Varonis licensing is the set of contract terms and usage measures under which Varonis Systems, Inc. makes its Data Security Platform and related security products available. Varonis states that it licenses on user count and does not charge according to the amount of data a customer has.[4] The platform is now delivered as software as a service. The governing document is a Subscription Services Agreement that grants a limited right to access the service during the subscription period named in a Purchase Confirmation, for the Authorized Usage purchased.[1] The legacy self-hosted product, which was licensed through a separate licence site with user and data counters, was announced for end-of-life by 2026-12-31.[5]
Varonis publishes less pricing and counting detail than many enterprise vendors. There is no public price list or part-number catalogue in the documents reviewed for this wiki, and the Subscription Services Agreement leaves the quantity and the usage metric to the order document. This article therefore concentrates on the contract structure, the measures the documents do name, and the changes of model that a licence manager is likely to meet.
Contracting entity and document set
The Subscription Services Agreement describes itself as a legal agreement between the subscriber and Varonis Systems, Inc., a Delaware corporation with its principal place of business in New York, “and its subsidiaries and affiliates”. It governs access to Varonis’ web-based cloud security solution offered on a software-as-a-service basis, together with the services made available by Varonis, and it applies “irrespective of whether such access and/or use took place prior to or after the Subscriber accepted” it.[1] Acceptance is by clicking an accept button or by accessing or using any portion of the service.[1]
Several other documents form part of the commercial relationship:
| Document | Role | Source |
|---|---|---|
| Subscription Services Agreement | Licence grant, restrictions, fees, term, termination, evaluation, reseller orders | [1] |
| Purchase Confirmation | Lists the products and services provided; states the subscription period and the Authorized Usage | [1] |
| Service Level Agreement | Support Services scope, supported versions, availability commitment, service credits | [2] |
| Customer Data Processing Addendum for SaaS Products | Personal Data processing terms, treated as an integral part of the agreement | [1][3] |
| Documentation | Product documentation against which the service is used and warranted | [1] |
The SLA states that it is part of, and governed by, the subscription services agreement, but that “in the event of a conflict” between the two, the SLA controls.[2] The agreement also allows Varonis to amend it, including incorporated terms, policies and documents, at any time by posting the amended terms on a web address reachable by signing in to a MyVaronis account; continued use after the effective time counts as acceptance.[1] The contract article walks through these clauses in order.
How use is measured
Authorized Usage
The agreement defines Authorized Usage as the usage metric or metrics and factors identified in the applicable Purchase Confirmation. It adds that Authorized Usage “may include, among other metrics and factors” the number of individuals who have an account on the systems or environments monitored by the Subscription Services, or the data, number of folders and events tracked or monitored.[1] The agreement therefore does not fix a single metric. The order document decides which of these factors applies to a given subscription and in what quantity.
Licensed users
On its purchasing page Varonis says: “We license based on user count and you’re never charged based on the amount of data you have.”[4] The page does not say which accounts are counted. The agreement’s own wording, individuals who have an account on monitored systems or environments, points to accounts on the environments the service covers, but a licence manager should read the Purchase Confirmation for the exact definition. The row for Licensed users records both statements.
Quotas shown in the product
A January 2024 release summary describes a license information page, available to the Enterprise Manager and System Admin roles. It shows the licence expiration date, the platforms covered by the licence, “available quotas for daily events and monitored resources”, a breakdown of daily resource usage and event numbers, and alerts indicating licence violations.[8] These quota concepts are recorded as Daily events quota and Monitored resources quota. The page describes what is displayed. It does not state how an excess is priced.
Data sources
Varonis’ privacy whitepaper says its technology “crawls data sources” for threat detection, data security, compliance and remediation. A customer that adds a corporate generative AI platform as a data source, or uses the Atlas AI licence, causes Varonis to collect, analyse and store the relevant prompts and responses on the platform.[7] The Data source row records this term. It is a description of what the platform connects to, not a published price unit.
Over Usage
The agreement contains an explicit true-up mechanism. If the subscriber’s actual usage exceeds the Authorized Usage (defined as “Over Usage”), the Authorized Usage “shall be updated to reflect and cover” actual usage, and the subscriber must pay the associated subscription fees for the updated Authorized Usage for the remaining portion of the subscription term.[1] Failure to pay, including for Over Usage, gives Varonis the right to terminate immediately and to suspend the service.[1] See Over Usage true-up.
Fees, term and renewal
Fees for the Subscription Services are charged annually in advance, and fees for additional services are invoiced upfront or as a statement of work provides. Varonis reserves the right to update the fees at the end of each subscription period. Except as the agreement expressly states, payments are final and non-refundable.[1] Invoices are payable net 30, in U.S. dollars unless Varonis agrees otherwise, with a late payment charge of 1.5% per month or the legal maximum if lower.[1]
The agreement remains in effect until terminated, while the services remain in effect for the period or periods specified in the relevant Purchase Confirmation.[1] The agreement text reviewed contains no automatic-renewal or notice-of-non-renewal clause, so renewal mechanics, if any, would come from the order document. A reseller transaction adds a separate reseller arrangement, discussed below.
Purchase channels
Varonis sells directly and through resellers. The agreement allows a subscriber to buy through a Reseller under a separate agreement; the Reseller cannot change the agreement or give warranties on Varonis’ behalf, and Varonis has no obligation to provide the service unless it has received a purchase order from the Reseller.[1] The navigation of the Varonis platform page also lists buy links for the AWS, Azure and Salesforce marketplaces.[6] The terms of those marketplace listings are outside the Varonis documents reviewed here. See Reseller order.
Trials and evaluation
Varonis states that all its products have a no-obligation 30-day unlimited free trial.[4] Separately, the agreement lets Varonis grant an Evaluation Subscription for “private preview” or “beta” features. Such access is as-is, without warranties and without liability, for a period Varonis determines, after which the subscriber must stop using it.[1] The rows 30-day free trial and Evaluation Subscription record the two.
Product lines and add-ons
The platform page lists the capabilities Varonis groups into the Data Security Platform, among them data discovery and classification, data security posture management (DSPM), database activity monitoring, data-centric user and entity behaviour analytics, data access governance and data loss prevention, with separate groupings for AI security (Atlas), identity security, Interceptor email and browser security, and managed data detection and response (MDDR).[6] The same page states that all customers receive proactive threat hunting and posture assessments with their SaaS subscription and that MDDR is an upgrade that adds 24x7x365 response to alerts.[6] MDDR is described as having a 30-minute response for ransomware attacks and 120 minutes for all other alerts.[10] Identity Protection was announced in June 2025 as a suite of identity resolution, identity posture management and identity threat detection and response built into the platform.[11] How these items are packaged and priced is not stated in the public documents. The product article lists what each page says.
The move from self-hosted to SaaS
Varonis sold its platform as self-hosted software before its SaaS offering. The legacy product was licensed per platform through a licence site, with counters for licensed users and data that triggered a 30-day grace period when exceeded and enforcement was enabled.[9] In a statement updated on 2025-11-12, the Varonis chief executive said the company had announced the end-of-life of its legacy self-hosted product by December 31, 2026, that the SaaS transition was complete two years early, and that SaaS made up 76% of its business.[5] For remaining self-hosted customers Varonis says it will partner on migration, that a specialist team performs each migration and needs access to the self-hosted environment, and that the SaaS platform, including MDDR and automated remediation, can be used immediately with no gap in protection while the migration runs in parallel.[5] The SLA, by contrast, lists “any migration services” among items not covered by Support Services.[2] A licence manager who holds legacy licences should confirm in writing how the legacy entitlement converts. The statement quoted above does not describe conversion pricing or credit. See Self-hosted end of life and SaaS migration and the legacy licensing article.
Data handling that affects scope
Three data-handling statements bear on how the service is deployed and what a subscriber should plan for.
- Varonis states that its products process metadata, customer content remains in the customer environment, and customer data is retrieved and processed by Collector servers installed in the customer premises, so that only metadata is stored on the platform.[7]
- The default retention of Subscriber Data on the SaaS platform is a sliding window of 180 days during the subscription term, unless Varonis approves a longer period; classification results are kept while the original data source exists; and Subscriber Data held at the end of the term is deleted within up to 30 days after termination.[7]
- At onboarding the platform can be set to operate from the geography the customer chooses.[7]
The agreement treats the subscriber as the owner of Subscriber Data, which it defines as electronic metadata generated in the use of the service, and grants Varonis a licence during the term to use it as reasonably necessary to perform the agreement.[1]
Audit and compliance language
The Subscription Services Agreement reviewed contains no general software-usage audit clause of the kind found in many on-premises licence agreements. Its audit language concerns trade-control compliance: the subscriber must reasonably cooperate with an audit, review or investigation of compliance with the sanctions and export clause and deliver the records Varonis reasonably requests.[1] The agreement’s quantity mechanism is the Over Usage clause described above, which resets the Authorized Usage to actual usage. In the other direction, the DPA says that, on written request and subject to confidentiality, Varonis satisfies customer verification of its data-protection compliance by providing its SOC 2 Type II report and answering questionnaires no more than once a year, and that the customer has no additional right to audit Varonis unless data protection law grants one.[3]
Out of scope
This article does not cover Varonis’ website terms of use, partner programme terms, marketplace listing terms, professional services statements of work, price quotations, or any negotiated order form. It does not describe individual security features beyond what bears on licensing, and it does not state prices, because Varonis publishes none in the documents reviewed.