Varonis self-hosted licensing refers to the way Varonis licensed the software that customers installed and operated themselves, before and alongside its SaaS platform. The primary public sources are the release notes of the Metadata Framework, the common back end of the self-hosted products. Two sets are used here, version 6.2.85 (publication date March 29, 2017) and version 6.3.190 (September 27, 2017).[1][2] Their licensing sections describe a licence site on which licences are selected per platform, counters for licensed users and data, and the behaviour of each component when a licence enters a grace period or expires. The release notes are about nine years old and describe versions that have since been superseded, so they show the design of the legacy model and not the contract terms of any current self-hosted agreement. Varonis announced the end-of-life of its self-hosted product by December 31, 2026.[3]
Readers who still hold self-hosted licences, or who inherit documentation from them, will find the same vocabulary in older entitlement records: platforms, licensed users, data counters, grace periods, Lite and full licences, and permanent and evaluation licences.
Components and platforms
The Metadata Framework release notes refer to a set of products built on it. Those that appear in the licensing sections are:[1]
| Component | Role described in the release notes |
|---|---|
| DatAdvantage | Core product; licences are selected per platform (for example Windows, Unix, SharePoint, SharePoint Online, OneDrive) |
| DatAlert and DatAlert Analytics | Alerting; DatAlert Analytics needs its own licence |
| Data Classification Framework (DCF) | Classification; licences per platform, requiring the matching DatAdvantage licence; DCF Lite licence for importing external files |
| DatAnswers | Search over scanned data; licences per platform |
| Automation Engine | Has evaluation and permanent licences, with evaluation limitations that a licence site administrator can enforce or remove |
| Data Transport Engine | Copying and archiving data; supported for Windows and on-premises SharePoint only |
The licence site is a web location where licensed capabilities are selected and configured. Roles with access to it include a License Site Admin and a License Site Support Admin.[1]
Licence identification
From version 6.3.102 the License Configuration page of the Varonis Setup Wizard lets an administrator enter the customer’s ID for validation, in place of an email address. The customer ID is shown together with the serial number supplied by Varonis.[1] For a licence manager the serial number and customer ID are the identifiers to record against a self-hosted entitlement.
Licensed users and data counters
The release notes describe two counters, licensed users and data. Their behaviour is stated in a short section headed “Licensed Users and Data Counters”:[1]
- If the Enforce users number or Enforce size data options are selected and the counters exceed their configured limit, a 30-day grace period begins.
- If those options are cleared, the Metadata Framework remains as it was before the grace period.
- In both cases mail alerts are sent about pending licence expiration.
- If the counters return to their configured limit, the grace period is cancelled.
- Folders and users can be set as unmonitored in the Management Console so that the configured limit is not exceeded.
This is the self-hosted analogue of the SaaS Over Usage clause, but with opposite mechanics. In the self-hosted model, an excess triggered a technical enforcement path that an administrator could turn off, or avoid by changing what was monitored. In the SaaS agreement an excess is a billing event: the Authorized Usage is updated to cover actual usage and the subscriber pays for the remainder of the term.[5] See Data counter (self-hosted), Licensed users and the Licence grace period row.
Varonis’ purchasing page states that it licenses on user count and does not charge according to the amount of data.[4] The 2017 release notes nevertheless describe a data counter and an Enforce size data option. A licence manager reading older entitlement documents should therefore expect that a self-hosted licence record may contain a data-size limit even though Varonis’ current purchasing statement is expressed in users.
Per-platform licences
Licences were bought per platform. The 6.3.50 changes made DCF and DatAnswers licences installable per platform and allowed DatAnswers to be installed without a valid DatAdvantage licence. A DCF licence could be purchased for Windows and SharePoint, Unix, SharePoint Online, or OneDrive, and “when a DCF license is selected for a particular platform in the license site, the corresponding DatAdvantage license must also be selected.”[1] Version 6.3.102 added several dependencies:[1]
- DatAlert Analytics requires a separate licence from standard DatAlert, and can be purchased only together with a standard DatAlert licence.
- DatAlert can be selected only if a licence with auditing capabilities (for example Windows, Unix or SharePoint Online auditing) is selected.
- OneDrive for Business requires a licence separate from SharePoint Online; the OneDrive licence is required to add OneDrive file servers through the Management Console.
- The DCF Lite licence, required to import files from external sources, received enforcement improvements.
- The number of days set for the SharePoint Online full licence cannot exceed the number of days set for the SharePoint Online Lite licence.
- The Data Transport Engine is supported for Windows and on-premises SharePoint only, and the corresponding DatAdvantage licences must be selected.
In the Office 365 changes the notes describe Lite and full licences. The SharePoint Online and OneDrive full licences include auditing and event collection. They are separate from the Office 365 Lite licences, which provide bi-directional visibility only, and must be purchased separately; a full licence can be purchased only if the matching Lite licence is purchased. The DatAdvantage Lite licence supports Office 365 Lite licences only, not full ones.[1]
For a licence manager, the key lesson is that a self-hosted entitlement was a bundle of linked licences, each with its own platform and its own number of days. Counting installed components without the dependency rules would misstate compliance either way: for example, a DatAlert deployment depended on an auditing-capable DatAdvantage platform licence, and a DCF deployment depended on the DatAdvantage licence of the same platform.
GDPR Patterns and Automation Engine licences
Version 6.3.185 introduced a GDPR Patterns licence, required to use GDPR predefined patterns and rules in the Data Classification Framework and to retrieve classification results based on GDPR content. It requires a valid DCF licence, cannot be purchased separately, and needs at least one valid DCF platform. During its grace period scanning and indexing continue and the patterns remain visible. After it expires, the patterns and predefined GDPR rules are no longer shown, GDPR-related rules are disabled (user-defined rules continue to be displayed), and “all classification results retrieved by using GDPR content” are deleted.[1] The deletion of results on expiry is the sharpest consequence described in the notes, since it removes data already produced.
The same version let licence site administrators enforce or remove the limitations of the Automation Engine Evaluation licence through an Enforce limitations checkbox, selected by default and visible only to the License Site Admin and License Site Support Admin roles. The notes say the option is not relevant for customers with a permanent Automation Engine licence.[1]
Grace periods and expiry
The 2017 notes describe, component by component, what happens when a platform licence reaches the end of its configured number of days. For DCF, the Data Classification Engine continues to run during the grace period, with folders scanned and classified on existing rules, and stops when the licence expires; the DCF configuration window and monitor remain available in grace but cease to be available on expiry; the DatAdvantage interface stops showing special files and classification hit counts for the platform.[1]
For DatAdvantage evaluation licences, version 6.2.3 (documented in the 6.2.85 notes) extended the grace period to 30 days. During the grace period crawling, event collection and jobs continue, and if a platform is purchased during that time all events from it become available in the interface and reports. After the grace period crawling and event collection cease, and if a platform is purchased afterwards “all events performed following license expiration will be lost.”[2] For expired file servers the folder structure is no longer available in the DatAdvantage interface, historical data from them ceases to be available in all reports, and DatAlert does not send alerts for expired resources; the interface remains available while at least one platform remains licensed.[2]
These behaviours matter for audit trails. Under the 2017 behaviour a lapse in a self-hosted licence could mean permanent loss of event history, not merely a pause in access to it. For evaluation licences the notes state that email notifications about pending expiry go to the system administrator, and for the counters that mail alerts are sent, so the notification mailbox is a control point for tracking renewals.[2]
From licence site to the SaaS licence page
The SaaS platform replaced the licence site with a product page. A January 2024 release summary introduced a license information page, available to Enterprise Manager and System Admin roles, that shows the licence expiration date, the platforms covered, “available quotas for daily events and monitored resources”, a breakdown of daily usage and alerts about licence violations.[7] The quota concepts differ from the self-hosted counters, and the SaaS agreement’s definition of Authorized Usage, which names accounts, data, folders and events tracked or monitored, is broader than the user and data counters of the 2017 notes.[5]
End of life and migration
Varonis announced the end-of-life of its legacy self-hosted product by December 31, 2026. It describes the SaaS transition as having finished two years early, with SaaS at 76% of its business, and says that over the following year it will partner with remaining self-hosted customers on migration. According to Varonis, a dedicated specialist team handles each migration, needing only access to the self-hosted environment, and customers can start using the SaaS platform immediately, including MDDR and automated remediation, with no gap in protection while the self-hosted migration proceeds in parallel.[3]
Documents consulted say nothing about the treatment of existing self-hosted entitlements, such as credits, conversion ratios or the status of permanent licences, at migration, so these are matters to settle in writing with Varonis. Three formal points are visible in the public documents:
- The SLA gives Support Services only for the current and available version of the Subscriber Program and excludes services announced as End of Life and “any migration services”.[6]
- The SaaS agreement is a new contract with its own Authorized Usage, fees charged annually in advance and Over Usage mechanism.[5]
- Cloud sources that were separate offerings, such as DatAdvantage Cloud, announced in early access in June 2023 for AWS, Box, GitHub, Google Drive, Jira, Okta, Salesforce, Slack and Zoom, were already cloud-hosted and are not part of the self-hosted model.[8]
See Self-hosted end of life and SaaS migration.
Out of scope
This article does not cover current self-hosted contract terms, if any remain in force under older end-user licence agreements that Varonis has not published at the addresses reviewed; versions of the Metadata Framework other than 6.2.85 and 6.3.190; maintenance and support terms for self-hosted software; prices; or the technical features of the products beyond what bears on licensing.