General terms of sale

Preamble

These terms are offered by INTELLIX, a French simplified joint-stock company (SAS) with a share capital of €5,000, whose registered office is at 4 rue Marie Bracquemont, 85660 Saint-Philbert-de-Bouaine, France, registered under RCS La Roche-sur-Yon 941 084 386, SIRET 941 084 386 00015, which operates the DMC DEFENSE brand (hereinafter "DMC DEFENSE").

1. Purpose, scope and contract documents

1.1 Purpose. These general terms of sale ("Terms") govern the cybersecurity services sold by DMC DEFENSE: penetration tests ("Pentest"), security monitoring ("SOC") and information security policy ("PSSI").

1.2 Business customers. The services are reserved for businesses and public-law entities (the "Customer"). They are not offered to consumers. The Terms are the sole basis for commercial negotiation (article L441-1 of the French Commercial Code) and are provided to any Customer who requests them.

1.3 Enforceability. Any order constitutes acceptance of the Terms in force on its date. The Customer's general terms of purchase apply only if DMC DEFENSE has accepted them in writing.

1.4 Contract documents. The contract consists of the following documents, in decreasing order of precedence in the event of conflict:

1. the signed quote, with its appendices (Pentest scope sheet, list of services monitored by the SOC);
2. the personal data processing agreement (article 9.2);
3. these Terms.

1.5 Definitions.

• Services: the services ordered by the Customer, described in the quote.
• Tenant: the Customer's Microsoft 365 / Entra ID / Azure environment, of which the Customer remains the sole holder.
• Scope: the part of the Customer's information system covered by a Service, described in the quote or in the scope sheet.
• Security incident: one or more unwanted or unexpected events likely to compromise the availability, integrity or confidentiality of the Customer's information system.
• User: a person with an active, licensed Microsoft 365 account in the Tenant who is covered by the SOC.
• Business days: Monday to Friday, excluding public holidays in mainland France.

1.6 Public buyers. When a Service is purchased under a public contract, the contract documents (deed of commitment, CCAP, CCTP, applicable CCAG) take precedence over the Terms, which apply only to matters those documents do not cover. Payment terms, late-payment interest and the fixed recovery fee are then those of the French Public Procurement Code.

1.7 Language. The Terms are written in French. In the event of translation, only the French version is binding.

2. Orders

2.1 Quote. Each Service is covered by a quote. It specifies the Scope, the price, the term and, for the SOC, the tier, the number of Users and the commitment chosen. Unless stated otherwise, it is valid for 30 days.

2.2 Scoping. Prices shown on dmc-defense.com are public "from" prices. For the Pentest, the final price is set at scoping, after a discussion of the Scope. For the PSSI, a complex scope (several sites or entities) may be quoted separately.

2.3 Acceptance. The order becomes firm when DMC DEFENSE receives the quote signed by a person authorised to bind the Customer, on paper or by electronic signature.

2.4 Changes. Any change to the Scope after the order is covered by an amendment or a new quote. For the SOC, changes in the number of Users follow article 4.4.

3. Pentest terms

3.1 Price. The Pentest is invoiced per engagement: from €4,000 excl. VAT per web application, and from €4,000 excl. VAT per Microsoft 365 / Entra ID Tenant. The final price is set at scoping (article 2.2).

3.2 Written authorisation. Before any test, the Customer signs a scope sheet that constitutes authorisation to access its information system within the meaning of articles 323-1 et seq. of the French Criminal Code. It specifies the targets, excluded targets, permitted techniques, test period and hours, and emergency contacts. No test starts without it.

3.3 Third-party systems. The Customer warrants that it is entitled to authorise testing of the entire Scope. If an element belongs to or is hosted by a third party (hosting provider, managed service provider, SaaS vendor), the Customer obtains its prior written consent and provides it to DMC DEFENSE on request. DMC DEFENSE may suspend the engagement until it is received.

3.4 Customer prerequisites. Before testing, the Customer:

• makes a complete, verified backup of the systems in the Scope;
• provides the agreed test accounts and access, and removes them at the end of the engagement;
• appoints a contact reachable throughout the test period and authorised to stop the tests;
• avoids scheduling tests during a sensitive operation (migration, major release).

3.5 Exclusions. Unless agreed in writing in the scope sheet, the Pentest includes no deliberate denial of service, no social engineering (phishing, physical intrusion) and no modification or destruction of data. A vulnerability whose exploitation could destabilise a system is exploited only with the Customer's written consent.

3.6 Critical vulnerability. If DMC DEFENSE discovers a vulnerability presenting a critical risk during the engagement, it informs the Customer without waiting for the report.

3.7 Report. DMC DEFENSE delivers a report within 15 Business days after the end of testing. For each vulnerability found, it states its severity and the fix to apply. If the Customer wants DMC DEFENSE to apply the fixes, this is planned at scoping; it never covers the code of the Customer's applications.

3.8 Retest. A retest of the vulnerabilities found is included if carried out within 60 days of delivery of the report. It covers only the vulnerabilities in the report, on the same Scope. After that period, it is quoted separately.

3.9 End of engagement. DMC DEFENSE removes the accounts, tools and traces it created during testing and deletes the evidence collected 90 days after delivery of the report, unless the Customer requests otherwise.

3.10 Limits. The Customer acknowledges that a Pentest is not exhaustive: it shows that certain vulnerabilities exist on the test date, not that no other vulnerabilities exist.

3.11 Independence. DMC DEFENSE recommends that an independent provider test an infrastructure it monitors. If the Customer chooses to entrust both to DMC DEFENSE, DMC DEFENSE carries out the engagement.

4. SOC terms

4.1 Prerequisites. The SOC runs on the Microsoft security stack. The Customer has a Microsoft 365 Tenant and the licences required for the chosen tier. These licences and Azure consumption remain the Customer's responsibility, except for the ingestion included under article 4.3.

4.2 Tiers and prices. Price excl. VAT per User per month, without commitment:

Billing covers at least 10 Users, with a minimum of €100 excl. VAT per month per Customer. SOC onboarding is included, at no charge.

4.3 Azure consumption. For Standard and Premium, the price includes Azure consumption for Microsoft Sentinel ingestion up to €2 excl. VAT per User per month. Beyond that, the excess is re-invoiced at cost, after the Customer's written approval. Without that approval, DMC DEFENSE may propose reducing the log sources collected.

4.4 Number of Users. The number of Users billed is read monthly from the Tenant. An increase is billed from the following month. A decrease takes effect the following month; during a commitment, the number billed does not fall below the number ordered.

4.5 Deployment. The SOC is deployed within 2 to 4 weeks of the order, subject to the access and information provided by the Customer. Billing starts on the go-live date notified in writing.

4.6 Service content. On all tiers:

• 24/7 monitoring of security alerts in the Scope;
• automatic detection of a Security incident by Microsoft tools in under 15 minutes, at any time;
• audit of the Customer's Microsoft 365 every 3 months, which sets the roadmap; the next audit checks the fixes; the audit covers Microsoft 365 only;
• remediation of the Microsoft 365 vulnerabilities found: DMC DEFENSE proposes the fix, ready for the Customer's IT team to apply, or applies it on the Customer's behalf, at the Customer's choice; every fix applied is validated by an expert.

From SOC Standard: response to a Security incident within 30 minutes of its detection.

4.7 Analyst availability. The hours during which analysts are on duty for each tier are set out in the quote. Automatic detection runs continuously.

4.8 Not included. The SOC does not include: remediation outside Microsoft 365 (business applications, servers, devices), carried out by the Customer or by DMC DEFENSE on a quote; in-depth digital forensics; system restoration; crisis management outside SOC Premium.

4.9 Tenant access. The Customer grants DMC DEFENSE delegated rights on its Tenant, whose extent it sets with DMC DEFENSE and which it may revoke at any time. DMC DEFENSE uses these rights only to perform the Services. A revocation suspends the parts of the service that depend on them, without suspending billing. Logs remain in the Customer's Tenant, in its Azure region; DMC DEFENSE keeps no copy.

4.10 Term, commitment and discounts.

Example: 1-year commitment with annual payment = 0.90 × 0.85, i.e. 23.5% off the base price. Annual payment is not offered without a commitment. For a SOC without commitment, DMC DEFENSE may only terminate with 3 months' notice, to give the Customer time to organise the handover (article 10.4).

4.11 End of commitment. At the end of the term, the subscription continues without commitment, at the base price and with 1 month's notice, unless a new commitment is signed.

4.12 Limits. The Customer acknowledges that no monitoring service detects every Security incident: some attacks evade detection tools. The SOC reduces the risk and the reaction time; it does not guarantee the absence of incidents or consequences. The times in article 4.6 apply while Microsoft tools operate normally, their availability being the vendor's responsibility.

5. PSSI terms

5.1 Content. The PSSI engagement delivers a framework policy and its appendices (IT charter, technical directives, incidents and crises, IT component of the business continuity plan, governance), with a GDPR roadmap. It is conducted by video conference, over 20 to 30 hours of work, part of it outside sessions.

5.2 Price. Price excl. VAT of the engagement by number of Customer users, and discounted price for SOC subscribers committed for at least 12 months:

Without a 12-month SOC commitment, the base price applies. If the SOC commitment is terminated before its end, the PSSI discount becomes payable: the difference from the base price is invoiced to the Customer.

5.3 Annual review (optional). Each year, the Customer may order a review of its PSSI. It is ordered year by year, without automatic renewal.

5.4 Cooperation. The Customer provides the contacts and information needed for the sessions. A delay on its part shifts the schedule without changing the price; beyond 3 months of interruption caused by the Customer, DMC DEFENSE may invoice the work done.

5.5 No legal advice. DMC DEFENSE's GDPR experts write the PSSI rules based on the applicable texts. DMC DEFENSE does not provide legal advice and gives no opinion on the Customer's legal compliance. For a contract, a dispute or dealings with the CNIL, the Customer consults its lawyer.

5.6 Outcome. The documents are written from the obligations of the Customer's sector. Their effect depends on how the Customer applies them. The PSSI grants no certification or label.

6. Prices, invoicing and payment

6.1 Prices. Prices are in euros excluding taxes; VAT at the applicable rate is added. The applicable prices are those of the accepted quote.

6.2 Invoicing.

• Pentest: on delivery of the report.
• SOC: monthly, in advance, from go-live; with annual payment, one invoice per year, at the start of the period. Approved Azure consumption overages (article 4.3) are invoiced the following month.
• PSSI: on delivery of the documents.
• Annual review: on delivery of the review.

Invoices are issued and received electronically in accordance with the French mandatory e-invoicing schedule. The Customer provides the details of its receiving platform with the order.

6.3 Payment term. Invoices are payable by bank transfer within 30 days of their date, with no discount for early payment.

6.4 Late payment. Any delay automatically gives rise, without reminder, to:

• penalties at the rate applied by the European Central Bank to its most recent refinancing operation plus 10 percentage points, from the day after the due date;
• a fixed recovery fee of €40 per invoice (article D441-5 of the French Commercial Code), and additional compensation on proof if actual costs are higher;
• after a formal notice left unanswered for 15 days, the right for DMC DEFENSE to suspend the Services, without the Customer being able to claim compensation.

6.5 Price changes. DMC DEFENSE may change its public prices. For a SOC without commitment, the new price applies after written notice of at least 2 months; the Customer may terminate before that date without notice. During a commitment, the price is fixed until the end of the term.

7. Customer obligations

The Customer actively cooperates in the performance of the Services. In particular, it:

• appoints a contact and a deputy, reachable and competent for its information system (internal team or IT provider), and reports any change;
• provides accurate and complete information on its information system and reports any change to the monitored Scope;
• keeps its Microsoft licences and Azure subscription active and paid;
• makes and tests its backups; DMC DEFENSE is not responsible for backing up its data;
• informs its employees of the security monitoring in compliance with employment and personal data law;
• applies, or has applied, the recommended fixes it chooses not to entrust to DMC DEFENSE.

A breach of these obligations by the Customer releases DMC DEFENSE from liability for the resulting consequences and may delay the timelines.

8. Liability

8.1 Best-efforts obligation. DMC DEFENSE performs the Services with the care of a cybersecurity professional. It is bound by a best-efforts obligation (obligation de moyens).

8.2 Cap. DMC DEFENSE's liability, for all damages and on any basis, is limited to proven direct damages and may not exceed:

• for the Pentest and the PSSI: the price excl. VAT of the engagement concerned;
• for the SOC: the amounts excl. VAT paid by the Customer for the SOC during the 12 months preceding the event giving rise to liability.

8.3 Excluded damages. DMC DEFENSE is not liable for indirect damages, including loss of revenue, customers or data, nor for damages caused by a third-party attacker, by Microsoft tools or by a breach by the Customer.

8.4 Exceptions. The cap and exclusions do not apply in the event of gross negligence or wilful misconduct, or personal injury.

8.5 Limitation period. Any action by the Customer against DMC DEFENSE is time-barred one year from the day the Customer knew or should have known the facts enabling it to bring the action (articles 2224 and 2254 of the French Civil Code).

9. Confidentiality, data and ownership

9.1 Confidentiality. Each party keeps confidential the other's information obtained during the contract, including the vulnerabilities found, reports and configurations, during the contract and for 5 years after it ends. DMC DEFENSE staff are bound by the same obligation.

9.2 Personal data. When it accesses the Customer's personal data to perform the Services, DMC DEFENSE acts on the Customer's behalf, as a "processor" within the meaning of article 28 of the GDPR. DMC DEFENSE processes this data within the Customer's Tenant, using Microsoft 365 tools and tools linked to Microsoft Sentinel; Microsoft acts under the contract the Customer has concluded with it. The locations from which DMC DEFENSE accesses the data are set in the contract, at the Customer's choice: if the Customer requests access exclusively from the European Union, DMC DEFENSE complies; otherwise, the data may also be viewed by DMC DEFENSE employees based outside the European Union. This access remains internal to DMC DEFENSE: the data is disclosed to no other entity, and DMC DEFENSE applies the same security measures and remains responsible for it. A data processing agreement, signed with the quote, sets out the subject matter, duration, data concerned, security measures, access locations chosen and what happens to the data at the end of the contract. DMC DEFENSE engages no other provider to process this data without the Customer's prior written authorisation.

9.3 Ownership of deliverables. Once paid in full, the Customer may freely use the reports and documents delivered, for its internal needs and to show them to its customers, insurers, auditors or authorities. DMC DEFENSE retains ownership of its methods, tools, templates and detection rules, which it may reuse without the Customer's data.

9.4 Customer reference. DMC DEFENSE mentions the Customer's name or logo only with its prior written consent.

10. Final provisions

10.1 Performance by DMC DEFENSE. DMC DEFENSE performs the Services with its own staff. It entrusts no part of them to another provider without the Customer's prior written consent.

10.2 Force majeure. Neither party is liable for a failure due to force majeure within the meaning of article 1218 of the French Civil Code, including unavailability of Microsoft services caused by the vendor. A cyberattack targeting the monitored Scope is not force majeure for DMC DEFENSE. If the impediment lasts more than 30 days, either party may terminate without compensation.

10.3 Termination for breach. In the event of a serious breach by a party not remedied within 30 days of formal notice by registered letter, the other party may terminate the contract automatically, without prejudice to damages.

10.4 Reversibility. When the SOC ends, DMC DEFENSE removes its delegated access, hands over documentation of its configuration (rules, playbooks, settings deployed in the Tenant) and, at the Customer's request and on a quote, assists the handover to the Customer or another provider. Logs remain in the Customer's Tenant.

10.5 Changes to the Terms. The applicable Terms are those in force on the date of the order. For an ongoing SOC, a new version is notified at least 2 months before it takes effect.

10.6 Notices. Terminations, formal notices and refusals of consent are made by registered letter with acknowledgement of receipt or by email with acknowledgement of receipt, to the addresses in the quote. Notice periods run from receipt.

10.7 Survival. Articles 8 (liability), 9.1 (confidentiality) and 10.4 (reversibility) remain in force after the contract ends, for the period they provide.

10.8 Severability. If a clause is held void or deemed unwritten, the others remain in force.

10.9 Governing law and disputes. The Terms are governed by French law. The parties first seek an amicable solution for 30 days. Failing that, any dispute falls under the exclusive jurisdiction of the Commercial Court of La Roche-sur-Yon (France).