Mimecast licensing is the set of terms under which Mimecast sells its cloud services for email security, email archiving, security awareness training, insider risk management and collaboration governance. Mimecast publishes one Service Agreement for all of them. It consists of General Terms & Conditions and a separate Service Schedule, and it applies to all Mimecast Services.[1] A global version applies generally, and “GER versions” apply where the contracting Mimecast party is located in Germany.[1] Each purchase is recorded in a Services Order, which can be a quote, statement of work or purchase order. It states the Services, the Subscription Term and any usage quantities.[2]
Unless the Service Schedule defines another measure, usage quantity is the number of Permitted Users. These are the end users that the customer or a Customer Affiliate authorizes to access and use the Services.[2] For software asset managers the result is a user-based subscription estate, with a small number of product-specific metrics set out in the Service Schedule and in the Service Descriptions that Mimecast publishes in its support knowledge base.[3] For the general model, see named user licensing and subscription and consumption licensing.
Editions
Mimecast groups its products on the public Plans page into three families. Each has named plans, and none has a published price. Every plan is marked “Contact for pricing” or “Custom pricing available”.[4]
| Family | Plans | Notes |
|---|---|---|
| Email security (threat protection) | Critical, Advanced, Premium[4] | New customers have had to buy these plans since 2025-08-15. Legacy bundles held by existing customers continue unchanged.[4] |
| Insider risk management (Incydr) | Professional, Enterprise, Gov[4] | Incydr came from Mimecast’s acquisition of Code42, announced 2024-07-24.[11] |
| Security behavior management (Engage) | Core, Pro[4] | Licensed individually or together according to the Order Form.[8] |
| Governance, Compliance and Insight (GCI) Suite | Core, Pro, Max[6] | Archiving, supervision, eDiscovery and collaboration monitoring. It builds on the Aware platform, acquired in 2024.[12] Backup & Recovery is sold separately from the tiers.[6] |
Other services named in the Service Schedule include DMARC Analyzer and Brand Exploit Protect, each with its own metric.[3] Managed Threat Response is an analyst-led service for email that end users report as suspicious. Its tier is set out on the Order Form.[16] Mimecast publishes no part numbers. The catalog records the plans as SKUs without part numbers, for example Email Security Critical plan, Incydr Enterprise and Engage Pro. Plan contents are covered in Mimecast email security, archive and retention licensing and Mimecast Incydr, Aware and Engage licensing.
Metrics
| Mimecast term | Catalog row | Where it applies | What Mimecast says |
|---|---|---|---|
| Permitted User | Permitted User | All Services unless the Service Schedule defines otherwise | End users that the customer or a Customer Affiliate authorizes to access and use the Services.[2] |
| Customer domain | Customer domain (DMARC Analyzer) | DMARC Analyzer | Priced by the number of customer domains subjected to the service.[3] |
| Domain and Takedown | Protected domain and takedown | Brand Exploit Protect | Domains are capped at the maximum on the Services Order. Takedowns are charged per request received.[3] |
| Annual user license | Incydr annual user license | Incydr | Granted annually from the date of purchase. All active users require one.[9] |
| Licensed seat with fair use limits | GCI fair use allowance | GCI Suite | Monthly per-user limits on messages, prompts and files. A “User” is a licensed seat, whether active or inactive.[6] |
| Pooled storage | Backup & Recovery pooled storage | Backup & Recovery | Each licensed seat adds 50 GB to a tenant-wide pool.[15] |
| Migration volume | Migration data volume | Simply Migrate software | 20 GB per Permitted User subscribed to the hosted services.[10] |
Counting / floors
Authorized users, not mailboxes (as of 2026-09-01). The contract measures authorized end users. It does not count mailboxes or active users.[2] The Service Schedule adds that the customer will only allow the number of Permitted Users shown in the Service Order to use the Services.[3] Users of Customer Affiliates are included, and the customer is responsible for their use.[2] Catalog proof: Usage quantity defaults to Permitted Users; Only the number of Permitted Users in the Service Order may use the Services.
Disabled and inactive users. Neither the General Terms & Conditions nor the Service Schedule has a rule that excludes disabled accounts. Mimecast’s MSP guidance states that disabled user accounts still count toward the licensed seat total until a downsell is requested and processed.[14] The GCI Service Description likewise counts every licensed seat for fair use purposes, whether it was active or inactive.[6] Catalog proof: MSP accounts: disabled users count until a downsell is processed; GCI Services are subject to fair use limits that can trigger fees or upgrades.
Growth and reductions. A customer may add Services or increase quantities at any time during the Subscription Term, at additional fees. It may not reduce quantities, downgrade or remove Services until the start of a Renewal Term, and then only with 30 days’ written notice.[2] The purchased quantity therefore works as a floor for the whole term. Catalog proof: Quantities can be increased mid-term but only reduced at renewal.
Reasonable usage. The SLA does not apply to usage beyond reasonable usage allowances. For services that include archiving, journaling or SMS messaging, the limit is three times the typical average user. Mimecast may contact customers above the allowance to renegotiate contract terms.[5] Catalog proof: SLAs exclude usage above three times the typical average user.
No retrieved document publishes a minimum purchase quantity.
Virtualization & partitioning
Mimecast Services are cloud services, so no processor, core or partitioning rule applies to them. The only customer-side software named in the contract set is the Incydr endpoint agent, the Simply Migrate migration tool and Mimecast applications distributed through online marketplaces.[3][10] The Incydr agent supports Virtual Desktop Infrastructure. Incydr is counted per user, not per device or virtual machine.[7][9] Simply Migrate may be installed as one copy on one computer or server that the licensee controls.[10] Catalog proof: Simply Migrate may be installed once, plus one backup copy.
Cloud / BYOL
The Services are multi-tenant SaaS, and customer data is stored in a Hosting Jurisdiction chosen for the account.[2] Bring-your-own-license mapping does not apply. Several capabilities depend on the customer’s other SaaS licences. Aware capture of Microsoft Teams requires per-user Microsoft 365 licensing at E5, or E3 or Business Premium with the Purview add-on.[6] Incydr’s cloud and email connections also depend on the connected vendor’s plan.[7] See Microsoft 365 and Online Services.
Programs
- Resellers. Services may be bought through a third party authorized by Mimecast to resell them. The Services Order controls where it conflicts with the Agreement.[2] Pricing comes from the Reseller, and the payment section of the General Terms & Conditions does not apply.[2]
- Managed service providers. MSPs place upsell and downsell orders per customer in the Mimecast Partner Portal under their Service Provider Agreement. Seat reductions typically apply from the next billing cycle after a 30-day notice period.[14]
- Evaluations. Mimecast publishes an Evaluation Agreement for all Services, a separate Incydr evaluation agreement, and Evaluation Terms for Existing Customers.[1] Evaluation Services are provided as is.[13]
- Beta Program. A Beta Agreement governs products and services in beta and other pre-release testing phases.[1]
Contract terms
Renewal and price (as of 2026-09-01). Each Services Order renews automatically for 12 months unless a party gives written notice of non-renewal at least 30 days before the end of the Subscription Term.[2] At each renewal, Mimecast may increase recurring fees by up to 8%, or up to 11% for customers contracting with Mimecast South Africa (Pty) Limited. It must give notice of the renewal fees at least 100 days in advance.[2] Catalog proof: Services Orders renew automatically for 12 months; Renewal fees may rise by up to 8% (11% in South Africa).
Use rights. Use is limited to the customer’s own or its Affiliates’ internal business purposes.[3] The customer may not transfer, resell, license, rent, lease or otherwise make the Services available to third parties. Benchmarking intended for use outside the organization is also prohibited.[3] Catalog proof: Use is limited to internal business purposes of the customer and its Affiliates; Services may not be transferred, resold or made available to third parties; No external benchmarking, reverse engineering or competitive use.
These terms, together with assignment, suspension and termination, are covered in Mimecast Service Agreement terms.
Audits and compliance
The Global Service Agreement and the Service Schedule contain no clause that lets Mimecast audit a customer’s records.[2][3] Compliance rests on three mechanisms instead:
- The Permitted User cap in the Service Order.[3]
- The customer’s right to buy more quantity mid-term.[2]
- Mimecast’s right to suspend Services for suspected breach of the use restrictions or for non-payment.[2]
For the GCI Suite, the Service Description says that Mimecast will notify the customer where usage materially exceeds fair use limits.[6]
The Simply Migrate EULA is the exception. On Mimecast’s written request, the licensee must review its use and certify compliance in a document signed by an officer.[10] Catalog proof: Simply Migrate licensees must self-certify compliance on request. The general discipline is covered in software license audit and license compliance.
Out of scope
- Prices. Mimecast publishes none, and all plans are sold by quote.
- Signed enterprise agreements, public-sector contract vehicles and the Service Provider Agreement for MSPs. None was retrievable.
- The EU (English, German, French) and German-entity versions of the Service Agreement, which follow the same structure as the global version.
- The Data Processing Addendum on the Mimecast Trust Center.
- Legacy email security bundles, which were not published. The Service Levels and Support Description names legacy support packages only.