August 2, 2010
VIA EDGAR
Christy Adams, Senior Staff Accountant
Division of Corporation Finance
United States Securities and Exchange Commission
100 F Street, NE
Washington, DC 20549-3561
| Re: | Commtouch Software Ltd. |
Form 20-F for the Fiscal Year Ended December 31, 2009
Filed March 26, 2010 (the “Filing”)
File No. 0-26495
Dear Ms. Adams:
Further to your letter to the undersigned dated July 13, 2010 and our letter of July 20, 2010 in which we notified you of our intention to respond to your letter before August 5, 2010, below please find our detailed response. For your convenience, your original comment appears in bold text, followed by our response.
Form 20-F for the Year Ended December 31, 2009
Revenue Recognition, page F-12
1. We refer to you revenue recognition policy. You indicate that you consider each sale as a service arrangement, since the software portion of the product sold cannot effectively stand on its own. To help us better understand the basis for your revenue recognition policy, please tell us about the material provisions associated with a typical sales arrangement, describing the products and/or services provided, how your products are delivered to and accepted by your customers and how you recognize revenue during the term of the contract. Please tell us about any cancellation, termination or refund provisions in your contracts and describe how these affect revenue recognition.
Response:
The services we provide and channels through which we provide them:
Commtouch Software Ltd. (Commtouch or the Company) is a provider of messaging and Web security solutions to a wide array of customers and OEM distribution partners.
-2-
Our solutions include:
1) Real-time Anti-spam Service – provides full spam identification and spam classification to our customers, and we provide both inbound (i.e. spam entering the organization) and outbound (i.e. spam exiting an organization) services to our customers.
2) Zero-Hour Virus Outbreak Protection Service - provides customers with the ability to block malware, including email borne viruses, in real time, at the moment the initial attack occurs.
3) GlobalView Mail Reputation Service - decides which email sender traffic to allow to enter the organization and which to block, based on the senders’ IP address reputation.
4) URL Filtering Service - provides categorization of web sites on the Internet, allowing users to enforce usage policies such as organizational surfing policies and parental control.
At the core of Commtouch’s messaging solutions (services 1 – 3 above) is Commtouch’s proprietary Recurrent Pattern Detection (RPD)™ technology which, in general terms, analyzes in real time messages associated with mass email outbreaks and directs the blocking of such emails, without the need to analyze individual messages. At the core of Commtouch’s URL filtering solution is the Company’s ability to analyze large volumes of user surfing behaviors and provide categorization of websites in accordance with the filtering needs of websites per the customer’s request.
We utilize various third party distribution channels to sell our solutions. Generally, our offerings are provided to OEM customers or service providers, who in turn offer our services to their end customer base. Our services are generated from various Detection Centers, which are strategically situated worldwide and managed by our operations team (mostly remotely). These services are enabled after our OEM customers and service providers complete what is typically a simple integration of a Software Development Kit (or “SDK”) into their product or service offerings, allowing our Detection Centers to communicate with these products/services in the hands of our customers’ end customers. The SDK is delivered to customers over the Internet.
We also sell our services to enterprises (“Enterprise Gateway services”) (9% of revenues for the year ended December 31, 2009), mainly through resellers. The Enterprise Gateway services are substantially identical to the solutions described above, though we do not provide outbound spam protection or URL Filtering Services through the Gateway. It should be noted that there is no need for a Gateway customer to integrate the SDK into a third party product or service; rather the customer simply downloads Commtouch’s Gateway SDK and connects to the Detection Centers with a dedicated key provided by Commtouch.
U.S. Office: 292 Gibraltar Drive, Ste. 107 Sunnyvale, CA 94089 Tel: 650-864-2290 Fax: 650-864-2006 | International Office: 4A Hazoran Street (P.O. Box 8511) Poleg Industrial Park Netanya, Israel 42504 Tel: 972-9-8636888 Fax: 972-9-8636863 |
-3-
How our services are delivered to and accepted by our customers:
The Detection Centers noted above are at the heart of Commtouch’s services. They are made up of various forms of computer equipment (i.e. servers, routers, etc.), which contain all of the know-how and data bases required for Commtouch’s services to function properly, including the latest threats relevant to our services (i.e. current spam, virus and IP address trends in the messaging industry, and URL related threats (i.e. phishing, virus infested websites, etc.) in the Web security industry). As our Detection Centers constitute the core of our services, we employ a number of processes aimed at protecting their operation and availability, including firewalls, 24/7 monitoring and back-up systems. Access to the Detection Centers from products located worldwide (through either the SDK or Gateway SDK) is controlled by Commtouch with dedicated keys for each service. In addition, Commtouch provides its customers technical support over the service term (i.e. help desk updates and upgrades to the SDK, if and when available). Technical support is not priced separately and is not provided or sold on a standalone basis. This technical support is viewed by the customer as part of the entire service offering provided over the term of the contract.
Our OEM and service provider customers can buy a right to utilize one or more of our solutions. The control of user access to our services occurs by providing a dedicated key to the customer per service. The key is sent to the customer via email. In substantially all cases, our customers are provided access to our services prior to making a purchase in order to evaluate the quality of the service. Therefore, OEM and service provider customers integrate the SDK and test our solutions using a “trial” (temporary) key that we provide them prior to ordering the service. Once the customer decides to order the service, the trial key is replaced by a “Production” (permanent) key. Therefore, our contracts do not include customer acceptance provisions.
Material provisions associated with a typical sales arrangement (including termination, cancellation and refund provisions):
A typical OEM or service provider sales arrangement is as follows: Deliverables include an SDK and dedicated keys to connect to Commtouch’s Detection Centers, as well as technical support for the service term. Our service contracts are generally for a term of one to three years. Commtouch is paid service fees under a variety of fee structures:
| 1) | Fixed fee per user/mailbox or per product/service sold, based on monthly/quarterly reports received from the customer. |
| 2) | Non-refundable flat fee, which is paid on a periodic basis over the term of the agreement. |
| 3) | Non-refundable flat minimum commitment fee (up to a fixed number of users/mailboxes, etc.), which is paid on a periodic basis over the term of the agreement, plus incremental fees (“excess fees”) payable on a per user/mailbox etc. basis only if the OEM customer exceeds the minimum commitment user threshold as pre-defined in the agreement. The fees are generally paid monthly or quarterly over the service term. |
U.S. Office: 292 Gibraltar Drive, Ste. 107 Sunnyvale, CA 94089 Tel: 650-864-2290 Fax: 650-864-2006 | International Office: 4A Hazoran Street (P.O. Box 8511) Poleg Industrial Park Netanya, Israel 42504 Tel: 972-9-8636888 Fax: 972-9-8636863 |
-4-
All payments made are non-refundable and no refund provisions or adjustments to price exist in our contracts. Per our agreements, in the event that our customers decide to cancel or terminate the contract for convenience, the due date of all amounts due for the remaining term of the contact shall automatically be accelerated to become due on the date of termination.
Revenue recognition during the term of the contract:
As described above, the service component of our solution (i.e. our Detection Centers) is considered the key element to the functionality of the solution, and the software component is incidental to the solution. We have considered whether our arrangements contain a software element that is within the scope of ASC 985-605, Software Revenue Recognition.
ASC 985-605-55 (formerly paragraph 5 of Emerging Issues Task Force 00-3 - “Application of AICPA Statement of Position 97-2 to Arrangements That Include the Right to Use Software Stored on Another Entity's Hardware”), Issue 2, discusses whether ASC 985-605 applies to arrangements that include software and hosting services. The Task Force concluded that ASC 985-605 only applies to hosting arrangements when “…it is feasible for the customer to either run the software on its own hardware or contract with another party unrelated to the vendor to host the software.” In our case, the software element is used only as a service enabler to the Detection Centers. The services can only be provided if the SDK has a valid key and is connected to the Company’s Detection Centers, where the analysis and classification of the data takes place on an ongoing basis to provide real-time protection against those Internet threats noted above. Therefore, there is no utility value to the SDK without the services provided by the Detection Centers. When software cannot be used on a standalone basis or with another party unrelated to the vendor, the arrangements are outside the scope ASC 985-605 and are deemed service contracts. As the SDK cannot function on a standalone basis, the Company considers each sale as a service arrangement in accordance with Staff Accounting Bulletin (SAB) Topic 13, Revenue Recognition. Based on the above analysis, the Company determined that the arrangement should be recognized in accordance with SAB Topic 13.
Since our arrangements have multiple deliverables (i.e. SDK and services ), they fall within the scope of ASC 605-25, Revenue Recognition- Multiple-element Arrangements. ASC 605-25 establishes three criteria, all of which must be met, in order for a deliverable to qualify as a separate unit of accounting as follows: 1. the delivered item(s) has value to the customer on a standalone basis; 2. there is objective and reliable evidence of fair value of the undelivered item(s); and 3. if a general right of return exists relative to the delivered item, delivery or performance of the undelivered item(s) is considered probable and substantially in the control of the vendor. In our case, since the SDK for all of our solutions has no standalone value to the customer since it is not sold separately by any vendor (or by Commtouch) and the customer cannot resell it on a standalone basis, and there is no objective and reliable evidence of fair value of the services, the deliverables are accounted for as one unit of accounting and the revenues are recognized from the services over the respective service term.
U.S. Office: 292 Gibraltar Drive, Ste. 107 Sunnyvale, CA 94089 Tel: 650-864-2290 Fax: 650-864-2006 | International Office: 4A Hazoran Street (P.O. Box 8511) Poleg Industrial Park Netanya, Israel 42504 Tel: 972-9-8636888 Fax: 972-9-8636863 |
-5-
We recognize revenues from the services provided when persuasive evidence of an arrangement exists, services are provided, the fee is fixed or determinable and collectability is probable. Revenues derived from these services are recognized ratably over the life of the service period, commencing on the date the service is made available to the customer and the agreement signed.
In accordance with Question 2 of SAB Topic 13, revenues from services should be recognized on a straight line basis, unless evidence suggests that the revenue is earned or obligations are fulfilled in a different pattern, over the contractual term of the arrangement or the expected period during which those specified services will be performed, whichever is longer.
For arrangements of a fixed fee per user/mailbox/product sold/etc., revenues are recognized straight-line over the respective service term on a per unit basis, based on periodic reports received from the customer during the term of the agreement. For arrangements with a flat fee, revenues are recognized on a straight-line basis over the term of the contract. For arrangements with a minimum commitment (plus excess fees), the services are recognized ratably over the term of the arrangement (straight line method), as this is deemed the most appropriate service revenue recognition method and most accurately reflects the way revenues are earned. This is due to the fact that the Company provides a service over a fixed term and is entitled to the minimum commitment fees, regardless of how many users/mailboxes/products utilize such service. In addition, the excess fees (if applicable) are also recognized on a straight line basis over the respective service term based on customer reports received by the Company.
It should be noted that in Note 2 (k) on page F-13 of our 2009 financial statements included in the Filing and on page 17 of Item 5 of the Filing, it incorrectly states that our revenues are recognized in accordance with ASC 605, rather than SAB Topic 13 due to a clerical error. In our future filings, this error will be corrected.
In connection with our response above, we acknowledge that:
| · | the Company is responsible for the adequacy and accuracy of the disclosure in the Filings; |
| · | staff comments or changes to disclosure in response to staff comment do not foreclose the Commission from taking any action with respect to the Filing; and |
| · | the Company may not assert staff comments as a defense in any proceeding initiated by the Commission or any person under the federal securities laws of the United States. |
U.S. Office: 292 Gibraltar Drive, Ste. 107 Sunnyvale, CA 94089 Tel: 650-864-2290 Fax: 650-864-2006 | International Office: 4A Hazoran Street (P.O. Box 8511) Poleg Industrial Park Netanya, Israel 42504 Tel: 972-9-8636888 Fax: 972-9-8636863 |
-6-
Should you have any questions regarding the above, please feel free to contact me at the address below for the Israeli office, on my cell phone (972-54-2001111) or by email: ron.ela@commtouch.com. Please note that I will be away travelling for the next few weeks, so please copy Gary Davis, our General Counsel, at the numbers below for the US office or by email: gary.davis@commtouch.com.
Sincerely,
/s/ Ron Ela
Ron Ela
Chief Financial Officer
Commtouch Software Ltd.
U.S. Office: 292 Gibraltar Drive, Ste. 107 Sunnyvale, CA 94089 Tel: 650-864-2290 Fax: 650-864-2006 | International Office: 4A Hazoran Street (P.O. Box 8511) Poleg Industrial Park Netanya, Israel 42504 Tel: 972-9-8636888 Fax: 972-9-8636863 |