Terms and conditions of sale and use

These terms are entered into between VESPERID (VesperID), whose identifiers appear in the legal notice, and the client, a legal entity or an individual acting in a professional capacity. An individual who subscribes for purposes outside their trade or profession is a consumer client: the special conditions of the “Consumer clients” section then apply in addition and prevail in case of conflict.

Their purpose is to define how threat exposure monitoring services, platform access and associated services are supplied.

Any order implies unreserved acceptance of these terms, which prevail over the client’s purchasing terms unless otherwise agreed in writing.

Licence: an annual, named and non-exclusive right of use covering a set of services, quotas and seats defined in the accepted quotation.

Service: an item of the VesperID catalogue activated for a licence, each with its own functional scope and its own quota unit.

Perimeter: the set of assets declared by the client and verified (domain names, addresses, individuals, keywords, address ranges, code repositories, Microsoft 365 tenant, bank identification numbers) over which monitoring is carried out.

Seat: a named user’s access to the platform, counted whether active or pending acceptance of an invitation.

Detection: an observed exposure item, dated and attached to an asset in the perimeter.

Quota: the maximum volume of units consumable over the licence term or over one month, depending on the unit applicable to the service.

Every engagement is covered by a written quotation setting out the activated services, quotas, number of seats, term and price line by line. The quotation is valid for thirty days from issue unless stated otherwise.

The contract is formed upon the client’s written acceptance of the quotation. An invoice is then issued.

The prices applied are those in the accepted quotation; they are fixed for the licence term, including where the price catalogue subsequently changes.

The licence is granted for a term of one year from activation, for the agreed perimeter, services and quotas. A client organisation, company or individual, may hold several licences; each carries its own composition of services, its quotas, its term and its invoice.

The right of use is personal to the client and its designated users. It may not be assigned, sub-licensed, resold or made available to a third party, including an affiliate not named in the contract.

Platform access is restricted to users holding a seat. Sharing credentials between several people is prohibited.

The client shall not attempt any automated bulk extraction outside the export functions provided, nor any reverse engineering of the platform, except in the cases provided by law.

The licence is activated once the corresponding invoice is paid. The owner account designated by the client then receives a named invitation.

Monitoring of an asset begins only once the client’s legitimacy over that asset has been verified: publication of a DNS record for a domain name, or the person’s acceptance of the invitation for a protection profile.

The client acknowledges that without a verified asset no detection is possible, and that completing and maintaining the perimeter is its responsibility.

Some services require the perimeter identifiers to be transmitted to our collection provider: this is subject to information and to a recorded attestation by the client before activation.

The number of seats and the quotas appear in the accepted quotation and are visible at all times in the client area.

Counters are computed from actual consumption. An identical search repeated within a short interval is not counted twice.

Reaching a quota does not interrupt monitoring already in place; it prevents further units being consumed for the service concerned until an extension or renewal.

Any mid-year extension (additional service, seats, quotas, credits) is covered by a proposal priced pro rata for the remaining term and by a separate invoice.

Prices are stated in euros and exclusive of tax. Applicable value added tax is added to the invoice at the rate in force.

Payment is made exclusively by bank transfer, to the details shown on the invoice. There is no online payment and no direct debit.

Unless the quotation states otherwise, invoices are payable within thirty days of the invoice date.

Late payment automatically triggers late payment interest at the rate applied by the European Central Bank to its most recent refinancing operation plus ten percentage points, together with a fixed recovery cost indemnity of forty euros, in accordance with the French commercial code.

Where non-payment persists after a formal notice has remained without effect for fifteen days, VesperID may suspend access to the platform, monitoring being maintained so far as reasonable until the matter is resolved.

A consumer client owes neither late payment interest at the commercial rate nor the fixed recovery indemnity; only interest at the statutory rate runs after a formal notice, under the “Consumer clients” section.

The licence is entered into for one year. It does not renew automatically: renewal is the subject of a written proposal sent before the term ends and of the client’s express acceptance.

At the end of the term, absent renewal, platform access is maintained in read-only mode for a grace period allowing data export, then closed. Detections and their metadata are deleted ninety days after the licence ends, unless a different period is set in writing within a limit of twelve months, and the identifiers are withdrawn from the collection provider.

Either party may terminate the contract in the event of a serious breach by the other party that is not remedied within thirty days of a written formal notice.

Where termination is due to VesperID’s fault, sums corresponding to the unperformed period are refunded pro rata. Where termination is due to the client’s fault, sums already paid remain due.

A person covered by a protection profile may end it at any time, without giving a reason; monitoring of that profile then ceases immediately, without that ending giving rise to any refund for the client who subscribed on their behalf, and without any consequence for the person.

The client warrants that it holds the necessary rights over the assets it declares and can demonstrate ownership or legitimate use of them.

Before activating a service that processes its staff’s data (Compromised credentials, Infected devices, Stolen sessions, Exposed staff), the client informs them individually with the information notice VesperID supplies, consults the works council where the law requires it, and records the corresponding dated attestation in its client area, per service; activation depends on it.

The client requests the monitoring of a person by name (name, private addresses, aliases) only under the Executive protection service, once that person has accepted the invitation. Minors are covered by no service.

The client uses detections, analyses, scores, cohorts, recommended actions and exports solely to secure its systems and accounts and to defend its rights. It refrains from any personnel management use: appraisal, disciplinary sanction, activity monitoring, recruitment or individual decision about a person. Results are reserved for the people in charge of information security, and the client answers for the conformity of its authorisations with this rule.

The client shall not use the platform or the Investigations service to search for information about a candidate, an employee or a person’s private life; an investigation concerns a threat aimed at its organisation, and VesperID refuses any request without a security purpose.

The client adopts the reveal policy (“Reveal on demand” section), designates the members authorised to reveal in full, reviews the reveal log monthly and handles abuses.

The client is responsible for managing its users, their roles and the revocation of access for people who have left the organisation, and for the alert destinations it configures (addresses, Slack, Microsoft Teams, webhooks), which are not sub-processors of VesperID.

VesperID undertakes to supply the services with the care and diligence of a professional in the field, to keep the platform operational and to provide support on business days.

The platform’s alerts are issued automatically according to the rules set by the client. VesperID undertakes that an analyst answers any request from the client within one working day, public holidays excepted, and qualifies a detection at its request.

VesperID undertakes to inform the client of any planned interruption and, without delay, of any security incident affecting its data.

VesperID’s obligations in respect of monitoring, takedown and investigation services are best-efforts obligations. Monitoring covers external sources whose exhaustiveness and availability cannot be guaranteed; the outcome of a takedown request depends on a third party’s decision.

By default, a secret attached to a detection is shown masked (first two and last two characters). Full reveal is reserved for members holding the manager and owner roles, after re-authentication less than five minutes old, upon entering a reason, within twenty reveals per member per rolling twenty-four hours.

Full reveal is only possible for an account whose domain or targeted service belongs to the client’s verified perimeter; for a payment card, the perimeter is a BIN declared by the client, for a bank account, a verified identity. The value of a third-party service’s session cookie is never revealed; the other exposures of the same address outside the perimeter are shown as a count.

The secret is read live from the collection provider, sent to the member’s browser with caching forbidden, and recorded nowhere by VesperID. Every reveal produces an audit entry (member, detection, field, masked or full, reason, IP address, user agent, timestamp).

The client undertakes not to copy, record, export or transmit any revealed secret, including to the person concerned, and never to attempt a login with a revealed secret nor to replay a session.

The client subscribes to the service for natural persons it designates, within the profile quota of the licence. The service for a person is activated only when the person accepts the invitation VesperID sends; until it is accepted, no data about the person is processed under this service and no identifier is sent to the collection provider.

A protected person’s exposure data is accessible to the person alone and to the members to whom they themselves granted access. The client has no access to it and cannot require VesperID to disclose it, even after the service ends; it receives an aggregate state limited to the display name, the profile status, the number of open detections, the highest level and the date of the last update.

The person may end the service concerning them at any time, without giving a reason; the client may also end it, informing the person. No end of service opens retroactive access for the client to the person’s data or gives rise to a refund. The client refrains from any measure, decision or request towards the person based on the existence of the profile, on the aggregate state or on a refusal to grant access.

A protected person’s relatives are not covered by the client’s licence. An adult relative may enter into a contract of their own with VesperID; the client sees no state of it. Minors are excluded from the service.

VesperID cannot be held liable for the consequences of a compromise, a fraud or any damage suffered by the client, its customers or its staff. The service consists in informing and qualifying, not in preventing an incident or securing the client’s systems.

VesperID does not warrant the exhaustiveness of external sources, the detection of every existing exposure, or a favourable outcome to a takedown request made to a third party.

VesperID’s liability, on all grounds combined, is limited to the tax-exclusive amount actually paid by the client for the licence in force at the time of the triggering event.

Neither party is liable for indirect damages, in particular loss of business, loss of revenue, loss of the client’s data or reputational harm.

These limitations do not apply in the event of gross negligence, wilful misconduct or personal injury, nor where the law sets them aside.

Each party undertakes to preserve the confidentiality of the information received from the other party, for the term of the contract and five years thereafter.

VesperID shall not cite the client’s name, brand, logotype or any identifying story, for any purpose including commercial ones, absent express and revocable written agreement.

Access to a client’s data by VesperID teams is limited to operational and support needs, logged, and subject to individual confidentiality undertakings.

For monitored perimeter data, VesperID acts as a processor within the meaning of Article 28 of the General Data Protection Regulation, on the documented instructions of the client acting as controller.

VesperID processes that data solely for the performance of the contract, implements appropriate technical and organisational measures, assists the client in responding to rights requests, and informs it of any engagement of a further processor.

The list of subprocessors, their location and the legal framework for transfers appear in the privacy policy.

On expiry of the contract, data is deleted at the end of the stated retention periods, or earlier at the client’s written request, subject to statutory retention obligations.

The platform, its components, its documentation and its report templates remain the exclusive property of VesperID. The contract confers only a limited right of use, for the licence term.

The declared perimeter data and the reports generated for the client belong to the client. The client may export and use them freely, including after the contract ends.

Feedback and suggestions made by the client may be used by VesperID to improve its services, without conferring any ownership right on the client or entitling VesperID to name it.

Neither party is liable for a failure caused by an event of force majeure within the meaning of Article 1218 of the French civil code. The affected party shall inform the other without delay; if the impediment lasts more than sixty days, either party may terminate without indemnity.

The contract may not be assigned by the client without VesperID’s prior written agreement. VesperID may assign the contract as part of a transaction affecting its business as a whole, informing the client in writing and without degrading the level of service.

These special conditions apply to any natural person who subscribes to a licence for purposes outside their trade or profession. They prevail over the other sections in case of conflict. The following do not apply to a consumer client: the late payment interest and recovery indemnity, the limitation of liability, the clause keeping sums paid in case of termination and the jurisdiction clause.

Pre-contractual information: before any order, VesperID provides the consumer client, on a durable medium attached to the quotation, with the essential characteristics of the services, the total price inclusive of tax and the payment terms, the contract term (twelve months, no tacit renewal), the conditions of the right of withdrawal and the model form, the existence of the legal guarantee of conformity, the functionalities and interoperability of the digital services (CSV and JSON exports, PDF reports), the details of the consumer mediator and how personal data is processed (Articles L. 111-1 and L. 221-5 of the French consumer code). The quotation and these terms form the contract; VesperID confirms its conclusion on a durable medium.

Right of withdrawal: the consumer client has fourteen days from the conclusion of the contract to withdraw, without giving a reason and at no cost, by an unambiguous statement sent to contact@vesperid.com or to the registered office, for instance using the model form attached to the quotation (Article L. 221-18). VesperID refunds all sums paid at the latest fourteen days after being informed. The service starts before the end of that period only at the consumer client’s express request, recorded with its date; if they then withdraw within the period, they owe the price of the service supplied up to their decision, pro rata to the total price over twelve months, and the balance is refunded (Article L. 221-25). As a twelve-month licence is never fully performed before the end of the period, the right of withdrawal is not lost.

Term and termination: the contract is concluded for twelve months, with no tacit renewal. The consumer client may terminate it at any time, without giving a reason, by email or from their area; termination takes effect at the end of the current month and the whole months not performed are refunded within fourteen days, pro rata to the total price. At the end of the contract, the area stays readable for thirty days for export, then exposure data is deleted ninety days after the end of the contract and the identifiers are withdrawn from the collection provider.

Price and payment: prices are stated inclusive of tax; the licence price is payable by bank transfer within thirty days of accepting the quotation. In case of delay, a formal notice is sent; failing payment within fifteen days, interest at the statutory rate runs and the service may be suspended. No fixed penalty is due.

Legal guarantee of conformity: VesperID is bound by the legal guarantee of conformity for digital services (Articles L. 224-25-12 et seq. of the French consumer code) for the whole period of supply, and provides the updates needed. In case of a defect, the consumer client is entitled to conformity being restored at no cost or, failing that, to a price reduction or to the termination of the contract.

Liability: VesperID answers for the proper performance of the contract under ordinary law; no clause limits or excludes its liability beyond what the law allows, and no sum is kept without consideration in case of early termination. Monitoring obligations remain best-efforts obligations.

Personal data: for the service supplied to the consumer client, VesperID is the controller; processing their identifiers and exposures is necessary to perform the contract. The consumer client alone sees their exposure data, grants and revokes access to their area, reads the support access log and ends the service; the transmission of their identifiers to the collection provider established in Canada and the other sub-processors are described in the privacy policy. An adult relative enters into a contract of their own; minors are covered by no service.

Mediation: in case of a complaint, the consumer client first writes to contact@vesperid.com. If the dispute is not resolved within two months, they may turn free of charge to the consumer mediator VesperID is affiliated to, within one year of their written complaint (Articles L. 611-1 to L. 616-3 of the French consumer code). The mediator’s appointment is in progress; their details are given on the quotation and on this page before any consumer order. Mediation is optional; the consumer client keeps the right to go to court.

Governing law and jurisdiction: the contract is governed by French law, without prejudice to the more protective mandatory provisions of the law of the consumer client’s state of residence. Besides the courts having jurisdiction under the French code of civil procedure, the consumer client may bring proceedings before the court of the place where they resided when the contract was concluded or when the harmful event occurred (Article R. 631-3 of the French consumer code). The contract is written in French.

These terms are governed by French law.

The parties shall endeavour to settle amicably any dispute concerning their interpretation or performance. Failing agreement within thirty days, the dispute shall be brought before the competent court in the jurisdiction of VesperID’s registered office, including where there are several defendants or third-party proceedings.

Where the client is a consumer, the “Consumer clients” section applies: protective jurisdiction rules, consumer mediation and the right of withdrawal.