Skip to main content
own2pwn

Terms of Sale

Last updated:

1. Purpose and scope

These Terms of Sale (hereinafter "Terms") govern the contractual relationship between own2pwn (hereinafter "the Provider") and any legal entity, or any individual acting for the purposes of their professional activity (hereinafter "the Client"), subscribing to a SaaS plan or service offered by own2pwn.

The offers covered include:

  • Subscriptions to the EASM and AI-Native AppSec SaaS platforms
  • Blackbox / Whitebox Web Pentest engagements
  • NIS2 Audit — technical scope: assessment of the effectiveness of security measures within the meaning of article 21.2(f) of Directive (EU) 2022/2555, coverage matrix, inventory of exposed assets and remediation plan (see article 1 bis)
  • Bespoke offers formalised by quote (Enterprise)

1 bis. Scope of the "NIS2 Audit" engagement

The "NIS2 Audit" engagement covers exclusively the technical scope: tests and measures allowing assessment of the effectiveness of cybersecurity risk-management measures (art. 21.2(f) of the NIS2 Directive), inventory of exposed assets, a coverage matrix of the measures tested, and a prioritised remediation plan.

Expressly excluded from the scope, unless otherwise agreed in writing: risk analysis, the information system security policy (ISSP), the business continuity and disaster recovery plan (BCP/DRP), crisis management and, more generally, any governance component.

No NIS2 certification, attestation or declaration of conformity is issued — no such document exists under the Directive. The deliverables help the Client demonstrate the effectiveness of its technical measures to its supervisory authority; the assessment of conformity is a matter for that authority and remains the Client's responsibility.

2. Subscription

Subscription is made online (for standard plans) or by signing a quote / purchase order (for Enterprise offers and service engagements). Subscribing constitutes unreserved acceptance of these Terms of Sale and of the Terms of Use.

2.1 Professional status of the Client (offer reserved for professionals)

The Services are exclusively intended for professionals. Online subscription requires entering the Client's company name and SIRET number, as well as accepting an express declaration that the Client is acting for the purposes of its professional activity. This declaration, its timestamp and the company identifiers entered are retained as proof of the professional nature of the contract.

The Client warrants the accuracy of this information and that the person subscribing has the authority to bind the declared company. Any subscription made on the basis of an inaccurate declaration may be terminated as of right by own2pwn.

3. Prices and VAT

Prices are those in effect on the day of the order, as displayed on the product pages or stated in the quote.

own2pwn falls under the French small-business VAT exemption("franchise en base", art. 293 B of the French General Tax Code, CGI): no VAT is charged. The displayed prices are therefore the amounts actually due — the "excl./incl. VAT" distinction is not applicable — and invoices bear the mention "TVA non applicable, art. 293 B du CGI" (VAT not applicable, art. 293 B of the CGI).

The intra-EU VAT number FR53937694875 of THE HIVE is used solely for intra-EU transactions and the associated reporting obligations; it does not entail any VAT invoicing by own2pwn. For a taxable Client established in another EU Member State, any tax due is payable by the recipient under the reverse-charge mechanism, in accordance with the regulations applicable to it.

Should own2pwn exceed the thresholds of the small-business exemption, prices would be increased by VAT at the applicable rate for invoices issued after leaving the scheme, with the Client informed at least 30 days in advance.

own2pwn may revise its prices at any time for new subscriptions. For existing Clients, any increase is notified at least 30 days in advance and applies at the next renewal.

4. Payment terms

4.1 SaaS subscriptions

Subscriptions are payable in advance, by credit card via Stripe (recurring debit) or by bank transfer for annual and Enterprise offers. The subscription is automatically renewed at each term, unless terminated.

4.2 Service engagements (pentest)

Engagements are invoiced according to the schedule set out in the quote (deposit upon order, balance upon delivery of the report, or per contractual milestones).

4.3 Late payment

Any late payment automatically triggers, without prior notice, the application of late-payment interest at the European Central Bank rate plus 10 points (art. L.441-10 of the French Commercial Code), as well as a flat-rate recovery-cost indemnity of €40 (art. L.441-10 and D.441-5). In the event of persistent non-payment, own2pwn reserves the right to suspend access to the Service.

5. Effective date and term

The subscription takes effect upon payment validation or signature of the quote. It is entered into for the stated term (monthly or annual), renewable by tacit renewal for an equivalent period.

6. Right of withdrawal

As the Services are reserved for professionals (B2B contracts, see article 2.1), the right of withdrawal provided for in articles L.221-18 et seq. of the French Consumer Code does not apply.

As an exception, article L.221-3 of the French Consumer Code extends this right to professionals employing five employees or fewer where the subject matter of the contract does not fall within the field of their main activity. A Client meeting both conditions has 14 days from conclusion of the contract to withdraw, by writing to contact@own2pwn.fr. Where the Client has requested immediate performance of the Service, they remain liable for the amount corresponding to the service already provided.

7. Termination

7.1 Termination by the Client

The Client may terminate their subscription at any time from their account or by email to contact@own2pwn.fr. Termination takes effect at the end of the current billing period. No pro-rata refund is provided.

7.2 Termination by own2pwn

own2pwn may terminate the subscription in the event of a serious breach by the Client of its obligations (in particular non-payment, breach of the Terms of Use, abusive use), after formal notice remains unaddressed for 15 days.

8. Delivery and performance

8.1 SaaS platforms

Access opens immediately after payment validation for standard plans, or on the effective date agreed for Enterprise offers.

8.2 Pentest engagements and the technical scope of the NIS2 audit

Engagements are performed according to the schedule defined in the engagement letter. The final report is delivered in digital format (PDF) and presented orally (by videoconference or on site).

For the technical scope of the NIS2 audit, deliverables include the inventory of exposed assets, the coverage matrix of the technical measures tested, and the prioritised remediation plan, within the scope limits set out in article 1 bis.

9. Provider's obligations

  • Best-efforts obligation: to implement reasonable means to provide the Service in line with the state of the art in cybersecurity
  • Confidentiality of deliverables and Client data (see dedicated clause)
  • Compliance with service level commitments (SLA) where contractually agreed

Important: no penetration test can guarantee exhaustive vulnerability detection. The Provider undertakes a best-efforts obligation, not an obligation of result.

10. Client's obligations

  • Provide the information necessary for the proper performance of the Services (scope, application context, test accounts, etc.)
  • Warrant that it has the legal authorisation to have tests performed on the assets submitted
  • Pay the sums due on the agreed terms
  • Comply with the Terms of Use (professional use, no resale, etc.)

11. Confidentiality

Each party undertakes to preserve the confidentiality of any information, data, document or deliverable transmitted by the other party in connection with the performance of the contract. This obligation remains in force for the entire term of the contract and for 5 years after its termination.

Pentest reports and scan data are strictly confidential. own2pwn shares no information with third parties without the Client's written consent, except where required by law.

12. Intellectual property

Intellectual property rights over own2pwn's platforms, tools, AI models and methodologies remain the exclusive property of the Provider. The Client has a right of use for the duration of its subscription.

Pentest reports are delivered with an unlimited internal-use licence for the Client's benefit. Any external distribution (to a regulator, an auditor, an end client) is authorised within the scope of the Client's professional activity.

13. Liability

own2pwn's liability, on all grounds combined, cannot exceed the amount paid by the Client under the contract during the 12 months preceding the event giving rise to liability.

own2pwn can in no event be held liable for indirect damage suffered by the Client (loss of business, loss of turnover, data loss resulting from an external compromise, damage to reputation).

14. Personal data

The processing of personal data is carried out in accordance with the GDPR and is detailed in our Privacy Policy. Where own2pwn acts as a processor (within the meaning of art. 28 GDPR), a Data Processing Agreement (DPA) is entered into between the parties.

15. Force majeure

Neither party may be held liable for non-performance due to an event of force majeure within the meaning of article 1218 of the French Civil Code.

16. Assignment

The Client may not assign the benefit of the contract to a third party without the prior written consent of own2pwn. own2pwn may assign the contract in the event of restructuring, merger or transfer of business, subject to informing the Client.

17. Governing law and jurisdiction

These Terms of Sale are governed by French law. Failing an amicable resolution, any dispute will be submitted to the exclusive jurisdiction of the courts of Cannes, even in the event of multiple defendants or third-party proceedings. This clause is entered into between professionals within the meaning of article 48 of the French Code of Civil Procedure; it is set aside where a mandatory provision designates another court.

18. Contact