregate and $200,000 remained available under the facilities.

In September 1999, the Company entered into a $525,000 financing arrangement
with another company to finance its directors' and officers' liability insurance
premium. Borrowings under the loan agreement are payable in nine equal monthly
installments. As of December 31, 1999, total debt outstanding under this
financing arrangement was $302,000.

The Company's capital requirements depend on numerous factors, including
market acceptance of the Company's products and services, the resources the
Company devotes to development of its products and services and the resources
the Company devotes to sales and marketing. The Company has experienced a
substantial increase in capital expenditures and operating expenses since its
inception consistent with the Company's relocation and the growth in operations
and staffing. The Company anticipates that this growth will continue for the
foreseeable future. Additionally, the Company expects to make additional
investments in technologies, and plans to expand its sales and marketing
programs. The Company currently anticipates that its existing cash and sources
of liquidity will be sufficient to meet the Company's anticipated needs for
working capital and capital expenditures for at least the next

26

12 months. To the extent the Company experiences growth beyond the next
12 months, the Company will need to raise funds for its growth from financing
activities.

The Company will continue to consider its future financing alternatives,
which may include the incurrence of indebtedness, additional public or private
equity offerings or an equity investment by a strategic partner. However, other
than the revolving credit facility and the equipment loan facilities, the
Company has no present commitments or arrangements assuring the Company of any
future equity or debt financing, and additional equity or debt financing may not
be available to the Company on favorable terms, if at all. The Company is not
aware of seasonal aspects of its business that will affect the Company's
business on a short or long-term basis.

YEAR 2000 COMPLIANCE

The Company currently is not aware of any Year 2000 problems in any of its
critical systems and products. However, the success to date of the Company's
Year 2000 efforts cannot guarantee that a Year 2000 problem affecting third
parties upon which the Company relies will not become apparent in the future
that could harm the Company's business.

QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

The Company transacts business in various foreign currencies. Accordingly,
the Company is subject to exposure from adverse movements in foreign currency
exchange rates. This exposure is primarily related to revenue and operating
expenses in Europe and Japan which are denominated in local currencies. However,
as of December 31, 1999, the Company had no hedging contracts outstanding.

The Company currently does not use financial instruments to hedge operating
expenses in Europe or Japan which are denominated in local currencies. The
Company assesses the need to utilize financial instruments to hedge currency
exposures on an ongoing basis.

The Company does not use derivative financial instruments for speculative
trading purposes, nor does the Company hedge its foreign currency exposure in a
manner that entirely offsets the effects of changes in foreign exchange rates.
The Company regularly reviews its hedging program and may as part of this review
determine at any time to change its hedging program.

INTEREST RATE SENSITIVITY

The primary object of the Company's investment activities is to preserve
principal while at the same time maximizing the income the Company received from
its investments without significantly increasing risk. Some of the securities
that the Company has invested in may be subject to market risk. This means that
a change in prevailing interest rates may cause the principal amount of the
investment to fluctuate. For example, if the Company holds a security that was
issued with a fixed rate equal to the then-prevailing interest rate and the
prevailing interest rate later rises, the fair value of the Company's investment
will decline. To minimize this risk, the Company maintains its portfolio of cash
equivalents in commercial paper and money market funds. In general, money market
funds are not subject to market risk because the interest paid on these funds
fluctuates with the prevailing interest rate.

The following table presents the amounts of the Company's cash equivalents
that are subject to market risk by range of expected maturity and
weighted-average interest rates as of December 31, 1999. This table does not
include money market funds because these funds are not subject to market risk.



MATURING IN
-------------------
ONE YEAR OVER FAIR
OR LESS ONE YEAR TOTAL VALUE
-------- -------- -------- --------

Included in cash and cash equivalents................... $11,885 None $11,885 $11,885
Weighted--average interest rate......................... 4.52%


27

RISKS AND UNCERTAINTIES

BECAUSE TUMBLEWEED IS IN AN EARLY STAGE OF DEVELOPMENT AND HAS A HISTORY OF
LOSSES, IT IS DIFFICULT TO EVALUATE ITS BUSINESS AND TUMBLEWEED MAY FACE
EXPENSES, DELAYS AND DIFFICULTIES.

Tumbleweed has only a limited operating history upon which an evaluation can
be based. Accordingly, Tumbleweed's prospects must be considered in light of the
risks, expenses, delays and difficulties frequently encountered by companies in
a similarly early stage of development, particularly companies engaged in new
and rapidly evolving markets like secure online communication services. We
incurred net losses of $16.4 million, $6.6 million and $4.7 million in the years
ended December 31, 1999, 1998 and 1997, respectively. As of December 31, 1999
(without giving effect to the Worldtalk acquisition), we had incurred cumulative
net losses as a C-corporation of $28.4 million. See "Consolidated Statements of
Operations" and "Management's Discussion and Analysis of Financial Condition and
Results of Operations."

TUMBLEWEED ANTICIPATES CONTINUED LOSSES.

Although we believe that our success will depend in large part upon our
ability to generate sufficient revenue to achieve profitability and to
effectively maintain existing relationships and develop new relationships with
customers and strategic partners, our revenue may not increase, and we may not
achieve or maintain profitability. In particular, we intend to expend
significant financial and management resources on product development, sales and
marketing, strategic relationships and technology, and operating infrastructure.
As a result, we expect to incur additional losses and continued negative cash
flow from operations for the foreseeable future.

TUMBLEWEED'S QUARTERLY FINANCIAL RESULTS ARE SUBJECT TO SIGNIFICANT
FLUCTUATIONS.

As a result of our limited operating history and the emerging nature of the
markets in which we compete, we may be unable to accurately forecast our revenue
or expenses. We may be unable to recognize quarterly or annual revenue
consistent with our historical operating results or expectations. Our success is
dependent upon our ability to enter into and maintain strategic relationships
with customers and to develop and maintain volume usage of our products by our
customers and their end-users. Our revenue has fluctuated and our quarterly
operating results will continue to fluctuate based on the timing of the
execution of new customer licenses, customer transitions from pre-production to
final launch phase, and customer implementation of Tumbleweed products in that
quarter. Our license revenue consists primarily of initial license and
distribution fees. As a result, in order to realize comparable or increased
license revenue, we must regularly and increasingly sign additional customers
with substantial initial license fees on a timely basis. Our services revenue
historically has consisted almost entirely of implementation and consulting
fees. As a result, in order to realize comparable or increased services revenue,
we must increase our implementation and consulting work, or increase revenue
from product upgrades, which comprise an additional component of our services
revenue. Revenue derived from product upgrades may fluctuate significantly based
on the timing of our release of new versions of our products, and on our
customers' acceptance of the new versions. Our transaction revenue is derived in
the short term from contractual transaction minimums and will only increase in
the longer term through increased transaction volume associated with the use of
our services. The timing of these transactions may also cause our quarterly
operating results to fluctuate. Unless and until we have developed a significant
and recurring transaction-based revenue stream from communications that are sent
with our services, our revenue may continue to fluctuate significantly.

28

In addition, we have experienced, and expect to continue to experience,
fluctuations in revenue and operating results from quarter to quarter for other
reasons, including, but not limited to:

- the amount and timing of operating costs and capital expenditures relating
to our business, operations and infrastructure, including our
international operations; and

- the announcement or introduction of new or enhanced services and products
in the secure online communications or document delivery markets.

A LIMITED NUMBER OF CUSTOMERS ACCOUNT FOR A HIGH PERCENTAGE OF TUMBLEWEED'S
REVENUE AND THE FAILURE TO MAINTAIN OR EXPAND THESE RELATIONSHIPS COULD HARM
TUMBLEWEED'S BUSINESS.

The loss of one or more of our major customers, the failure to attract new
customers on a timely basis, or a reduction in usage and revenue associated with
the existing or proposed customers would harm our business and prospects. Five
customers comprised approximately 36% of our revenue in 1999, and approximately
73% of our revenue in 1998. We expect that a small number of customers will
continue to account for a majority of our revenue for the foreseeable future.

TUMBLEWEED'S SERVICE PROVIDER CUSTOMERS MAY COMPETE WITH TUMBLEWEED OR FAIL TO
PROMOTE TUMBLEWEED'S PRODUCT.

To date, we have generated a significant amount of our IME revenue from
contracts with a very limited number of service provider customers, including
Hikari Tsushin, United Parcel Service, the U.S. Postal Service, Canada Post and
France's La Poste, as member posts of the International Post Corporation
Technology, S.C., Pitney Bowes, Nippon Telegraph and Telephone Corporation and
UPAQ Ltd., which use or intend to use our products for the communication of
third-party documents and data. If these customers do not effectively promote
the use of Tumbleweed IME to their end-users, adoption of our services and the
recognition of associated revenue could be limited. Because our contracts with
our service provider customers are non-exclusive, these customers could elect to
offer competing secure online communication services to their customers through
our existing or future competitors. The service provider customers also may
compete with our secure online communication services through their traditional
physical delivery channels.

IF TUMBLEWEED DOES NOT SECURE KEY RELATIONSHIPS WITH ENTERPRISE CUSTOMERS,
TUMBLEWEED'S ACCESS TO BROADER MARKETS WILL BE LIMITED.

Our enterprise customers, which use or intend to use Tumbleweed IME for
internal purposes or for distribution of internally generated communications to
their customers, are an increasingly significant source of our revenue. A key
aspect of our strategy is to access target markets prior to adoption of
alternative online distribution solutions by the larger participants in these
markets. The failure to secure key relationships with new enterprise customers
in targeted markets could limit or effectively preclude our entry into these
target markets, which would harm our business and prospects.

CUSTOMERS IN A PRELIMINARY PHASE OF IMPLEMENTING TUMBLEWEED'S PRODUCT MAY NOT
PROCEED ON A TIMELY BASIS OR AT ALL.

Some of our customers are currently in a pre-production or pre-launch stage
of implementing Tumbleweed IME and may encounter delays or other problems in the
introduction of IME-based services. A decision not to do so or a delay in
implementation could result in a delay or loss in related revenue or otherwise
harm our businesses and prospects. In particular, a complaint was filed with the
Postal Rate Commission in 1999 alleging that the U.S. Postal Service's offering
of the Tumbleweed IME-based service PostECS, currently in a preliminary phase,
is subject to regulation by the Postal Rate Commission. On May 3, 1999, the
Postal Rate Commission issued an order determining that it has jurisdiction over
the implementation of PostECS and is pursuing formal proceedings to consider the

29

complaint. These proceedings could result in a delay of the launch of our
service by the U.S. Postal Service or an election not to proceed with the
product launch. We cannot predict when any customer that is currently in a pilot
or preliminary phase will implement broader use of our services.

THE MARKETS FOR SECURE ONLINE COMMUNICATION SERVICES GENERALLY, AND THE
TUMBLEWEED IME PRODUCT SPECIFICALLY, ARE NEW AND MAY NOT DEVELOP.

The market for our products and services is new and evolving rapidly. If the
market for our products and services fails to develop and grow, or if our
products and services do not gain broad market acceptance, our business and
prospects will be harmed. In particular, our success will depend upon the
adoption and use by current and potential customers and their end-users of
secure online communication services. Our success will also depend upon
acceptance of our technology as the standard for providing these services. The
adoption and use of our products and services will involve changes in the manner
in which businesses have traditionally exchanged information. In addition, sales
and marketing of our products and services is to a large extent under the
control of our customers. In some cases, our customers have little experience
with products, services and technology like those offered by us. Our ability to
influence usage of our products and services by customers and end-users is
limited. To date, the usage of Tumbleweed IME by the end-users of our service
provider customers has been limited. We have spent, and intend to continue to
spend, considerable resources educating potential customers and their end-users
about the value of our products and services. It is difficult to assess, or to
predict with any assurance, the present and future size of the potential market
for our products and services, or its growth rate, if any. Moreover, we cannot
predict whether our products and services will achieve any market acceptance.
Our ability to achieve our goals also depends upon rapid market acceptance of
future enhancements of our products. Any enhancement that is not favorably
received by customers and end-users may not be profitable and, furthermore,
could damage our reputation or brand name.

THE TRADITIONAL AND INTERNET DELIVERY SERVICES INDUSTRIES ARE HIGHLY COMPETITIVE
AND RAPIDLY CHANGING, AND TUMBLEWEED MAY NOT BE ABLE TO COMPETE SUCCESSFULLY.

We may not be able to compete successfully against current and future
competitors, and the competitive pressures we face could harm our business and
prospects. Broadly speaking, Tumbleweed IME is an alternative to traditional
mail and courier delivery services, such as those offered by Federal Express
Corporation, United Parcel Service or the U.S. Postal Service, and to general
purpose e-mail applications and services. As such, we compete with these
options. Ultimately, we believe that the Internet will become the primary
solution for secure online communication services. Within this area, our direct
competition comes from other secure online communication service providers of
various sizes, some of which have products that are intended to compete directly
with our products. Examples of secure online communication service providers
include Automatic Data Processing, Inc., Critical Path, Inc., Differential Inc.
(now known as Receipt.com), e-Parcel, LLC, PostX Corporation, and ZixIt
Corporation. On November 4, 1999, Critical Path, Inc. announced that it had
entered into a definitive agreement to acquire The docSpace Company, Inc., and
on March 9, 2000 announced that the acquisition had been completed. This
acquisition may significantly increase the competitive pressures we face
particularly because Tumbleweed has filed a patent infringement lawsuit against
The docSpace Company, Inc. In addition, companies with which we do not presently
directly compete may become competitors in the future, either through the
expansion of our products and services or through their product development in
the area of secure online communication services. These companies could include
America Online, Inc./Netscape Communications Corporation, International Business
Machines Corporation/Lotus Development Corporation, Microsoft Corporation and
VeriSign, Inc.

The market for secure online communication services is new, rapidly
evolving, and highly competitive. The level of competition is likely to increase
as current competitors improve their offerings

30

and as new participants enter the market. Many of our current and potential
competitors have longer operating histories, larger customer bases, greater
brand recognition and significantly greater financial, sales, marketing,
technical and other resources than Tumbleweed. Moreover, these competitors may
enter into strategic or commercial relationships with larger, more established
and well-financed companies. Some of our competitors may be able to enter into
these strategic or commercial relationships on more favorable terms.
Additionally, these competitors have research and development capabilities that
may allow them to develop new or improved products that may compete with product
lines we market and distribute. New technologies and the expansion of existing
technologies also may increase competitive pressures on us. Increased
competition may result in reduced operating margins as well as loss of market
share and brand recognition. This could result in decreased usage of our
products.

WE FACE TECHNICAL, OPERATIONAL AND STRATEGIC CHALLENGES THAT MAY PREVENT US FROM
SUCCESSFULLY INTEGRATING WORLDTALK.

The integration of the Worldtalk Communications Corporation business,
including its technology, operations and personnel, has been and will be a
complex, time consuming and expensive process that may disrupt our business if
not completed in a timely and efficient manner. We must operate as a combined
organization utilizing common information and communication systems, operating
procedures, financial controls and human resources practices. In particular, we
are currently evaluating and upgrading our management information systems and
establishing uniformity among the Tumbleweed systems and those formerly operated
by Worldtalk. We may encounter substantial difficulties, costs and delays
involved in integrating the operations of the Worldtalk subsidiary, including:

- potential incompatibility of business cultures

- perceived adverse changes in business focus

- potential conflicts in customer, advertising or strategic relationships,

- potential failure to complete anticipated sales, and

- the loss of key employees and diversion of the attention of management
from other ongoing business concerns.

As a result, we may not be successful in integrating the Worldtalk business
or technologies and may not achieve anticipated revenue and cost benefits. We
also cannot guarantee that this acquisition will result in sufficient revenues
or earnings to justify our investment in, or expenses related to, this
acquisition. Nor can we guarantee that any anticipated synergies will develop.
If we fail to execute our acquisition strategy successfully for any reason, our
business will suffer significantly.

TUMBLEWEED'S PRODUCT INTEGRATION EFFORTS MAY BE HINDERED BY A VARIETY OF
TECHNICAL FACTORS.

Tumbleweed faces certain risks associated with the planned integration of
the Worldtalk technology. Because Worldtalk has historically based its products
on an NT platform and we have created a platform-independent architecture for
the Tumbleweed IME products, the integration of products from Worldtalk may
result in unanticipated architectural incompatibilities that would require
additional time and engineering resources to resolve. The loss of key
engineering personnel may increase the time and resources needed to resolve
these and other technical integration issues. To the extent that our technical
personnel who formerly worked for Worldtalk collaborate with our personnel who
have not worked for Worldtalk, the identification and resolution of any
previously divergent technical standards used by each company's personnel, as
well as the implementation of common product development practices and
standards, may result in unanticipated product development delays.

31

In addition, the installation of integrated or complementary software products
at customer sites may result in difficulties associated with customer-specific
installation processes.

WE HAVE EXPERIENCED RAPID GROWTH WHICH HAS PLACED A STRAIN ON RESOURCES AND OUR
FAILURE TO MANAGE GROWTH COULD CAUSE OUR BUSINESS TO SUFFER.

We have expanded our operations rapidly and intend to continue this
expansion. The number of our employees increased from 75 as of June 30, 1999 to
224 as of February 29, 2000. This expansion has placed, and is expected to
continued to place, a significant strain on managerial and operational
resources. To manage any further growth, we will need to improve or replace our
existing operational, customer service and financial systems, procedures and
controls. Any failure to properly manage these systems and procedural
transitions could impair our ability to attract and service customers, and could
cause us to incur higher operating costs and delays in the execution of our
business plan. We will also need to continue the expansion of our operations and
employee base. Our management may not be able to hire, train, retain, motivate
and manage required personnel. In addition, our management may not be able to
successfully identify, manage and exploit existing and potential market
opportunities. If we cannot manage growth effectively, our business and
operating results could suffer.

TUMBLEWEED HAS A LENGTHY SALES AND IMPLEMENTATION CYCLE WHICH COULD HARM ITS
BUSINESS.

The inability to license our services to new customers o