Legal information
Terms applicable to any order of Kalisecu services operated by KaliCertif SAS: one-off penetration tests (Essential, Application, Complete), Ready For Prod, and monitoring subscriptions (Watch, Surveillance, Pilot).
These Terms of Sale govern any contractual relationship between KaliCertif SAS (hereinafter "Kalisecu" or "the Provider"), publisher of the Kalisecu commercial brand, and any individual or entity acting in a professional capacity (hereinafter "the Client") subscribing to one of the services offered on kalisecu.com.
The Terms of Sale are binding on the Client as soon as they validate their order, which constitutes full acceptance. No specific conditions can prevail without written and signed agreement from the Provider.
Kalisecu offers the following services:
Pre-production validation of an application (typically built with Cursor, Claude, Lovable, v0, Bolt.new or similar tools) before its go-live. Audit of code, configuration, infrastructure and authentication. Report within 48 business hours ranked by severity, 30-minute call, free re-check at 7 days. No commitment.
Services are best-effort obligations and not result obligations (cf. article 09).
Any order requires the Client to first electronically sign an authorisation document, by which the Client declares to be the legitimate holder or operator of the site(s) concerned and expressly authorises Kalisecu to perform the described checks. Without this signed document, no service starts.
For one-off penetration tests (Essential, Application, Complete): after the order and signature of the authorisation document, the report is delivered within 5 business days (Essential and Application) or 10 business days (Complete).
For Ready For Prod: the report is delivered within 48 business hours after signing.
For subscriptions: the first check is scheduled within 24 business hours, the dashboard is opened immediately.
Prices are in euros, excluding VAT. French VAT at the legal rate in force applies to clients established in France and to non-VAT-registered EU clients. VAT-registered EU clients benefit from reverse charge subject to providing a valid intra-EU VAT number.
Payments are made by credit card via an authorised provider. Subscriptions are debited in advance (monthly or annual according to the Client's choice). The penetration tests (Essential, Application, Complete) and Ready For Prod are ordered and paid in full online at the time of order.
In case of payment default, the service is suspended after a formal notice without effect for 7 days. Late-payment penalties at the legal interest rate increased by 10 points and a flat indemnity of €40 for recovery costs (article L.441-10 of the French Commercial Code) will be due.
For the Application and Complete pentests, a re-test of the identified vulnerabilities is offered after the Client has implemented the fixes, within a reasonable timeframe agreed between the parties. A test attestation may be provided to the Client at the end of the service.
For Ready For Prod, a re-check is offered within 7 days of delivery of the initial report. The Complete pentest includes a 30-day follow-up.
These additional services cover exclusively the perimeter initially audited. Any extension of the perimeter is subject to a new quote.
One-off services (Essential, Application, Complete pentests, Ready For Prod): single execution service with no commitment of duration. Once the report is delivered, the service is deemed performed. No refund is due once the report has been sent, except in case of characterised breach by the Provider.
Monthly subscriptions: no commitment of duration. The Client can cancel at any time from their dashboard or by email at bonjour@kalisecu.fr. Cancellation takes effect at the end of the current billing period. No amount is refunded for the started period.
Annual subscriptions (2 months free): no commitment of duration. The Client can cancel at any time, but the current year already paid is not refunded or pro-rated.
The Provider reserves the right to terminate any order for legitimate reasons (suspected fraud, illegal site content, unreasonable behaviour) with pro-rated refund.
Kalisecu services are intended for clients acting in a professional capacity. The right of withdrawal provided by articles L.221-18 et seq. of the French Consumer Code does not apply, in accordance with article L.221-3 (professional clients with no more than five employees and outside the scope of application are invited to contact the Provider before ordering).
For orders eligible for the right of withdrawal, the Client expressly waives this right by requesting immediate execution of the service (signing the authorisation document and starting the report).
The Client warrants that they hold the necessary rights over the site(s) submitted for audit and that they have authority to authorise the checks. The Provider cannot be held liable for any harm to a third party resulting from an inaccurate declaration by the Client on this point.
The Client undertakes to provide, on request, the technical information necessary for the service (read access, test credentials, application map). The Provider uses light-touch techniques: across 5 years of work, zero clients have experienced downtime or data loss caused by our checks.
Kalisecu services are best-effort obligations. No security expert can guarantee exhaustive detection of all existing vulnerabilities, nor the absence of any subsequent compromise. For maximum coverage, the Client may complement Kalisecu services with a deeper audit (cf. Validix for mid-market / large-cap needs).
The Provider's liability is capped, all damages combined, at the total amount paid by the Client for the relevant service over the 12 months preceding the triggering event. Indirect damages, loss of business, data loss, and reputational harm are excluded.
The Provider holds professional liability insurance appropriate to its activity.
If our test does not reveal any critical or high severity flaw on your site, the pentest is fully refunded. Vulnerability severity is assessed using a CVSS-type severity scale, detailed in the report delivered to the Client.
This guarantee results in a refund of the relevant service, excluding any other compensation. It applies exclusively to the Essential, Application and Complete pentests, excluding Ready For Prod and monitoring subscriptions.
The refund request must be made within 15 days of the report's delivery, by email to bonjour@kalisecu.fr.
Reports, identified vulnerabilities, technical and strategic Client data are strictly confidential. They are stored in France at OVH SAS or Scaleway, with no transit through servers outside the EU.
The detail of processing is described in the privacy policy.
Neither party may be held liable for a breach resulting from a case of force majeure within the meaning of article 1218 of the French Civil Code (disasters, conflicts, major failure of indispensable third parties, etc.). Deadlines are then suspended for the duration of the event.
These Terms of Sale are governed by French law. Any dispute will be subject to a prior amicable resolution attempt. Failing this, exclusive jurisdiction is granted to the courts within the jurisdiction of the Court of Appeal of Rennes, including in case of multiple defendants or warranty claims.
Last updated: 13 July 2026 · Version 2.1 · Lire en français