Terms of sale

1. Purpose and scope

FirmVox is an online service supporting compliance with Regulation (EU) 2024/2847 (Cyber Resilience Act), published by MINDSTACK, SAS with a share capital of 1 euro, Paris Trade and Companies Register 105 706 642, 59 rue de Ponthieu, bureau 326, 75008 Paris (the “Publisher”). It is intended for companies that design, manufacture, import or distribute products with digital elements.

The service is reserved for professionals acting in the course of their business. By creating an account or placing an order, the customer declares that it acts in a professional capacity.

Any order implies unreserved acceptance of these terms, in the version in force on the date of the order.

2. Description of the offerings

The diagnostic. An online questionnaire, free and without account creation, whose computation runs entirely in the user's browser. It returns the product's classification, the obligations attached to the declared role, a maturity score and the first three identified gaps.

The full report. For a diagnostic saved to an account, unlocking the full report gives access to all identified gaps, the action plan and the document templates. It is a one-off purchase, attached to a given report.

Vulnerability monitoring. A monthly subscription giving access, for each monitored product, to daily monitoring of the software components declared by the customer, alerts when a published vulnerability affects them, and the preparation of notification drafts. Monitoring relies exclusively on the software bills of materials supplied by the customer.

The guided diagnostic. A ninety-minute video session during which the questionnaire is completed with the customer and the report discussed. The customer receives the full report for the product covered and a prioritised action plan.

3. Definition of a monitored product

For the purposes of the monitoring subscription, a product is one monitored firmware or software, embodied in a single software bill of materials (SBOM). Commercial references sharing the same firmware constitute a single product, whatever their number.

The number of monitored products determines the subscription amount according to the price grid. The customer may add or remove a product at any time from its account; the amount is adjusted pro rata for the current period.

4. Prices

Prices are stated in euros. The Publisher benefits from the French VAT exemption for small businesses (Article 293 B of the General Tax Code): no VAT is added, and the amounts stated are the amounts invoiced. Should the Publisher become subject to VAT, prices would be understood exclusive of VAT and VAT would be added at the rate in force, after prior notice to the customer and from the following instalment.

The full report is billed at €200 per report. The guided diagnostic is billed at €390 per session. Monitoring is billed monthly in graduated tiers: €500 for the first monitored product, €200 per product from the second to the fifth, €100 per product from the sixth onwards — each tier keeping its own price.

When a customer subscribes to monitoring, the amount paid for the full report or the guided diagnostic for the same product within the thirty days preceding the subscription is deducted from the first monthly instalment.

The Publisher may change its prices. Changes apply to orders placed after their publication; for current subscriptions, they take effect at the instalment following prior notice of at least thirty days, the customer being free to terminate at no cost within that period if it declines the new grid.

5. Launch offer

A 50% discount on the monitoring subscription for twelve months is offered to the first ten customers, on presentation of a promotion code at subscription. It is conditional on a twelve-month commitment and on taking part in usage feedback exchanges with the Publisher.

Should the customer terminate before the end of the twelve months, the discount received since the start of the subscription becomes due and is invoiced as an adjustment, up to the difference between the amounts invoiced and the standard rate over the elapsed period. No adjustment is due where termination results from a breach by the Publisher.

6. Ordering and payment

Payments are made by card through the provider Stripe. The Publisher never has access to the customer's card data. The invoice is issued through Stripe and made available to the customer.

The full report is unlocked upon payment confirmation. The monitoring subscription takes effect upon confirmation of the first payment and renews monthly by automatic debit.

The guided diagnostic is booked through the site's scheduling tool and invoiced after the session, payable on receipt. The session may be cancelled or rescheduled at no cost up to forty-eight hours before the agreed time; after that, it is due, save for legitimate impediment.

In the event of payment failure, access to the offerings concerned is suspended until the situation is regularised.

7. Term and termination

The monitoring subscription is concluded for one month, tacitly renewable. The customer may remove products or terminate at any time from its account; termination takes effect at the end of the current monthly period, which remains due and served. No pro rata refund is made for a period already begun.

Removing the last monitored product amounts to terminating the subscription.

The Publisher may terminate the subscription in the event of a breach of these terms by the customer, after formal notice remaining without effect for fifteen days.

8. Right of withdrawal

The service is reserved for professionals acting in the course of their business: the right of withdrawal granted to consumers therefore does not apply. By exception, where the customer is a business employing five employees or fewer and the subject matter of the contract falls outside its main activity, it has the fourteen-day withdrawal period provided for in Article L. 221-3 of the French Consumer Code. In that case, a customer requesting immediate performance acknowledges, under Article L. 221-25 of the same code, that it owes the amount corresponding to the service already provided.

9. Customer obligations

The customer is solely responsible for the accuracy of the information it provides — product profile, economic role, questionnaire answers, software bills of materials. The service's results depend directly on it.

The customer retains control of, and responsibility for, its compliance decisions, its declarations and its notifications to the authorities. The service prepares documents; the customer checks and submits them itself.

The customer undertakes not to use the service on behalf of third parties without the Publisher's agreement, and to keep its credentials confidential.

10. Nature of the service and liability

FirmVox is a support tool: its results are produced automatically from the customer's answers and the text of the regulation. They do not constitute legal advice, guarantee neither the compliance nor the classification of a product, and do not dispense with consulting the official text or qualified counsel.

Vulnerability monitoring relies on public sources (the OSV database, CISA's KEV catalogue) whose completeness and publication delays the Publisher does not control. The absence of an alert does not mean the absence of a vulnerability.

The Publisher's liability is limited to direct and foreseeable damage resulting from a breach attributable to it, capped at the total amounts paid by the customer during the twelve months preceding the triggering event. Indirect damage is excluded, in particular loss of business, revenue, data or reputation, as well as the consequences of an administrative penalty imposed on the customer. The Publisher is not liable for failures resulting from force majeure, from inaccurate information supplied by the customer, or from the unavailability of public vulnerability sources. These limitations do not apply in the event of gross negligence or wilful misconduct.

11. Availability and evolution of the service

The Publisher endeavours to provide continuous access to the service, without any availability guarantee. Maintenance interruptions may occur. The service evolves; its features may be modified provided the purpose of the subscribed offerings is preserved.

12. Personal data and confidentiality

The processing of personal data is described in the privacy policy. Data submitted by the customer — bills of materials, products, results — remains its property; the Publisher uses it only to perform the service.

13. Intellectual property

The service, its assessment engine, its texts and its brand remain the property of the Publisher. The customer has a non-exclusive, non-transferable right of use for the duration of the offerings. Reports and documents generated for the customer may be freely used by it in the course of its business.

14. Governing law and disputes

These terms are governed by French law. In the event of a dispute, the parties will seek an amicable solution; failing that, jurisdiction is granted to the courts of Paris.

Recourse to a consumer mediator is not available for disputes between businesses. The parties may nevertheless agree to contractual mediation before any legal action.

15. Changes to the terms

The Publisher may amend these terms. The applicable version is the one in force on the day of the order; for subscriptions, the new version applies from the instalment following its notification to the customer.

See also

• Legal notice
• Privacy policy