JFrog licensing is the set of terms under which JFrog sells the JFrog Platform. The platform is a software supply chain product built around Artifactory, JFrog’s binary repository manager. Around Artifactory sit Xray scanning, JFrog Advanced Security, Curation, distribution and machine-learning services. JFrog publishes one subscription agreement for each deployment type: Self-Managed, SaaS, Hybrid and SaaS Monthly. It also publishes addenda for ML, AI, the EU Data Act and premium availability.[1] Under all of these agreements JFrog grants a limited, non-exclusive, non-transferable, non-sublicensable and revocable licence for the Subscription Term. The licence covers only the features in the Order Form and only internal use.[2] Fees depend on the Subscription Level and on Platform Metrics. These are the measures set in the Order Form, such as data consumption, number of Instances, number of Contributing Users and number of actions on Customer Artifacts.[2] For the general models, see subscription and consumption licensing.
Editions
JFrog sells three subscription levels in two deployment forms.[6]
| Level | SaaS (list) | Self-managed (list) | Main differences |
|---|---|---|---|
| Pro / Pro X | Pro: USD 150 per month, 25 GB base consumption, monthly only[6] | Pro X: from USD 27,000 per year, 1 server[6] | Artifactory; Pro X adds base Xray scanning[7] |
| Enterprise X | Enterprise X: from USD 950 per month, 125 GB base consumption[6] | Enterprise X: from USD 51,000 per year, 3 servers[6] | High availability, federation, SSO; Advanced Security as an add-on[6][7] |
| Enterprise+ | Enterprise+: custom pricing and consumption[6] | Enterprise+: custom pricing, 6 servers[6] | Multisite federation, distribution and Edge nodes, High Touch Support[6] |
JFrog’s pricing FAQ gives rough sizes for each level. Pro typically suits up to 50 users and 2 TB of consumption, and Enterprise X up to 300 users and 20 TB.[6] Security and MLOps are sold as bundles on top of Enterprise X and Enterprise+. The Unified Security and Ultimate Security bundles start at a base of 200 developers.[6] JFrog also offers non-commercial self-managed editions: JFrog Container Registry, Artifactory OSS and Artifactory Community Edition for C/C++.[7] Catalog: Non-commercial Artifactory editions.
Metrics
| JFrog term | Catalog row | Where it applies |
|---|---|---|
| Consumption | Consumption (GB) | SaaS: peak storage plus total data transferred in the calendar month.[10] |
| Artifactory server | Artifactory server licence | Self-managed: one licence per Artifactory service or HA node.[8][9] |
| Contributing Developer | Contributing Developer | Advanced Security and security bundles.[3][6] |
| Instance | Instance | A customer-hosted service of the platform, or a JFrog-hosted Distribution Edge.[2] |
| Distribution Edge | Distribution Edge | Read-only repository through which External Users download releases.[2] |
Counting / floors
Minimum term. A Subscription lasts at least twelve months unless the Order Form states otherwise.[2] Self-hosted licences are bought on contracts of at least one year. Pro SaaS is sold only by the month.[6] All subscription fees are paid in advance and are non-refundable unless the agreement says otherwise.[2] Catalog: Subscriptions run at least twelve months unless the Order Form says otherwise; Subscription fees are payable in advance and non-refundable.
SaaS consumption. Each SaaS package includes base monthly consumption. Usage above it is charged per GB in tiers, and the discount for a tier applies only to the GB that fall inside it.[6] Under an annual SaaS Order, the included Platform Metrics are used month by month. Unused amounts do not roll over to later months or to a renewal, and excess usage is billed monthly.[3] Catalog: SaaS Platform Metrics are monthly and do not roll over; SaaS usage above the monthly metrics is billed monthly. See JFrog SaaS consumption licensing.
Self-managed servers. Pro X includes one Artifactory server, Enterprise X three and Enterprise+ six.[7] Each node of a high-availability cluster must be activated with a different licence.[8] Catalog: Each Artifactory HA node needs its own licence; Self-managed packages include 1, 3 or 6 Artifactory servers. See JFrog self-managed licensing.
Contributing Developers. Advanced Security is charged by the number of Contributing Developers. A Contributing Developer is a developer who contributed in the last 90 days to a project scanned by Advanced Security. Downloading a public package counts as contributing. A developer who works on several projects counts once.[6] Enterprise X includes 50 base Contributing Developers per month and Enterprise+ includes 200.[6] Catalog: Advanced Security is charged per Contributing Developer over 90 days.
Virtualization & partitioning
JFrog does not count processors or cores. Self-managed licences are counted per Artifactory service or node, whether it runs on physical hardware, a virtual machine or Kubernetes.[9] There is one platform-specific limit. On Amazon ECS, Artifactory runs only as a single node on an instance of up to 16 vCPUs, and it cannot connect to Xray or Distribution.[8] Catalog: Artifactory on Amazon ECS is limited to a 16 vCPU single node.
Cloud / BYOL
JFrog SaaS runs on public clouds and can be bought directly or through a cloud marketplace. Marketplace fees are billed through the customer’s marketplace account, under the payment terms of the marketplace offer.[2] The Hybrid agreement covers a self-managed platform that includes JFrog-hosted SaaS Features, such as Distribution Edges or Curation. Its body governs the self-managed part, and its Exhibit B (SaaS Terms) governs the hosted part.[4] No published right lets a customer move a self-managed licence to SaaS. JFrog’s pricing page directs customers who want to migrate to its account team.[6] Catalog: Cloud Marketplace purchase; Hybrid subscription.
Programs
- SaaS annual and SaaS monthly. Annual SaaS is prepaid, and usage is drawn down against the prepayment. Monthly SaaS renews automatically each calendar month, and each renewal runs under the terms posted at that time.[3][5]
- License buckets. Self-managed subscriptions that include Mission Control can pool their licences in buckets and attach them to services with the JFrog CLI.[9]
- Support. Support levels are Community Support (free editions and Pro), 24/7 SLA Support (Enterprise X), 24/7 High Touch Support (Enterprise+), and optional Gold and Platinum support.[6] JFrog may change the Standard Support terms by posting a revised version.[11]
Contract terms
Internal use. The licence covers only internal use by the customer and its Customer Users. These are employees, contractors, consultants, service providers and development partners of the customer and its affiliates. Use by or for the benefit of a third party is excluded.[2] External Users may only download releases from a Distribution Edge, at one Edge per External User, and only under Enterprise+.[2] Catalog: JFrog Platform licence is for internal use only; External users only through Distribution Edges under Enterprise+.
Restrictions. Customers may not use the platform to build or provide a competing product. They may not give third parties access by any mechanism, including proxying or caching. They also may not bypass consumption or limiting features, or use proxying, caching or any other means to avoid fees.[2] If JFrog reasonably believes these restrictions have been breached, it may terminate immediately.[2] Catalog: Proxying or caching to avoid fees or give third parties access is prohibited; No use to build a competing product; no service bureau use; JFrog may terminate immediately for breach of the licence restrictions.
Contracting entity. The JFrog contracting entity, the governing law and the courts all depend on where the customer is domiciled. JFrog, Inc. under California law contracts with customers in the Americas. JFrog Ltd contracts under English law for most of EMEA and APAC, and under Israeli law in Israel and elsewhere. JFrog SAS contracts under French law for listed countries, including France and Belgium.[2] Catalog: Contracting entity and law follow the customer domicile.
Audits and compliance
The Self-Managed and SaaS agreements contain the same Records; Audit clause. The customer must keep complete and accurate records of its use. The records must be good enough for JFrog to calculate or verify fees and to find out whether a breach has occurred. They must be kept for the whole term and for at least two years after it ends. During that Audit Period, JFrog may audit on reasonable advance written notice, which can be given by email. JFrog may also send a third-party auditor, and the customer must cooperate.[2][3] Self-managed customers must also monitor their usage of the Platform Metrics and report it accurately through MyJFrog when JFrog asks.[2] For SaaS, the Usage Explorer in MyJFrog shows data transfer, storage and monthly consumption.[10] The agreements put no cap on audit frequency and do not say who bears the cost. Catalog: Records kept two years after the term; JFrog or a third party may audit; Self-managed customers must monitor and report Platform Metrics on request. See software license audit.
Out of scope
- Negotiated enterprise agreements and private marketplace offers.
- JFrog ML, AI, EU Data Act and Premium Availability addenda.
- JFrog Connect device bundles and MLOps bundles in detail.
- Litigation: no court case about JFrog licences was found with a primary court record.