General terms of service

1. Who these terms apply to

These terms apply to professional customers who order services from DASKALOS APPS SAS (the "Provider"). They are not consumer terms. Services are ordered under a master services agreement and one or more statements of work signed by both parties. In case of conflict, the signed agreement prevails, then its annexes, then the statement of work, then this page.

2. Nature of the services

Purpose. The services are professional advisory and engineering-support services intended to help the customer prepare for and maintain its own compliance with the Cyber Resilience Act. Each engagement is a fixed-scope piece of work that ends when its last deliverable is accepted. We operate nothing, watch nothing and are on call for nothing.

Obligation of means. The Provider performs the services with reasonable skill and care, in accordance with good industry practice, using appropriately qualified personnel. The Provider does not guarantee, warrant or represent that the customer, any product, any process or any deliverable is, will be, or will be found by any authority to be, compliant with the regulation, any standard or any other law.

The customer remains the manufacturer. The customer is and remains the manufacturer (or importer or distributor) of its products and is solely responsible for the obligations attached to that role: essential requirements, conformity assessment, technical documentation, the EU declaration of conformity, CE marking, vulnerability handling, support period commitments, security updates and all notifications and reports to authorities. The Provider is not appointed and does not act as authorised representative; does not sign, issue or co-sign any declaration of conformity; does not affix CE marking; is not a conformity assessment body or notified body and issues no certificate; does not place any product on the market; does not, in any circumstances, submit any notification, report or communication to an authority on the customer's behalf, and accepts no mandate to do so — every submission is made by the customer, in its own name, from its own account, on its own assessment and within its own deadlines; and does not monitor the customer's products, systems, components or any vulnerability feed on the customer's behalf, receives no alert from any monitoring tool, and owes no response to any alert, vulnerability or incident.

Not legal advice. The services interpret technical and regulatory requirements from an engineering perspective. They are not legal advice.

Evolving framework. Implementing measures, guidance and standards change, and several standards are drafts. Deliverables reflect the Provider's professional understanding at the date of delivery. The Provider has no obligation to monitor for such changes, to notify the customer of them, or to update any deliverable after delivery. A periodic review is not on the Provider's price list today and cannot be ordered: it has no tick-box on the statement of work, no fee has been fixed for it, and it cannot be added by change order (Article 3.5 and Annex A section 2b of the master services agreement). If it goes on the price list it becomes orderable like anything else — a new engagement under its own statement of work, priced and accepted in its own right, not an update of an earlier deliverable and not renewing automatically.

Automated tooling and AI. The Provider uses scanning tools and AI-assisted tooling, including large language models, to produce parts of the services. Every deliverable is reviewed and released by a named professional before delivery. Such tools may fail to detect issues and may produce output requiring correction. The Provider's obligations remain an obligation of means.

3. Exclusions

Unless a statement of work expressly includes them, the services do not include, and the Provider is not responsible for: penetration testing, red-teaming, security certification or attestation of any product; modifications to the customer's source code, firmware, products, infrastructure or supply chain, or their remediation; any submission, notification or communication to any authority, or representation before one; legal advice or the determination of the customer's legal obligations; hardware testing, radio, safety or other regulatory regimes; any monitoring, watch, alerting, triage, response or availability of any kind, whether during or outside business hours — we operate no watch, hold no rota, are on call for no one, and offer no response target, service level or service credit in respect of any vulnerability, alert or incident; any guarantee that a product is free of vulnerabilities or that all vulnerabilities, exploitation or incidents will be detected; the operation, availability, accuracy, completeness, security, continuity, licensing or cost of any monitoring tool or other third-party tool we recommend, evaluate or configure under section 6, and any change its vendor makes to it after hand-over; the receipt of, or any action or response to, any alert, report or finding produced by such a tool or by the customer's own systems; the obligations of the customer's importers, distributors or downstream customers; and any work on products, versions or components not identified in the statement of work.

None of that affects our ordinary correspondence with you during an engagement, including answering your written questions.

Four of these exclusions are absolute: no statement of work may buy back submission to an authority, monitoring or availability of any kind, responsibility for a third-party tool, or a response to an alert. A statement of work purporting to include them has no effect. ⚖

4. Customer obligations

The customer provides complete and accurate information, materials and access in good time, designates a single point of contact with authority to decide, and is solely responsible for its own decisions, including which recommendations to implement and whether, when and what to notify to any authority. The Provider may rely on the customer's materials and decisions without independent verification. The customer records its decisions on the Provider's recommendations in a decision log; a recommendation not recorded as accepted within 10 business days of delivery is deemed declined.

5. Deliverables and acceptance

Within 10 business days of delivery, the customer either accepts the deliverable in writing or notifies a material non-conformity with the statement of work, with reasonable detail. A deliverable is deemed accepted if no such notice is given in that period or if the customer uses it for its business. Where a material non-conformity is duly notified, the Provider corrects it within a reasonable time and re-delivers; the corrected deliverable has a further acceptance period of 5 business days. Correction and re-delivery are the customer's sole and exclusive remedy for non-conformity of a deliverable. Beyond that period, and for twelve months from delivery, the Provider corrects and re-delivers at no charge a deliverable that falls short of the reasonable skill and care owed, including where a customer of the customer or a distributor rejects it for a reason inside the agreed scope (Article 7.4 of the services agreement). That undertaking does not qualify Article 13.4: the Provider gives no warranty concerning the position an authority may take, and a rejection or challenge by an authority is not a trigger. ⚖ Where the deliverable is, or includes, a configuration made in an account we no longer have access to — a monitoring tool handed over under section 6 — that undertaking is discharged by giving the customer corrected written instructions it can apply itself; it does not oblige us to regain access to that account, and it does not cover anything changed there after hand-over. ⚖

6. Monitoring set-up and tool recommendations

What is ordered. Where a monitoring set-up is ordered in a statement of work, the Provider, for one technical-documentation unit and on a one-off basis: advises on the choice of a monitoring tool suited to the customer's stack, component list and budget; configures that tool in an account held by, contracted for by and paid for by the customer, against the component list identified in the statement of work; routes that tool's alerts to contacts designated by, and belonging to, the customer; delivers a written runbook telling the customer what to do when its own monitoring alerts it, and a picture of the customer's exposure at the date of the set-up; walks the customer through the configured tool; and hands over.

What is not ordered, and it is the essential point. The set-up is a one-off piece of advisory work that ends at hand-over. The Provider does not monitor the customer's products. After hand-over we hold no account, receive no alert, watch no feed on the customer's behalf, and owe the customer no response, no availability, no service level and no service credit in respect of any vulnerability, alert or incident, at any hour. We are not a security operations centre, an incident-response provider or a managed-security-service provider. The exposure picture describes the position on the day it was produced and nothing after it.

The customer monitors, decides and reports. The customer is and remains solely responsible for operating and paying for the tool and keeping its configuration, component list and contacts current; for receiving, reading and acting on its alerts; for determining whether a vulnerability is actively exploited or an incident is severe; for deciding whether, when and what to notify to an authority; for making every submission itself, in its own name and within the statutory deadlines; for telling the users that the vulnerability or incident affects, which the Cyber Resilience Act requires of the manufacturer alongside the notification to an authority; and, where the vulnerability is in a component the customer did not write, for reporting it to whoever manufactures or maintains that component and sharing any modification it developed to address it.

Third-party tools. The tool is supplied to the customer by its vendor, under the customer's own contract with that vendor. The Provider is not a party to that contract, is not the vendor's agent, distributor or reseller, and gives no warranty of any kind in respect of the tool. Vulnerability feeds and the tools built on them are third-party sources which may be incomplete, inaccurate or delayed, and neither party controls them.

Recommendations are advice, the Provider is independent, and any interest is disclosed. ⚖ The Provider does not accept, and shall not accept, any referral fee, commission, reseller margin, partner status or free or discounted use from the vendor of any tool it recommends, so that a recommendation reflects the customer's needs and nothing else. Every recommendation of a named tool or vendor states plainly, in writing and at the time it is made, that the Provider has no commercial relationship with that vendor, or, should that ever cease to be true, what the relationship is; is a recommendation only, which the customer is free to decline or replace with a tool of its own choosing; and is recorded in the decision log with the customer's decision, so that the record shows the customer chose the tool. A recommendation is not a certification, an endorsement, a procurement decision or an assurance that the tool is fit for the customer's purpose.

Credentials. The customer gives such access to its own accounts as the set-up requires. The Provider holds that access only for as long as the set-up requires it, uses it only for the work in the statement of work, and at hand-over returns or destroys every credential it held and confirms in writing that it has done so. From that confirmation we have no access to and no visibility of the tool or its alerts.

7. Fees, invoicing and payment

Fees are stated in the statement of work, exclusive of VAT and of pre-approved expenses invoiced at cost. Unless the statement of work provides otherwise, fixed-price services are invoiced 50% on signature and 50% on delivery, save that a statement of work whose total fee is small is invoiced in full on delivery. No service is invoiced on a recurring basis: a periodic review, if it ever goes on the price list and is ordered, is invoiced under its own statement of work in the year it is performed. It cannot be ordered today — section 2. Invoices are payable within 30 days of the invoice date by bank transfer, without set-off or withholding. An invoice dispute must be notified within 10 business days of receipt; the undisputed part remains due. ⚖ Late payment automatically incurs, without notice, interest at three times the French legal interest rate and a fixed recovery indemnity of €40 per invoice, as provided by French law, without prejudice to further costs on justification. If an invoice remains unpaid 15 days after a written reminder, the Provider may suspend the services and withhold deliverables until payment.

The ladder credit. ⚖ The whole of what you pay us for anything other than Market Ready — the scoping and classification memo, Reporting Ready, the engineer-led gap review, the monitoring set-up and the half-day training alike — is credited against Market Ready when you order it, and what you pay for the scoping memo is credited in the same way against Reporting Ready and against the gap review. It is a full credit and not a percentage, a discount rate or a voucher, so every route to Market Ready costs the same as ordering it outright. What is credited is what you actually paid, so an item invoiced at a reduced rate, or invoiced once for a session covering several units, is credited at the amount invoiced; and a credit is never more than the fee it is set against, so it never becomes a balance we owe you. The credit has no period of validity: it is not lost by the passage of time, by a gap between engagements, by the completion of the work that earned it, or by the end of this relationship, and no credit window in any earlier agreement, statement of work or price list applies to it.

Market Ready, the top step, is not on our price list at the moment and cannot be ordered. The reason is our own commercial position and it is set out in Article 9.7(c) of the master services agreement and on our pricing page. Three things follow, and all three are Article 9.7 rather than statements on this page. Your statement of work records a reference price for Market Ready — stated for that Article only, and not an offer. We write to you when we start accepting orders again, and for the period stated in Article 9.7(d) you pay no more than that reference price less your credit; after that period the credit still applies in full, against the list price of the day. If we decide never to offer Market Ready again, we write to you, and the credit does not lapse: it can be set against any other service we offer, in full and with no time limit.

The limits of that promise, which we would rather state than leave you to discover. The fees you have paid are not refunded in cash. They bought deliverables that were specified, delivered and accepted, and you keep them and your licence to use them. The credit is a credit against our own future services: it is not money held on your behalf, it bears no interest and it is not indexed. It is personal to you and transfers only with the business or the products your statement of work relates to. And it is no better secured than any other obligation of ours — if we ceased to trade it would rank as an ordinary unsecured claim and you might recover nothing under it.

8. Intellectual property and data

The Provider's pre-existing materials (methods, control library, knowledge base, templates, prompts, software and tooling) remain its property. On full payment, the customer receives a non-exclusive, perpetual licence to use, reproduce and modify the deliverables for its internal purposes and to demonstrate the conformity of its products to authorities, customers and auditors; deliverables may not be resold or used to provide services to third parties. Customer materials remain the customer's property. The Provider does not use customer materials, including source code, to train, fine-tune or evaluate machine-learning models, and contracts with its AI model providers on terms under which customer materials are not used to train the provider's models. Where the Provider processes personal data on the customer's behalf, it does so as processor under the data processing agreement annexed to the master services agreement, using the sub-processors listed in that agreement, hosted in the European Union, with no transfer of personal data outside the EU or EEA without the customer's written authorisation. Each party keeps the other's confidential information confidential for the period set in Article 11.3 of the master services agreement after it ends, and for as long as source code and trade secrets remain confidential.

9. Warranties and liability

The Provider warrants that the services are performed with reasonable skill and care; the sole remedy for breach of this warranty is correction or re-performance under section 5. All other warranties, including as to fitness for purpose, results, compliance, absence of vulnerabilities or detection of vulnerabilities, are excluded to the extent permitted by law. The Provider gives no warranty concerning the position any authority may take on scope, classification, conformity or notification.

Cap. ⚖ The Provider's total aggregate liability arising out of or in connection with the agreement and any statement of work does not exceed the total fees paid by the customer under the statement of work giving rise to the claim during the twelve months preceding the event giving rise to the claim.

Excluded losses. The Provider is in no event liable for indirect or consequential loss; loss of profit, revenue, business, contracts, opportunity, goodwill or anticipated savings; loss, corruption or unavailability of data or software; regulatory fines, penalties or sanctions of any kind; costs of recall, withdrawal, corrective measures, market-surveillance actions or product suspension; claims by third parties, including product-liability claims; losses arising from any security incident, exploitation, vulnerability or breach affecting the customer's products or systems; costs of remediating products; or losses arising from the acts or omissions of the customer, an authority or a third-party provider of feeds, hosting or other services, including the vendor of any monitoring tool; or losses arising from a vulnerability, alert or incident that a monitoring tool did not detect, did not report, reported late, or reported to a contact the customer had not kept current.

Shared responsibility. Where other advisers or contractors contributed to the same loss, the Provider's liability is several and limited to its own proportionate share of it.

Reliance. The Provider has no liability arising from inaccurate, incomplete or late customer materials, information or decisions, or from the customer's failure to implement a recommendation.

Mandatory carve-outs. ⚖ Nothing in these terms excludes or limits liability for gross negligence (faute lourde), wilful misconduct (dol), death or personal injury caused by negligence, or any other liability that cannot be excluded or limited under applicable law.

No reliance by anyone else. ⚖ What we deliver is written for you, from what you give us, for the purpose set out in your statement of work. You may show it to an authority, to your own customers or to an auditor — section 8 says so. But nobody other than you acquires a right to rely on it, and we owe no duty of care to anyone else. Please say so when you pass it on.

Time bar. ⚖ Any claim against the Provider must be brought within twelve months of the event giving rise to it.

The customer retains the regulatory and product risk attaching to its role as manufacturer and maintains appropriate insurance. The Provider maintains professional civil liability insurance with Hiscox SA, in force from 11 September 2026, for at least €50,000 per claim and per year.

10. Term and termination

The master services agreement may be terminated by either party on three months' written notice without affecting statements of work in progress. Every statement of work ends on acceptance of its last deliverable. There are no retained, recurring, subscription or continuing services under these terms, and no service renews automatically. A periodic review cannot be ordered today (section 2); if it goes on the price list, each review is a separate statement of work signed for that occasion, placing one such order neither obliges nor entitles either party to a further one, and no tacit renewal arises from a review being ordered in successive years. ⚖ Either party may terminate for material breach not remedied within 30 days of written notice. On termination the customer pays for services performed and deliverables delivered up to that date. Under Article 17.4 of the master services agreement, its Articles 3, 5, 6.3, 7.4, 8.6, 9 to 15, 17.4, 18.3, 20 and 21 — including confidentiality, the customer indemnity and the twelve-month non-solicitation — survive termination. ⚖

11. Governing law and jurisdiction

These terms and the agreement are governed by French law. The parties attempt to resolve any dispute amicably within 30 days of written notice. ⚖ Failing that, any dispute is submitted to the exclusive jurisdiction of the Tribunal de commerce de Bourg-en-Bresse, including in case of multiple defendants, summary proceedings or third-party proceedings.

12. Contact

DASKALOS APPS SAS, 183 rue de l'Abbé Griffon, 01960 Péronnas, France. RCS Bourg-en-Bresse 928 998 715. tech@daskalos-apps.com. Company details are on the legal notice page.