Terms of use

1. Purpose and parties

These terms of use (the "Terms of Use") govern access to and use of Patcharo, a vulnerability intelligence and remediation support service made of the public site patcharo.com and the application app.patcharo.com (together, the "Service").

The Service is published and provided by Ahmed BECHIR EI (individual entrepreneur), trading as DELQUOR, registered with the Trade and Companies Register under number 992 562 728 R.C.S. Vienne, whose establishment is located at 36 Rue Antonio Meucci, 38090 Villefontaine, France (the "Publisher"). Full contact details are in the legal notice.

The Terms of Use apply to anyone who visits the public site or uses the application (a "User"). Paid subscriptions are also governed by the terms of sale and subscription (the "Terms of Sale"), and personal data processed on behalf of customers by the data processing agreement. In case of conflict, the data processing agreement prevails for that data, then the Terms of Sale for paid subscriptions, then the Terms of Use.

The application is intended for professional use: knowing and handling the vulnerabilities of the devices an organisation operates or is in charge of managing.

2. Definitions

• Account: a User's personal access to the application, identified by their e-mail address.
• Workspace: the environment of the application in which an organisation records its inventory, watches and actions, and invites its members.
• Customer: the organisation (company, public body, association or independent professional) on whose behalf a Workspace is created or a subscription taken out.
• Administrator: a User who has the owner or administrator role in a Workspace.
• Customer Data: the information entered in a Workspace by the Customer or its Users (inventory, versions, watches, statuses, notes, exceptions) and the results the Service derives from it.
• Public Content: the vulnerability records, histories, vendor, product and version pages, guides and other pages of the public site.
• Sources: information published by third parties that the Service collects, in particular the NVD, the CVE Program, CISA, FIRST, CERT-FR and vendors' advisories and documentation.
• MSSP Account: the account that lets a security service provider manage, from a dedicated console, isolated Workspaces for its own customers (the "Managed Customers").

3. Description of the Service

The public site is freely accessible without an account. It presents vulnerability records (CVE), the catalog of known exploited vulnerabilities published by CISA (KEV), pages by vendor, product and version, a ten-year vulnerability history, a search explorer, guides and the Service's methodology.

The application requires an Account. In particular, it lets you:

• keep the inventory of network and security devices (vendor, product, model, version, patch level);
• match that inventory against the Sources deterministically and obtain, for each vulnerability, a reasoned status: affected, fixed, not affected (with its basis), needs review or unknown;
• prioritise actions with their reasons, see the fixes and releases published by vendors, and track remediation actions and exceptions;
• watch technologies and versions, as well as IP addresses compared with the indicators published by CERT-FR;
• receive alerts in the application and by e-mail, export data as CSV, invite members with roles and read an audit log;
• with the Business MSSP plan, manage Managed Customers from a dedicated console.

The Service does not scan the Customer's networks, does not connect to its devices, installs no agent and applies no fix: it reasons on the information entered and on the Sources. No artificial intelligence model decides whether a device is affected. Some texts of the Sources are machine-translated between French and English by an artificial intelligence model (Mistral AI), then checked deterministically; they are marked as such, and the original text prevails.

Plans limit volume (assets, users, managed customers), never vulnerability information. Their content and prices are described on the pricing page and in the Terms of Sale.

4. Scope and limits of vulnerability intelligence

The Service is a decision-support tool. It replaces neither the Customer's vulnerability management process, nor the expertise of its teams, nor vendors' official communications. In particular:

• Sources may be incomplete, published late, corrected or withdrawn afterwards; the Service reflects their state at their last collection, whose date is shown;
• the absence of an alert or of a displayed vulnerability does not guarantee the absence of a vulnerability: a flaw may not be published yet, may not be linked to the product in the Sources, or may depend on a configuration the Service does not know;
• the match between a device, its version and a vulnerability depends on the information entered and on the published version ranges; when they do not allow a conclusion, the Service says so ("needs review" or "unknown") instead of concluding, and an unrecognised custom value never produces a conclusion. These results may need to be validated by the Customer;
• remediation information (fixed versions, recommended releases, workarounds) repeats what vendors publish; it must be checked against the vendor's documentation and the Customer's technical context (configuration, compatibility, dependencies, maintenance window) before any intervention;
• scores and indicators (CVSS, EPSS, listing in the KEV catalog, priority) help rank vulnerabilities; they prove neither that a vulnerability is exploited in the Customer's environment nor that it is not.

The Service does not guarantee the absence of security incidents. The Customer alone decides on the operations carried out on its systems. These limits describe the nature of the Service: they do not release the Publisher from providing the Service as described and with the care expected of a professional (see the Liability section).

5. Account and access security

The Account is created with an e-mail address and a password, after accepting the Terms of Use; it is activated by the confirmation link sent to that address. The User provides accurate information and preferably uses their professional e-mail address.

The Account is personal and may not be shared. The User keeps their credentials confidential; the Publisher never asks for a password by e-mail. Two-factor authentication is offered and recommended; once enabled, it is required at each sign-in, except on a device the User asked to remember, for 30 days at most. A session ends after 2 hours without activity.

A User who suspects unauthorised use of their Account changes their password and notifies the Publisher without delay at security@patcharo.com. A User who creates a Workspace or takes out a subscription for an organisation declares that they have the authority to bind it.

6. Workspaces, roles and MSSP Accounts

When the application is first opened, a Workspace is created for the User with a 14-day free trial whose conditions are set out in the Terms of Sale. Each member of a Workspace has a role:

• owner: manages the plan and payment, and can hand over ownership;
• administrator: manages members, invitations and Workspace settings;
• analyst: changes the inventory, watches and action tracking;
• viewer: reads without changing anything.

Invitations are single-use links, valid for 7 days, that the Administrator sends to the invited person themselves. Administrators choose members and their roles, remove access from people who no longer need it, configure alerts and make sure the data entered complies with the Customer's obligations.

The holder of an MSSP Account manages, for its Managed Customers, Workspaces isolated from one another. It declares that it holds the necessary authorisations from its Managed Customers and is answerable to them for the use it makes of the Service on their behalf.

7. Permitted and prohibited uses

The User uses the Service fairly, for its intended purpose and lawfully. In particular, the User shall not:

• access or attempt to access an Account, a Workspace or data without authorisation, or circumvent a security or isolation measure or a plan limit;
• test the security of the Service (scanning, penetration testing, load testing) without the Publisher's prior written agreement; a flaw found in good faith is reported as described on the Security page;
• disrupt the Service, its infrastructure or other Users, in particular through excessive automated requests, or extract Public Content by automated means beyond normal browsing or indexing or without honouring the robots.txt file;
• use the Service to prepare or carry out an attack, or to target systems the Customer is not authorised to administer or assess;
• enter data unrelated to the purpose of the Service, in particular passwords, keys or secrets, health data or other special categories of personal data, or unnecessary personal data in free-text fields;
• introduce malicious code, impersonate anyone or infringe third-party rights;
• resell, rent or make the Service available to third parties, except through an MSSP Account for its Managed Customers;
• decompile or disassemble the Service, except where the law allows it.

8. Public Content, Sources and intellectual property

The software, the interface, the texts, the structure and selection of the Public Content, and the Patcharo and DELQUOR names and logos belong to the Publisher or are used with their owners' permission. They are protected by intellectual property law, including the database producer's right.

The Publisher grants each User, for the duration of the trial or subscription, a personal, non-exclusive and non-transferable right to use the application for the Customer's needs. Public Content may be freely read and briefly quoted with an indication of its source; any other reproduction or substantial extraction requires the Publisher's prior agreement, subject to the exceptions provided by law.

Information from the Sources remains subject to its authors' terms, listed in the legal notice. Product names and trademarks mentioned belong to their owners; mentioning them implies neither partnership nor endorsement.

9. Customer Data

The Customer keeps all its rights over Customer Data. The Publisher uses it only to provide, secure and support the Service and to meet its legal obligations. It does not sell it, does not use it to train artificial intelligence models and does not pass it to the machine translation service, which receives public texts only.

The Publisher's staff access Customer Data only when necessary for requested support, the security of the Service or a legal obligation. They go through a restricted administration console that records in a log every change and every view of personal data or of a Workspace's content; the latter is read-only, time-limited, masks some fields and appears in the Workspace's audit log.

The Customer is responsible for the data it enters and its lawfulness. It can download at any time a complete copy of the Workspace's Customer Data in JSON (Settings › Workspace, owners and administrators) and the CSV exports of the analysis (Reports), and keep the exports it considers useful. Reversibility and switching provider, described on the Data portability page, apply to every Customer, subscribed or not. Personal data contained in Customer Data is processed in accordance with the data processing agreement.

10. Availability, maintenance and changes

The Publisher uses reasonable means to keep the Service accessible at all times, without guaranteeing a given availability or response time, unless agreed in writing. The Service may be interrupted for maintenance, after an incident, when hosting providers or networks are unavailable, or in case of force majeure. The Publisher endeavours to announce foreseeable maintenance in advance.

The Sources are collected at regular intervals, described on the Methodology page, with no guaranteed delay between their publication and their inclusion. The Service evolves: the Publisher may add, change or remove features. For a paid subscription, removing an essential feature of the plan follows the Terms of Sale.

11. Alerts and service e-mails

Alerts are sent according to each User's preferences, which can be changed at any time in Settings › Notifications. E-mails needed for the Account (confirmation, password reset, security) cannot be turned off while the Account exists. Delivering an e-mail also depends on e-mail services: the User checks the application, which prevails.

The Publisher sends no marketing communication without the User's prior consent where the law requires it.

12. Suspension and closure

The User can delete their Account at any time from Settings › Account. Deletion is immediate and final; it requires first handing over ownership of Workspaces shared with other members and, where applicable, of an MSSP Account. Its effects on data are described in the privacy policy.

The Publisher may suspend a User's or a Workspace's access, proportionately, in case of a breach of the Terms of Use, a risk to the security of the Service or of other Users, a request from an authority or, for a subscription, in the cases set out in the Terms of Sale. Except in an emergency or where the law forbids it, it informs the User by e-mail with the reasons, and the User can challenge the measure at support@patcharo.com.

The Publisher may end the free use of the Service (trial, Workspace without a subscription) or the Service itself with 30 days' notice by e-mail, during which exports remain possible.

13. End of use and what happens to the data

Several situations must be distinguished:

• end of the trial or termination of a subscription: the Workspace becomes read-only; its data is kept and remains readable and exportable;
• leaving a Workspace or removal of a member: that person's access ends, the Workspace's data remains;
• Account deletion: the Account is erased immediately, together with the Workspaces of which the User was the only member and their data;
• erasure of personal data: it can be requested at any time under the privacy policy.

To date, the Publisher does not automatically delete read-only Workspaces; the Customer can delete them itself by deleting their owner's Account, once the other members are removed.

14. Liability

The Publisher has an obligation of means (best efforts). It is liable for direct and foreseeable damage caused by a proven breach of its obligations. It is not liable for the consequences of:

• the content of the Sources, which it reproduces with their origin, where the damage results from an error, omission or delay of the Source itself;
• inaccurate or incomplete information entered by the Customer or its Users;
• the Customer's decisions and interventions on its systems, or a use of the Service contrary to the Terms of Use;
• an interruption due to force majeure or to the failure of networks or external services the Publisher does not control.

For a paid subscription, the liability cap set out in the Terms of Sale applies. No limitation applies in case of gross negligence or wilful misconduct, personal injury, or where the law forbids it; in particular, a User acting as a consumer keeps every right to compensation the law grants them. The User is responsible for their use of the Service and for the data they enter.

15. Personal data and cookies

The processing of personal data the Publisher carries out on its own behalf is described in the privacy policy and trackers on the Cookies page. For Customer Data, the Publisher acts as a processor under the data processing agreement. The User who creates a Workspace accepts it on the Customer's behalf.

16. Points of contact and notice of illegal content

The single point of contact for authorities and Users, in particular under Regulation (EU) 2022/2065 on digital services, is contact@patcharo.com, in French or English.

Anyone may notify that address of content hosted by the Service that they consider illegal, stating the exact location of the content, the reasons for the notice, their name and e-mail address (save where the law provides otherwise) and their good faith. The Publisher acknowledges receipt, handles the notice diligently and informs its author of its decision. Customer Data is not public and is not subject to any automated moderation; the Publisher only acts on a notice or a legal obligation, and informs the User concerned of any restriction and its reasons.

17. Changes to the Terms of Use

Each version of the Terms of Use is dated and remains available at its own address. The Publisher may change the Terms of Use to reflect changes to the Service or the law. A substantial change is announced at least 30 days before it takes effect, by e-mail or in the application, and its express acceptance is requested in the application; a User who refuses it can stop using the Service and delete their Account, and the Terms of Sale set out the rights of a subscribed Customer. A correction of form or of contact details applies as soon as it is published.

18. Contact and complaints

For any question or complaint about the Service, the User writes to support@patcharo.com describing their request. The Publisher acknowledges receipt and replies as soon as possible. Questions about personal data go to contact@patcharo.com, security flaws to security@patcharo.com.

19. Governing law and disputes

The Terms of Use are governed by French law. In case of disagreement, the User first sends the Publisher a written complaint so that an amicable solution can be sought.

Failing an amicable settlement, any dispute between the Publisher and a User who is a trader (commerçant) falls under the exclusive jurisdiction of the competent court for the place where the Publisher's establishment is located, including in case of multiple defendants or third-party claims. In other cases, the competent court is determined by the statutory rules.

20. Language and general provisions

The Terms of Use are offered in French and English; in case of discrepancy, the French version prevails, subject to any more favourable mandatory provisions applicable to the User.

The Publisher's electronic records, in particular the record of the acceptance of the Terms of Use with its version, date and language, constitute evidence between the parties unless proven otherwise. If a clause were held void, the others would remain in force. Not relying on a clause does not waive the right to rely on it later.