The Kong Customer Agreement (KCA) is the master agreement for customer subscriptions to Kong products and services, and Kong’s legal page lists it together with the Product-Specific Terms, a Support and Maintenance Policy, a Service Level Agreement, a data processing addendum and professional services terms.[5] The KCA states that it governs use of the Products and Professional Services “unless we have executed a separate written agreement with you for that purpose”. Assent can be shown by clicking acceptance, creating an account, executing an Order Form that references the KCA, or using any part of the Products.[1] The version retrieved is headed “Last Updated: August 10, 2026”.[1] This article reads the documents as a licensing reference for a software asset manager and maps them to the product-specific articles starting at Kong licensing.
Editions
The contract set does not have editions; it has layers that apply in a fixed order. The KCA’s order of precedence is: (i) the data processing addendum or a Business Associate Agreement, (ii) an Order Form or statement of work to the extent it expressly supersedes a term, (iii) the Product-Specific Terms, and (iv) the rest of the KCA.[1] Catalog proof: Order of precedence: DPA, then Order Form, then Product-Specific Terms, then the KCA.
| Document | Role | Last updated |
|---|---|---|
| Kong Customer Agreement | Master terms: licence, restrictions, fees, term, indemnity, open source[1] | 2026-08-10 |
| Product-Specific Terms | Product-specific clauses; part of the Order Form and applied from the Order Form’s effective date for the Subscription Term[2] | 2026-09-01 |
| Support and Maintenance Policy | Support levels, contacts, version support, deprecation[3] | 2026-08-31 |
| Service Level Agreement | Uptime commitments for Konnect and Dedicated Cloud Gateways[4] | 2025-10-01 |
| Order Form | Subscription Term, usage or licence parameters, pricing and payment terms[1] | Per order |
The Product-Specific Terms state that the terms in force on the effective date of the customer’s Order Form “will apply to the Products on that Order Form for the duration of the applicable Subscription Term”.[2] The KCA itself says Kong may change the Support Policy or SLA with 30 days’ notice if the change is a standard one and there is no material degradation.[1]
Metrics
The KCA defines no price metric. Quantities come from the Order Form, which specifies “any applicable usage or license parameters”.[1] The agreement does define who may use the Products. An Authorized User is a person designated and granted access by or for the customer, including the customer’s and its Affiliates’ Contractors. Authorized Users “do not include External Users”, meaning third parties whose programmatic applications interact with the customer’s APIs, data or resources through the Products.[1] The practical consequence is that applications calling an API through Kong do not become Authorized Users, although their traffic may still count toward a volume metric such as API requests in the Order Form or rate card. Catalog proof: External Users are not Authorized Users; Affiliates and Contractors may be Authorized Users unless they are existing Kong customers.
Metric-specific articles are Kong Konnect plans and usage pricing, Kong Mesh licensing and Kong Insomnia licensing.
Counting / floors
Licence grant. During the Subscription Term Kong grants “a non-exclusive, non-transferable, worldwide, limited-term right and license” either to access and use purchased Cloud Services and, if applicable, install and use the Software in the Customer Network Environment, or, for Software without Cloud Services, to install and use the Software in the Customer Network Environment.[1] The Customer Network Environment is the customer-controlled network on which the Software is deployed, which may include its own servers and servers of third-party cloud providers.[1] Catalog proof: Licence grant is non-exclusive, non-transferable and limited-term.
Usage limits and excess. Subscriptions “are subject to usage limits set out in the Order Form or on or through a registration or administrative web page or otherwise in the signup process”, and the customer must comply or buy the excess.[1] Increased limits bought mid-term are priced at the underlying subscription price or the Order Form price, prorated, and end with the underlying subscription. Kong “may invoice Customer for any excess or additional use exceeding the usage limits”.[1] Catalog proof: Usage limits come from the Order Form or sign-up page; Kong may invoice excess usage; increased limits are prorated.
Restrictions. Customers must not use the Product beyond the Agreement or Order Form restrictions, reverse engineer the Software, use its functionality to create a similar program, sublicense, sell, rent, lease or redistribute the Product, use it in a service bureau or outsourcing offering, or install the Software outside the Customer Network Environment.[1] The restriction on sublicensing and redistribution has two carve-outs, the Affiliate and Contractor rule and the rule that lets the customer expose its own APIs to third parties.[1] Catalog proof: Software may not be installed outside the Customer Network Environment or used as a service bureau; No sublicensing, resale or redistribution of the Product.
Fees. Unless the Order Form says otherwise, fees are in US dollars, invoices are due within 30 days, fixed-term subscriptions are invoiced in full on execution, and “subscription fees are based on Products and Support Services purchased and not actual usage”. Amounts paid are non-refundable except where the KCA says otherwise, and late payment can attract a charge at the lower of 1.5% per month or the legal maximum, and suspension.[1] Catalog proof: Subscription fees are based on what is purchased, not actual usage. Pricing confidentiality is also relevant: “Kong’s non-public pricing information” is Kong’s Confidential Information, while the terms (but not the existence) of the Agreement are Confidential Information of both parties.[1] Catalog proof: Kong non-public pricing information is Kong Confidential Information.
Virtualization & partitioning
The contract set contains no virtualization, partitioning, processor or core rules. Deployment location is dealt with by the Customer Network Environment definition and by product metrics, such as the Mesh data plane proxy count in Kong Mesh licensing. The retrieved documents do not contain a rule of the kind described in virtualization and partitioning.
Cloud / BYOL
Software delivery and licence keys. Kong delivers Software when it makes it available for download and provides the licence key; the customer installs it.[1] The KCA states that a licence key limiting the duration, functionality or scope of use to the subscription is not code that breaches Kong’s malicious-code warranty.[1] Catalog proof: Software delivery is complete when the licence key is made available; A licence key may limit duration, functionality or scope.
Verification and telemetry. The KCA lets Kong “collect and use Usage Data … to verify Customer’s usage in compliance with this Agreement”.[1] For Kong API Gateway Enterprise, Kong AI Gateway (on-prem) and Kong Mesh, the Product-Specific Terms add that at Kong’s request the customer will promptly provide a Software-generated report specified in the Documentation, or data reasonably requested by Kong, to verify use and purchased usage limits. The customer may disable the Software feature that transmits Usage Data to Kong.[2] The Gateway documentation describes a licence report that is generated manually and does not send data to Kong.[6] The retrieved documents do not describe an on-site audit, an audit notice period or a cost-shifting threshold. Catalog proof: Kong may use Usage Data to verify compliance; Customer must provide a Software-generated report on request; Customer may disable usage-data telemetry from the Software.
Purchases through resellers and marketplaces. An Authorized Reseller includes “any third-party marketplace platform, such as AWS Marketplace”. If the customer buys through one, the terms between customer and reseller replace Section 8 (Subscriptions and Usage), Section 9 (Payment, Taxes and Indirect Orders) and Section 12 (Term and Termination).[1] Catalog proof: Reseller terms supersede KCA sections 8, 9 and 12.
Cloud Services exit. Unless the Product-Specific Terms or Order Form say otherwise, the customer may access Cloud Services for 30 days after termination or expiry, solely to retrieve Customer Content, after which Kong deletes it.[1] Dedicated Cloud Gateways and Insomnia have their own exit wording in the Product-Specific Terms.[2] Catalog proof: Cloud Services content can be retrieved for 30 days after termination or expiry.
Programs
- Trials and previews. Trial access is free, evaluation-only and ends at the earliest of the communicated trial end, the start of a purchased subscription or termination by Kong. Preview and beta offerings are “AS IS”, with no obligation to release a general version.[1] Catalog proof: Trials are free, evaluation-only and end at the earliest of three events.
- Term and termination. Either party may terminate the KCA for convenience only if no Order Form or SOW is in effect. “Order Forms may not be terminated for convenience.” Termination for cause requires a material breach uncured after 30 days’ notice, and a customer that terminates for uncured breach receives a prorated refund of prepaid fees.[1] Catalog proof: Order Forms cannot be terminated for convenience.
- Updates and separate SKUs. Updates are bug fixes and upgrades released during the term, but exclude modules or features that Kong sells for a separate fee under a different SKU or part number.[1] Catalog proof: Updates exclude features sold under a different SKU or part number.
- Support. The Support Policy lets the customer name up to the Order Form number of technical contacts, or 20 if none is stated.[3] For software support periods, Kong Gateway Enterprise LTS versions are supported for 3 years or the OS lifecycle, minor versions for 1 year, and Kong Mesh releases for 12 months from the major version release.[3] Catalog proof: Support Contacts are limited to the Order Form number, or 20 if none is stated.
- Service Level Agreement. Service Credits for Konnect and Dedicated Cloud Gateways require a ticket within 24 hours and a claim by the end of the month after the Downtime, and are the sole remedy.[4] Catalog proof: Service Credits are the sole remedy and cannot be converted to money.
- Assignment. The KCA may not be assigned without consent, but each party may assign it to a successor in interest of all or substantially all of the relevant business or assets.[1] Catalog proof: The Agreement may not be assigned without consent except to a successor of the business.
Open-source and AI terms
Open source inside the Products. “Third Party Open Source” is publicly available third-party open-source software delivered with the Software, which may be listed in a software bill of materials, a readme or a URL referenced in the Product-Specific Terms. It remains subject to its own licence, and restrictions in the KCA do not apply to it where its licence prohibits them.[1] Products may also include modules that Kong provides under the Apache 2.0 licence or a separate licence; that licence governs those modules in a conflict with the KCA.[1] Kong’s IP indemnity excludes claims attributable to Third Party Open Source.[1] See Kong Gateway open-source and Enterprise licensing for the Apache 2.0 Gateway repository. Catalog proof: Apache 2.0 modules inside Products are governed by Apache 2.0; Kong’s IP indemnity excludes claims attributable to Third Party Open Source.
Artificial intelligence. The Product-Specific Terms treat Customer Input and Generated Output as Customer Content and say Kong “will not use Customer Content to train or fine-tune any artificial intelligence model” without the customer’s prior permission or instruction. The customer can decline or disable generative AI functionality through administrative controls, and Kong may use input and output to detect abuse and to improve the features unless the customer disables that use.[2] Capabilities that route, proxy or govern the customer’s own AI traffic are defined as not being Generative AI Features.[2] Catalog proof: Kong will not train AI models on Customer Content without permission.
Out of scope
This article does not cover the data processing addendum, security measures, indemnity procedure, liability caps, export and government end-user clauses, governing law and venue by region, or professional services terms in detail. It does not cover Kong’s partner agreements or reseller contracts. Where an Order Form or a negotiated master agreement exists, it controls.