The Varonis Subscription Services Agreement is the standard contract for the Varonis SaaS Data Security Platform. It is a click-through agreement between the subscriber and Varonis Systems, Inc. “and its subsidiaries and affiliates”, and it covers the web-based cloud security solution, the collector software installed in the subscriber’s environment, and the support and additional services Varonis provides.[1] The agreement contains no price and no quantity. It points to a Purchase Confirmation for both, which makes the order document the most important commercial record a licence manager holds. This article follows the agreement’s own order and cites section numbers as they appear in the PDF reviewed on 2026-10-08, which carries no date.
Key definitions
| Term | Meaning in the agreement | Section |
|---|---|---|
| Authorized Usage | “the usage metric(s) and factor(s) identified in the applicable Purchase Confirmation”, which may include the number of individuals who have an account on monitored systems or environments, or the data, number of folders and events tracked or monitored | 1.3 |
| Subscriber Program | The object code of the service application made available to be installed on the subscriber’s computing device or environment and used solely with the Subscription Services | 1.4 |
| Purchase Confirmation | The purchase confirmation issued by Varonis which lists the products and services to be provided; each is subject to the agreement | 1.8 |
| Subscriber Data | “electronic metadata generated in the course of the use of the Subscription Services and the Services” | 1.10 |
| Subscription Services | Varonis’ web-based cloud solution offered on a SaaS basis; the Subscriber Program and its Updates are an integral part | 1.11 |
| Services | Support Services and Additional Services (for example professional services, penetration testing services and forensic services) | 1.1, 1.9, 1.12 |
All rows are drawn from [1]. The catalog rows for Authorized Usage and Purchase Confirmation quote these definitions.
Licence grant
Section 2.1 states that, subject to payment of all applicable fees when due, Varonis grants the subscriber a “non-exclusive, non-transferrable, non-sublicensable, limited license to access and use the Subscription Services during the subscription period” in the Purchase Confirmation. The service may be accessed “solely for Subscriber’s internal business purposes”, in accordance with the Documentation, and for the Authorized Usage purchased.[1] Section 2.2 adds a second grant: the subscriber may install the Subscriber Program solely in its own computing device or environment and use it solely as required to use the Subscription Services during the subscription period.[1] Because the collector software is licensed only for use with the service, it has no independent value after the subscription ends. Varonis states that customer data is processed by Collector servers installed in the customer premises.[4]
Varonis keeps ownership of the service. Section 7.1 states that it owns all right, title and interest, including intellectual property rights, in the Subscription Services, the Services and the Documentation, and that no rights are granted by implication, estoppel or otherwise except the limited right to access and use the service.[1]
Over Usage
The last sentences of section 2.2 set out the true-up. If the subscriber’s actual usage of the Subscription Services exceeds the Authorized Usage, defined as “Over Usage”, “the Authorized Usage shall be updated to reflect and cover Subscriber’s actual usage”. The subscriber is then “required to pay the associated subscription fees for the updated Authorized Usage for the remaining portion of the subscription term”.[1] Three consequences follow from the text:
- The measure of compliance is actual usage against Authorized Usage, and the agreement treats the gap as a charge to pay rather than a breach to cure.
- The updated quantity covers the remaining part of the current term only; the agreement does not say how the updated quantity carries into a later term, which the Purchase Confirmation or a renewal quote would address.
- Unpaid Over Usage fees feed the termination and suspension rights described below.
The agreement does not define a notice period, a cap on the uplift, or a pricing rate for Over Usage. The Over Usage true-up program row records the clause.
Restrictions
Section 4.1 lists what the subscriber must not do, and not permit others to do, with the Subscription Services.[1] The list includes:
- licensing, sublicensing, selling, reselling, renting, leasing, transferring, assigning, lending, distributing, time sharing, operating “as a service bureau”, or otherwise making the services available for access by third parties;
- security scanning or penetration testing, or any use that adversely affects other subscribers;
- “any commercial use” of the services, or granting a third party any right to use them, and using them to develop or operate products or services intended to be offered to third parties;
- reverse engineering, copying, creating derivative works, or removing proprietary notices;
- publishing benchmarking or performance data or any comparative study or analysis of the services; and
- circumventing security-related or access-related features, or contesting Varonis’ intellectual property rights.
The subscriber is responsible for the equipment needed to connect, for the security of its accounts and passwords, and for all activity through the service, and must notify Varonis within 48 hours of any known or suspected breach of security or unauthorized use of a password or account.[1] For a managed service provider or a subsidiary arrangement the prohibition on making the service available to third parties is the clause to test: the agreement allows use for “internal business purposes” and the defined term Affiliate (section 1.2) appears in the indemnity, confidentiality and limitation-of-liability clauses but not in the licence grant. Anyone relying on affiliate use should seek written confirmation in the Purchase Confirmation.
Section 4.6 applies export controls and sanctions: the subscriber may not install the client program or access the service in, or on behalf of, a Restricted Country or Restricted Party. Becoming a Restricted Party is a material breach, and Varonis may terminate immediately without prior notice.[1] This section also contains the agreement’s only audit language: the subscriber must reasonably cooperate with an audit, review or investigation of its compliance with applicable laws as set out in that section and deliver the records Varonis reasonably requests.[1]
Fees and payment
Section 8 sets the payment mechanics.[1]
| Topic | Provision |
|---|---|
| Billing cadence | Fees for the Subscription Services are charged annually in advance; additional services are invoiced upfront or under a signed statement of work |
| Fee changes | Varonis may update the fees at the end of each subscription period |
| Refunds | Payments are final and non-refundable except as expressly stated |
| Payment terms | Net 30, or other terms agreed to comply with financial sanctions; U.S. dollars unless Varonis agrees otherwise |
| Late payment | 1.5% per month on any outstanding balance or the legal maximum, plus collection expenses; suspension or termination is possible |
| Taxes | Not included; the subscriber bears sales, value added, withholding, digital economy and similar taxes and grosses up withholding |
The agreement states that both parties intend to treat the services as services for tax purposes and that the subscriber will not take a position inconsistent with that classification.[1] Payment may be made to Varonis or to an authorised reseller (section 8.1).
Term, termination and suspension
Section 9.1 says the agreement remains in effect unless terminated under its terms, while the Subscription Services and Services remain in effect for the periods specified in the Purchase Confirmation. The agreement does not contain a renewal clause, so renewal terms and any notice dates are matters for the order document.[1]
Varonis may terminate on thirty days’ written notice if the subscriber materially breaches and does not cure within thirty days, or becomes insolvent and the proceeding is not dismissed within thirty days. In two cases Varonis “reserves the right to terminate this Agreement immediately”: a breach of section 4, and a failure to pay fees in due course, “including without limitation, for Over Usage”.[1]
On expiry or termination the subscriber must stop using the service. If Varonis terminates in accordance with the agreement, all outstanding fees, “including for committed future periods as set forth in the Purchase Confirmation”, become immediately due.[1] This acceleration clause makes the committed term in the Purchase Confirmation a financial exposure and not only a service period.
Section 9.4 gives Varonis a separate right to suspend the service if payment is overdue (including for Over Usage), if suspension is necessary because of a breach of sections 2.1 or 4, to avoid material harm to Varonis or other subscribers, or because law or a governmental entity requires it.[1] The SLA excludes suspension and termination from the availability commitment.[3]
Data, privacy and feedback
The subscriber (or its licensors) owns the Subscriber Data. The subscriber grants Varonis a worldwide, non-exclusive, royalty-free, fully paid-up licence during the term, and during any retrieval period identified in Varonis’ privacy policy, to use that data as reasonably necessary to perform the agreement.[1] Personal Data within Subscriber Data is processed under the Data Processing Addendum, which the agreement calls an integral part of it.[1] The DPA says that accepting the main agreement accepts the DPA, and that after expiry or termination Varonis deletes or returns Personal Data in its possession unless law requires retention.[2] The privacy whitepaper gives the default retention of Subscriber Data as a sliding window of 180 days during the term, with deletion within up to 30 days after termination.[4]
Section 7.3 grants Varonis a worldwide, perpetual, irrevocable, royalty-free licence to use feedback, such as comments and suggestions, for any business purpose, including incorporating it into products.[1] The subscriber also agrees under section 4.5 that it alone is responsible for ensuring that its use of the service, including the provision of Subscriber Data, complies with applicable law including privacy law.[1]
Evaluation, private preview and beta
Section 12 lets Varonis, at its sole discretion, grant a limited right to access the service or to use new features presented as “private preview” or “beta” for trial and evaluation. The period is set by Varonis and may be extended. Such an Evaluation Subscription is as-is, without warranties and without any obligation to provide Services, and without liability; at the end of the Evaluation Period the subscriber must stop using it, and agrees to receive promotional and support communications during and after the period.[1] The SLA excludes these offerings from Support Services and allows Varonis to change or discontinue them without notice or to charge fees if they are fully released.[3]
Warranty, liability and risk allocation
Varonis warrants that during the subscription period the service will conform in all material respects to the Documentation; the sole remedy is to remedy or replace the non-conformance in accordance with the SLA.[1] It disclaims other warranties, states the service is not intended as a storage, backup or archiving service, and excludes liability for loss or corruption of data. Its liability is limited, among other ways, to the fees it received for the Subscription Services in the twelve months preceding the event giving rise to the claim.[1] The subscriber, by contrast, indemnifies Varonis under section 5 for third-party claims arising from a violation of section 4 or from claims that Subscriber Data, a non-Varonis service or equipment infringes or misappropriates third-party rights or violates privacy rights or laws.[1]
Section 13.10 states that the service is not designed for high-risk activities or for “containing or processing financial or other similar restricted or sensitive data that is regulated under law”, with GLBA given as an example, and that Varonis disclaims warranties of fitness for those activities.[1] A subscriber in a regulated sector should read this section alongside the DPA before onboarding data sources.
Miscellaneous terms that affect licence management
- Amendment (13.3). Varonis may amend the agreement, including incorporated terms, policies and documents, at any time by posting amended terms at a web address accessed by signing in to a MyVaronis account. Amendments apply from the effective time, and continued use constitutes acceptance. A variation by the subscriber is valid only if in writing and signed by both parties.[1]
- Assignment (13.4). The subscriber may not assign, transfer or sublicense the agreement without Varonis’ prior written consent; Varonis may assign without consent.[1] Mergers, divestitures and migration between group companies therefore need Varonis’ consent where the subscription itself must move.
- Publicity (13.1). Varonis may refer to the subscriber as a customer and use its name and logo, including in public filings and marketing materials.[1]
- Third-party software (13.7). The service may contain third-party components, and some services contain software provided by Oracle that is subject to additional provisions on a Varonis help page.[1]
- Law and forum (13.8). New York law, excluding conflicts rules, and exclusive jurisdiction of the federal or state courts located in New York, New York; the UN Convention on Contracts for the International Sale of Goods, the Uniform Commercial Code and UCITA are excluded.[1]
- Reseller orders (13.16). The subscriber may buy through a Reseller under a separate arrangement. The Reseller cannot change the agreement, Varonis has no obligation to provide the service unless it has received the Reseller’s purchase order, and Varonis may share Subscriber Data with the Reseller about Authorized Usage. If the Reseller fails to pay Varonis because the subscriber has not paid the Reseller, the termination provisions apply.[1] See Reseller order.
- U.S. government end users (13.13). The service and Documentation are treated as commercial computer software and commercial computer software documentation under FAR 12.212(a) and DFARS 227.7202-1(a).[1]
Points for a licence manager
The following points derive from the text and are commentary, not contractual advice.
- Obtain every Purchase Confirmation. It, and not the agreement, states the metric, the quantity and the subscription period.
- Track actual usage against Authorized Usage. The agreement converts overage into a charge for the remainder of the term and links non-payment to termination and suspension.
- Treat the committed term as a liability: on termination by Varonis, fees for committed future periods fall due.
- Monitor the amendment page. Terms can change by posting, and continued use is acceptance.
- Check consent needs before restructuring: assignment requires Varonis’ written consent.
Out of scope
This article does not cover the legacy self-hosted licence terms, which Varonis described under separate release notes; the website terms of use; negotiated agreements that supersede the standard text; the terms of marketplace listings; or the individual features of the platform.