General Terms of Services and Sale – PANOPSYS
Preamble
The purpose of these General Terms of Services and Sale (hereinafter the ” Terms “) is to define the terms and conditions under which the company PANOPSYS, a simplified joint-stock company (société par actions simplifiée) with a capital of 10,098.00 euros, registered with the Paris Trade and Companies Register under number 994 804 730, whose registered office is located at 60 Rue François 1er, 75008 Paris, identified under the intra-community VAT number FR70 994 804 730 (hereinafter the ” Provider “), provides its clients with an online software service (hereinafter the ” Service “).
The Provider can be contacted at the following email address: legal@panopsys.ai or by post at its registered office address.
0.1. Object and Scope of Application
These General Terms of Service (GTS) define the contractual framework applicable to the access and use of the SaaS cybersecurity Service published by the Provider. They are intended exclusively for a professional clientele and apply to any subscription provided by the Company.
0.2. Definitions
For the purposes of interpreting these Terms, the terms below, whether used in the singular or plural, shall have the following meaning:
- Subscription: The contractual formula granting the right to access the Service for a specific duration, according to the pricing terms defined by the Provider.
- Assets: Designates all elements of the Client’s information system (IP addresses, domain names, URLs, APIs, web applications) declared by the Client on the Service to be the subject of analyses or scans.
- Client: Any natural or legal person having subscribed to a Subscription Agreement for the Service for their professional needs.
- Client Account: Designates a user account allowing access to the Service via a username and an individual password.
- Agreement (or Contract): The set formed by these Terms, as well as any SLA, DPA, technical annex, or purchase order accepted by the Client.
- Documentation: Designates the technical and functional documentation of the Service made available by the Provider on the Site or within the Service.
- Client Data: All information, files, logs, metadata, indicators, and content transmitted, generated, or hosted via the Service on behalf of the Client.
- Provider or Company: Designates the company Panopsys, publisher of the Service.
- Security Incident: Any event likely to affect the confidentiality, integrity, availability, or authenticity of Client Data.
- Party(ies): Designates individually the Client or the Provider, and collectively both.
- Security Policy: Designates the document describing the Provider’s technical and organizational security measures, accessible on the Site or upon request.
- Service (or SaaS Service): Designates the software platform hosted and operated by the Provider, allowing the Client to access, via the Internet, cybersecurity functionalities (monitoring, detection, automated pentesting).
- Site: Designates the Provider’s website (www.panopsys.ai) allowing the presentation, subscription, or access to the Service.
- SLA (Service Level Agreement): The service level agreement defining the performance and availability commitments, accessible in the Documentation or in an annex.
- User: Any natural person authorized by the Client to access and use the Service within the framework of the Agreement concluded between the Client and the Provider.
0.3. Acceptance of Terms
Access to and use of the Service are conditioned upon the unconditional acceptance of these General Terms of Service (GTS). This acceptance is materialized by a checkbox (“Opt-in”) during account creation or, failing that, by the first effective use of the Service. The Client declares having full legal capacity to contract and bind the entity on behalf of which they are acting.
Article 1 – Object, Access, and Mandate
1.1. License of Use
The Provider grants the Client a personal, non-exclusive, non-transferable, and worldwide license to access the SaaS cybersecurity platform (including modules for CVE Monitoring, Audit, and Threat Intelligence). The Service is provided in SaaS mode (“Software as a Service”). The Client strictly forbids themselves from any reverse engineering, decompilation, or attempt to access the source code.
1.2. Audit Mandate and Authority (Essential Clause)
The Client expressly mandates the Provider to perform technical operations of analysis, vulnerability scanning, and automated penetration testing on the Assets (IP addresses, domain names, URLs, APIs) that they enter into the platform. The present Agreement constitutes express authorization for intrusion within the meaning of Articles 323-1 et seq. of the French Penal Code regarding the declared Assets.
Ownership Warranty: To ensure the legitimacy of the Client’s claims over Assets such as domain names or URLs, the Provider implements a mandatory technical validation process :
- Provision of Verification Code: For each Asset declared, the Provider shall provide the Client with a unique, randomly generated identification string (the “Verification Code”).
- Deployment of TXT Record: The Client agrees to insert this Verification Code into a TXT record within the DNS zone of the concerned Asset.
- Automated Validation: The Provider will perform an automated check to verify the presence and accuracy of the TXT record. The commencement of the technical operations described in Section X.1 is strictly conditional upon the successful completion of this validation.
- Continuous Compliance: The Client agrees to maintain this DNS record for the entire duration of the Subscription to allow for periodic re-verification.
For Non-DNS Assets : For Assets where DNS TXT record insertion is not technically feasible (e.g., raw IP addresses), the Client acknowledges that the sole responsibility for verifying ownership rests with the Client. The Provider reserves the right, at its sole discretion, to request additional documentary evidence of ownership or authorization before initiating any analysis on such Assets.
1.3. Eligibility Conditions and Verifications
Access to the Service is strictly reserved for professionals. The Client declares: (i) not to be a direct competitor of the Provider (publisher of security solutions, EDR, SIEM) ; (ii) not to be subject to international sanctions ; and (iii) never to have been convicted of computer offenses. The Provider reserves the right to verify the Client’s identity and the ownership of the targeted Assets at any time. Any doubt regarding the Client’s legitimacy may result in the refusal or immediate suspension of the account. In this case, the Provider will not provide any reimbursement of any kind.
1.4. Prohibited Uses
It is strictly forbidden to use the Service to:
- Scan third-party infrastructures without authorization;
- Conduct illicit activities of any kind.
Any breach will result in immediate termination without refund and may be reported to the competent authorities.
1.5. Account Management and Security
The Client is responsible for the security of their access. They undertake to enable strong authentication (MFA) if available and to keep their credentials confidential. Any action performed via their account is deemed to be performed by them.
1.6. Availability and Maintenance
The Provider strives to keep the Service accessible in accordance with the SLA (available in the Annex). Interruptions for maintenance (preventive, corrective, or security) may occur and do not give rise to any compensation if they do not exceed the thresholds of the SLA.
1.7. Beta Versions
Features identified as “Beta” or “Preview” are provided “as is”, without warranty of performance or data retention, for testing purposes only.
Article 2 – Financial Conditions
2.1. Price and Payment
The Service is invoiced in US Dollars ($ USD). Subscriptions are payable in advance for the subscribed period. Payment is made by credit card or any other means proposed on the platform. The Client warrants that they have the necessary funds and authorizations.
2.2. Late Payment and Suspension
Any late or rejected payment automatically entails the application of penalties at the ECB refinancing rate plus 10 points, as well as a fixed recovery fee of €40. Furthermore, the Provider reserves the right to immediately suspend access to the Service until full payment of the amounts due. This suspension does not entitle the Client to any compensation.
2.3. Taxes and Withholding
Prices are expressed exclusive of tax. The Client is responsible for the payment of applicable VAT and any other local tax. If a withholding tax is required by the Client’s tax legislation, the latter must pay the Provider an increased amount so that the Provider receives the net amount invoiced (“Gross-up”).
2.4. No Refund
Except in the event of proven gross negligence (faute lourde) by the Provider, amounts paid are definitively retained. No refund (nor pro rata) will be made in the event of early termination or non-use of the Service by the Client. Any invoice dispute must be notified in writing within ten (10) days; past this deadline, the invoice is deemed accepted.
Article 3 – Duration, Suspension, and Termination
3.1. Duration and Renewal
The Agreement takes effect upon subscription. The Subscription is concluded for the selected duration and subsequently renews by tacit renewal for successive periods of the same duration, unless terminated by one of the Parties.
3.2. Termination of Subscription (Unsubscribe)
The Client may terminate their Subscription at any time via their client area or by simple written notification before the renewal date. Termination takes effect at the end of the current period (end of the contractual year). Any period commenced is due in full and will not give rise to any pro rata refund.
3.3. Suspension and Termination for Fault
In the event of a breach by the Client (non-payment, violation of terms of use, or security risk), the Provider reserves the right to suspend access to the Service immediately and without notice. If the breach is not remedied within fifteen (15) days following notification, the Provider may terminate the Agreement automatically (de plein droit), without prejudice to the amounts due. In the event of a security emergency or malicious act, termination may be immediate.
3.4. End of Contract and Data (Reversibility)
Upon cessation of the Agreement:
- Access to the Service is cut off;
- The Client has a period of ninety (90) days to retrieve their Data via standard export functionalities. Past this deadline, the Provider may proceed with their permanent deletion;
- Confidentiality, intellectual property, and liability limitation clauses survive termination.
Article 4 – Intellectual Property
4.1. Provider’s Property
The Provider remains the sole holder of all intellectual property rights related to the Service, its technology (source code, algorithms, interfaces), and its documentation. The Client benefits only from a personal, non-exclusive, non-transferable, and temporary right of use for the duration of the Agreement. It is strictly forbidden for the Client to: (i) proceed with any form of reverse engineering or decompilation of the Service; (ii) copy or create derivative works; (iii) circumvent technical protection measures.
4.2. Client Data and Feedback
The Client retains exclusive ownership of their Data. They grant the Provider a free and worldwide license to host and process such Data, limited to the needs of executing the Service and security. Any suggestion or idea for improvement (“Feedback”) transmitted by the Client may be freely exploited by the Provider without compensation or limitation.
4.3. Service Improvement (Threat Intelligence)
The Client expressly authorizes the Provider to aggregate and anonymize technical data and metadata resulting from the use of the Service (indicators of compromise, attack patterns) for statistical purposes and to improve detection models. The Provider guarantees that no data allowing the identification of the Client or its Users will be disclosed to third parties.
4.4. Infringement Warranty
The Provider warrants that the Service does not infringe upon third-party rights. In the event of a claim, the Provider shall bear the Client’s defense and may, at its choice: (i) obtain the right to continue using the Service; (ii) modify it so that it is no longer infringing; or (iii) terminate the Agreement and refund the Client pro rata for the unconsumed period. On their part, the Client warrants that they hold the necessary rights to the Data they submit to the Service.
Article 5 – Data Security
5.1. Provider’s Obligations
The Provider undertakes to implement appropriate technical and organizational measures, consistent with the state of the art, to guarantee the security, integrity, and confidentiality of the Service and Client Data. These measures include, notably, data encryption, strict access control, and continuous infrastructure monitoring, as detailed in the Annex or the Provider’s technical documentation (e.g., Security Policy).
5.2. Incident Management
In the event of a confirmed security incident affecting the Client’s data, the Provider undertakes to:
- Take necessary corrective measures to contain the incident;
- Notify the Client by email without undue delay and at the latest within forty-eight (48) hours if the incident concerns personal data (in accordance with the GDPR).
5.3. Client’s Obligations
The Client is solely responsible for the security of their own environment and the confidentiality of their access credentials (passwords, API keys). They undertake to use robust authentication methods (MFA if available) and to immediately notify the Provider in case of suspected fraudulent access. Any action performed with the Client’s credentials is deemed performed by the Client.
Article 6 – Liability and Warranties
6.1. Service Warranty
The Provider warrants that the Service will function essentially in accordance with its documentation. This warranty is a best efforts obligation (obligation de moyens). The Service is provided “as is”; the Provider does not warrant that it will be free of errors, that it will meet the specific needs of the Client, nor that it will prevent all security threats.
6.2. Warranty Exclusions
The Provider’s liability cannot be engaged in the event of malfunctions resulting from:
- The Client’s technical environment (network, hardware, firewalls, configuration errors);
- Non-compliant or illicit use, or a failure to secure access (MFA, passwords) by the Client;
- External causes or cases of force majeure within the meaning of Article 1218 of the Civil Code;
- Service suspensions provided for in the Agreement (maintenance, non-payment, security risks).
6.3. Limitation of Liability
In the event of proven fault, the Provider’s total liability is strictly limited to direct damages and capped at the total amount paid by the Client during the twelve (12) months preceding the triggering event. Expressly excluded from any compensation are indirect damages, including notably: loss of data, loss of business, damage to image, financial or commercial prejudice, even if the Provider has been advised of their possibility.
6.4. Client Warranty (Indemnification)
The Client undertakes to indemnify and defend the Provider against any claim, loss, or sanction resulting from: (i) non-compliant or illicit use of the Service; (ii) violation of third-party rights or applicable laws; or (iii) Data and Assets submitted to the Service by the Client.
Article 7 – Confidentiality
Each Party undertakes to keep strictly confidential the non-public information of the other Party (notably Client Data and Provider’s trade secrets) and to use them only for the execution of the Agreement. This obligation survives three (3) years after the term of the Agreement, except for trade secrets (perpetual protection). Public information or information legitimately known prior to disclosure is not confidential. At the end of the Agreement, confidential information must be destroyed or returned.
Article 8 – Evolution of Service and Conditions
8.1. Evolution of Service
The Provider may evolve the Service at any time (addition, modification, or removal of features, patches). Security updates and critical patches are deployed automatically without notice. If an evolution results in a substantial degradation of an essential feature or its permanent removal, the Provider will inform the Client with reasonable notice. The Client may then terminate the Agreement without cost if no satisfactory workaround is proposed.
8.2. Modification of Terms (GTS)
The Provider may modify these General Terms at any time. Any substantial modification will be notified to the Client (by email or via the platform) at least thirty (30) days before its entry into force. In the event of refusal of the new conditions, the Client must terminate their Subscription before the end of this notice period. Failing that, the new conditions are deemed accepted.
8.3. Price Revision
Prices are guaranteed for the current subscription period. Any price modification will apply only upon renewal of the Subscription. The Client will be informed of any price increase at least thirty (30) days before the due date. If they refuse this increase, the Client may end the automatic renewal of their Subscription before the due date.
Article 9 – Applicable Law and Jurisdiction
9.1. Applicable Law
The present Agreement is exclusively governed by French law. The application of the Vienna Convention on the International Sale of Goods is expressly excluded.
9.2. Dispute Resolution
In the event of a dispute, the Parties undertake to seek an amicable solution before any judicial action. Failing an amicable agreement within thirty (30) days following the notification of the dispute by one of the Parties, exclusive jurisdiction is attributed to the courts within the jurisdiction of the Provider’s registered office. This jurisdiction clause applies notwithstanding multiple defendants, third-party claims (appel en garantie), or summary proceedings (référé).
Article 10 – General Provisions
10.1. Validity and Force Majeure
The nullity of a clause does not entail that of the Agreement. The liability of the Parties is suspended in the event of force majeure (Art. 1218 Civil Code) lasting more than 30 days.
10.2. Proof and Entire Agreement
The Agreement constitutes the entire agreement between the Parties. Computerized records (logs, timestamps) kept by the Provider have probative force and are admissible as evidence in court.
10.3. Notifications
Official communications are made by email to the addresses indicated in the Client Account or on the Site.
ANNEX : SERVICE LEVEL AGREEMENT (SLA)
1. Availability
The Provider targets a monthly availability of 99.5%. In the event of failure to meet this target, the Client may request a Service Credit of 10% (if availability < 99.5%) or 20% (if availability < 95%) to be applied to their next invoice. Excluded from the calculation are: scheduled maintenance, force majeure events, third-party internet outages, or suspensions for security reasons.
2. Support
Support is available via email (support@panopsys.ai) during business hours (Mon-Fri, 09:00–18:00 CET). The Provider shall use best efforts to respond to critical incidents within 4 business hours (best efforts obligation).
