Terms and conditions

1. Scope

These terms and conditions (conditions générales de vente, CGV) apply to all orders placed with Techspike SARL, 39 rue du Général de Gaulle, 33460 Margaux-Cantenac, France (Bordeaux Trade and Companies Register (RCS) 982 709 255), through audit.techspike.fr, in every language version of the site. They are the basis of the commercial relationship within the meaning of Art. L. 441-1 Code de commerce.

We work only for business customers, that is natural or legal persons acting for purposes of their commercial, industrial, craft, professional or agricultural activity. We do not contract with consumers or non-professionals. By ordering, you confirm that you act as a business on behalf of the company you name.

The customer’s purchasing terms apply only if we accept them in writing. The order confirmation, the non-disclosure agreement and the data processing agreement (Art. 28 GDPR) take precedence over these terms.

2. Services

The audit runs automatically with analysis tools and AI agents. Scope, delivery time and price follow from the package description at the time of ordering and from the order confirmation. The result is a report in PDF format.

• Code audit: we read the source code. We do not run it and change nothing in your repository.
• App audit: we actively test the running application with your test accounts, for example login, sessions, rate limits and access rights. Test data may be created or test accounts locked in the process. We start only after your written authorisation; an e-mail is enough (address, environment, time window).
• Full audit: app audit and code audit together, each finding checked by an expert, with a debrief and a re-test.

An audit is not a manual penetration test, not a load or performance test, not a certification and not a conformity assessment (for example under NIS 2 or the Cyber Resilience Act). We only audit third-party systems with their operator’s consent.

We may subcontract part of the service, in particular to our partner Viewconic GmbH, bound by the same confidentiality obligations. We alone remain responsible to you for its performance.

3. Duty of care

We audit carefully, according to the state of the art, and owe our best efforts (obligation de moyens). No audit finds every vulnerability, however. We owe the audit described and an understandable report, not the security of your software. The fact that a vulnerability was not found is not, in itself, a failure to perform. The report describes the audited state at the time of the audit.

4. Ordering and conclusion of the contract

Ordering takes three steps: package and options, details of the application and billing, summary. Before sending, you can check all details and correct errors via “Edit”. By clicking “Place binding order”, you make a binding offer; the automatic acknowledgement of receipt is not yet an acceptance. The contract is concluded by our order confirmation sent by e-mail. If we do not accept within five working days, you are no longer bound by your offer.

The contract is concluded in French. You can view, save and print these terms at any time on this page; with the order confirmation, you receive your order details and these terms by e-mail. We archive the order and the confirmation for the statutory retention period. Working days are Monday to Friday, excluding public holidays in France.

5. Your cooperation

You warrant that you are authorised to have the application and code audited, as rights holder or with the rights holder’s consent, and you indemnify us against third-party claims based on a lack of authorisation attributable to you. You provide in good time: the code or read access, for the app audit two test accounts without MFA or captcha, and the authorisation. Remove credentials, keys and real customer data beforehand. For active tests, we recommend a test environment; for a production system, you make sure an up-to-date backup exists.

6. Delivery time

The delivery time starts once payment has been received and the code, access and authorisation are complete. With the express option, we deliver within 24 hours from that point; hours on Saturdays, Sundays and public holidays in France are not counted. If your cooperation is delayed, delivery moves back accordingly. If it has still not been provided 60 days after the contract was concluded, we may terminate the contract after a formal notice that has remained without effect for 15 days; we then invoice the services provided and expenses incurred up to that point and refund any excess paid.

7. Prices and payment

The fixed prices shown on the site at the time of ordering apply. They are net prices in euros.

• Customers established in France: French VAT at the applicable rate (20 %) is added to the price.
• Customers established in another EU member state with a valid VAT ID: invoice without VAT, reverse charge by the customer (Art. 283-2 Code général des impôts and Art. 196 Directive 2006/112/EC).
• Customers established outside the EU: the service is outside the scope of French VAT (Art. 259-1 Code général des impôts).

Payment is due on ordering: by bank transfer within 14 days of the invoice date, or by card or SEPA direct debit through our payment link. We start once payment is received. No discount is granted for early payment.

Any late payment automatically incurs, from the day after the due date and without prior reminder, late-payment interest at the rate applied by the European Central Bank to its most recent refinancing operation plus 10 percentage points, as well as a fixed recovery fee of €40 per invoice (Art. L. 441-10 and D. 441-5 Code de commerce). If the recovery costs incurred are higher, we may claim additional compensation on proof. As long as an invoice is overdue, we may suspend our services.

8. Cancellation

Until the audit starts, you may cancel free of charge by e-mail; we refund any amounts paid. After that, you may terminate the contract at any time by e-mail; the price remains due, less the expenses we save as a result of the termination. We let you know by e-mail when the audit starts. As the contract is concluded between businesses, no right of withdrawal applies.

9. Re-test and workshop

The re-test checks once whether the findings in the report have been fixed. You may request it within three months of delivery and send us the current version for it; new features are not included. The workshop lasts two hours online; we agree a date with you within three months of delivery. The quote for fixing the vulnerabilities is free and without obligation; an order for it requires a separate contract.

10. Confidentiality and personal data

Before any access, we sign a non-disclosure agreement and, if personal data may be involved, a data processing agreement (Art. 28 GDPR). We use the code and access only for the audit and delete the code no later than 30 days after delivering the report. The provider of the AI models used does not train on your data. The processing of personal data is described in our privacy policy.

11. Use of the report

After full payment, you have a non-exclusive right, unlimited in time, to use the report within your company and to pass it on to your customers, auditors, insurers and investors. Our methods, tools and report templates remain our property. Third parties to whom you pass the report acquire no rights of their own against us.

12. Acceptance and conformity of the report

The report is deemed accepted if you do not notify us in writing of a non-conformity within 14 days of delivery; we remind you of this on delivery. If the report does not conform, for example because a finding is poorly supported or a described check is missing, we correct it within a reasonable time. If that fails, you may obtain a proportionate price reduction (Art. 1223 Code civil) or terminate the contract; damages are governed by section 13. Any claim regarding the conformity of the report must be brought within one year of its delivery (Art. 2254 Code civil), except in the case of gross negligence or wilful misconduct.

13. Liability

Our liability is unlimited for gross negligence (faute lourde) or wilful misconduct (faute dolosive), for personal injury and under product liability (Art. 1245 et seq. Code civil). In all other cases, we are liable only for direct damage that was foreseeable when the contract was concluded (Art. 1231-3 Code civil); indirect damage such as loss of revenue, customers or reputation is excluded. Our total liability is then limited to €50,000 per order. This limitation does not deprive our essential obligation to carry out the audit ordered of its substance (Art. 1170 Code civil). For loss of data, we are liable only for the effort that would have been needed to restore it from regular backups, which are your responsibility.

14. Force majeure

Neither party is liable for a delay or failure to perform caused by force majeure within the meaning of Art. 1218 Code civil, for example a general outage of networks or of our infrastructure providers. Performance is suspended for as long as the impediment lasts. If it lasts more than 30 days, either party may terminate the contract in writing; amounts paid for services not provided are refunded.

15. Free security check

The free security check only evaluates publicly visible information about a website, without logging in and without attacking. Request it only for domains you own or are authorised for. It is without obligation; there is no right to have it carried out or to a particular time frame. We are liable for it only for gross negligence, wilful misconduct and personal injury.

16. Governing law and disputes

The contract is governed by French law, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG). The French version of these terms is binding; the German and English versions are translations.

In the event of a dispute, the parties first seek an amicable solution for 30 days from the written complaint. Failing that, and subject to mandatory provisions to the contrary, any dispute relating to the contract falls under the exclusive jurisdiction of the Commercial Court (tribunal de commerce) of Bordeaux, including for interim relief, third-party claims and multiple defendants.