HCL AppScan, Unica and Informix licensing covers three HCLSoftware product families with quite different metrics. AppScan is an application security testing family that came from IBM. Its on-premises tools are licensed per user. Its SaaS service, AppScan on Cloud, is licensed per application or scan.[1][4] Unica Campaign, a marketing automation product also from IBM, is licensed by audience records and platform users.[5] The Informix database is licensed per core.[6] Each product has a License Information Document (LI) or Service Description that sets these terms on top of the HCLSoftware Master License Agreement or Cloud Services Agreement.
Editions
| Product | Editions in the retrieved documents | Metrics |
|---|---|---|
| AppScan Standard 10.12.X | Standard; Standard (Evaluation)[1] | Authorized User; Floating User, Single Install |
| AppScan Source 10.12.X | for Remediation, Automation, Analysis, Development (each with an Evaluation version)[2] | Authorized User; Floating User |
| AppScan Enterprise 10.12.x | Enterprise Server Basic; Enterprise Server; Enterprise Reporting Only User[3] | Authorized User; Floating User |
| AppScan on Cloud | DAST, SAST, IAST and SCA offerings[4] | Application Instance, Job, Concurrent Event |
| Unica Campaign 26.1 | Campaign[5] | Marketing Audience Record; Platform User |
| Informix Dynamic Server V14.10 | V14.10.FC10 and later[6] | Core |
The AppScan LIs add a rule for bundles. A program acquired as part of a “suite” or “bundle” gives an entitlement “for the whole offering as a unit”, not separate rights to each program in it.[1]
Metrics
Authorized User. “An Authorized User is a unique person who is given access to the Program.” A dedicated entitlement is needed for each person accessing the program “in any manner directly or indirectly (for example: via a multiplexing program, device, or application server)”. The entitlement may be reassigned only on permanent transfer.[1]
Floating User. “A Floating User is a person who is accessing the Program at any particular point in time.” An Install is a copy installed on a physical or virtual machine.[1]
Application Instance. “Application Instance means one (1) Project or ten (10) Microservices.” A Microservice is a codebase of up to 20,000 lines of code. AppScan on Cloud also uses Job (one scan) and Concurrent Events.[4]
Marketing Audience Record and Platform User for Unica.[5]
Core (Informix). The LI says Core “is the unit of measure which the program can be licensed as defined in the support policy”.[6]
Counting / floors
AppScan on-premises
For AppScan Standard and Enterprise, “One (1) Authorized User license will serve only one (1) running instance of the Program”. A tester who runs two scanner instances at once therefore needs two entitlements.[1][3] A Floating User who “simultaneously accesses more than one (1) Install of the Program” needs “a separate entitlement for each such Install”.[2] Catalog proof: AppScan Authorized User licence serves one running instance; Floating User needs one entitlement per Install accessed at once.
The AppScan Enterprise Server Basic licence key “is based on connections which are limited to ten (10 per entitlement)”. Connections are calculated as set out in an HCLSoftware knowledge article.[3] Catalog proof: AppScan Enterprise Server Basic is limited to ten connections per entitlement.
AppScan licences also limit what may be scanned. The customer warrants that it “shall not use the Program to scan any websites and/or applications other than websites and/or applications owned by Licensee or those that licensee has the right and authority to scan”.[1] Catalog proof: Scan only owned or authorised targets.
AppScan on Cloud
Application Instances are “consecutive scans of a single application”. A dynamic-testing instance covers a site of up to 5,000 pages in one domain. A static-testing or SCA instance covers up to 1,000,000 lines of code. Deployments of the same application in test, development, staging and production “are considered separate Application Instances”.[4] Resource limits are listed in the Order Schedule. “If thresholds are exceeded, HCLSoftware reserves the right to charge for the excess consumption at HCLSoftware’s current list price.”[4] Pay-per-scan purchases must be used within twelve months.[4] Catalog proof: AppScan on Cloud excess consumption charged at list price.
Unica Campaign
A Marketing Audience Record is a unique customer or prospect entry “accessed by the Program for the purposes of marketing”, whether active or inactive. The count is “derived by adding Marketing Audience Records across audience levels serviced by Program in a given year”. “Every unit of the Program purchased entitles the Licensee to use 250,000 unique Marketing Audience Records.”[5] Platform Users are counted as “the total number of Platform Users that access the Program in a given year”.[5] Worked example: a business that markets to 900,000 households at household level and 1,400,000 individuals at individual level sums the two levels to 2,300,000 records. That needs 10 units (2,500,000 records). As commentary, adding audience levels means the same customer can be counted once at each level. Catalog proof: Unica Marketing Audience Records: 250,000 per unit, counted per year.
Informix
The Informix LI points to the support policy for the meaning of “Core”. It also excludes HCL Informix Client SDK and the JDBC Driver/Embedded SQL from the count: “these components are not used to determine the number of entitlements required for the Program”.[6] The Informix Warehouse Accelerator component may be used only with Informix Dynamic Server.[6] Catalog proof: Informix Client SDK and JDBC driver are not counted.
Virtualization & partitioning
The AppScan Floating User metric counts an Install on “a physical or virtual machine” in the same way.[1] The Informix LI retrieved here does not set out virtualization rules. They are left to the support policy that defines Core.[6] Unica metrics count records and users, not infrastructure.[5]
Cloud / BYOL
AppScan on Cloud is a service under the Cloud Services Agreement, which renews for 12-month periods unless 30 days’ notice is given.[7] After the transfer from IBM, HCLSoftware said existing AppScan on Cloud subscriptions would not change and that new orders go through HCL sales.[8]
Programs
Unica annual usage reporting and active license management. “No later than thirty (30) days prior to end of each twelve (12) month period during the term of an Order”, the customer must submit a usage report of the licensed metric. The report may be a dashboard screenshot, an encrypted report from a database script that HCLSoftware supplies, or an integration with active license management. The customer must send the report “as is”. If HCLSoftware finds the entitlement exceeded, it “reserves the right to invoice at the applicable rate”.[5] Where active license management is enabled, a License Server must be installed and kept online to sync usage. If it cannot sync, an encrypted daily usage report must be sent every six months.[5] Catalog proof: Unica usage report due 30 days before each contract year ends.
AI functions in Unica. The Unica LI covers connections to third-party AI services, which need the customer’s own agreement with the provider. It also covers native OpenAI functionality offered “as an initial, limited time use”. HCLSoftware’s indemnity does not extend to claims that AI output infringes.[5]
Informix hosting restriction. The customer “is not authorized to use the Program to provide commercial IT services to any third party, to provide commercial hosting or timesharing”, unless the applicable agreements expressly allow it.[6] Catalog proof: Informix may not be used for commercial IT services or hosting.
Out of scope
- AppScan 360, AppScan on marketplaces, packaged services and earlier AppScan versions.
- Other Unica modules (Plan, Optimize, Interact, Journey, Discover), whose LIs were not reviewed here. They may use other metrics.
- The Informix support policy that defines Core, and Informix editions other than Dynamic Server V14.10.