The Proofpoint Product Terms are the exhibit to the Proofpoint Customer Agreement (or another licence agreement) that describes each Proofpoint product and adds product-specific conditions. “In the event of conflict between the Agreement and this Exhibit the terms of this Exhibit shall govern.”[1] The current version was last updated on 2026-08-17. The Customer Agreement puts the Product Terms first in its order of precedence, ahead of statements of work, the agreement itself and Purchase Orders.[4] Catalog proof: Proofpoint Product Terms.
Section 1 sets the general limit for every product: “Customer’s right to use the Proofpoint Product is limited to the maximum number of Licenses for each module, the deployment type (Appliance, Software, or Service (SaaS)), and any other limitations specified in this Exhibit, and each Purchase Order and/or Quote.”[1] Entitlement is therefore counted per module, not per package total, and a SaaS licence does not cover an on-premises deployment of the same product. Catalog proof: Use is capped per module and deployment type.
Editions
Proofpoint sells most enterprise products in packages and quotes them per user. The how-to-buy pages describe two families.[2][3]
Collaboration Security
| Capability | Core | Tier 2 | Tier 3 | Prime |
|---|---|---|---|---|
| Email security | Yes | Yes | Yes | Yes |
| Account takeover, compromised supplier accounts, Teams and Slack protection, corporate password misuse | Yes | Yes | Yes | |
| Human risk insights, threat-guided training, threat-to-simulation | Yes | Yes | ||
| Domain fraud and spoofing, hosted DMARC/DKIM/SPF, lookalike domains, application email | Yes |
Source: the Collaboration Security comparison table.[2] Catalog rows: Core Email Protection, Collaboration Security Tier 2, Tier 3, Collaboration Security Prime. Proofpoint’s Prime page groups Prime’s components into multichannel threat defence, trusted communications (Email Fraud Defense, Secure Email Relay, lookalike domain detection and takedown) and human risk management.[8] Core Email Protection can be deployed by API or inline as a secure email gateway.[7] The Product Terms describe the API form as “Core Email Protection API (formerly known as Adaptive Email Security (AES))”.[1]
Data Security
DLP Transform Tier 1 covers cloud apps and endpoints, and Tier 2 adds email DLP, dynamic email encryption and document fingerprinting. AI Data Security Tier 1 includes Data Security Posture Management, and Tier 2 adds data access governance, GenAI activity monitoring and discovery of AI and SaaS misconfigurations.[3] Catalog rows: DLP Transform Tier 1, DLP Transform Tier 2, AI Data Security Tier 1, AI Data Security Tier 2. Proofpoint says most Data Security tiers “do not have technical dependencies on Collaboration Security packages”.[3]
Pricing basis
Collaboration Security budgetary pricing “can be determined based on the number of user licenses and contract term (single or multi-year)”, with “exceptions that depend on consumption”.[2] Data Security adds “data volume scanned” to the basis.[3] No list prices are published. Catalog proof: Packages are priced on user licences and contract term; Data security tiers are priced on users and data volume scanned.
Metrics
| Product | Unit | What the documents say | Catalog row |
|---|---|---|---|
| Email Protection, Core Email Protection | User | “Each User must be assigned a separate account on Customer’s email server”; not for bulk mail or accounts not assigned to an individual[1] | User |
| Continuity Plus | User | “Continuity Plus is licensed on a User basis”; days and per-User data volume per quote[1] | User |
| Endpoint DLP | Unique access credential or server | Separate licence per credential; physical and virtual alike[1] | Endpoint DLP User |
| ITM SaaS | Unique access credential or server | Same counting, plus ingestion, retention and storage tiers[1] | ITM SaaS User |
| ITM On-Prem | Endpoint | “based on the number of endpoints the Agent is installed on”[1] | ITM On-Prem endpoint |
| Secure Email Relay | Annual messages | “limited to the annual amount identified in the Proofpoint quote or Order Form”[1] | Secure Email Relay annual message volume |
| CASB Protection for IaaS, CASB OCR, Web Security OCR | Traffic or images | DLP traffic and image limitations per quote or Order Form[1] | none |
The archived Security Products Exhibit (2018) was more explicit than today’s Product Terms. It said Email Protection, Targeted Attack Protection (TAP), Threat Response, Threat Response Auto Pull, Continuity and Continuity Plus were each “licensed on a User basis”.[5] The current Product Terms leave the metric to the quote, in line with the Customer Agreement’s definition of a License.[4]
Counting / floors
Email users. The Email Protection terms tie the User to a mailbox: each User needs “a separate account on Customer’s email server”, and the service may not be used “for the machine generated message delivery of bulk or unsolicited emails or emails sent from an account not assigned to an individual”.[1] Application and system mail belongs in Secure Email Relay, which is sold by annual message volume.[1] Catalog proof: Email Protection requires one email account per User; Secure Email Relay is capped at an annual message volume.
Credentials, not people. For Endpoint DLP and ITM SaaS, “If an individual has more than one access credential, then a separate User license for each of that individual’s unique access credentials must be purchased.”[1] An engineer with a standard login and a separate administrator login therefore needs two licences when both are monitored. A server with its own credential can also be a licensed User.[1] Catalog proof: Endpoint DLP needs a licence per access credential.
Capacity tiers. ITM SaaS Metadata Capture and Visual Capture are “subject to the activity ingestion rate(s) and retention time tiers” in the quote, Visual Capture also to aggregate storage limits, and the Metadata Feed to a maximum monthly export. “Proofpoint reserves the right to require that the Customer pay additional fees when any ingestion, storage, and/or export limit is exceeded.”[1] Secure Email Relay has the same kind of clause for its annual message limit, and excess traffic “may lead to throttling”.[1] Catalog proof: ITM SaaS limits can trigger additional fees.
Virtualization & partitioning
Agent-based products are counted the same on physical and virtual machines. Endpoint DLP and ITM SaaS users are counted “regardless of whether the Agents are deployed on physical or virtual systems”, and ITM On-Prem may run on “bare-metal, VMs or customer-managed cloud”.[1] In a virtual desktop pool, each monitored credential counts for the SaaS products, and each endpoint carrying the Agent counts for ITM On-Prem. The Product Terms contain no core, socket or host rule. Catalog proof: ITM On-Prem is counted per endpoint with the Agent.
Cloud / BYOL
Most products are SaaS. Some carry deployment conditions:
- Email Protection. If the customer asks in writing, Proofpoint sets up its instance in US gateways or data centers. A customer licensed for the SaaS deployment may not turn off Dynamic Reputation, and must keep outbound filtering set to block mail with a virus or a spam score of 95 or higher.[1]
- Proofpoint PX. Usable only for business mail “flowing through a Microsoft O365 application instance”.[1]
- Threat Response Auto Pull. May only be integrated with listed event sources and with Microsoft Exchange, Microsoft Office 365, Google Gmail or IBM Domino as the enforcement device.[1]
- APIs. Use of any Proofpoint API is governed by the Agreement and the API Terms of Use.[1]
Programs
- Archive Wind Down Period. After a Proofpoint Archive licence ends, the customer may for 30 days, “subject to payment of a pro-rata fee”, access and retrieve archived data but not archive new mail. Export to storage media costs extra. Without a written export request, Proofpoint removes the data so that it “cannot be restored in human readable form”.[1] The archived Information & Compliance Products Exhibit of 2019 already contained this wind-down for Archive and Governance.[6] Catalog proof: Archive data can be retrieved for 30 days after the end of the licence; Legacy archive exhibit covered Archive, Supervision and related products.
- Continuity dependency. Continuity “is only to serve as a secondary, emergency failover option” and “Customer is required to have a current subscription for Proofpoint email protection to use Continuity”.[1] Catalog proof: Continuity requires a current email protection subscription.
- Cloudmark for service providers. The Cloudmark licence “includes the right to use the Cloudmark Products for the benefit of Customer’s end user customers”, under a written licence at least as protective of Proofpoint as the Agreement.[1] Catalog proof: Cloudmark products may serve the customer's end-user customers.
- ZenGuide. ZenGuide is the security awareness product “formally known as Proofpoint Security Awareness aka PSAT”. It delivers training content, simulations and multi-tenant administration.[1] Its metric is set in the quote; in the packages it appears as human-risk-based training in Collaboration Security Tier 3 and Prime.[2] Support for the awareness products has its own program, which promises a response within 24 hours (next business day).[9]
Out of scope
- The SLAs for each hosted service, listed separately on the License Terms page.
- Products in the Product Terms not discussed here, including Domain Discover, Social Patrol, Proofpoint Shadow, Spotlight, Secure Access and Proofpoint Satori, whose metrics are set only in quotes.[1]
- Proofpoint Essentials and 365 Total Protection, covered in Proofpoint Essentials and MSP licensing.