Kaseya sells its endpoint security and data protection products largely under the Datto brand, with their own Product Terms of Use hosted on datto.com and incorporated into the Kaseya Master Agreement. This article covers three groups. The first is endpoint security: Datto EDR, Datto AV and Ransomware Detection.[1] The second is device and endpoint backup under the Datto Unified Backup terms.[3] The third is SaaS backup and security, Datto SaaS Protection and SaaS Defense.[4] Each can be bought on its own. Datto AV, Datto EDR, Ransomware Detection and Datto Endpoint Backup are also Kaseya 365 Endpoint Components, and SaaS Protection can be the SaaS Backup Component of Kaseya 365 User.[6]
The three groups use three different units: an Endpoint for security, a licence plus pooled storage for endpoint backup, and a user of a third-party tenant for SaaS backup. Each has a different trap for the unwary: virtual machines, storage overage and leavers respectively.
Editions
| Terms | Products covered | Updated |
|---|---|---|
| Datto EDR, Datto AV, Ransomware Detection Product Terms | Datto EDR, Datto AV, Ransomware Detection[1] | 2024-04-01 |
| Datto Unified Backup Terms of Use | Including Datto Endpoint Backup with Disaster Recovery, Datto Endpoint Backup, Datto Endpoint Backup for PCs, SIRIS, ALTO, Datto NAS and Datto Workplace[3] | 2026-08-21 |
| Datto SaaS Protection and SaaS Defense Terms of Use | SaaS Protection (backup) and SaaS Defense (threat protection) for Microsoft 365 and Google Workspace[4] | 2025-05-19 |
The endpoint backup products differ in capability as well as name. “Datto Endpoint Backup with Disaster Recovery allows for Cloud Virtualization and failback”, while Datto Endpoint Backup does not.[3] A customer cannot upgrade to a product with Cloud Virtualization during a disaster or otherwise after purchase.[3]
Metrics
- Datto EDR and Datto AV Endpoint: each Endpoint scanned and protected.
- Ransomware Detection license: in Datto RMM, each device with an enabled Ransomware monitor.
- Datto Endpoint Backup license: a licence carrying a storage allotment into a shared pool.
- SaaS Protection Active License and SaaS Protection Archive License: per User of the Third-Party Tenant.
Counting / floors
Datto EDR, Datto AV and Ransomware Detection
Per Endpoint (terms updated 2024-04-01). “Product Subscriptions are licensed per “Endpoint,” and any Endpoint that is scanned and protected by a Product requires a License.” An Endpoint is “a network endpoint such as a workstation, server, virtual server, virtual desktop or other logically distinct Internet Protocol (IP) addressable endpoint”.[1] Purchases of Datto EDR made before November 15, 2022 follow separately agreed usage terms.[1] Additional licences or features added by any administrator, “either manually or through automatic add features”, modify the Order, and the customer is responsible for features its Clients enable.[1] Catalog proof: Datto EDR and AV count every scanned and protected Endpoint, physical or virtual.
Allocation and enforcement. Licence allocation begins when a device is first deployed to a location. The device receives an AV and/or EDR licence according to the location’s policies. A Microsoft Defender Antivirus policy is assigned an EDR licence.[2] “Datto EDR/AV uses license enforcement.” If the licence pool shrinks below the number of licensed agents, licences are unassigned “starting with the oldest first”. Agents deployed beyond the count are not allocated a licence but still show as Active.[2] Unlike Datto RMM, the security products therefore enforce the count on the device rather than billing the excess. Catalog proof: Datto EDR and AV unassign licences oldest-first when the pool shrinks.
Within Kaseya 365. Devices using Datto EDR consume Kaseya 365 Endpoint licences. Devices using standalone Ransomware Detection in Datto RMM do not.[7]
Datto Endpoint Backup and BCDR
Pooled storage. Datto Endpoint Backup licences include a Datto Cloud storage allotment “pooled across all licenses (a “Storage Pool”)”. Kaseya’s example is 100 licences at 250GB each, giving a 25,000GB pool.[3] Additional storage is paid monthly in advance for the rest of the term “regardless of whether it is used” and may not be decreased. Use above the allotment is “Excess Storage”, billed monthly in arrears. There is no charge in months where use falls back within the allotment.[3] Under Kaseya 365 Endpoint, the Kaseya 365 Storage Entitlement rules prevail over these standalone terms.[6] Catalog proof: Datto Endpoint Backup excess storage billed monthly in arrears.
Datto Workplace. User Licenses, Server Licenses and storage are allocated to Teams. Billing is monthly at “the greater of Actual Usage or the number of Licenses designated in your Service Subscription”.[3]
Terms and renewals. A Committed Service Term begins on the first of the month after the Activation Date. A free or reduced-charge initial period extends only the first term.[3] SIRIS, ALTO and Datto NAS subscriptions not on month-to-month terms renew for 12 months. Other products renew for the length of the expiring term. Subscriptions keep incurring fees until cancelled, “even a Product is no longer taking backups”. Early termination makes the monthly fee times the remaining months, less prepayments, due immediately.[3] The Partner First Pledge reintroduced month-to-month contracts for Datto BCDR.[8] Catalog proof: Datto backup early termination charges remaining monthly fees.
Datto SaaS Protection and SaaS Defense
Per User regardless of status. Each Product Account backs up or protects the data of individual Users of a Third-Party Tenant such as Microsoft 365 or Google Workspace. “A Product License is required for each User regardless of status (e.g., active, paused, archived or other specified usage)”. SaaS Defense licences are not required for archived Users.[4] Catalog proof: SaaS Protection needs a licence for every User regardless of status.
Active and Archive Licenses. Active Licenses are for Users with an active licence to the Third-Party Tenant. When that licence ends, for example when an employee leaves, SaaS Protection moves the User to an Archive License. It adds an Archive License automatically if none is available. Under an Archive License “no new backups are taken, but old backups are accessible”.[4] Leavers therefore stay chargeable, at the Archive rate, for as long as their backups are kept.
Auto-provisioning and CMQ. Users added manually or through automatic add consume an unused licence or “automatically provision an additional Active License”. The customer is responsible for automatic add and licence cap features it enables.[4] From November 2025, reflected on invoices after December 1, 2025, SaaS Protection and SaaS Defense receive Committed Minimum Quantity billing. Monthly use above the CMQ is invoiced as variable usage.[4] Catalog proof: SaaS Protection auto-provisions Active Licenses for new Users.
Storage. Unless the Order says otherwise, SaaS Protection includes 60GB per License averaged across all Licenses. Excess storage is invoiced at the end of each monthly period, and purchased additional storage cannot decrease during the term.[4]
Virtualization & partitioning
For security products each virtual server and virtual desktop is a separate Endpoint.[1] There is no host-based alternative. For backup, the rules concern running workloads inside the backup service. Cloud Virtualization in the Datto Cloud “is intended for emergency periods and DR preparedness testing only, and not as a non-emergency production environment”. Kaseya may disable virtualizations that outlast a documented business continuity event or a limited testing period.[3] The Master Agreement likewise lists as unauthorized “using a backup Product in a prolonged virtualized production environment”.[5] Catalog proof: Datto Cloud Virtualization only for emergencies and DR testing; Backup Products not authorised as a prolonged virtualised production environment.
Cloud / BYOL
All three groups are delivered through Kaseya’s cloud, the Datto Cloud for backup and the product consoles for security, so bring-your-own-license does not arise. The data rules at the end of a subscription vary by product.
- Datto EDR and AV telemetry and suspicious content may be deleted on termination. After that “there will be no further right to download Telemetry or Suspicious Content”.[1]
- For Datto Endpoint Backup and Endpoint Backup for PCs there is no retention after termination, and export must be done before it.[3]
- SaaS Protection export requires an active Subscription. Kaseya may permanently delete Content 30 days after a Subscription terminates.[4]
Programs
- Committed Minimum Quantity applies to SaaS Protection and SaaS Defense.[4]
- FLEXSpend began in 2023 as a way to reallocate spend within the backup suite and now extends to all product suites, excluding Kaseya 365.[8]
- Month-to-month subscription is available again for Datto BCDR.[8]
- Hardware upgrades. Kaseya “typically allows you to purchase a new device and return an existing device in the form of an Upgrade”. A device replaced but not returned continues to be billed until the subscription is cancelled.[3]
Out of scope
- Datto SIRIS, ALTO and NAS hardware warranties and RMA procedures, beyond the billing points above.
- Unitrends, Spanning and Backupify products, which have their own terms on those brands’ sites.
- RocketCyber and Kaseya MDR service terms.
- Datto Networking products.