General Terms and Conditions of Sale

1. Service Provider

The PentestLouis service is published and provided by GROUPE ALRIC, a single-shareholder simplified joint-stock company (SASU) with share capital of €311,000, whose registered office is located at 17 place Richard Baret, 75017 Paris, registered with the Paris Trade and Companies Register (RCS) under number 751 736 166, intra-EU VAT number FR26751736166 (hereinafter the “Provider”).

Commercial and contractual contact: support@pentestlouis.com.

2. Scope

These general terms and conditions of sale (the “Terms”) apply to any paid access to PentestLouis services and to any purchase of analysis credit. They prevail over the Customer’s purchasing terms, unless otherwise agreed in writing. Any special terms, quotes or purchase orders that have been accepted prevail over the Terms in the event of a conflict.

The service is reserved for individuals or legal entities contracting for the purposes of their professional activity (the “Customer”). The person who creates an account, accepts the Terms or places an order represents that they have the authority required to bind the Customer. PentestLouis does not accept orders placed in a consumer capacity.

3. Description of the Services

PentestLouis provides an automated security analysis platform that can, in particular, examine a code repository, its dependencies and secrets, certain configuration elements and a web surface, and then produce findings, scores, reports or attestations. Some analyses use artificial intelligence models and third-party technical providers that are identified in the interface before the analysis is launched.

The features, scope, prerequisites, maximum budget and, where applicable, the limitations specific to each analysis are presented in the interface before it is confirmed. Free features may be modified or discontinued and do not constitute a commitment to permanent provision.

4. Customer Authorization and Obligations

The Customer undertakes to analyze only systems, domains, applications, repositories and data that it owns or for which it holds prior, express and sufficient authorization. The Customer remains solely responsible for the scope it designates and for obtaining authorizations from its own customers, hosting providers, service providers and rights holders.

• provide accurate information and keep its access credentials and contact details up to date;
• protect its means of authentication and promptly report any unauthorized access;
• not use the service to attack a third party, circumvent a security measure or commit an unlawful act;
• back up its systems and data before any active analysis;
• review the results and have them validated before any sensitive decision or production deployment.

The Provider may request any proof of authorization and immediately suspend an analysis in the event of reasonable doubt, risk to a third party or breach of these Terms.

5. Account and Formation of the Contract

Access to certain features requires an account linked to an organization. The Customer chooses the amount of its top-up, checks the summary and the applicable taxes, accepts the Terms and then confirms its payment on Stripe’s secure interface. The contract is formed when the payment is confirmed. A confirmation and an invoice are then made available in the billing area.

For each paid analysis, the Customer selects its scope and spending cap, then confirms the launch. This confirmation constitutes the order to perform the service.

6. Prices and Taxes

Prices are stated in euros. The final price and its tax treatment are those displayed in the Stripe summary before payment. Value added tax and any other applicable tax are calculated based on the billing information provided by the Customer and the regulations in force.

For an analysis, the amount chosen is a cap and not a flat fee that is always due. The cost actually debited corresponds to the consumption measured by the platform, up to the confirmed cap. Estimates of depth, duration or coverage are indicative. No discount is granted for early payment.

7. Analysis Credit

Any paid top-up credits an internal account denominated in euros. This credit is a right to use PentestLouis services: it is neither electronic money nor a bank deposit, bears no interest and may not be assigned or transferred.

When an analysis is launched, the chosen cap is reserved. Only the actual cost is debited upon completion; the unused portion becomes available again. If the analysis is stopped by the Customer, reaches its cap or covers only part of the scope, the consumption already incurred remains due and the result may be partial.

Except in the case of a billing error, a legal obligation or the Provider’s written agreement, purchased credits are not refundable in cash. Deleting the account results in the permanent loss of the remaining balance. Promotional credits or credits granted free of charge may be subject to special conditions and are never refundable.

8. Payment and Invoicing

Card payments are processed by Stripe using the methods offered at the time of the order. The Provider does not receive the full card number. Credit is added only after irrevocable confirmation of the payment. In the event of a rejection, cancellation, suspected fraud or chargeback, the Provider may suspend the account and cancel the corresponding credit, without prejudice to any amount already consumed.

Where deferred payment is exceptionally agreed with a professional Customer, any amount unpaid by the due date automatically incurs, without any reminder being required, late payment penalties at a rate equal to three times the French statutory interest rate, as well as the fixed €40 indemnity for collection costs provided for in Article D. 441-5 of the French Commercial Code (Code de commerce). Additional compensation may be claimed where the collection costs incurred exceed this amount.

9. Performance, Cancellation and Incidents

The service begins as soon as the Customer confirms the launch. The Customer may interrupt an analysis from the interface when this feature is offered; resources already consumed remain billable. No withdrawal period applies to orders placed exclusively for professional purposes.

In the event of an incident attributable to the Provider that prevents the service from being provided, the Provider may, at its option, relaunch the analysis, re-credit the cost wrongly debited or refund the service concerned. A failure related to the Customer’s scope, its access credentials, a third-party service or an interruption requested by the Customer does not automatically give rise to a refund.

10. Scope of the Results

Since cybersecurity cannot guarantee the absence of vulnerabilities, PentestLouis is bound by an obligation of means (best-efforts obligation). An analysis reflects a given scope, technical state, available information and budget as of the date it was performed. It may contain false positives, false negatives, incomplete results or unsuitable suggestions.

Scores, reports and attestations do not constitute a regulatory certification, a guarantee of compliance, legal advice or a promise that no attack will succeed. The Customer remains responsible for human verification, remediation, backups, the security of its systems and its decisions.

11. Availability and Changes

The Provider endeavors to ensure the availability of the service but does not guarantee continuous or error-free operation. It may carry out maintenance operations, apply emergency measures or change features for reasons of security, compliance or improvement. It informs the Customer within a reasonable time when the nature of the intervention allows.

12. Data and Confidentiality

Each party undertakes to protect the confidential information received from the other and to use it only for the performance of the contract. The Customer acknowledges that performance may require the transmission of code, metadata or instructions to the technical subcontractors presented in the service. The applicable retention periods and measures are described in the documentation and in the information on data protection.

The Customer shall not submit personal data, secrets or content that is not necessary for the analysis and shall ensure that it has a legal basis for the data it entrusts to the service.

13. Intellectual Property

The Customer retains its rights to its code, data and content. It grants the Provider, for the duration necessary for the service, the technical right to host, reproduce and process them solely in order to provide and secure the service.

The Provider retains all rights to PentestLouis, its software, methods, models, interfaces, trademarks and pre-existing content. Subject to full payment, the Customer may use, reproduce and distribute internally the reports produced for its professional needs. Any resale, systematic extraction or competing exploitation of the service is prohibited without written consent.

14. Liability

Each party is liable for the direct damage it causes to the other as a result of a proven breach. The Provider is not liable for indirect damage, including loss of revenue, margin, customers, opportunity, reputation or data, nor for the consequences of a decision made without human validation of the results.

To the extent permitted by law, the Provider’s total aggregate liability, for all causes combined, is limited to the amount excluding taxes actually paid by the Customer during the twelve months preceding the event giving rise to the liability. This limitation does not apply in the event of gross negligence or willful misconduct, personal injury, or where a mandatory rule prohibits it.

15. Suspension, Termination and Account Deletion

The Provider may suspend all or part of the service in the event of a security risk, non-payment, suspected fraud, unlawful use or serious breach. Except in an emergency or in the case of a breach that cannot be remedied, termination for breach takes effect after a formal notice has remained unheeded for fifteen days.

The Customer may delete its account from the settings. It is the Customer’s responsibility to download beforehand any documents it wishes to keep. Deletion results in the erasure of the items indicated in the interface, the invalidation of attestations and the non-refundable loss of the remaining credit, subject to the data that the Provider must retain to comply with its legal obligations, defend its rights or prevent fraud.

16. Force Majeure

Neither party is liable for a failure caused by an event beyond its reasonable control that meets the conditions of Article 1218 of the French Civil Code (Code civil). The affected party informs the other and limits the effects of the event as far as possible. If the impediment lasts more than thirty days, either party may terminate the affected service without compensation.

17. Evidence

Electronic records kept under reasonable security conditions (confirmations, event logs, consumption, emails, payment data and the version of the Terms accepted) are binding between the parties unless proven otherwise. Electronic documents may be retained and produced as evidence on a durable medium.

18. Amendments to the Terms

The Provider may amend the Terms for the future. The version applicable to a top-up is the one accepted when it was ordered. Any substantial amendment applicable to future use of the service is brought to the Customer’s attention by appropriate means. The date and version number appear at the top of the document.

19. Governing Law and Disputes

The Terms and the contract are governed by French law. In the event of a dispute, the parties first seek an amicable solution and have thirty days from a written notification to reach one.

Failing an amicable agreement, any dispute between merchants relating to the validity, interpretation, performance or termination of the contract falls within the exclusive jurisdiction of the Commercial Court of Paris (Tribunal de commerce de Paris), including in the case of multiple defendants or third-party warranty claims. For other professional Customers, the statutory rules of jurisdiction apply.