The Rapid7 Master Software and Services Agreement (MSSA) is Rapid7’s standard contract for its software and services. It consists of the Agreement itself, Schedule A for Services and Schedule B for Software. A schedule applies only to the extent the relevant offering is purchased.[2] The web version reads “Last updated October 2025”. Rapid7 applies it to purchases made from 24 October 2025. Purchases made earlier are directed to archived terms.[2] The Agreement binds the parties to the extent that Rapid7 Offerings are purchased on an Ordering Document. Rapid7 LLC contracts with customers in the United States and Rapid7 International Limited with customers elsewhere.[1]
Which terms apply
Rapid7 has replaced its standard terms twice. The governing document therefore depends on the purchase date, unless the customer has a signed agreement.[2][3]
| Purchase date | Governing terms | Notes |
|---|---|---|
| From 2025-10-24 | Master Software and Services Agreement, Schedules A and B[2] | Current terms |
| 2023-03-01 to 2025-10-23 | Archived General Terms and Conditions with Schedules A and B[3][4] | True-Up and True-Forward overage options |
| Before 2023-03-01 | Insight Platform Terms of Service (Insight cloud products), End User License Agreement (Nexpose, Metasploit, AppSpider), Master Service Agreement (services)[3] | Product-specific legacy terms |
Commentary: a renewal or expansion order placed after a cut-over date may bring that order under the newer terms, while the original entitlement stays under the old ones. Record the governing terms per Ordering Document, not per customer. Catalog proof: Terms depend on purchase date: 2025-10-24 and 2023-03-01 cut-overs.
The terms page maps each offering to the Agreement and schedules. Managed services such as MDR and managed vulnerability management use the Agreement and Schedule A. Professional services, including penetration testing, also use the Agreement and Schedule A. Managed Threat Complete and Vector Command use the Agreement and both schedules. Cloud-hosted and distributed software, including Surface Command, InsightVM, InsightIDR, InsightCloudSec, Nexpose, Metasploit and threat intelligence, uses the Agreement and Schedule B.[2]
Licence grant and restrictions
Grant (effective 2025-10-24). Schedule B grants, during the Term, a non-exclusive, non-transferable, non-sublicensable right to use the Software and the Rapid7 Data. The Software is licensed in object code only. Use is limited to the customer’s internal business purposes and to the Volume Limitations, and must follow the Agreement. Any further restrictions on the Ordering Document also bind.[1] “Software” covers both Cloud-Hosted Software, which Rapid7 hosts, and Distributed Software, which is deployed on the customer’s premises.[1] The customer may make a reasonable number of copies of Distributed Software for backup and archiving.[1] Catalog proof: Software licensed for internal business purposes within Volume Limitations.
Restrictions. Schedule B §2 prohibits several uses:
- reselling, renting, leasing, sublicensing or distributing the Software or access to it, including timesharing and service bureau use;
- combining Rapid7 Data with the customer’s own offerings to sell to a third party;
- accessing the Software to build a competing product or for competitive analysis.[1]
The customer also warrants that it is authorised for every network, system, IP address and asset it scans, monitors or tests.[1] Catalog proof: No resale, sublicensing, timesharing or service bureau use; No use to build a competing product or for competitive analysis; Customer must be authorised for every system it scans or tests.
Affiliates. The customer may make Offerings available to its Affiliates and is liable for their breaches. An Affiliate is an entity the customer controls through a majority of its voting securities.[1] Commentary: parent and sister companies fall outside this definition, so a group-wide deployment should be contracted by the top entity. Catalog proof: Affiliates may use the Offerings; customer liable for them.
Volume Limitations and overages
Definition. Volume Limitations are the capacity indicated on the Ordering Document or Documentation. They include unique assets, applications, number of scans, number of billable cloud resources, gigabytes or workflows, as applicable.[1] The Ordering Document identifies the offering, Volume Limitations, overage options, Term, tiers and price.[1] The legacy Insight Platform Terms of Service used almost the same list.[6] The legacy EULA also counted “named individual users of the Software”.[5] Catalog proof: Volume Limitations are the capacities on the Ordering Document or Documentation.
Current overage rule (effective 2025-10-24). Excess usage is invoiced after a reasonable notification period, the Notice Period. The rate is Rapid7’s then-current list rate for the Volume Limitation tier associated with the excess, prorated for the remainder of the Term.[1] Catalog proof: Excess usage invoiced at then-current list rate for the tier, prorated.
Archived overage rule (purchases 2023-03-01 to 2025-10-23). Excess usage was invoiced at then-current list rates or as set on the Ordering Document, and Rapid7 called this “True-Up”. It applied notwithstanding the limitation of liability. For Cloud-Hosted Software, the customer could instead move up to the next Volume Limitations tier for the rest of the Term at prorated incremental fees, called “True-Forward”. A customer that did not choose True-Forward paid the True-Up thirty days after the Notice Period.[4] See True-Up and True-Forward and Legacy terms offered True-Forward to the next tier for cloud overages.
Commentary: both versions price the overage at list rate rather than the discounted contract rate. The True-Forward option under the archived terms priced the next tier at the Ordering Document’s incremental fee, which is usually lower. The current terms do not repeat that option, although an Ordering Document may still define overage options.
Usage verification and audits
Current terms (effective 2025-10-24). Distributed Software may track or enforce its Volume Limitations. On Rapid7’s written request, no more than once every six months, the customer must provide a signed certification that the Distributed Software is used in accordance with the Agreement.[1] The MSSA contains no right for Rapid7 to inspect records or premises. Cloud-Hosted Software is measured by Rapid7 directly, and Rapid7 may suspend it for non-payment more than thirty days late or for use in contravention of the Agreement.[1] Catalog proof: Distributed Software may enforce limits; signed usage certification at most every six months.
Legacy EULA (before 2023-03-01). The same six-monthly certification applied. In addition, Rapid7 could review and verify the customer’s records, deployment and use of the Software at its own expense. A review had to be scheduled at least ten days in advance and held during normal business hours at the customer’s facilities. Overscanning fees were payable at then-current list rates notwithstanding the liability cap.[5] Catalog proof: Legacy EULA allowed Rapid7 to review records and deployment on ten days notice.
Term, renewal and termination
Renewal. Each Term renews automatically for the same period, at the rate on the Ordering Document. This does not happen if the Ordering Document says otherwise, or if either party gives written notice of non-renewal at least 30 days before the end of the Term. For a renewal term, Rapid7 may change rates, charges and usage policies, or introduce new charges, on at least 60 days’ written notice. That notice may be given by email.[1] The legacy EULA renewed the Software Term, or the Maintenance and Support Term of perpetual software, for one year on the same 30-day and 60-day notice periods.[5] Catalog proof: Terms auto-renew for the same period unless 30 days notice; 60 days notice of rate changes.
Fees and early termination. Fees are non-refundable and non-cancellable unless the Agreement or the Ordering Document says otherwise.[1] A customer that terminates before the end of a fixed term gets no refund and remains liable for all fees for the full term. After termination the customer must stop using the Offering. Rapid7 may deactivate the account immediately and delete it, with all Customer Content, after at least thirty days.[1] Either party may terminate for a material breach not cured within thirty days.[1] Catalog proof: No refund on early termination; fees due for the full fixed term.
Assignment. The customer may not assign its rights or obligations without Rapid7’s advance written consent.[1] The agreement has no carve-out for mergers or internal reorganisations. Catalog proof: Assignment requires Rapid7 advance written consent.
Partners. If the customer buys through a Rapid7 authorized partner, invoicing, fees and taxes are as agreed with that partner.[1] The Ordering Document may be agreed by Rapid7 or its authorized reseller.[1] Service providers that want to operate the platform for clients join Rapid7’s PACT partner specialization, which provides a multi-tenanted platform.[9] Catalog proof: Purchases through an authorized partner follow partner fee and invoicing terms.
Evaluations
A trial or evaluation lasts thirty days, or the Term on the Ordering Document. The same Software may not be trialled more than once in any twelve-month period unless Rapid7 agrees. Rapid7 may revoke trial access at any time. The Schedule B warranties and Rapid7’s IP indemnity do not apply to evaluations.[1] See Evaluation and trial licenses and Evaluations last 30 days; one per product per twelve months.
Services and managed services
Schedule A governs Services. Where Managed Services include Rapid7 Software, the customer receives a licence to that Software for the Term of the Managed Services only.[1] Professional Services can be rescheduled free of charge up to ten business days before they start. They must be used or scheduled within twelve months of the order date, after which unscheduled time is forfeited.[1] Customers own the Results of the Services. Deliverables that include Rapid7 IP come with a perpetual, royalty-free, non-transferable licence for internal business purposes.[1] Catalog proof: Software included in Managed Services is licensed only for the Managed Services term; Unscheduled professional services forfeited after twelve months.
Warranties, support and availability
Cloud-Hosted Software is warranted to conform in all material respects to its Documentation during the Term. Distributed Software carries the same warranty for ninety days after delivery. If Rapid7 cannot restore conformity, the customer may terminate the affected Ordering Document for a pro-rata refund.[1] Support is provided during any Term under Rapid7’s support policy, the Customer Support Guidebook.[1] The Guidebook recommends running supported software versions. For issues on unsupported versions, the customer may have to reproduce the error on a supported version.[8] The Insight Platform SLA commits to 99.95% monthly availability. Its service credits apply only to future renewals or purchases, never as refunds. Downtime caused by use in excess of licensed capacities is excluded.[7] Catalog proof: Support tied to the Term and to supported software versions; SLA credits only against renewals or purchases; excess-capacity use excluded.
Liability and indemnity
Each party’s liability is capped at the amount paid or payable for the relevant Offering in the twelve months before the event giving rise to liability. The cap does not apply to violations of a party’s intellectual property rights or to express indemnification obligations.[1] Rapid7 indemnifies against third-party claims that an Offering infringes intellectual property rights. As remedies it may procure the right to continue, modify the Offering, or terminate and refund prepaid fees pro rata.[1] North American customers are governed by Delaware law and all others by the law of England and Wales.[1]
Out of scope
- Negotiated master agreements, which override the web terms.
- The Data Processing Addendum and the Intelligence Hub data protection provisions of Schedule B §7.
- Services statements of work and service briefs, which define the scope of each managed or professional service.
- The legacy DivvyCloud EULA and IntSights terms listed on the archive page.