The Mimecast Service Agreement is the contract under which Mimecast provides all of its products and services. It consists of General Terms & Conditions (GTC) and a Service Schedule, both published on the Mimecast Contracts site.[3] The current global versions are labelled “ENG v. 01-Sep-2026 Clickwrap”.[1][2] The Service Schedule forms part of the Service Agreement or of any existing agreement with Mimecast, and it takes precedence if it conflicts with those terms.[2] EU versions in English, German and French are published alongside the global and UK version.[3] Service Descriptions and SLAs are incorporated by reference. The SLAs are posted on the Contracts site, and the Service Descriptions are posted in the Mimecast knowledge base.[1]
Editions
The agreement has no editions. Its structure is:
| Document | Role | Version cited |
|---|---|---|
| General Terms & Conditions | Commercial and legal terms for all Services: Services Orders, warranty, liability, term, payment, assignment, governing law[1] | ENG v. 01-Sep-2026 |
| Service Schedule | Part 1 Terms of Use for all Services; Part 2 terms for specific Services[2] | ENG v. 01-Sep-2026 |
| Service Levels and Support Description | Availability commitments, service credits, support packages[7] | Effective 01 June 2026 |
| Evaluation Agreement | Stand-alone click-through terms for evaluation use[4] | 1 June 2026 |
| Evaluation Terms for Existing Customers | Addendum to an existing agreement for evaluating further Services[5] | 04 November 2024 |
| Beta Program Addendum | Amendment governing Beta Services[6] | December 2024 |
The Services Order is the transactional document: a quote, statement of work, purchase order or similar. It sets out the Services, the Subscription Term and any usage quantities.[1]
Metrics
The GTC set one default metric. Unless the Service Schedule defines otherwise, usage quantity is the number of Permitted Users, meaning end users authorized by the customer or a Customer Affiliate to access and use the Services.[1]
Part 2 of the Service Schedule defines other quantities for particular Services:
- DMARC Analyzer is priced by the number of customer domains.
- Brand Exploit Protect has a maximum number of protected Domains and a number of Takedowns.
- The GCI Services are subject to the fair use limits in their Service Description.[2]
The Evaluation Agreement defines Permitted Users more narrowly, as individuals employed by or otherwise under the customer’s control and permitted to use the Services.[4]
Counting / floors
Order cap. The customer will only allow the number of Permitted Users shown in the applicable Service Order to use the Services.[2] It must also implement reasonable controls so that only permitted people access the Services, and it is responsible for anyone who gains access through its systems.[2] Catalog proof: Only the number of Permitted Users in the Service Order may use the Services.
Affiliates. Permitted Users include users authorized by a Customer Affiliate. The Agreement creates no direct contract between Mimecast and the Affiliate, and the customer is responsible for Affiliate use.[1] Catalog proof: Use is limited to internal business purposes of the customer and its Affiliates.
Mid-term changes. Quantities and Services can be increased at any time with advance notice to the Reseller or Mimecast, and additional fees apply. Services Orders are non-cancellable. Quantities cannot be reduced, and Services cannot be downgraded or removed, during a Subscription Term. Such changes take effect at the start of a Renewal Term if written notice is given at least 30 days before the renewal date.[1] Catalog proof: Quantities can be increased mid-term but only reduced at renewal.
Historical data imports. If Professional Services include importing historical Customer Data, the quantity on the Services Order must be delivered within 12 months of the start of the engagement. Data received later incurs additional fees.[1] Catalog proof: Historical data for import must be delivered within 12 months.
Virtualization & partitioning
The Agreement contains no virtualization or partitioning terms, because the Services are provided as software-as-a-service.[1] Mimecast applications distributed through online marketplaces are licensed for the duration of the Subscription Term.[2] Catalog proof: Mimecast marketplace applications are licensed for the Subscription Term.
Cloud / BYOL
Customer Data is stored in the Hosting Jurisdiction, the country where it is kept for the relevant Services. Support may be provided from any jurisdiction where Mimecast keeps support personnel, as listed on the Trust Center.[1] When the customer connects third-party services through APIs, it must hold its own licences for them, and their terms govern that use.[2]
Programs
Resellers. Services may be bought through an authorized Reseller.[1] Several terms change for Reseller purchases:
- The GTC payment and tax section does not apply, and refunds or service credits are paid to the Reseller.[1]
- Mimecast may terminate if the customer does not pay the Reseller and fails to cure within 15 days of written notice.[1]
- A customer that moves to a different Reseller keeps the Agreement, with the new Reseller’s pricing and terms added.[1]
- No Reseller may modify the Agreement or make promises on Mimecast’s behalf.[1]
Catalog proof: Mimecast may terminate if the customer does not pay its Reseller; Changing Reseller keeps the Agreement in force.
Trial Services. For Services provided for evaluation, the GTC remove the data retention obligation, the SLA, warranties and indemnities. Either party may terminate immediately on written notice.[1] Evaluation Terms for Existing Customers give a 30-day Evaluation Period, which Mimecast may extend in writing (including email). The Services are provisioned for the Permitted Users or Domains specified on the online form.[5] New customers sign the stand-alone Evaluation Agreement. If they later take a paid subscription, the GTC then apply.[4] Catalog proof: Trial Services carry no SLA, warranty or data retention.
Beta Services. Beta Services carry no service levels, support or maintenance obligations. Mimecast may modify, suspend or abandon them at any time. The customer receives a revocable, non-transferable right to use them for the duration of the Beta Test.[6] Catalog proof: Beta Services carry no service levels or support.
Managed services. A customer that subscribes to a managed service offering enables Mimecast to keep an assigned role in the customer’s account, with limited access to certain Customer Data or dashboards.[2]
Contract terms
Term and renewal. The Agreement stays in force until all Services Orders have expired or it is terminated. Each Services Order renews automatically for 12 months, or as agreed in the Services Order, unless either party gives written notice of non-renewal at least 30 days before the end of the current term. Notice may go to the Reseller or to Mimecast.[1] Catalog proof: Services Orders renew automatically for 12 months.
Fees and renewal pricing. Undisputed fees are due 30 days from invoice. At each renewal Mimecast may raise recurring fees by up to 8%, or up to 11% for customers contracting with Mimecast South Africa (Pty) Limited. Renewal fees must be notified at least 100 days before the Renewal Term.[1] The Plans page applies “standard price increase terms” to customers who move from legacy email bundles to the current plans.[9] Catalog proof: Renewal fees may rise by up to 8% (11% in South Africa); New email security customers must buy the current plans from 2025-08-15.
Use restrictions. Part 1 of the Service Schedule sets out three restrictions:
- The Services may be used only in line with the Agreement and Service Documentation, and only for the customer’s or its Affiliates’ internal business purposes.[2]
- The customer may not transfer, resell, license, rent, lease or grant access to the Services, the Service Description or the Documentation to third parties.[2]
- The customer may not reverse engineer the Services, build a competitive service with them, or benchmark them for use outside its organization.[2]
A breach of these restrictions is excluded from the liability caps.[1] Catalog proof: Services may not be transferred, resold or made available to third parties; No external benchmarking, reverse engineering or competitive use.
Suspension and termination. Mimecast may suspend Services when:
- activities appear to breach the use restrictions; or
- undisputed fees remain unpaid 15 days after notice.
It may also charge a reinstatement fee.[1] Either party may terminate for a material breach that is not cured within 30 days.[1] If a change to the Services materially degrades them or the SLA, and Mimecast does not correct it within 30 days of notice, the customer may terminate and receive a prorated refund of prepaid fees.[1] Catalog proof: Services may be suspended for non-payment after 15 days; Material degradation of a Service allows termination with a prorated refund.
Assignment and M&A. The customer may assign the Agreement to a successor in interest on a sale or merger. Any other assignment needs Mimecast’s consent, which may not be unreasonably withheld.[1] Mimecast’s support guidance treats combining two Mimecast customer organizations as a technical project: archived data is usually moved into one storage account, and users are migrated.[8] Catalog proof: Assignment only to a successor in a sale or merger without consent.
Liability and service credits. General liability of each party is capped at the fees paid or payable for the applicable Services in the 12 months before the incident. Data claims have a separate cap: the greater of USD 100,000 or twice those fees.[1] Service credits must be requested through a support case within 14 days of the end of the affected month.[7]
Audits and compliance
Neither the GTC nor the Service Schedule gives Mimecast a right to audit the customer’s records or systems.[1][2] Licence compliance under this Agreement works through the Service Order cap and the customer’s own access controls.[2] Additional quantity is bought mid-term at additional fees.[1] Mimecast may also contact customers whose usage exceeds the SLA’s reasonable usage allowance, to renegotiate contract terms.[7] Catalog proof: SLAs exclude usage above three times the typical average user. For the general discipline, see license compliance.
Out of scope
- Governing law and arbitration seats by region, set out in GTC s.10, which do not affect the licence position.
- The Data Processing Addendum and the Trust Center.
- Negotiated master agreements and Service Provider Agreements, which are not published.