Zscaler licensing is the set of contract terms and counting rules under which Zscaler, Inc. sells access to its cloud security services, marketed together as the Zero Trust Exchange. The main services are Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA) and Zscaler Digital Experience (ZDX). Zscaler describes each of them as a Software as a Service (SaaS) product “licensed in various ways”.[3][4] The End User Subscription Agreement (EUSA) grants subscription rights for the quantity of Products in an Order and for the Subscription Term.[1] Separate licensing and fair use articles on the Zscaler Help Portal define the metrics. The most common is the seat, counted as unique individual users over a rolling 90-day period and paired with per-gigabyte monthly traffic thresholds.[3][4][5] Unlike processor and core licensing of installed software, nothing is counted on customer servers: Zscaler counts users, traffic and objects that pass through, or are recorded by, its own cloud. For the general models, see named user licensing and subscription and consumption licensing.
Editions
Zscaler sells a small number of platform bundles and a larger set of standalone products and add-on modules. The Pricing and Plans page names two bundles. The Essentials Platform offers internet access, limited private access and standard versions of other services. The Zscaler Platform adds full private access and inline data security.[7] Both include standard versions of Digital Experience, Data Security, Sandbox, Firewall, Cyber Isolation and “Zero Trust for Workloads (1GB/user/month)”.[7] Zscaler’s data sheets give part numbers for these and related offerings:
| Offering | Part number | What the data sheet says |
|---|---|---|
| Essentials Platform | ZS-ESS-PLATFORM | ZPA for 1 user per 20 subscribed users (minimum 500 subscribed users); 10 App Segments[8][9] |
| Zscaler Platform | ZS-PLATFORM | ZPA for all subscribed users; 20 App Segments[8][9] |
| Zscaler Private Access Platform | ZS-ZPA-PLATFORM | Standalone ZPA; 20 App Segments[9] |
| ZPA Clientless Platform | ZPA-CLIENTLESS-PLATFORM | Browser-based access; extra guest user licences are bought under this part number[9] |
| Zscaler Advanced Platform | ZS-ADVANCED-PLATFORM | Includes ZDX Advanced alongside ZIA, ZPA, Zero Trust Browser, Sandbox Advanced, Segmentation and Deception[15] |
ZPA, SaaS Security, DSPM, Deception, Unified Vulnerability Management, Zero Trust for Workloads, Zero Trust SD-WAN, ZDX Advanced, ZDX Advanced Plus and Device Segmentation are also sold as standalone products that do not need a platform bundle.[7] Earlier Zscaler material used ZIA and ZPA Business, Transformation and Unlimited edition names, and the Privileged Remote Access data sheet still refers to ZPA Business, Transformation and Unlimited Editions.[16] Zscaler publishes no list prices; the ZIA data sheet refers pricing questions to the Zscaler account team.[8] Bundles are described in more detail in Zscaler platform bundles and editions.
Metrics
Each Zscaler product has its own licensing and fair use article, and the metric names differ by product. The table lists the rows in this catalog.
| Zscaler name | Catalog row | Used by | Definition (summary) |
|---|---|---|---|
| Seat | Seat | ZIA, ZPA, ZDX, Zero Trust Browser, Deception, Risk360, SSPM | A subscription license for an individual authorized user, counted over the previous rolling 90 days[3][4][5] |
| Light Customer User | Light Customer User | ZIA, ZPA | A Seat designated as a light or occasional user, with a monthly traffic allowance[6] |
| ZIA Monthly Traffic | ZIA Monthly Traffic | ZIA, Zero Trust Browser, SIPA | Authenticated and unauthenticated traffic uploaded and downloaded via ZIA in a calendar month, in GB[3] |
| ZPA Monthly Traffic | ZPA Monthly Traffic | ZPA | Total traffic uploaded and downloaded via ZPA in a calendar month, in GB[4] |
| Site | Site | Zero Trust SD-WAN, IoT visibility | A site or location subscription[3][4] |
| Workload | Workload | Workload Communications, ZIA, ZPA | A unique domain name, an IP address, or a set of IP addresses[3] |
| Data Center | Data Center | Managed Dedicated IP | The Zscaler data center associated with a subscribed IP pair[3] |
| System | System | Privileged Remote Access | An RDP, SSH, VNC or RealVNC target[4] |
| Bandwidth | Bandwidth (China Premium) | ZIA/ZPA China Premium | Mbps measured on five-minute samples[10] |
Products outside the core three have further metrics: devices, gateways and gateway instances, data stores, assets, tokens, user identities and cellular devices. These are covered in Zscaler workload, branch and consumption metrics.
Counting / floors
Unique users over 90 days (help articles undated, retrieved 2026-09-26). For ZIA, ZPA and ZDX, the number of seats required is the total number of unique individual users over the previous rolling 90-day period.[3][4][5] The seat count is therefore a high-water mark of distinct people, not a count of concurrent sessions. See concurrent and device licensing for the difference. Catalog proof: ZIA seats counted as unique users over a rolling 90-day period, ZPA seats counted as unique users over a rolling 90-day period, ZDX seats counted over 90 days and deployed by selective entitlement.
Who is a user (EUSA last updated 2026-08-01). An Authorized User is “an employee, agent, contractor, or other third party” authorized by the customer or its Affiliates.[1] Contractors and partner staff who use a service therefore count in the same way as employees. Catalog proof: Authorized User includes contractors and third parties authorized by Customer or Affiliates.
Endpoints and traffic caps (undated, retrieved 2026-09-26). Total ZIA endpoints across all seats may not exceed three times the number of seats purchased.[3] ZIA fair use expects average monthly traffic per purchased seat to stay below two times the cloud-wide average, currently 8 GB per seat per month, plus any purchased bandwidth. Unauthenticated traffic above that level needs a bandwidth subscription.[3] The ZPA threshold is two times a cloud-wide average of 3 GB per seat per month.[4] Catalog proof: ZIA endpoints may not exceed three times the seats purchased, ZIA fair use: average monthly traffic below twice the cloud-wide average, ZPA fair use: average monthly traffic below twice the cloud-wide average.
Light Customer Users (last updated 2025-08-15). A customer may designate some seats as Light Customer Users. Each Light seat carries an allowance of 1 GB of monthly traffic for ZIA or 0.5 GB for ZPA.[6] If the allowances are exceeded by more than 10%, the customer must reduce bandwidth, buy more seats or traffic, or upgrade light users to regular seats. If none of these happens within 90 days of notification, Zscaler or the Partner may invoice from the notification date.[6] Catalog proof: Light Customer User allowances and remediation after 10% overage.
Overage (EUSA last updated 2026-08-01). If usage exceeds the quantities in the Order, including usage limits set out in the Documentation, the customer agrees to “promptly purchase the additional quantities being used”.[1] Because fair use thresholds and usage limits are part of the Documentation, this clause is what makes them commercially binding. Catalog proof: Usage above purchased quantities must be purchased promptly.
Virtualization & partitioning
Zscaler’s metrics do not depend on hosts, processors or virtual machines for its SaaS products. Virtual environments matter in three places. First, a workload can be a virtual machine, VDI, serverless function or container-based resource, and is counted as a unique domain name, IP address or set of IP addresses.[3] Second, since 19 April 2024 the Workload Communications policy has been replaced by the ZIA and ZPA policies and their Workload metric.[11] Third, Zscaler-provided hardware stays Zscaler property, may not be relocated without approval, and must be returned within 21 calendar days after the Subscription Term ends.[14] Catalog proof: Workload Communications policy replaced by ZIA and ZPA Workload metric, Hardware remains Zscaler property and must be returned within 21 days of term end.
Cloud / BYOL
The services run in Zscaler’s own multi-tenant cloud, so there is no bring-your-own-license mapping to hyperscaler compute. The EUSA makes the customer responsible for forwarding traffic to Zscaler through valid forwarding mechanisms (PAC, IPsec, GRE tunnels or the Zscaler App).[1] Some entitlements depend on location. The ZIA data sheet lists access to “High-Cost” public data centres as a Zscaler Platform feature, and lists China Premium and regulated Middle East data centre access separately.[8] ZIA and ZPA China Premium are licensed by purchased bandwidth in Mbps, measured at the 95th percentile of five-minute samples.[10] A Managed Dedicated IP pair is licensed per data centre and cannot be moved to another one during the subscription.[3] Catalog proof: ZIA China Premium: P95 accounting and 130% burst limit, Managed Dedicated IP pair cannot move to another data center.
Programs
- Orders and partners (EUSA last updated 2026-08-01). Products are bought through an Order. Unless otherwise agreed in writing, fees and payment terms are set between the customer and the Partner.[1] Rights are limited, non-transferable and non-exclusive, and cover the customer’s internal business purposes.[1] Catalog proof: Fees and payment terms are set with the Partner, Subscription rights limited to internal business purposes and purchased quantity.
- Term and renewal (EUSA last updated 2026-08-01). The Initial Subscription Term runs for the period stated in the Order. It is renewed by subsequent Orders, and the Agreement “will automatically expire when there is no active Order”.[1] Catalog proof: Orders run for the stated term and renew only by subsequent Orders.
- Light Customer Users (last updated 2025-08-15), a lower-traffic seat type for ZIA and ZPA.[6]
- Support Services packages (last updated 2026-09-21). Standard Support is included in Product fees. Essential, Support Plus, Premium Support Advanced and Premium Support Advanced Plus cost extra.[2]
- SLA Service Credits (last updated 2026-09-21). ZIA, ZPA and ZDX each commit to 99.999% availability. Credits run from 3 to 30 days of fees, are capped at 30 days per month and cannot be taken as refunds.[2] Catalog proof: Service Credits: claim within 24 hours and 10 days, capped at 30 days of fees.
- Evaluation Products (EUSA §12.8). Free access for internal evaluation during an agreed period.[1]
- EOS and EOL Policy (effective 2017-08-01). At least 90 days’ notice before a SaaS product reaches End-of-Sale, and End-of-Life at least one year after that.[13]
Audits and compliance
The retrieved EUSA contains no audit or verification clause.[1] Instead, each product licensing article states that Zscaler “periodically reviews” the relevant counts. For ZIA, these are the number of seats, sites and workloads and the amount of monthly traffic.[3] This review is based on Zscaler’s own service telemetry. The EUSA defines Systems Data, which includes product usage data, as Zscaler Materials.[1] All usage must also follow the Acceptable Use Policy. That policy is incorporated into the Agreement, and Zscaler reserves the right to monitor use and suspend access for violations.[12] In practice, a Zscaler license compliance position comes from comparing admin-portal user and traffic counts against the Order. It is not an installation inventory, and a shortfall is closed by buying more under EUSA §4.2, in effect a true-up. Catalog proof: Zscaler periodically reviews seats, sites, workloads and traffic for license compliance, Acceptable Use Policy is incorporated and Zscaler may monitor use.
The EUSA also restricts penetration and load testing without prior written consent, and bars public benchmarking without express prior written consent.[1] Assignment without consent is allowed only to an Affiliate, or in a merger or asset sale that does not involve a direct competitor.[1] Catalog proof: No public benchmarking or penetration testing without consent, Assignment only to an Affiliate or in a merger not involving a competitor.
Out of scope
- Prices and discounts. Zscaler publishes none on its own domains, and third-party reseller or government price lists are not vendor documents.
- The U.S. Government and Japan Government versions of the EUSA, the Data Processing Agreement, the AI Addendum and the Data Act Addendum.
- Product-specific hardware terms beyond the general Hardware Usage Terms.
- Partner programme terms (reseller, MSP) and services such as Deployment Services and Services Credits.
- Guidance on software license audits generally. The EUSA has no audit clause.
Catalog rows
Catalog rows for this article, grouped by table.
- Metrics
- SKUs
- Programs
- Rules
- ZIA seats counted as unique users over a rolling 90-day period
- ZIA endpoints may not exceed three times the seats purchased
- ZIA fair use: average monthly traffic below twice the cloud-wide average
- ZPA fair use: average monthly traffic below twice the cloud-wide average
- Light Customer User allowances and remediation after 10% overage
- Usage above purchased quantities must be purchased promptly
- Subscription rights limited to internal business purposes and purchased quantity
- Authorized User includes contractors and third parties authorized by Customer or Affiliates
- Orders run for the stated term and renew only by subsequent Orders
- Fees and payment terms are set with the Partner
- No public benchmarking or penetration testing without consent
- Assignment only to an Affiliate or in a merger not involving a competitor
- Zscaler periodically reviews seats, sites, workloads and traffic for license compliance
- Workload Communications policy replaced by ZIA and ZPA Workload metric
- Hardware remains Zscaler property and must be returned within 21 days of term end
- Service Credits: claim within 24 hours and 10 days, capped at 30 days of fees
- Acceptable Use Policy is incorporated and Zscaler may monitor use
- Evaluation Products only for internal evaluation
- End-of-Sale notice of 90 days and End-of-Life at least one year later