The Veracode End User Assessment Agreement (EUAA) is the standard contract between Veracode, Inc. and its customers for the Veracode Solutions. It is a master agreement. A purchase happens when the parties enter into one or more Order Forms that reference it, and each Order Form is incorporated into the agreement.[1] The version analysed here carries the identifier 20240610. An earlier click-through version, 6.1 of August 2021, still governs customers who accepted the EUAA before 2022-02-14.[2] Separate documents cover evaluations, technology partners and plug-ins. For the products and metrics, see Veracode licensing.
Editions
The EUAA has no editions. Its key defined terms decide what an Order Form can sell.
| Term | Meaning in the EUAA (version 20240610) |
|---|---|
| Solution | The products stated in an Order Form, including Software, Documentation, the Solution Platform and updates. It excludes Applications, Remediations and Reports.[1] |
| Application | A collection of logically related software components that perform a coordinated set of functions. It may be owned by the customer or licensed from a third party, and is designated for Assessment.[1] |
| Software | Agents, APIs, virtual appliances and e-Learning content provided for use with a licensed Solution.[1] |
| Remediation | A suggested change generated by the Solution after an Assessment. It may take the form of code.[1] |
| Order Form | A mutually signed order, or a customer purchase order that expressly references a Veracode sales order form. It states the Solutions, quantity, fees and Subscription Term. Through a reseller, the Order Form may be between Veracode and the reseller.[1] |
| Users | Anyone the customer grants access to a Solution as the agreement permits.[1] |
The 2024 text adds definitions for Remediations and Third-Party Integrations. The 2021 version has neither.[1][2]
Metrics
The EUAA defines no unit of measure. It defers to “the quantity of Solution(s) ordered” on the Order Form.[1] Veracode documents the units used to track that quantity in its license consumption reports: licences and megabytes per subscription year, and application profiles under the tier model.[6] Catalog: Order Form sets Solutions, quantity, fees and Subscription Term; Application; Megabytes of analysis size.
Counting / floors
Grant. Veracode grants a non-exclusive, non-transferable right and licence, during the Subscription Term, to access and use the Solutions on an Order Form and any associated Software, solely for the customer’s Internal Use.[1] Internal Use excludes use for compensation of any kind.[1] Catalog: EUAA licence is non-exclusive, non-transferable and for Internal Use during the Subscription Term; Internal Use excludes use for compensation.
Affiliates. An Affiliate that signs an Order Form under the EUAA is bound by it, and the customer is responsible for its Affiliates’ compliance.[1] Affiliate means control through more than 50% of voting securities, by contract or otherwise.[1] Catalog: Affiliates ordering under the EUAA are bound by it.
Users and accounts. The customer registers a primary administrative User, who creates subaccounts. Each subaccount has a unique login ID, and the customer is responsible for all its Users.[1] The EUAA does not cap the number of Users. User counts matter only for seat-based products such as Security Labs, described in Veracode DAST, training and platform subscriptions.
Excess use. Veracode may refuse registration of Users who breach the terms. It may also limit or remove access for usage above the Order Form quantity. The customer must pay fees for any use in excess of that quantity.[1] Both the 2021 and 2024 versions contain the same excess-use wording.[2] Catalog: Use above the Order Form quantity is payable.
Virtualization & partitioning
The EUAA has no hardware-based counting. Its Application definition expressly lists virtual machines, containers, serverless functions, network resources and datastores as things a customer may designate for Assessment.[1]
Cloud / BYOL
The Solutions are automated software-as-a-service Solutions running on Veracode’s Solution Platform. The customer provides the systems, servers, software and network needed to connect to them.[1] Applications are supplied in an agreed form, such as executable object code, source code where an Application is only deployed as source, or a URL for a web Application.[1]
Programs
Proof of Value. Evaluations run under the Proof of Value Terms. They grant a limited, non-exclusive, non-transferable licence, for evaluation purposes only, for a period not exceeding the number of days the parties agree.[3] The customer accepts them by clicking “I accept the terms of the Proof of Value”. The acceptable-use list matches the EUAA’s.[3] Catalog: Proof of Value licence is for evaluation only and time-limited.
Technology partners. The Development and Demonstration License Agreement grants partners a royalty-free, non-transferable licence to the Veracode Licensed Programs, for building and testing interfaces with their own products. After Certification, it also covers demonstrations to prospective customers.[5] Partners may not use the programs for internal production use, competitive analysis or benchmarking.[5] Catalog: Partner licence excludes internal production use.
Integrations and plug-ins. Anyone may install a Veracode integration. Using a Veracode solution through it requires a customer or trial agreement, and customers’ use is governed by their customer agreement. Non-customers who install it accept terms that prohibit copying, transfer and reverse engineering.[4] Catalog: Integrations are free to install but need a customer or trial agreement to use.
Support packages. Service levels and response times of support packages are published on Veracode’s technical support page. The content posted there is effective as posted for the entire Subscription Term on the Order Form.[1] That page states that response times vary by support tier.[7] The 2021 version also contained a 99% monthly availability commitment for the Solution Platform. The 2024 version does not.[2][1] Catalog: Support content is fixed as posted for the Subscription Term.
Restrictions
The acceptable-use clause (s.4.4) contains the restrictions most relevant to licence scope. Customers and their Users may not:[1]
- make the Solutions available to unauthorised third parties, or use them to provide services to or for the benefit of third parties, except as the agreement permits;
- perform or disclose benchmark or performance tests, or unauthorised security testing of the Solutions;
- use Remediations to train a large language model;
- modify the Solutions, expose their source code or attempt to recreate them;
- submit health, payment card or similar sensitive data unless the Documentation supports it;
- attribute modified Reports or results to Veracode.
Veracode may also suspend accounts temporarily to mitigate security events or malicious activity.[1] Catalog: No services to third parties; No benchmark or performance tests; Remediations may not be used to train a large language model.
Reports, Remediations and third-party applications
During the Subscription Term, Veracode makes available a Report for each Application Assessed, and Remediations where the Solution provides them. The customer owns each Report and Remediation, subject to Veracode’s ownership of embedded Veracode Property. For that property the customer holds a non-exclusive, transferable, perpetual, worldwide licence for Internal Use.[1] Historical results therefore remain usable after the subscription ends, while the platform does not. Catalog: Reports and Remediations survive the subscription.
When a customer has a third party’s application assessed, Veracode may first require that third party to sign its own agreement. The third party then owns the detailed Report. The customer receives a version of it under a perpetual licence for Internal Use.[1] Catalog: Third party owns the detailed report of its assessed application; Third-party application testing.
Audits and compliance
The 2024 EUAA added a usage-measurement clause that the 2021 version lacks. No more than once a year, on Veracode’s reasonable request, the customer must cooperate in measuring its usage and provide documentation of that measurement.[1][2] The clause sets no audit cost-shifting threshold and no notice period. It works together with the excess-use payment obligation in s.4.4. The customer’s own record is the platform’s license consumption reports, which Security Leads and Administrators can export.[6] Catalog: Usage measurement at most once a year. See software license audit.
Term, termination and exit
The agreement runs from the Effective Date until sixty days after the last Order Form in effect expires.[1] Either party may terminate for a material breach that is notified within 30 days of its occurrence and not cured within 30 days of notice. Ending one Order Form does not affect the others.[1] When an Order Form expires or terminates, the customer must immediately stop using its Solutions. Veracode destroys Applications, Assessment results and Customer Confidential Information on request, or within sixty days after the agreement ends.[1] Catalog: Agreement continues until 60 days after the last Order Form expires; Use stops when an Order Form expires.
Assignment. Neither party may assign without the other’s prior written consent. Veracode may assign in whole to a successor in a merger, asset sale or change of control, or to an Affiliate, without consent.[1] Catalog: Assignment needs prior written consent.
Precedence and law. The EUAA prevails over conflicting Order Form terms unless the Order Form expressly amends it. Terms in customer purchase orders or procurement portals do not apply. The agreement is governed by Massachusetts law, with exclusive venue in the courts of Middlesex County.[1] Pricing and the economic terms are Confidential Information.[1]
Liability. Veracode’s aggregate liability is capped at the amount the customer paid in the twelve months before notice of the first claim. Veracode excludes liability for harm from penetration tests and for the customer’s use of Remediations.[1]
Out of scope
- Negotiated enterprise agreements and government reseller versions of the EUAA.
- Any EUAA version newer than 20240610, if one exists. None was found on Veracode’s public sites on 2026-10-07.
- The Data Processing Addendum and privacy terms, which concern personal data rather than licence scope.
- Product-specific quantities, covered in Veracode Static Analysis and SCA licensing.