The Checkmarx Terms of Service are Checkmarx’s standard customer agreement for its Software and Services. They apply unless the customer has a separate written agreement with Checkmarx. A customer accepts them by clicking an acceptance button, by signing a document that incorporates them, or by accessing or using the Software or Services.[1] They sit at the top of a document set that Checkmarx publishes together: Local Country Addenda for Australia, France, Germany, India and the United Kingdom, License Types pages for each product, a Software SLA, a Cloud Services SLA and a Data Processing Agreement.[2] The text carries no version date. For products and metrics, see Checkmarx licensing.
Editions
The agreement covers two delivery models. SaaS is the Solution provided on a subscription basis, hosted by Checkmarx and accessed over the Internet. On Premises is the Solution provided for download and installation on servers owned, leased or managed by the customer.[1] Hosting Services, in which Checkmarx hosts On Premises Software, are bought separately as their own Quote line item.[1]
| Term | Meaning in the Terms of Service |
|---|---|
| Quote | A valid quotation from Checkmarx or an authorized partner setting out the quantity and type of Solution licences and Services purchased[1] |
| License Type | The current licence type definitions and usage restrictions published at checkmarx.com/legal/terms[1] |
| Solution | The Software or data product licence purchased, as set out in the Quote[1] |
| Subscription Term | From the Commencement Date for the period in the Quote, including renewals; 12 months if the Quote states no term[1] |
The Commencement Date is the start date in the Quote or, if none is given, the date the licence keys or access credentials are first made available.[1] Catalog: Subscription Term defaults to 12 months.
Metrics
The agreement defines no unit itself. It grants use “subject to the License Type restrictions and the quantity and type of licenses purchased”.[1] Because the License Type definition refers to the current definitions at checkmarx.com/legal/terms, the published License Types pages are effectively part of the contract. For Checkmarx One that page is version 2026.09, with the Contributing Developer metric and Credits.[6]
Credits. Where features are sold on a consumption basis, the Quote or the Documentation specifies the Credits bought and the activities that consume them. Credits are not currency, stored value or a monetary balance. Access to Credit-based functionality may be suspended when Credits run out, and unused Credits expire as the Quote, License Type or Documentation provides.[1]
Counting / floors
Grant. Checkmarx grants the customer and its Affiliates a limited, non-exclusive, non-transferable, non-sublicensable licence to use the Solution and Documentation for their internal business purposes during the Subscription Term.[1] The customer is responsible for its Affiliates’ compliance.
Authorized Contractors. Contractors who need the Solution to provide services to the customer may be given access. They may use it only for the customer’s benefit and only to the extent needed for those services.[1] Catalog: Authorized Contractor use; Authorized Contractors may use the Solution only for the customer.
Orders. Orders are subject to Checkmarx’s approval and, once approved, are firm and non-cancelable. Any Affiliate that submits an order is bound by the agreement.[1] Fees are billed upfront and in advance unless the Quote says otherwise, are due 30 days from invoice and are non-refundable except in the stated cases.[1] Catalog: Approved orders are firm and non-cancelable.
Restrictions
Among the restrictions in the agreement, the customer, its Affiliates and Authorized Contractors may not:[1]
- use the Solution beyond the License Type restrictions or quantities purchased, or circumvent License Type limitations;
- resell, rent, lease, sublicense or lend the Solution;
- use the Solution to provide application security services to a third party, or make it available to a third party;
- use the Solution or its output for competitive analysis or benchmarking, or to build a competing product;
- share passwords, licence keys, credentials or API keys with a third party;
- make reports generated by the Solution available to third parties, except disclosures to regulators, insurers or others where the law requires them;
- try to reconstruct a vulnerability or threat database from the Solution.
Catalog: No use to provide application security services to third parties; Reports may not be given to third parties except as required by law. The reports restriction matters for software suppliers asked to share scan results with their customers. The agreement only allows legally required disclosure. API credentials and documentation are confidential, may be used only for the customer’s internal use of the Solution, and Checkmarx may restrict API use to prevent abuse or excessive use.[1]
Virtualization & partitioning
For On Premises Software the customer may install the Software on one server it owns, leases or manages. If it bought several server licences, it may install on the number of servers in the Quote. It may also keep one backup copy for non-production, inactive backup and archival purposes only.[1] Catalog: On Premises Software may be installed on the number of servers in the Quote.
Cloud / BYOL
SaaS and hosted Solutions are provided under the Cloud Services SLA.[1] That SLA commits to at least 99.5% availability per year, excluding a scheduled maintenance window from Friday 10:00 pm to Sunday 11:00 pm Eastern US Time.[4] Catalog: Cloud Services availability of at least 99.5% a year.
Programs
Evaluation Access. Trials, evaluations, betas and prereleases receive a non-exclusive, non-transferable licence for internal evaluation only. Accepting Evaluation Access means accepting the agreement. If Checkmarx specifies no Evaluation Period in writing, it is 14 days from first access. Evaluation Products are as-is, and at the end the customer must stop using them and delete copies unless it signs a definitive agreement.[1] Checkmarx’s pricing page says there is no self-serve free trial for Checkmarx One.[5] Catalog: Evaluation Access; Evaluation Access defaults to 14 days.
Support. Support follows the support SLA and the level purchased.[1] The Software SLA defines Standard support (business days) and Premium support (24 hours a day, 365 days a year).[3]
Professional services. One service day is eight hours. Purchased service hours or credits must be used within 12 months unless the Work Description says otherwise. After that they expire and are deemed delivered.[1] Catalog: Service hours and credits expire after 12 months.
Audits and compliance
The Usage Verification clause works as follows:[1]
- The customer must ensure that its own use, and that of its Affiliates and Authorized Contractors, does not exceed the number and type of licences purchased.
- On Checkmarx’s written request, it must provide a written certification of compliance signed by an authorized representative.
- On request, it must provide the records reasonably necessary to verify actual usage.
- If actual usage exceeds the purchased quantities, it must promptly buy additional licences. The fees run from the date the excess began and are invoiced for the rest of the current Subscription Term.
The clause sets no frequency limit, notice period or cost-shifting threshold. It does not provide for on-site inspection. Backdating fees to the start of the excess makes early detection valuable. Catalog: Customers must certify compliance and provide usage records on request; Excess usage is charged from the date it began. See software license audit and license compliance.
AI features and data
Checkmarx will not use Customer Data, or allow others to use it, to train AI or machine-learning models. The customer owns AI Output generated from its Customer Data, except for embedded Checkmarx Content. Where the customer incorporates suggested fixes into its own code during the Subscription Term, it receives a perpetual, royalty-free licence to that Checkmarx Content.[1] Checkmarx may use aggregated, de-identified Usage Data for statistics, benchmarking and product improvement.[1]
Term, termination and exit
The agreement continues until all active Subscription Terms have expired. Either party may terminate for a material breach not cured within 30 days of written notice, for insolvency proceedings not dismissed within 60 days, or immediately where performance would cause a material and incurable violation of law. On termination, all licences end, use must stop and unlicensed copies must be deleted. On written request, Customer Data can be exported for 30 days after termination or expiry, after which it is deleted.[1] Catalog: Customer Data can be exported for 30 days after termination.
Warranties and liability. SaaS Solutions are warranted to conform substantially to the Documentation during the Subscription Term. On Premises Solutions carry that warranty for 30 days after delivery.[1] Checkmarx’s aggregate liability is capped at the fees paid in the twelve months before the first event giving rise to a claim.[1]
Assignment and law. The customer may not assign the agreement without Checkmarx’s written consent. Checkmarx may assign it to Affiliates or to an acquirer.[1] New York law governs unless a Local Country Addendum designates otherwise. Disputes not settled within 60 days go to AAA arbitration in New York.[1] The contracting entity is Checkmarx, Inc. for customers in the United States or Canada, and Checkmarx Ltd. elsewhere unless the Quote or an addendum names another entity.[1] Catalog: Checkmarx, Inc. contracts in the United States and Canada.
Out of scope
- The content of the individual Local Country Addenda.
- The Data Processing Agreement and sub-processor list.
- Earlier versions of the Terms of Service, which Checkmarx does not publish alongside the current text.