The Darktrace Master Services Agreement is the contract that governs access to and use of every Darktrace Offering. Together with all applicable Orders it is the “Agreement”, and it becomes binding on the earliest of the date the customer accepts the terms, the date specified in an Order, or the date the customer downloads, installs, activates or otherwise uses the Offering. It remains in effect as long as the customer has authorised access to the Offering.[1] The version reviewed here is v2.4.0, dated 3 August 2026, as published on Darktrace’s legal page.[2]
Structure of the contract
The MSA states its own order of precedence: the Order comes first, then the main body of the MSA, then the documents incorporated by reference, except that the Data Processing Addendum prevails on its own subject matter.[1] The incorporated documents include the Product Specification, the Support Terms, the Data Processing Addendum and, where applicable under HIPAA, the Business Associate Agreement.[1] Darktrace publishes them on one legal page together with the Product Specific Terms, appliance specifications and service definitions.[2]
The MSA is not frozen. It can be amended only by a written document signed by authorised representatives, except that Darktrace may unilaterally modify the Product Specification and the Support Terms so long as it does not reduce or materially modify the functionality of the Offering.[1] A licence manager should therefore record the version of the Product Specification that applies at each renewal. The current Product Specification is v1.7.0 and the Support Terms are v1.4.0.[3][4]
Ordering and partners
The customer may buy directly from Darktrace or through a Partner, defined as an authorised reseller, under a separate Partner Arrangement. Either way, the MSA governs Darktrace’s obligations and liabilities. Only the terms in an Order signed by Darktrace and the customer, or by Darktrace and a Partner for the customer, have force. Pre-printed terms on a customer or Partner purchase order are expressly excluded, and Orders are non-cancellable.[1]
Fees and payment
Where fees are payable to Darktrace and the Order is silent, they are invoiced annually at the start of each year of the Subscription Period, where a year starts on the Commencement Date and each anniversary, and are payable within 30 days of an emailed invoice. All fees are non-refundable and non-cancellable except where the MSA expressly provides otherwise.[1]
Darktrace reserves three rights to raise fees. It may increase them on 30 days’ notice, proportionately, if its cloud provider raises charges for services needed for the Offering; once per year on not less than 60 days’ notice, taking effect from the next anniversary of the Commencement Date; and where changes to the customer’s network or infrastructure after the Order cause cost to Darktrace, which it may charge to the customer.[1] The cloud providers named in the definitions are Microsoft Azure, Amazon Web Services and Google Cloud Platform, as specified on the Order.[1] Fees exclude taxes. Late payments may attract a charge of 1.5 percent per month or, if lower, the highest lawful rate, and if the customer must withhold tax it must gross up the payment.[1]
Licence grant and usage limits
Subject to payment, Darktrace grants a non-exclusive, non-transferable (except under the assignment clause), non-sublicensable licence to access and use the Offering for the internal business purposes of the customer and its Affiliates, in accordance with the MSA and the Product Specification, during the Subscription Period.[1] The software is provided on a subscription access basis and not sold.[1]
Use is limited to the Usage Metrics in the Order, and the customer pays additional fees if they are exceeded.[1] The Order is defined as the document that identifies the Offering purchased, the Offering quantity “based on Darktrace’s applicable usage metrics”, the price and the Subscription Period.[1] The catalog entry Usage Metrics summarises this.
AI agents
The MSA permits access through “AI Agents”, defined as software, models or automated processes the customer, an Affiliate or an Outsource Provider uses to access the Offering, including through the Darktrace Model Context Protocol interface. Each act or omission of an AI Agent is deemed an act or omission of the customer, the customer must follow the Product Specification when using agents, and Darktrace may suspend an AI Agent’s access alone.[1] Warranties do not apply to non-conformities that arise from an instruction given through an AI Agent.[1]
Affiliates and outsourcers
The customer is responsible for Affiliates that use or benefit from the Offering. It may let an Outsource Provider, meaning a third-party hosting, managed service or other IT service provider, exercise the licence solely on its own or its Affiliates’ behalf, and it is liable for any breach by that provider.[1] The restrictions also prohibit employing or authorising a Darktrace competitor to use or view the Offering or to provide management, hosting or support for it.[1]
Restrictions
The MSA lists twelve restrictions. Customers may not exceed the licence scope, modify or create derivative works, reverse engineer, frame, sell, resell, rent or lease the Offering, infringe third-party rights, disrupt it, scrape it with tools other than those Darktrace provides, use it for benchmarking or competitive analysis, let a competitor use or view it, disclose the contents of Alerts or reports to third parties other than Affiliates and Outsource Providers without consent, use it to circumvent third-party security or develop malware, or help anyone else do these things.[1] Breach of these restrictions allows immediate suspension, falls outside the limitation of liability, and entitles Darktrace to seek equitable relief.[1]
Appliances
Title to Appliances remains with Darktrace unless agreed otherwise in writing. They are the medium for delivery and operation of the Software, must not be used for other purposes, and must be returned on termination of the Subscription Period in accordance with Darktrace’s or the Partner’s instructions.[1] The detail of ownership, delivery and customer duties is in appliances, sensors and deployment.
Customer data and security
The customer owns Customer Data and grants Darktrace a limited, non-exclusive, worldwide, royalty-free licence to host, access and use it only to operate the Offering and as required by law. Darktrace may use the metadata associated with Alerts on a deidentified basis to develop and improve the Offering.[1] The customer is solely responsible for security practices that control access to the Offering and for backing up Customer Data, because Darktrace does not provide backup or maintenance services for it.[1]
Warranties, indemnity and liability
Darktrace warrants that the Software will perform materially in accordance with the Product Specification and that it follows customary practices to prevent malicious or disabling code. If it cannot correct a non-conformity it may terminate the licence for the affected Software and refund prepaid fees for the unused period; that is the sole and exclusive remedy. The service warranty lasts 30 days from completion of the Services.[1] Darktrace does not guarantee that it will find all threats, vulnerabilities or malware.[1]
Darktrace will defend third-party claims that use of the Software infringes a patent, copyright or registered trademark, subject to prompt notice within 20 days, cooperation and control of the defence.[1] Neither party is liable for lost profits, revenue, data or consequential damages, and each party’s cumulative liability is capped at the fees actually paid to Darktrace for the Offering giving rise to the liability in the 12 months before the first event. The exclusions and cap do not apply to Darktrace’s indemnity, breach of the restrictions, the customer’s payment obligations, or infringement of the other party’s intellectual property.[1]
Term, suspension and termination
The MSA remains in effect until all active Subscription Periods have expired or it is terminated. It contains no automatic renewal clause. Darktrace may suspend access immediately for a significant security threat, breach of the restrictions, non-payment by the customer or Partner, or legal requirement. Either party may terminate for uncured material breach after 30 days’ written notice.[1]
On termination, the customer must cease use, de-install the Software, remove Customer Data from any Appliance and return it, and pay undisputed fees immediately. For 30 days Darktrace maintains Customer Data held in its cloud services so the customer can download and delete it, and then deletes it.[1]
Compliance verification
Section 16.3 obliges the customer to permit Darktrace, or an independent representative appointed by Darktrace, to verify that use complies with the Agreement, no more than once in any 12-month period. Where the customer bought through a Partner, Darktrace may also ask for confirmation of the orders placed, including agreements with the Partner with pricing removed.[1] The clause does not describe a procedure, notice period or cost allocation.
Assignment
Neither party may assign or transfer the MSA without consent, and any attempt is void. Either party may assign to an Affiliate in a corporate reorganisation, or to a third party that succeeds to all or substantially all of the relevant business and assets, whether by sale, merger or operation of law.[1] A customer acquisition or divestiture therefore needs a check against this clause.
Governing law and disputes
The governing law and forum depend on the customer location stated in the Order.[1]
| Customer location in the Order | Governing law | Courts or arbitration |
|---|---|---|
| United Kingdom | England and Wales | Courts of England and Wales |
| United States | California | State or federal courts in Santa Clara County, California |
| None of the above | England and Wales | ICC arbitration in London, three arbitrators, in English |
Either party may enforce intellectual property rights in any competent court, and Darktrace or its Affiliates may sue for payment in the country where the customer is located. The UN Convention on Contracts for the International Sale of Goods does not apply.[1]
Other terms
The customer must comply with export and sanctions laws of the United Kingdom, the United States and other jurisdictions and must not be on a denied-party list. The Offering is a “commercial product” for US government end users. The customer is responsible for compliance with laws governing its own deployment or use of AI Agents.[1] Notices to Darktrace go to its Legal Department in Cambridge, United Kingdom.[1]
Out of scope
This article does not reproduce the Data Processing Addendum, the Business Associate Agreement or the Standard Contractual Clauses, which are separate documents, or the Partner terms. It does not analyse earlier MSA versions, which are not listed on the legal page.[2]