Terms of sale

01 Purpose and scope

These Terms of Sale govern the contractual relationship between KaliCertif SAS (hereinafter “Kalisecu” or “the Provider”), publisher of the Kalisecu commercial brand, and any legal entity or individual acting in a professional capacity (hereinafter “the Client”) subscribing to one of the services offered on kalisecu.com.

The Terms are enforceable against the Client upon validation of the order, which constitutes full acceptance thereof. No specific condition may prevail without the written, signed agreement of the Provider.

02 Description of services

Kalisecu offers the following services. Prices are shown in euros, all taxes included (incl. VAT):

• Diagnostic — €99 incl. VAT (one-off payment). An external, automated and supervised security check of one site, performed once. The Provider tests the site from the outside, the way an automated attacker would, and delivers a prioritised, plain-language report of what to fix, together with a dated one-page record entitled “Attestation of completion of an external automated and supervised check” (scope, date, method, summary of results and limitations). This record only evidences that the described check took place: it is neither a security certification or label, nor a compliance audit, nor a manual penetration test, and it guarantees neither the absence of vulnerabilities nor its acceptance by any third party (insurer, client, principal). The Diagnostic amount is deductible from the first Sentinelle payment under the conditions of article 06.
• Sentinelle subscription — €99 incl. VAT/month, or €990 incl. VAT/year (billed once for twelve months). Recurring monitoring of one site: a weekly external check, recording of the Client’s technical stack, watch for newly published vulnerabilities likely to affect the site, and email alerts (a regular “all clear” recap and a “heads-up” alert with the action to take when a threat arises).
• Custom — on quote. Multiple sites, adapted pace, in-depth manual pentest, dedicated support. Scope and price defined by a quote accepted before any start.

The services are best-effort obligations and not obligations of result (see article 08).

03 Order, authorisation and start

Any order implies that the Client declares to be the holder or legitimate operator of the site(s) concerned and expressly authorises Kalisecu to carry out the described checks. Without valid authorisation, no service begins.

Authorisation is collected primarily via the online validation process: a verification code is sent to an email address on the domain concerned; entering this code, together with the declared identity of the signatory and the express acceptance of the displayed authorisation text, constitutes written authorisation. A timestamped, sealed receipt of this acceptance is kept by the Provider. Where this validation is not possible (email address on another domain, shared hosting, or any other case), the Provider collects the authorisation by another written means and may require additional evidence (DNS record, signed mandate). The authorisation can be revoked at any time by email.

For the Diagnostic: the report is delivered no later than 24 hours (assessed in business days) after receipt of the Client’s written authorization and the site URL. For the Sentinelle subscription: the first check is scheduled within 24 business hours of receipt of the written authorization.

04 Price and payment

Prices are shown in euros, incl. VAT. French VAT at the legal rate in force is calculated automatically and applies to clients established in France and to non-taxable EU clients. Taxable EU clients benefit from reverse charge, subject to providing a valid intra-EU VAT number.

Payments are made by bank card (and other offered methods) via our approved payment provider Stripe. The Diagnostic is paid in full at order. The Sentinelle subscription is charged, depending on the chosen plan, monthly or annually, in advance.

In the event of non-payment, the service is suspended after a formal notice left unaddressed for 7 days. Late-payment penalties at the legal interest rate plus 10 points and a fixed recovery indemnity of €40 (article L.441-10 of the French Commercial Code) will be due.

05 Term and cancellation

Monthly Sentinelle subscription: no commitment period. The Client may cancel at any time, by email to bonjour@kalisecu.com. Cancellation takes effect at the end of the current monthly billing period; no amount is refunded for the period already started.

Annual Sentinelle subscription: entered into for a twelve-month period, billed in full in advance, tacitly renewable for further twelve-month periods. The Client may request cancellation at any time, by email; it takes effect at the end of the current annual period, the service remaining provided until its term. No pro-rata refund is due where the Client cancels for convenience. This no-refund rule does not apply in the event of non-performance attributable to the Provider, early termination by the Provider without fault of the Client, or where mandatory provisions provide otherwise: in those cases, the unused period is refunded pro rata.

Diagnostic: a one-off service. Once the report is delivered, the service is deemed performed (subject to the refund guarantee in article 06).

The Provider reserves the right to cancel any order for a legitimate reason (suspected fraud, illegal site content, unreasonable behaviour), with a pro-rata refund where applicable.

06 Diagnostic commercial guarantee: refund or deduction

Within 30 calendar days of the Diagnostic report being made available, the Client benefits, at their choice, from one of the two following commercial benefits:

• Refund: a full refund of the price actually paid for the Diagnostic, on simple request and without justification, by email to bonjour@kalisecu.com. The refund is made to the original payment method, within a maximum of 14 days of the request, with the corresponding credit note issued.
• Deduction: a deduction of €99 incl. VAT from the first Sentinelle payment (monthly or annual), via a personal discount code provided with the report, valid for 30 days and usable once.

These two benefits cannot be combined. Using the discount code constitutes the choice of the deduction and makes the commercial refund of the Diagnostic unavailable; conversely, a refund of the Diagnostic entails the deactivation of the discount code. This non-combination rule is without prejudice to the Client’s mandatory legal rights.

These benefits apply exclusively to the Diagnostic, and not to the Sentinelle subscription or custom work, limited to one request per Client and per site. Requests constituting manifest fraud are excluded, in particular multiple orders intended to circumvent this limit. The guarantee gives rise only to the refund (or deduction) provided above, to the exclusion of any other compensation.

07 Right of withdrawal

Kalisecu services are intended for clients acting in a professional capacity. The right of withdrawal set out in articles L.221-18 et seq. of the French Consumer Code does not apply as of right to professional clients. For orders eligible for this right, the Client, by requesting immediate performance of the service, expressly waives the right of withdrawal once the service has been fully performed.

08 Scope, cooperation and liability

The Client warrants that it holds the necessary rights over the site(s) submitted for checking and has authority to authorise it. The Provider cannot be held liable for harm to a third party resulting from an inaccurate declaration by the Client on this point. The Provider only acts on the Client’s sites, never on third-party sites.

The Provider uses non-destructive techniques, without breaking, stealing or modifying the Client’s data. The Client undertakes to provide, on request, the technical information useful to the service.

Kalisecu services are best-effort obligations. No security expert can guarantee the exhaustive detection of all existing vulnerabilities, nor the absence of any subsequent compromise. The Provider’s liability is capped, for all damages combined, at the total amount paid by the Client for the service concerned over the 12 months preceding the triggering event. Indirect damages, loss of business, loss of data and reputational harm are excluded.

09 Confidentiality and data

The Client’s reports, identified vulnerabilities and technical data are strictly confidential. They are stored in France at OVH SAS or Scaleway, with no transit through servers outside the EU. Processing is detailed in our privacy policy (GDPR).

10 Force majeure

Neither party may be held liable for a failure resulting from a case of force majeure within the meaning of article 1218 of the French Civil Code. Deadlines are then suspended for the duration of the event.

11 Applicable law and jurisdiction

These Terms are governed by French law. Any dispute will be subject to a prior attempt at amicable resolution. Failing that, exclusive jurisdiction is granted to the courts within the jurisdiction of the Rennes Court of Appeal.