Terms of Use and Sale

The Supplier:

• Trackflaw, SAS au capital de 1000€
• RCS Paris 928 024 389 00019
• Registered office: 60 rue François 1er, 75008 Paris
• TVA : FR34928024389
• Email: contact@flawfence.com
• Phone: 07 45 23 64 02
• Director: Thibaud ROBIN

The Supplier has developed and provides the Flawfence service, a cybersecurity solution accessible in SaaS (Software as a Service) mode allowing external asset mapping operations and vulnerability scanning to be carried out.

Access to and use of the Service imply the Customer's unreserved acceptance of these Terms.

• Service: Means the Flawfence software solution, provided in SaaS mode by the Supplier and accessible over the internet, together with its components, its application programming interfaces (API), its associated documentation, and any update or new version.
• Subscription: Means the non-exclusive, non-transferable and revocable right to access and use the Service, granted to the Customer for a fixed term in consideration for payment of the agreed price.
• Target: Means any information system, network, server, application, IP address, domain name or any other IT asset that the Customer intends to analyse by means of the Service.
• Customer Data: Means all data entered by the Customer on the Platform, as well as the results, reports and information generated by the Service on the Customer's behalf.

The purpose of these Terms is to define the conditions under which the Supplier grants the Customer a right of access to and use of the Flawfence Service, in consideration for payment of a Subscription.

4.1. Warranty of authorisation

The Customer represents and warrants that it holds the necessary legal authority (ownership or written authorisation) for each analysis initiated via the Service on a Target.

The Customer undertakes to retain proof of this authorisation and to provide it to the Supplier upon simple request, or to any competent authority.

4.2. Prohibited uses

The Customer is strictly prohibited from:

• Using the Service to scan, probe, or interact with any Target for which it does not hold authorisation compliant with Article 3.2
• Using the Service for malicious purposes, such as preparing an attack, espionage, denial of service, data exfiltration or any other illegal activity
• Using the information obtained via the Service to cause harm, to exploit vulnerabilities without the Target owner's consent, or to disclose them publicly without following a responsible disclosure process

4.3. Exclusive responsibility

The Customer is solely and entirely responsible for the configuration of the analyses, the choice of Targets, and the consequences of its actions. It is responsible for any direct or indirect damage that may result from the use of the Service on a Target, even an authorised one.

4.4. Indemnification

The Customer undertakes to defend, indemnify and hold the Supplier harmless from any liability regarding any claims, actions, losses, damages, or costs (including attorneys' fees) arising from the Customer's breach of the terms of these Terms, and in particular from any use of the Service not compliant with Article 3.

5.1. Supplier ownership

The Supplier remains the exclusive owner of all intellectual property rights attached to the Service. The Subscription entails no transfer of ownership to the Customer. The Customer is prohibited from decompiling, disassembling, reverse-engineering, modifying, renting, lending or distributing the Service.

5.2. Ownership of Customer Data

The Customer is and remains the exclusive owner of the Customer Data. The Supplier undertakes not to use this data for any purpose other than those strictly necessary for the provision, maintenance and support of the Service.

6.1. Obligation of means

The Supplier undertakes to exercise all due diligence and care necessary to provide a quality Service, in accordance with the practices of the profession and the state of the art.

This is an obligation of means. The Supplier does not warrant that the Service will find all existing vulnerabilities, nor that the results of the analyses will be free of errors or false positives.

6.2. Exclusion of liability for use

The Supplier may under no circumstances be held liable for illegal or unauthorised uses of the Service by the Customer. The Supplier provides a tool; responsibility for its use rests entirely with the Customer.

6.3. Indirect damages

Under no circumstances shall the Supplier be liable for indirect damages, such as loss of profits, loss of data, commercial prejudice, or business interruption, resulting from the use of or inability to use the Service.

6.4. Liability cap

In any event, should the Supplier's liability be engaged under the performance of these Terms, its total and cumulative liability, on all grounds combined, shall be limited to the total amount excluding taxes paid by the Customer to the Supplier under the Subscription during the twelve (12) months preceding the event giving rise to the damage. This limitation does not apply to bodily injury, nor in the event of wilful misconduct or gross negligence by the Supplier.

7.1. Customer account data

The Supplier, as data controller, collects and processes the personal data of the Customer's contact (name, email, billing information) for account management, billing and the commercial relationship, in accordance with the GDPR and its privacy policy.

7.2. Data processed via the Service (Sub-processing)

For any personal data that may be discovered or collected on Targets during use of the Service, the Customer acts as Data Controller and the Supplier acts as Data Processor, on the Customer's instructions.

8.1. Term

These Terms take effect on the date the Customer subscribes to the Subscription for the chosen term (monthly or annual). Unless terminated by either party under the conditions set out below, the Subscription is renewed by tacit renewal for periods of the same duration.

8.2. Termination by the Customer

The Customer may terminate its Subscription at any time upon simple request. Termination shall take effect at the end of the current Subscription period (monthly or annual) and shall not give rise to any refund for the remaining period.

8.3. Termination by the Supplier

The Supplier reserves the right to suspend or terminate the Subscription automatically, without notice or compensation, in the event of a serious breach by the Customer of its obligations, in particular those defined in Articles 3 and 4, or in the event of an uncured payment default.

8.4. Consequences of Termination

Upon termination of the Subscription, the Supplier shall maintain access to the Customer's account for a period of thirty (30) days to allow it to export its Data. After this period, the Supplier shall permanently delete all Customer Data.

The Supplier provides technical support relating to the use and operation of the Service. The service levels, guaranteed response times and maintenance policy are described in the Service Level Agreement (SLA) available on the Supplier's website, which forms an integral part of these Terms.

These Terms are governed by French law.

In the event of a dispute relating to the interpretation or performance of these Terms, and failing an amicable settlement, exclusive jurisdiction is granted to the Courts of Paris, notwithstanding a plurality of defendants or third-party proceedings.

11.1. Free trial period

Upon request and at the Supplier's sole discretion, trial access may be granted to new Customers for a period of fourteen (14) calendar days from the date the Supplier opens access.

During this period, the Customer benefits from access to all Service features, under the same conditions of use and responsibility as those defined in these Terms. Access is provisioned by the Supplier's teams following a prior exchange with the Customer.

At the end of the trial period, access to the Service is automatically suspended. To continue using the Service, the Customer must subscribe to one of the subscription offers proposed by the Supplier, according to the terms agreed with the latter.

No payment will be charged at the end of the trial period without an explicit contractual agreement between the parties. The trial period is non-renewable and may only be granted once per Customer.

11.2. Rates and offers

The rates applicable to the Service usage licence are expressed in Euros and are understood to be exclusive of tax (excl. VAT). VAT at the rate in force on the date of invoicing will be applied in addition.

11.3. Payment methods

Payment is made in advance, according to the periodicity chosen by the Customer upon subscription (monthly or annual). Payment is made by bank transfer or any other means of payment offered by the Supplier.

For tacitly renewed subscriptions, the Customer expressly authorises the Supplier to automatically charge the amount of the fee to the payment method provided, at each new billing period. An invoice will be issued, made available to the Customer and sent by email.

11.4. Payment default

In the absence of full payment on the due date, and after a formal notice sent by any written means (in particular by email) that remains without effect for a period of eight (8) calendar days, the Supplier reserves the right to:

• Suspend the Customer's access to the Service until its situation is fully regularised
• Automatically apply late-payment penalties calculated on the basis of three (3) times the statutory interest rate in force, as well as a fixed indemnity for recovery costs in the amount of forty (40) euros
• Terminate the subscription at the exclusive fault of the Customer

11.5. Price revision

The Supplier reserves the right to modify its rates. Any price change will be notified to the Customer by email at least thirty (30) days before it takes effect.

The Customer will have the option to refuse this increase by terminating its subscription before the new rates come into effect, in accordance with the termination conditions set out in Article 8. Failing termination within this period, the new rates will be deemed accepted by the Customer.

11.6. Payment conditions

Issuance of invoices:

• For the annual subscription: A single invoice is issued on the subscription or renewal date, covering the fixed fees for full access for the coming year
• For the monthly subscription: The fixed portion is invoiced in advance (at the start of each month). The variable portion (unit costs of scans) is invoiced in arrears, on the basis of the actual consumption recorded

Payment deadlines: Payment is due from the Customer upon receipt of the invoice for payments by credit card or direct debit. In the case of payment by bank transfer, the maximum payment period is set at thirty (30) calendar days from the invoice issue date.

Proof of consumption: The Customer acknowledges that the computer records of the Service's internal measurement system (scan logs) shall be authoritative for calculating the variable portion of the monthly invoices.

12.1. Acceptance

Access to the Service is conditional upon the Customer's prior acceptance of these Terms. This acceptance is formalised by signing the purchase order or quote issued by the Supplier, or by any other contractual means agreed between the parties (email, electronically signed document, etc.).

The Customer acknowledges having read these Terms and their appendices before any subscription. The opening of access by the Supplier constitutes confirmation of the contractual agreement.

The Customer's representative who signs or validates the subscription declares that it is authorised to bind the Customer and acknowledges that these Terms are enforceable against it.

12.2. Modification

The Supplier reserves the right to modify these Terms at any time. Any new version will be notified to the Customer by email at least thirty (30) days before its effective date. Continued use of the Service after this date constitutes acceptance of the new Terms. Otherwise, the Customer may terminate its subscription according to the terms set out in Article 8.