Terms of use

1. Purpose

These terms govern the use of the Portolan Sec client portal (the "portal") by the people invited to it. The portal lets the clients of [Raison sociale] follow their engagements, read and discuss findings, record risk decisions, download reports, exchange encrypted files and access the same information through an API. The engagement itself (scope, price, confidentiality, liability) is governed by the contract signed with your organisation, which prevails over these terms. The portal is reserved for professional use.

2. Accounts

• Accounts are created only from a personal invitation link and are activated once validated by Portolan Sec.
• An account is personal: do not share it. You are responsible for keeping your password secret; we recommend enabling two-factor authentication.
• Your password also protects your encryption key, which nobody can recover. If you lose it, Portolan Sec can send you a reset link: you then get a new key, and files are shared with it again.
• Tell us immediately if you suspect that your account or an API token has been compromised.
• Your organisation must tell us when someone leaves it, so that we remove their access. Accounts unused for 18 months are deleted after a warning (see the privacy policy).

3. Acceptable use

• Use the portal only for the engagements of your organisation.
• Do not try to access data you have not been given access to, to bypass security measures, or to disrupt the service. If you find a vulnerability in the portal, report it under our disclosure policy.
• Only upload files needed for the engagement. Malware samples, credentials or other sensitive material are exchanged only when agreed with us, in an archive whose nature is stated clearly.
• API tokens are subject to rate limits; automated use must stay reasonable.

4. Confidentiality of findings

Findings and reports describe weaknesses of your systems. Your organisation decides who, internally, may read them, and is responsible for the distribution of the reports it downloads.

5. Retention and deletion

• Files are deleted 30 days after upload, unless another duration was agreed.
• The data of an engagement is deleted at the end of its retention period — by default 12 months after the report is delivered. You are warned 30 days before; download the report and anything you need to keep.

6. Availability

We do our best to keep the portal available and secure but, unless the contract says otherwise, we do not guarantee uninterrupted availability. Maintenance may interrupt the service briefly. Reports can always be sent to you by other means on request.

7. Personal data

The processing of personal data is described in the privacy policy.

8. Suspension

We may suspend an account that breaches these terms or endangers the security of the portal, and inform your organisation.

9. Changes and applicable law

We may update these terms; significant changes are announced in the portal. These terms are governed by French law. Any dispute between professionals that cannot be settled amicably falls under the jurisdiction of the courts of [Ville].