Check Point licensing is the set of terms under which Check Point Software Technologies Ltd. sells its network firewalls, security management, cloud firewalls and workspace security services. Two contracts divide the portfolio. The Software License Agreement covers Check Point’s firewall and management appliances (“Hardware Products”) and the software supplied with them.[1] The Terms of Service for Cloud Services cover every other Check Point product and service, including the services run from the Check Point Portal (formerly Infinity Portal).[2] Appliance software is licensed through a License Key that fixes a Licensed Configuration: the features, the number of users, devices or nodes, the number of cores or the maximum throughput on which the fee was based.[1] Cloud services are subscriptions for a Service Term, used within a “Permitted Scope” that Check Point may measure with technical tools.[2] For the general models, see processor and core licensing and subscription and consumption licensing.
Editions
Check Point does not publish a public price list. It names its products in product documentation, licence guides and package sheets, and sells through partners. In March 2026 it changed product names “to align with the new Check Point strategic pillars and portal navigation”, stating that no functional changes were made. Harmony Endpoint is now referred to as Endpoint Security.[10] The CloudGuard Central License Tool became the Cloud Firewall Central License Tool in the same exercise.[6]
| Product family | Current name (former name) | Main licensing unit |
|---|---|---|
| Network gateways | Quantum Security Gateways, Quantum Force and Spark Firewall appliances | Licensed Configuration on a Central or Local licence[1][5] |
| Cloud network | Cloud Firewall (CloudGuard Network) | Virtual cores in a central licence pool, or hourly marketplace PAYG[6] |
| Endpoint | Endpoint Security (Harmony Endpoint) | Per seat[7] |
| Email and collaboration | Email Security (Harmony Email & Collaboration) | Per protected user account[8] |
| Remote and internet access | Check Point SASE (Harmony SASE, Harmony Connect) | Per licensed unit; legacy Harmony Connect units capped at 12 GB of traffic a month[2] |
| Portal services, general | Check Point Portal (Infinity Portal) | Daily unique billable units[9] |
Product-level detail is in Check Point Quantum and Cloud Firewall licensing and Check Point workspace security licensing. Catalog SKUs include the Harmony Endpoint packages and the Email Security Advanced Protect package.
Metrics
| Check Point term | Catalog row | Where it applies |
|---|---|---|
| Licensed Configuration | Licensed Configuration | All products with a License Key: features, users, devices or nodes, cores or throughput.[1] |
| vCore | vCore (Cloud Firewall central licence pool) | Cloud Firewall gateways drawing cores from a pool on the management server.[6] |
| Seat | Endpoint seat | Every Endpoint Security client.[7] |
| Protected user | Email Security protected user | Each user account with a licence to a protected SaaS application.[8] |
| Billable unit | Check Point Portal billable unit | Devices, cores, users, seats or assets counted daily by Portal services.[9] |
| User per year | ELA user per year | Enterprise License Agreement.[11] |
The Licensed Configuration definition gives a “node” a specific meaning: an internal computing device with an IP address on the trusted side of the network, or one trying to traverse the firewall.[1] Catalog: Use is limited to the Licensed-server and the Licensed Configuration.
Counting / floors
License Key and Licensed-server. The appliance licence lets the customer install and use the Product only on the Licensed-server and only for the Licensed Configuration.[1] The Licensed-server is identified by the host ID the customer gives Check Point when it obtains the License Key.[1] In Quantum management this host ID is an IP address. A Central licence is attached to the IP address of the Management Server. A Local licence is tied to the IP address of a specific Security Gateway.[5] If a product comes without a License Key, the minimum configuration Check Point allows for that product applies.[1] Catalog: Central licences attach to the Management Server IP; Local licences to the gateway IP.
No engineering around the limits. Building any hardware, software or system that alters the number of readable IP addresses, users or cores, or exceeds the throughput presented to the Product, with the intent or effect of circumventing the Licensed Configuration, breaches the agreement.[1] Catalog: Circumventing the Licensed Configuration is a breach.
Features cost extra. The agreement warns that particular features, functionalities, operations or capabilities may need separate licences.[1] On gateways these are Software Blades. See Check Point Quantum and Cloud Firewall licensing.
Cloud services. A Service may be used only as described in the Service Order and Check Point’s product catalogue, within a Permitted Scope that can include users, applications, devices, gateways, cores, virtual machines, assets, traffic, bandwidth, throughput, logs and capacity.[2] In the Check Point Portal, daily usage is the number of unique billable units across all protected services in one day. Monthly usage is the sum of daily usages multiplied by 12 and divided by 365.[9] Catalog: Cloud Services are limited to the Permitted Scope and metered; Portal monthly usage is daily unique units x 12 / 365.
Floors. The general terms set no minimum quantity. Minimums appear in individual products, for example the SaaS Security Essentials tier, which is not sold to organizations with up to 499 users. See Check Point workspace security licensing.
Virtualization & partitioning
Check Point has no processor-partitioning rules of the kind used by database vendors. Virtualization matters in three places. First, the Licensed Configuration can be a number of cores, and presenting fewer cores to the product to stay within a licence is prohibited.[1] Second, Cloud Firewall gateways on public and private clouds draw virtual cores from a central pool, and members of a Full HA cluster each need their own non-central licence.[6] Third, Endpoint Security on terminal servers counts every user as a seat. See virtualization and partitioning.
Cloud / BYOL
Cloud Firewall can be licensed with customer-bought licences pooled on the Security Management Server or Multi-Domain Server, or bought hourly through a cloud marketplace. Both routes are covered in Check Point Quantum and Cloud Firewall licensing.
Programs
- Check Point Platform Agreement. Check Point describes these agreements as giving access to its full set of solutions, services and support programs within one procurement framework. They range from pre-defined multi-year contracts to shorter, flexible allowance agreements.[4]
- Infinity Enterprise License Agreement. An all-inclusive subscription priced per user, per year.[11]
- Direct Enterprise Support and Collaborative Enterprise Support. Support is bought separately from licences, at Standard, Premium or Elite level, either directly from Check Point or through a certified partner.[3]
- Evaluation and trial licences, Portal PAYG and MSP licensing.
These are described in Check Point support and enterprise agreements.
Contract terms
Term and ownership. The appliance licence is non-exclusive, non-sublicensable and non-transferable. It is perpetual, with two exceptions. A Product designated for a limited period ends when that period ends. A licence for a Hardware Product lasts only for the life of the originally designated appliance.[1] The licence is not a sale of the Product.[1] Catalog: Licence is perpetual except for time-limited products and appliance-bound licences.
No refunds. Unless agreed otherwise, appliance licence fees are non-cancellable and non-refundable during the licence term.[1] Cloud subscription fees are likewise non-cancellable and non-refundable during the Service Term.[2] Catalog: Licence fees are non-cancellable and non-refundable.
Who may use it. A “Standard User” may use the Products only for its own operations. No Product may be used by or for, accessed by, resold, rented or distributed to any other party.[1] A Managed Service Provider may use them only to manage the Product for Service Customers who have bought it, and is responsible for their compliance.[1] Assignment needs Check Point’s prior written consent.[1] Catalog: Standard Users may not use Products for other parties; Assignment requires Check Point consent.
Changes and law. Check Point may revise the Software License Agreement at any time by publishing a notice or the revised terms, and continued use counts as acceptance.[1] Israeli law governs, with exclusive jurisdiction in the courts of Tel Aviv.[1] Catalog: Check Point may revise the licence agreement at any time.
Termination. Check Point may terminate for a breach not cured within 30 days. When the agreement ends, the customer must stop using the Product, return or destroy it, and certify that it has done so.[1] Catalog: Termination requires ceasing use and certifying destruction.
Audits and compliance
The Software License Agreement contains no audit clause. Compliance for appliances is enforced technically. Licences are issued for a specific IP address. When a licence expires, the features it enables stop working on the computer it is attached to.[5] The cloud terms are more explicit. Check Point may use technical tools to measure consumption and verify compliance with the Permitted Scope.[2] If usage exceeds that scope, Check Point may charge list price for the additional subscription licences needed. On notice it may also limit, suspend or terminate the licence.[2] Catalog: Excess cloud usage is charged at list price. Product consoles show the same data. Endpoint Security escalates from email warnings to read-only policy and disabled installations when seats are exceeded or licences expire.[10] Email Security counts licences from the user accounts it syncs from Microsoft and Google.[8] For the general discipline, see software license audit and license compliance.
Out of scope
- Prices. Check Point publishes no list prices, and its online product catalogue requires a User Center login.
- Signed Platform Agreements and ELAs, public-sector contract vehicles and marketplace private offers, which override the web terms and were not retrievable.
- “Infinity Points” or other credit-based allowance schemes. No public Check Point document describing such a currency was found; allowance agreements are mentioned only in general terms.[4]
- Consumer products and hardware specifications.
- Check Point has been a defendant in patent infringement suits, but no court case about its software licensing, audits or licence scope was found, so there is no litigation article.