Snyk dropped its 5% renewal cap and added an AI training exception

The change

Snyk updated its Terms of Service twice in six weeks. The first update, in early August, rewrote how renewals and overages are billed. The second, dated September 18, 2026, added an exception to Snyk's promise about AI training and removed a reseller carve-out from auto-renewal.

These terms govern Snyk's self-serve plans and any order form that references them. Companies on a separately signed Snyk agreement, such as its Master Services Agreement, should check that document instead. Venpo caught both versions and compared each one clause by clause against the text it replaced.

What changed

Across the two updates, six changes affect what a Snyk customer pays or what Snyk can do with their data:

• Renewal price cap. The old terms said Snyk "may increase the Subscription Fees for each Renewal Term by no more than 5%." That sentence is gone, and renewals now move to "Snyk's then current rates."

• Credit pricing at renewal. For credit-based plans, the September update adds that Snyk's "then-current rate card applicable to Credits" applies at renewal.

• Overages. Customers who went over their plan used to get 30 days to reduce usage, and customers who ran out of credits got 30 days of good-faith negotiation. Both windows are gone, and extra usage is now invoiced "periodically in arrears" at current rates.

• AI training. Snyk still promises not to use your AI inputs to train its models, but the promise now ends with an exception for training that is "provided for you" and "not shared with other customers or third parties."

• Reseller purchases. The terms used to say that for purchases made through a reseller, "this Agreement will not auto-renew." That clause was deleted.

• Late payments. The 10-day window after a payment default notice, before Snyk can cut off access or terminate, now counts calendar days instead of business days.

The AI promise now has an exception

Snyk's AI Compliance clause used to be a flat commitment: Snyk would not use, or let anyone else use, customer inputs "to train, enhance or improve any AI Models" in its services. Inputs are any customer data a user puts into Snyk's AI features, and customer data expressly includes the code being scanned.

The September text keeps that sentence and adds an exception. Training or improvements are allowed when they are made for that customer, are not shared with other customers or third parties, and otherwise follow the agreement. In practice, the wording describes a model tuned on one customer's inputs and used only for that customer, not a general model trained on everyone's code.

Those limits are real, and the contract still permits something it did not permit before. Snyk's own documentation on generative AI says Snyk does not use customer proprietary code to "train, optimize, fine-tune, or improve any AI models," and the same page says customers' agreements with Snyk are what govern. The contract now allows customer-specific training that the documentation says Snyk does not do. AI training language is one of the clauses we see edited most often, from Mixpanel removing its AI data opt-in to GitBook deleting a one-sentence promise from its AI policy.

Renewals and overages now follow current rates

The billing changes came first, in the August update. Before it, a customer on these terms could plan a renewal with a ceiling of at most 5% more than the prior year. Now the renewal price is whatever Snyk's current rates are, and for credit plans, whatever the current credit rate card says.

Overages changed the same way. The old terms gave customers 30 days to bring usage back under their plan, or to negotiate more credits, before extra charges applied. The new terms skip that step: Snyk can invoice extra usage afterwards at current rates, and customers on a self-serve plan can have those charges billed to their card. Snyk's pricing page describes the same model, where usage past the prepaid credits is tracked as on-demand consumption and invoiced in arrears.

Two protections stay in place. An order form or service plan can still set different renewal pricing, because the renewal clause applies "unless otherwise set forth" there. And a customer can still stop a renewal by sending notice at least 30 days before the term ends. Prices that follow the vendor's current list are the same pattern we covered when DigitalOcean made its prices self-updating.

Reseller purchases and late payments

Buying Snyk through a reseller used to come with a clear line: payment terms followed the reseller agreement, and the Snyk agreement "will not auto-renew." The September update deleted the auto-renewal part. Payment still runs through the reseller, but nothing in Snyk's terms now keeps a reseller purchase out of the default one-year auto-renewal, so the reseller agreement and the renewal date both need a look.

The late-payment window also got shorter in practice. After a notice of payment default, Snyk can disable access or terminate if payment is not made within 10 days. It used to be 10 business days, so weekends and holidays no longer stretch the deadline.

What paid customers can still do

Snyk's terms give paid customers a way to push back on an update. If a customer reasonably objects, the terms call for a good-faith discussion. If nothing is agreed within 30 days of Snyk receiving the objection, Snyk either does not apply the update to that customer or lets them terminate without liability and refunds prepaid fees for services not yet delivered.

Timing matters. By default, updated terms take effect 30 days after they are posted, and continuing to use Snyk after that counts as accepting them. For the September 18 version, that puts the practical window at around October 18, unless Snyk's notice to customers set a different date.

Why this matters

Snyk sits close to the code. It scans repositories, containers, and infrastructure files, and its AI features take code snippets as input. For security and engineering teams, a no-training promise is often part of how a tool like this passes review, and a price cap is part of how its renewal gets budgeted.

None of this is visible in the product itself. It lives in the contract text, which is why an edit like this is easy to miss without automated monitoring of the terms. Keeping a current view of which vendors can use your data for AI, and on what conditions, is the same discipline as monitoring AI subprocessors.

Potential impact

For a SaaS company using Snyk, the two updates raise four practical questions:

• Does your order form set its own renewal pricing, or will your next renewal follow Snyk's current rates?

• If you use credits, how close are you to running out, now that usage past the balance is billed automatically?

• Does your own AI policy, or a promise you made to customers, say your code is never used to train a vendor's models, and does customer-specific training fit inside that?

• If you bought through a reseller, when is the renewal date, and who on your team needs to send notice 30 days before it?

How Venpo detected it

Venpo monitors Snyk's legal pages as part of continuous vendor risk monitoring. It flagged the August rewrite on August 5 and the September update on September 18, the day the new version was posted, with every inserted and deleted clause marked. Both redlines are public: the September changes and the August changes. Every monitored Snyk document is listed on the Snyk vendor profile.

Business outcome

Teams using Snyk got a plain-English account of both updates within a day of each version going live, with every point tied to the exact inserted or deleted text. For the September changes, that leaves time to check order forms, credit balances, and renewal dates, and to raise an objection before the update takes effect. The alternative is finding the new pricing on the renewal invoice.

Key takeaway

In six weeks, Snyk's terms lost a 5% renewal cap and two 30-day overage windows, and its AI training promise gained an exception. Each change is narrow on its own, but together they give Snyk more room on pricing and data use than its terms allowed in July, and that difference only shows up for teams monitoring the terms themselves.