CyberArk contract, support and lifecycle terms are the documents around the product metrics. They fix who the contracting entity is, what the customer may do with the software, how overuse is handled, what is refundable, what happens when a subscription ends and how long a self-hosted version stays supported. Palo Alto Networks completed its acquisition of CyberArk on 2026-02-11.[1] The contract documents now name Palo Alto Networks Ltd. (formerly CyberArk Software Ltd.) and its Affiliates as the contracting CyberArk entity, as indicated in the applicable Order.[2]
Editions
CyberArk publishes five relevant documents.
| Document | Applies to | Version shown |
|---|---|---|
| Software License Agreement (Global) | Self-Hosted Software | Rev. 10 September 2026[2] |
| SaaS Terms of Service (Global) | SaaS Products | Rev. 10 September 2026[3] |
| Support Terms (Global) | Support for perpetual and subscription Self-Hosted Software and SaaS Products | 10 October 2025[4] |
| Managed Services Provider License Agreement (Global) | Managed service providers that operate the software for a Tenant | Rev. April 2022[5] |
| End-of-life policy for self-hosted products | Supported versions of self-hosted software | Dates as listed in the Documentation[6] |
Each document defines the Order as CyberArk’s quote accepted by the customer’s purchase order or other ordering document, direct or through a Channel Partner, which references the software or services, pricing, payment terms, quantities, expiration date and other terms.[2][3] The Documentation, which includes docs.cyberark.com and the Venafi documentation sites and excludes sales and marketing materials, is the standard to which use must conform.[2][3]
Metrics
The contracts do not define product metrics. They require that use be in the quantity specified in the Order and measured by the entitlement measures of the Software.[2] Section 1.3(b) of the Software License Agreement and section 1.2(b) of the SaaS Terms of Service prohibit exceeding the licensed quantities, users or other entitlement measures.[2][3] The Authorized Users who may use the software are the customer’s employees, agents, consultants, contractors or vendors, for the internal use of the customer and its Affiliates, where an Affiliate is an entity under over 50 percent common ownership or control.[2] In the SaaS Terms an Authorized User may also be a Third Party Service provider authorised by the customer, and licences purchased as a bundle under a single product code cannot be separated between different Authorized Users.[3]
Counting and floors
CyberArk’s standard terms contain few floors. The numbers they do state are these.
- Invoices are payable within 30 days, and late amounts carry a charge of 1.5 percent per month or the legal maximum if lower.[2][3]
- Licence, support and SaaS fees are non-refundable and payable in advance.[2][3]
- CyberArk may suspend access on 30 days’ written notice if an invoice is more than 60 days past due for self-hosted software, or more than 30 days past due for SaaS.[2][3]
- MSP licences have an initial term of a minimum of one year.[5]
- A customer exercising EU Data Act rights may terminate an Order on two months’ written notice, with no refund of prepaid fees, immediate payment of the fees for the agreed Subscription Term and no additional exit fee.[3]
Virtualization and partitioning
The contracts contain no virtualization, partitioning or hosting-environment rules. Where such rules exist they are in the product documentation, for example the concurrent-agent treatment of non-persistent virtual desktops in Endpoint Privilege Manager.[7]
Cloud and self-hosted
Self-hosted software
The Software License Agreement grants a world-wide, non-exclusive, non-transferable licence to use the Software and Documentation for the licence term in the Order. The customer may make a reasonable number of copies of the Documentation and one archival copy of the Software.[2] The customer may not resell, sublicense, rent, lease, time-share or otherwise transfer the licence rights to a third party except as expressly permitted, may not decompile or use the software for competitive or benchmark purposes, and may not store regulated personal health, credit card or financial data in it unless required by the Documentation.[2] Either party may assign the agreement to a successor in a merger or acquisition or to an Affiliate on prior written notice; otherwise assignment needs consent that is not to be unreasonably withheld.[2]
SaaS
The SaaS Terms grant a non-exclusive, non-transferable right to access and use the SaaS Products during the Subscription Term, in accordance with the Documentation and in the quantity specified in the Order. CyberArk may update or upgrade the SaaS Products.[3] The customer must not exceed subscribed quantities, penetration-test the service without written approval or use it for high-risk activities, and may not store personal health data (unless a business associate agreement says otherwise) or ITAR data; PCI cardholder data is allowed only in services certified under PCI DSS as listed on the CyberArk Trust Center.[3]
When a Subscription Term ends CyberArk may deactivate the account immediately. The customer keeps a limited right to export Customer Data; CyberArk has no obligation to keep data beyond 40 days, and data is deleted within the period in the Documentation or, if none, within 60 days.[3] Trial Services data and configuration are lost at the end of the trial unless the customer buys a subscription to the same product or exports the data first.[3]
Conversion
If a customer converts perpetual self-hosted licences to a subscription or SaaS licence, the previously licensed perpetual licences and their support are terminated in accordance with the Order.[2][3]
Programs
Support options
Support Services for subscription self-hosted software and SaaS run for the subscription term, and for perpetual software from delivery or renewal.[4] The Annex lists four options with response times by severity: Production, Premium, Platinum and Trusted (US only). For example the Critical response targets are 2 hours for Production, 1 hour for Premium, 30 minutes for Platinum and 2 hours for Trusted.[4] Subscription self-hosted and SaaS customers that do not renew an enhanced option revert to Production Support, whereas perpetual customers that do not renew lose support entitlement; to reinstate lapsed perpetual support the customer pays the fees for the lapsed period plus CyberArk’s then-current reinstatement fees.[4]
Managed Services Provider licence
The MSP License Agreement amends the underlying Software License Agreement or SaaS Terms where a provider operates the software for third parties. Use is solely for the internal business purposes of the Tenant designated in the Order and not for any other third party. The provider is responsible for the Tenant’s use and for non-compliance by Authorized Users. Fees follow the then-current price list for Managed Services or the quote, and that price list may not be applied to the provider’s other resale activities. The initial term is at least one year.[5]
End-of-life policy
The policy for self-hosted products separates the Support Period from the Development Period. Versions are either Long Term Support (LTS) or Standard Term Support (STS), and any version not designated LTS is STS. LTS versions have backported high and critical security fixes and critical functionality fixes during development, and the customer may extend the support period for additional fees, though the development period cannot be extended. Upgrades are supported from one LTS version to another or to the latest release.[6] The policy lists dates by version; for PAM - Self-Hosted, version 14.6 (LTS) is shown with default end of support June 2028 and extended June 2030, and version 12.6 (LTS) with default September 2025 and extended June 2027.[6] The policy also records that support for the Privileged Threat Analytics domain controller agent ended on July 31, 2024.[6]
Trial versions
A Trial Version or Trial Services covers a free trial, proof of concept, beta or other free-of-charge use. It is for internal evaluation only, runs until the earliest of the end of the trial, the start of the purchased version or a termination notice, and carries no support obligation or warranty.[2][3]
Indirect Orders
If the customer orders through a Channel Partner, the final sales price is determined freely between the partner and the customer, CyberArk’s own pricing and payment provisions do not apply, and the customer still has to comply with the restrictions on use.[2][3]
Audits and compliance
The Software License Agreement allows CyberArk to review the customer’s use of Self-Hosted Software to determine compliance with fee requirements, product licensing parameters or licensing metrics, to request usage reports not more than once a year on reasonable advance notice if they are reasonably accessible, and to invoice use outside the licence scope, including more than the purchased number or type of licences.[2] The SaaS Terms contain no licence review clause; instead the customer must cooperate to resolve non-compliance, which may include paying overages at then-current rates.[3] On termination or expiry all outstanding fees become immediately due and payable and the right to use ends.[2][3]
After the Palo Alto Networks acquisition, the company stated that existing customers experience no disruption and that the solutions remain available as a standalone platform.[1] A contract renewal is the point at which the Order, and any assignment to a Palo Alto Networks entity, should be checked against the current documents.
Out of scope
Governing law and jurisdiction vary by CyberArk entity and are stated in each agreement. Data processing, business associate and FedRAMP terms are published separately and are not summarised here. Product metrics are in CyberArk licensing and the three product articles.