I. DEFINITIONS:
1. SitecoreAI Essentials
“Asset Storage” means the storage and retention of file-based assets in SitecoreAI including but not limited to images, videos, document files, data models, prompts, embeddings, and other digital content created, processed, transformed, or managed by SitecoreAI or its agentic components. This is measured across all modules of SitecoreAI, including (but not limited to) in the CMS and DAM modules.
“CDN Use” means the distribution and delivery of digital content (including web assets such as HTML pages, JavaScript files, stylesheets, images, media assets and Gen AI generated or agent-assembled outputs) through Sitecore Content Delivery Network (“CDN”). It is tracked based on the total amount of data transmitted and metered on the SitecoreAI CDN facility, including delivery initiated by automated or agentic processes. This is measured across all modules of SitecoreAI, most notably in the CMS and DAM modules, and any Gen AI-powered or agentic delivery services.
"Non-Production Environments” means the total number of non-production environments included in or provisioned under the customer’s SitecoreAI subscription, used for testing, development, staging or training purposes only.
“Production Environments” means the total number of production environments included in or provisioned under the customer’s SitecoreAI subscription, used for live, customer-facing, or business-critical operations.
"Experience Interaction” means any instance in which the SaaS Product dynamically personalizes, delivers, or responds to a user’s activity, profile, or context across digital channels. Examples include, but are not limited to, search queries, personalized content, recommendations, messages, or offers. “Experience Interactions” also include system-triggered, agentic, or user-defined events configured within the application, such as custom actions, signals, or API calls that initiate or record a personalized or contextual response.
2. CMS:
“Visit” means an instance in which an application (including, without limitation, a website, mobile application, or other software application running on a digital device) presents, uses, accesses, or otherwise leverages any content, data, or functionality originating from (whether accessed directly or indirectly) the SaaS Product.
For clarity, “indirectly” includes use of SaaS Product-originated content served from intermediate storage or delivery layers (e.g., cache/CDN), including where the SaaS Product is not contacted at the time of use.
For the purposes of this definition, a Visit may originate from
(i) Browser Activity,
(ii) Identified Non-Browser Activity, or
(iii) Unidentified Non-Browser Activity,
Each as defined below.
(i) Browser Activity means (a) direct human browser visits; or (b) indirect browser visits or requests made through web integrations, including but not limited to RSS feeds, iFrames, browsing agents or similar mechanisms that emulate browsing behavior, including agents that emulate browsing behavior.
For purposes of Browser Activity, a Visit shall be deemed to commence when such application first interacts with the SaaS Product and shall be deemed to conclude upon the earliest to occur of:
- continuous activity for more than 12 hours from commencement;
- more than two hundred (200) Rendered Page Events occurring within a session
- the closure or termination of the application session.
For clarity, a single session may give rise to more than one Visit where the applicable Visit conclusion rules are triggered more than once during that session.
For clarity, Browser Activity leads to a “Browser Visit”
(ii)
Identified Non-Browser Activity means non-browser, automated access to the CMS where the source of the activity can be identified and attributed (for example, indexing, discovery, aggregation, cataloguing, marketplace listing, or AI training/inference), and where the automated client:
- is identifiable and consistently discloses its identity (e.g., via user agent and/or other technical signals); and
- originates from a verifiable source.
For purposes of Identified Non-Browser Activity, a Visit shall be deemed to commence when such application first interacts with the SaaS Product and shall be deemed to conclude upon the earliest to occur of:
- continuous activity for more than 12 hours from commencement;
- more than two hundred (200) Rendered Page Events occurring within a session
- the closure or termination of the application session.
For clarity, a single session may give rise to more than one Visit where the applicable Visit conclusion rules are triggered more than once during that session.
For clarity, Identified Non-Browser Activity leads to a “Non-Browser Visit”.
(iii) Unidentified Non-Browser Activity means non-browser activity for which the source cannot be reliably identified or attributed.
For purposes of Unidentified Non-Browser Activity, each two hundred (200) Rendered Page Events will be counted as one (1) Visit.
For clarity, Unidentified Non-Browser Activity leads to a “Non-Browser Visit”.
Classification precedence: If an event could fall into multiple categories identified above, the terms and calculations related to Browser Activity prevail, then Identified Non-Browser Activity, then Unidentified Non-Browser Activity.
“Rendered Page Event” means a metering event recorded when an application renders for display a discrete user-facing page, screen, or view that presents, uses, or leverages content, data, or functionality originating from the CMS, whether accessed directly or indirectly.
In addition to the above, the classification and the treatment of Identified Non-Browser Activity and Unidentified Non-Browser Activity, whether such activities constitute billable Visits, shall be determined by Sitecore.
Distributed Denial-Of-Service (DDoS) attack
A Distributed Denial-Of-Service (DDoS) attack means a coordinated attempt to disrupt or degrade the availability, performance, or normal operation of Customer-controlled web applications, websites, APIs, or services that integrate with or operate as an upstream layer to the Sitecore SaaS Products, by generating an unusually high volume of automated requests from multiple sources over a concentrated period of time.
A DDoS attack shall be deemed to commence at the time of the first malicious request or traffic attributable to such attack (the “DDoS Commencement”), as reasonably determined from available logs, monitoring data, or other technical evidence. A DDoS attack will be assessed and treated as occurring within a single, continuous period not to exceed twenty-four (24) consecutive hours commencing from the DDoS Commencement and traffic attributable to such attack outside of that twenty-four (24) hour period shall constitute a separate DDoS event and not be considered part of the same DDoS attack.
Customer will not owe overages for any Visits or Experience Interactions that Customer can demonstrate were caused by distributed denial-of-service attack (DDoS), or similar automated malicious web traffic not involving actual human interaction, provided that (i) Customer has taken industry standard measures to prevent such malicious web traffic; and (ii) in the case of DDoS attack, an attack must not have lasted for more than a 24 hour period.
Tracking Rules for CMS Visit:
a) SDK Tracking
(i) Implementation of SDK: Customer shall implement and maintain the applicable version of the Sitecore Content SDK, including any required tracking or metering components, for the purpose of Visit tracking. The Sitecore Content SDK includes, or may be used with, the tracking and metering components required to support Visit-level measurement.
Sitecore may provide the Sitecore Content SDK in one or more editions, configurations, or feature sets, as described in the Documentation.
Sitecore may, from time to time, update, enhance, or replace the Sitecore Content SDK, provided that any such updates do not materially degrade the performance or functionality of the SaaS Product.
(ii) Mandated Use: Customer shall deploy and maintain an operational version of the Sitecore Content SDK, including any required tracking or metering components, within its implementation of the SaaS Product as a condition of continued access to Visit-level analytics and reporting functionality. Sitecore may, by written notice or Documentation update, specify the minimum version of the Sitecore Content SDK that Customer must use, including any required tracking or metering components (the “Mandated Version”).
(iii) Performance and Compatibility: The Mandated Version shall be designed such that its implementation does not materially slow load speeds or interfere with the performance of the Customer’s environment when used in accordance with Sitecore’s Documentation and applicable implementation guidance.
c) Non-SDK Tracking.
Notwithstanding the foregoing, if Customer elects not to implement the Content SDK, disables any required tracking or metering components, or implements them in a manner that does not permit reliable Visit measurement, usage will be calculated by reference to the number of Content Requests recorded by Sitecore.
Specifically, one (1) Visit will equal seventy-five (75) Content Requests for Customer’s digital properties and use cases, including, without limitation, websites, applications, mobile, aggregator sites, and other channels or experiences, whether such activity would otherwise be attributed to Browser Activity or Non-Browser Activity.
For purposes of this section, a “Content Request” means a request or metering event recorded by Sitecore for content, data, or functionality originating from the SaaS Product, whether served directly by the SaaS Product or indirectly from intermediate storage or delivery layers, including cache, CDN, edge, replication, or other delivery mechanisms.
3. Agentic Studio
“Custom Agent” means any software or AI-driven agent (including a bot, model, workflow, or automation) that is (a) developed, configured, or supplied by Customer or a third party on Customer’s behalf, and (b) integrated with, or permitted to interact with, Sitecore Products and Services via any API, SDK, connector, plug-in, webhook, or other interface, and (c) not provided or supported by Sitecore. Custom Agents are used at Customer’s sole risk.
“Builder Seat” means a permission-based role within the Sitecore Agentic Studio that grants an individual the ability to create and configure Custom Agents.
4. DAM
“Power User” means the total number of registered users who can manage and modify the following within the DAM: assets, content/content types, product, custom content, campaigns/collections and metadata. This includes the actions create, update, add, delete, lock, submit, publish, archive. Power Users can also execute the same action types (where relevant) on the following within the operations tools of the DAM: projects, project types, workflows, tasks and task types. A user is considered a Power User if they have permission to do one or more of these activities.
“Consumers” means the total number of registered users who can view and download the following in the DAM: assets, content, product, custom content, campaigns/collections. Consumers can also share assets and make content/asset approvals within workflow tasks. All Consumers will have permission to add/update comments. A user is considered a Consumer if they have permission to do one or more of these activities. A Consumer shall include any employee of Customer whose primarily role within Customer’s organisation is not website administration or a third party whose role is to upload materials to Customer’s Sitecore platform.
Managed Content Objects” or “MCOs” means the total number of distinct Content Objects, as defined below, that are made available as part of the DAM capability of the SaaS Product. A Content Object is made available as part of the DAM capability of the SaaS Product where, depending on the applicable SaaS Product configuration, such Content Object is either (a) made available for use within a distinctly provisioned DAM Application, DAM Tenant, or equivalent DAM environment, or (b) designated, governed, or otherwise elected by Customer for inclusion within the DAM capability through any applicable DAM governance functionality of the SaaS Product.
For clarity, a Content Object constitutes an MCO only where such Content Object is made available for use within Customer’s provisioned DAM capability of the SaaS Product, and not solely because such Content Object is stored in, synchronized to, or otherwise present within any shared underlying application, tenant, repository, or infrastructure used by the SaaS Product.
“Content Object” means a distinct, business-meaningful content entity, including, as applicable, file-based digital assets such as images, videos, audio files, documents, and design files; content items such as articles, blogs, and other editorial or atomic content; structured content records such as product items; and custom entity records or similar customer-defined content entities. For purposes of the Managed Content Object metric, a distinct Content Object is defined by a single persisted content entity with a unique system identifier within the applicable DAM capability of the SaaS Product.
A Content Object is counted once as the primary content entity and does not include additional versions, revisions, renditions, derivatives, transformations, metadata, tags, classifications, workflow steps, approvals, delivery events, or other technical or operational artifacts associated with that entity.
Environments. MCOs are counted across Customer’s Production and Non-Production environment(s). A Content Object made available for use in more than one environment is counted separately in each such environment. For example, if the same Content Object is made available for use in both a Production environment and a Non-Production environment, it constitutes 2 MCOs
II. TRACKING RULES:
Experience Interaction
- SitecoreAI Essentials: Only instances that return content are counted as Experience Interactions.
- SitecoreAI Tiers 1 and above: Every instance is counted as an Experience Interaction, whether or not the SaaS Product returns content.
This distinction allows Customers to configure usage rules or consumption management policies within the Essentials entitlements.
CMS Visit:
a) Implementation of SDK
Customer shall implement Sitecore’s analytics software development kit (the “Analytics SDK”) for the purpose of Visit tracking. Sitecore may offer two versions of the Analytics SDK, as follows:
- a Visits tracking Only version, designed solely to capture Visit-level metrics; and
- a full analytics version, designed to capture both Visit-level metrics and extended analytical data.
Sitecore may, from time to time, update, enhance, or replace the Analytics SDK, provided that any such updates do not materially degrade the performance or functionality of the SaaS Product.
b) Mandated Use Customer shall deploy and maintain an operational version of the Analytics SDK within its implementation of the SaaS Product as a condition of continued access to Visit-level analytics and reporting functionality. Sitecore may, by written notice, specify the minimum version of the Analytics SDK that Customer must use (the “Mandated Version”).
c) Performance and Compatibility. The Mandated Version of the Analytics SDK shall be designed such that its implementation does not materially slow load speeds or interfere with the performance of the Customer’s environment when used in accordance with Sitecore’s documentation.
If Customer elects not to implement the Analytics SDK, usage will be calculated by reference to the number of content requests, as captured in Sitecore system logs.
III. GOVERNANCE AND AMENDMENTS
Sitecore may, from time to time, update the Visit Definition or Visit tracking methodology described in this Schedule for legitimate business or technical reasons, including to reflect industry standards or product enhancements. Any material change that impacts billing shall be communicated to Customer in writing not less than thirty (30) days in advance.