Proofpoint licensing is the set of terms under which Proofpoint, Inc. sells its email and collaboration security, data loss prevention (DLP), insider threat, security awareness, archiving and digital communications governance products. Almost everything is sold as a subscription. The Proofpoint Customer Agreement states that its purpose is “to create a single mechanism under which Customer may license Proofpoint Products under a subscription licensing model”.[1] The products may be delivered as a hosted Service (SaaS), as installable Software, or on an Appliance, which the agreement defines as “a virtual or hardware device containing the Software”.[1]
Three documents carry most of the licensing rules. The Customer Agreement applies automatically when a customer issues a purchase order, directly or through a partner, unless a written licence agreement already covers the products.[1] The Product Terms add product-specific conditions and prevail over the Customer Agreement on conflict.[2] The quote and Purchase Order supply the product name, licence quantity, price, Subscription Term and billing contact; any other terms in a customer purchase order are void.[1] Proofpoint’s License Terms page also lists marketplace versions of the agreement, support programs, service level agreements, separate end user terms for Proofpoint Essentials, federal and state and local government customers, and an archive of legacy documents.[3] Catalog proof: Product Terms prevail over the Customer Agreement and Purchase Order.
The grant is a term licence. Proofpoint grants a “non-exclusive, time-limited, non-sublicensable, non-transferable” licence to use the products during the Term in the quantities of Licenses on the Purchase Order, “solely for Customer’s own internal business purposes”.[1] When the Agreement ends, all Software licences and Service access terminate immediately.[1] Catalog proof: Licence is limited to purchased quantities and internal business use; All licences end on termination or expiration.
Editions
Proofpoint publishes no price list. Its how-to-buy pages group the main products into tiered packages. Existing customers can renew their current solutions: “Proofpoint will honor renewals of current solutions for existing customers.”[4]
| Package family | Tiers | What changes between tiers | Priced on |
|---|---|---|---|
| Collaboration Security | Core Email Protection, Tier 2, Tier 3, Prime | Tier 2 adds account takeover, supplier account and messaging-app protection; Tier 3 adds human risk insights and threat-guided training; Prime adds domain fraud, DMARC hosting, lookalike domain and application email protection[4] | Number of user licences and contract term[4] |
| DLP Transform | Tier 1, Tier 2 | Tier 2 adds email DLP, dynamic encryption and document fingerprinting[5] | User licences, data volume scanned and contract term[5] |
| AI Data Security | Tier 1, Tier 2 | Tier 1 includes Data Security Posture Management; Tier 2 adds data access governance and GenAI activity monitoring[5] | Same as DLP Transform |
Core Email Protection can be deployed through the Microsoft Graph API or inline as a secure email gateway.[9] The Product Terms also cover products sold outside the packages, such as Insider Threat Management (ITM), Endpoint DLP, Proofpoint Archive, Secure Email Relay, the Cloudmark messaging products and ZenGuide, the security awareness training product formerly called Proofpoint Security Awareness (PSAT).[2] For small businesses and managed service providers, Proofpoint sells Proofpoint Essentials under its own EULA and, since 2026, 365 Total Protection through its MSP Platform business unit.[6][8] The packages and products are covered in Proofpoint Product Terms and licence metrics.
Metrics
The Customer Agreement does not fix a single metric. A License is “the license metric (e.g., type and quantity) identified in the Proofpoint sales quote and/or in the applicable Product Terms”, and the customer “needs a License in order to legally use a Proofpoint Product”.[1] The metric therefore has to be read from each quote. The documents name these units:
| Unit | Catalog row | Where it applies |
|---|---|---|
| User | User | Email protection and the Collaboration Security packages; each User needs a separate email account[2] |
| Unique access credential or server | Endpoint DLP User, ITM SaaS User | Endpoint DLP and ITM SaaS[2] |
| Endpoint with the Agent installed | ITM On-Prem endpoint | ITM On-Prem[2] |
| Annual message volume | Secure Email Relay annual message volume | Secure Email Relay[2] |
| Active User, Billed User, Mailbox | Essentials Active User, Essentials Billed User, Essentials Mailbox | Proofpoint Essentials[6] |
A User is defined broadly as the employees, agents, subcontractors, consultants and other individuals of the customer and its Affiliates “authorized hereunder to use the Proofpoint Product”.[1] Several products also carry capacity limits set in the quote, such as Continuity storage days and per-User data volume, ITM ingestion and storage tiers, and CASB and Web Security OCR image limits.[2]
Counting / floors
Module and deployment limits. Use is limited to “the maximum number of Licenses for each module, the deployment type (Appliance, Software, or Service (SaaS))” and other limits in the Product Terms, Purchase Order and quote.[2] Proofpoint publishes no minimum seat counts for the enterprise packages. Catalog proof: Use is capped per module and deployment type.
True-up. The customer monitors its actual usage, the License Count, against the Base License it has paid for. It must report the count once usage exceeds the Base License by 10% or more, and Proofpoint “may also at any time produce an actual license count for verification by Customer”. Licences above the Base License are charged “from the time such Licenses were activated through the remainder” of the term.[1] The archived General Terms of 2020 used a different rule, with a 5% threshold below which overage was charged only from the reporting date.[12] The mechanism is explained in Proofpoint Customer Agreement and true-up. Catalog proof: Report the License Count once usage exceeds the Base License by 10%; Overage is back-dated to activation; Legacy General Terms used a 5% back-dating threshold.
Per-credential counting. For Endpoint DLP and ITM SaaS, “a separate User license for each of that individual’s unique access credentials must be purchased”, so an administrator with a personal and a privileged account counts twice.[2] Catalog proof: Endpoint DLP needs a licence per access credential.
Virtualization & partitioning
Proofpoint does not license on processors or cores. The Product Terms state that Endpoint DLP and ITM SaaS users are counted “regardless of whether the Agents are deployed on physical or virtual systems”, and that a physical or virtual server with its own credential may itself be a licensed User.[2] ITM On-Prem is counted per endpoint with the Agent installed, on bare metal, virtual machines or customer-managed cloud.[2] The Appliance definition covers both virtual and hardware devices, so a virtual appliance is treated as an Appliance under the Purchase Order.[1] Catalog proof: ITM On-Prem is counted per endpoint with the Agent.
Cloud / BYOL
Most Proofpoint products are hosted Services, so bring-your-own-licence does not arise. Purchases through cloud marketplaces use their own versions of the Customer Agreement. The Microsoft commercial marketplace version (August 2025) has orders invoiced by the reseller or Microsoft, and Proofpoint “reserves the right to separately invoice Customer for any License True-Up”.[10] An AWS Marketplace version exists as well.[3] Catalog proof: Microsoft marketplace true-ups may be invoiced separately; AWS Marketplace true-ups are payable to Proofpoint or the marketplace.
Programs
- Subscription Term and Extension Term. Each Purchase Order renews automatically for further Extension Terms, by default one year, unless either party gives notice of non-renewal at least 90 days before the end of the term.[1]
- License True-Up. The 10% reporting trigger and back-dated overage described above.[1]
- Self-Service, Platinum and Premium Support, with the Global Time Zone Add On. Platinum and Premium cost extra; Premium adds a designated Technical Account Manager.[7]
- Federal End User License Terms. Federal customers report usage the same way, but audit charges pass through the contractor and follow the FAR Disputes clause.[11]
- Archive Wind Down Period. Thirty days of paid read access to archived data after the licence ends.[2]
- Proofpoint Essentials monthly and annual billing. Covered in Proofpoint Essentials and MSP licensing.[6]
Use rights and restrictions
Affiliates, consultants and advisors may use the products “solely for the benefit of Customer”, and the customer is liable for them.[1] The customer may not “resell, sublicense, lease, time-share or otherwise make a Proofpoint Product (including the Documentation) available to any third party”.[1] Benchmarks or comparisons intended for publication need Proofpoint’s prior written consent.[1] The Cloudmark products are an exception to the internal-use limit: they may be used for the benefit of the customer’s own end user customers under a written licence at least as protective as Proofpoint’s terms.[2] Catalog proof: Affiliates, consultants and advisors may use the products only for the customer; No resale, sublicensing or time-sharing; Published benchmarking requires consent; Cloudmark products may serve the customer's end-user customers.
Audits and compliance
The Customer Agreement contains no separate on-site audit clause. Compliance runs through the true-up: the customer reports its License Count, and Proofpoint can produce its own count at any time.[1] Proofpoint Essentials goes further: Proofpoint monitors usage and “may increase the Licensed Usage accordingly” when scanned Active Users exceed it.[6] Under the federal terms, any audit Proofpoint requests is at its own expense.[11] Catalog proof: Proofpoint may produce its own licence count; Proofpoint may raise Essentials Licensed Usage to the scanned count; Federal audits are at Proofpoint's expense and disputes follow the FAR. For the general discipline see software license audit and true-up.
Out of scope
- Prices, discounts and part numbers, which Proofpoint does not publish. Budgetary pricing depends on user licences and contract term, with consumption-based exceptions.[4]
- Negotiated licence agreements, partner and MSP program agreements, and the commercial terms of 365 Total Protection, which come from the Hornetsecurity platform and are not part of the documents above.[8]
- The state and local government (SLED) end user terms and the service level agreements other than the Essentials SLA, which were not reviewed for this article.[3]
- Litigation over Proofpoint’s own software, which is covered in Proofpoint v. Vade Secure.