SentinelOne licensing is the set of terms under which SentinelOne, Inc. sells subscriptions to the Singularity Platform and the products and services built on it: endpoint, cloud workload and identity protection, Singularity Data Lake and AI SIEM, the Purple AI analyst, AI security products, and managed detection and response. The Master Subscription Agreement (MSA) is the base contract for paid and evaluation use of all Solutions. The customer’s right to use a Solution is limited to what it subscribed to in a Purchase Order and to the licence section of that Solution’s Solutions Addendum.[1] For the platform, the Singularity Platform Terms grant a worldwide, non-exclusive, non-transferable licence for the Subscription Term, and that licence is limited to the quantity of Endpoints in a valid Purchase Order.[2] Public packages are therefore priced per endpoint per year.[3] Other constructs sit beside the Endpoint metric: data ingestion for Singularity Data Lake,[5] Singularity Credits for AI-powered work,[6] and hours for incident response retainers.[11] For the general models, see concurrent and device licensing and subscription and consumption licensing.
Document set
SentinelOne publishes its customer terms as a layered set on its legal page. The MSA sits at the base. Solutions Addenda for the Singularity Platform, Prompt Security and Observo sit on top of it, together with a GSA version of the MSA, a U.S. Public Sector Addendum, a Services Addendum, an Incident Response Retainer Addendum, an SDK Addendum, two warranties and the Support Terms.[16] Where a Solutions Addendum conflicts with the MSA, the Solutions Addendum takes precedence.[1] The Purchase Order may be a document between the customer and a Partner that references a SentinelOne Quote, a document between the customer and SentinelOne, or written terms accepted online.[1] This matters for entitlement records: the quantity and the unit price that later drive a true-up both come from that Purchase Order.
| Document | What it governs | Revision shown |
|---|---|---|
| Master Subscription Agreement | All Solutions: definitions, evaluation, fees, True-Up, renewal, termination | 2026-06-24[1] |
| Singularity Platform Terms | Platform licence grant and License Restrictions | 2026-05-14[2] |
| Services Addendum | Vigilance, WatchTower and other SentinelOne Services | 2026-05-14[7] |
| Support Terms | Singularity Support levels and term | 2026-08-27[8] |
| Incident Response Retainer Addendum | IR Hours and IR Services | 2026-07-16[11] |
| Ransomware Warranty; Breach Response Warranty | Warranty payments tied to package or MDR SKUs | 2026-05-14; 2026-09-11[9][10] |
| U.S. Public Sector Addendum | Federal, state, local and publicly funded customers | 2026-05-14[12] |
The MSA and its addenda are covered in detail in SentinelOne Master Subscription Agreement terms.
Editions
SentinelOne sells the platform as packages that build on one another. The pricing page publishes per-endpoint annual prices for four packages and sells the top package by quote.[3]
| Package | Positioning and main additions (vendor description) | Published price |
|---|---|---|
| Singularity Core | Entry package, listed in the comparison-table selector (NGAV and EPP; see the packages article) | $69.99 per endpoint annually[3] |
| Singularity Control | Listed in the comparison-table selector; adds suite features such as device and firewall control (see the packages article) | $79.99 per endpoint annually[3] |
| Singularity Complete | AI-driven endpoint and cloud workload protection, real-time detection and response, 14 days of data retention, AI Security Assistant | $179.99 per endpoint per year[3] |
| Singularity Commercial | Complete plus Identity Detection & Response, 90-day data retention and managed threat hunting | $229.99 per endpoint per year[3] |
| Singularity Enterprise | Commercial plus the Agentic AI SOC Analyst, full visibility and forensics, and expert-led onboarding and training | Contact sales[3] |
The same comparison appears in a datasheet dated by its document code 2025-08-15. That datasheet lists Control, Complete, Commercial and Enterprise, and it marks some capabilities as add-ons.[4] Each published price is recorded as a catalog SKU, for example Singularity Complete - annual. SentinelOne publishes no part numbers. Package contents, add-ons and the cloud and identity products are covered in SentinelOne Singularity Platform packages.
Metrics
| SentinelOne term | Catalog row | Where it applies | What SentinelOne says |
|---|---|---|---|
| Endpoint | Endpoint | Singularity packages, cloud workload and identity agents | Physical or virtual computing devices and/or computing environments, such as containers, that can process data.[1] The licence is limited to the Endpoint quantity in the Purchase Order.[2] |
| Monthly average ingestion | Monthly average ingestion | Singularity Data Lake, AI SIEM | Priced on monthly average ingestion, not daily limits.[5] |
| Singularity Credit | Singularity Credit | Purple AI Agentic Investigation and other AI-powered work | A unified currency drawn down across AI-powered work in the platform.[6] |
| IR Hour | IR Hour | Incident Response Retainer | Hours of IR Services stated in the Purchase Order.[11] |
| Covered Endpoint | Covered Endpoint | Breach Response Warranty for MDR SKUs | The subscribed unit count of Covered Endpoints sets the warranty cap.[10] |
The FAQ confirms the endpoint basis in plain terms: prices vary with the number of deployed endpoint agents.[14] Prompt Security products carry no named metric in their addendum. That licence is “limited as set forth in a valid Purchase Order”, so the unit is whatever the Quote specifies.[15]
Counting / floors
Endpoint quantity (effective 2026-05-14). The Singularity Platform licence covers the customer’s and its Affiliates’ internal business, security and operations, and it is capped at the Endpoint quantity in the Purchase Order.[2] Catalog proof: Licence limited to the Endpoint quantity in the Purchase Order.
True-Up (effective 2026-06-24). If usage exceeds what the Existing Purchase Order bought, SentinelOne may invoice the increment. It can do so pro rata at the Purchase Order unit price for the rest of the term, as overages for the relevant period at that unit price, or both.[1] Catalog proof: Usage above the Purchase Order is invoiced as a True-Up. See true-up.
Floors. None of the retrieved documents sets a minimum quantity. The public prices are displayed for 5-100 workstations. All purchases go through an authorized partner, and the partner’s pricing controls where it differs from the published figures.[3] Catalog proof: Public prices are indicative; partner pricing controls.
Data and AI consumption. Singularity Data Lake usage is averaged over the month and reviewed at renewal.[5] Singularity Credits are bought through partners, direct billing or eCommerce after a complimentary trial allotment.[6] See SentinelOne Data Lake, AI SIEM and Purple AI licensing.
Virtualization & partitioning
The MSA definition of Endpoint names virtual devices and containers alongside physical devices.[1] The retrieved terms publish no host-level, processor or core alternative, and no hard or soft partitioning policy of the kind found in processor and core licensing. For Endpoint-metered packages, each virtual machine, VDI instance or container environment that runs the agent is therefore counted as an Endpoint. Singularity Cloud Workload Security covers servers, VMs, containers, CaaS and serverless workloads.[17] Its public pages do not state a separate workload metric. Catalog proof: Virtual devices and containers count as Endpoints. For the cross-vendor background, see virtualization and partitioning.
Cloud / BYOL
The Singularity Platform is a SaaS service with downloadable agents. SentinelOne makes the downloadable software available from its site or by other means it chooses.[2] No bring-your-own-license mapping applies, because the customer does not host the platform. Workloads in public clouds are licensed through the same subscriptions. Purchases through cloud marketplaces and MSP marketplaces follow the marketplace’s order documents. Pax8’s Managed AI Defense is one such case: it is sold per endpoint as a single SKU.[13]
Programs
- Evaluation. Evaluation use lasts up to 30 days unless SentinelOne agrees otherwise in writing. Use beyond the Evaluation Period without consent can be charged at price-list Fees.[1]
- Singularity Support. Support is coterminous with the Subscription Term and cannot be cancelled during it. It comes at a Standard or a Premium level.[8]
- Ransomware Warranty and Breach Response Warranty. Each warranty is tied to named SKUs and must be stated in the Quote or Purchase Order.[9][10]
- Incident Response Retainer. The customer prepays IR Hours for a 12-month term. Hours not used in that term expire.[11]
- SentinelOne Services. Vigilance, WatchTower and similar services require a Singularity Platform subscription and do not renew automatically.[7] See SentinelOne managed services and warranties.
- Managed AI Defense. A per-endpoint MSP offering sold through Pax8, with optional add-on SKUs.[13]
- U.S. Public Sector Addendum. Replaces the commercial renewal clause with a 12-month term that renews only through a new Purchase Order with a Partner.[12]
Contract terms
Renewal (effective 2026-06-24). Subscriptions renew automatically for the same length unless either party gives written notice at least 30 days before the term ends. If the customer gives no timely notice and issues no Purchase Order for the renewal term, renewal Fees are 120% of the most recent Purchase Order.[1] Catalog proof: Subscriptions renew automatically unless notice is given 30 days before term end; Renewal without notice or new Purchase Order is priced at 120%.
Use rights. The platform may be used only for internal business operations and may not be offered as a service to third parties. Performance information may not be published.[2] A Third-Party Service may operate the Solutions for the customer’s own purposes.[1] Catalog proof: No resale or service to third parties from a customer subscription; No publication of performance information; Third-Party Service providers may operate the Solutions for the customer.
Transfer. Assignment needs the other party’s written consent, which may not be unreasonably withheld. The exception is a successor to substantially all of the business or assets, and a customer’s successor must not compete with SentinelOne.[1] Catalog proof: Assignment needs consent; successors must not compete with SentinelOne.
Audits and compliance
The retrieved MSA and Singularity Platform Terms contain no clause giving SentinelOne a right to audit a customer’s records. Compliance rests on three mechanisms instead. First, the licence is capped at the Purchase Order quantity.[2] Second, SentinelOne may invoice True-Ups at the Purchase Order unit price.[1] Third, after termination the customer must uninstall the Solutions and confirm this in writing on request, and SentinelOne reserves the right to investigate suspected violations of those obligations.[1] The platform also reserves a right to monitor and access the Solutions to remediate suspected illegal activity and prevent harm.[2] Because the agent reports to a SentinelOne-hosted console, the vendor already holds the deployed-agent count that a True-Up invoice would use. Catalog proof: Uninstall on termination; SentinelOne may investigate. A signed enterprise agreement may add terms that the web documents lack. The general discipline is covered in software license audit and license compliance.
Out of scope
This page does not cover SentinelOne’s MSSP Agreement or partner programme terms, which are not published on the legal page. It also does not cover prices charged by partners, distributors or cloud marketplaces, Data Lake and Credit price points (not published), or the Data Protection Addendum. Hardware, vulnerability feeds and product efficacy are outside the LICENSEWARE Wiki’s scope.