General Terms of Use

Purpose and contractual documents

These General Terms of Use (hereinafter the “Terms”) set out the conditions for accessing and using the techwatchalert.com website and the application available at app.techwatchalert.com, including its API (hereinafter together the “Service”), published and operated by TechWatchAlert (hereinafter “TechWatchAlert”).

Accessing and using the Service implies full acceptance of these Terms. Users who do not accept them must refrain from using the Service.

These Terms are supplemented by:

• the General Terms of Sale (Terms of Sale), for plans and the Partner programme;
• the Privacy Policy, for the processing of personal data;
• where applicable, a data processing agreement (DPA) or a specific contract signed with TechWatchAlert, which prevails over these Terms and the Terms of Sale for the matters it covers.

Definitions

• “Service”: the TechWatchAlert platform as a whole: website, web application, REST API, and their features (vulnerability and end-of-life monitoring, alerts and notifications, workflows, cases and reports, NIS2 module, Discussions, the Vigie assistant, Partner space, integrations and exports).
• “User”: any natural person who accesses the Service, with or without an Account.
• “Customer”: the natural or legal person who subscribes to a plan, free or paid, for an Organisation.
• “Account”: a User's personal access to the application, protected by their Credentials.
• “Organisation”: a team's workspace, which holds the subscription, members, groups, projects, API keys and settings. Each Account also has a personal space.
• “User Content”: any data entered, imported or sent by a User in the Service: inventories, configurations, comments, cases, registers, imported files, Discussions messages, requests made to Vigie or to support.
• “Security Data”: information on vulnerabilities (CVEs), their exploitation, their scores (CVSS, EPSS) and software end-of-life dates, taken from the third-party sources described in Article 13.
• “Discussions”: the team messaging built into the application, end-to-end encrypted (Article 9).
• “Vigie”: the Service's artificial intelligence assistant and, more broadly, the AI features described in Article 11.
• “NIS2 Module”: the features that help implement Directive (EU) 2022/2555, described in Article 14.
• “Partner”: an organisation admitted to the Partner programme, which manages its own clients' Organisations (the “Managed Clients”) from the Partner space.
• “Credentials”: the email address and password, two-factor authentication codes, single sign-on (SSO) and API keys that give access to the Service.

Access to the Service, Account creation and trial

3.1 Open access

The techwatchalert.com website and its public tools (guides, CVSS calculator, directories) are free to use, without registration.

3.2 Trial without an account

The application offers a trial without an account: the User pastes a dependency manifest, an SBOM or a list of components and gets the known vulnerabilities affecting them. The submitted content is analysed on the fly and is not stored. The trial is limited in size and frequency, including per IP address. Its results are indicative and fall under Article 13.

3.3 Creating an Account

Access to the application requires an Account, created with a valid email address held by the User and a password meeting the platform's requirements, or through the single sign-on (SSO) configured by an Organisation. A verification email confirms the address. Creating an Account constitutes acceptance of these Terms and, for paid plans, of the Terms of Sale.

The email address serves as the login and as the channel for notifications about the Account, alerts and billing. TechWatchAlert may refuse or suspend the creation of an Account, in particular where there is a risk of abuse.

Registration requirements

4.1 Legal capacity

The Service is reserved for natural persons of legal age with full legal capacity. A User acting on behalf of a legal entity declares that they have the authority required to bind it.

4.2 One Account per person

Each User may hold only one Account per email address. Creating multiple Accounts to circumvent the limits of a plan, or for any other fraudulent purpose, is prohibited and is grounds for termination.

4.3 Accurate information

Users provide accurate information and keep it up to date. Fraudulent or incorrect information may lead to suspension or termination of the Account.

4.4 Professional use

The Service is designed for professional use in the field of IT security. Personal use remains possible but is not the Service's intended use.

Security of the Account and Credentials

5.1 Responsibility for Credentials

Users are solely responsible for keeping their Credentials confidential and for the actions carried out from their Account. TechWatchAlert is not liable for the consequences of unauthorised access resulting from a User's negligence.

5.2 Good practice

Users undertake to:

• choose a strong, unique password and never disclose their Credentials to anyone;
• enable the two-factor authentication (TOTP) available on all Accounts, and keep their recovery codes in a safe place;
• log out at the end of each session on a shared device, and protect the devices on which they use Discussions (Article 9).

5.3 Incident notification

If a compromise is suspected (unauthorised access, stolen Credentials, abnormal activity), the User immediately changes their password, has the relevant API keys revoked, resets their two-factor authentication and notifies TechWatchAlert at [email protected]. TechWatchAlert may temporarily suspend an Account showing signs of abnormal activity and informs the User as soon as possible.

5.4 API keys

API keys are Credentials in their own right. They must never be exposed (code repositories, logs, unprotected variables). A compromised key must be revoked without delay from the relevant Organisation (Article 16).

Organisations, projects, roles and groups

6.1 Organisation

The Organisation is a team's workspace: it holds the subscription, members, groups, projects, API keys, single sign-on and audit log. Its creator is its Owner. An Account's personal space is reserved for a single User and does not accept invitations.

6.2 Roles and groups

Rights derive from the roles and groups defined in the Organisation:

• the Owner chooses, changes or cancels the plan, appoints the NIS2 officers and may delete the Organisation;
• the Administrators manage members, invitations, groups, API keys and single sign-on, and consult the audit log, depending on the plan;
• the Members access the projects and features their groups open to them, with a project role (Owner, Admin, Analyst or User) and rights configurable by area, including for Discussions.

6.3 Customer responsibility

The Customer, through its Owner and Administrators, decides whom it invites and which rights it grants. It promptly removes access for people who leave its team, ensures that its members comply with these Terms and is responsible for their use of the Service.

6.4 Single sign-on

On the Team and Enterprise plans, the Organisation can configure OpenID Connect single sign-on and verify its domains. The Customer remains responsible for its identity provider and the accounts it manages there.

Acceptable use of the Service

Users use the Service fairly, in accordance with its purpose, these Terms, applicable laws and regulations and the rights of third parties.

7.1 Permitted uses

• monitoring of vulnerabilities and end-of-life dates for technologies used by the User or their clients, alerts, prioritisation and remediation tracking;
• production of reports and evidence, including with the NIS2 Module;
• team conversations on these topics in Discussions;
• integration of the Service into the User's tools (ticketing, messaging, CI/CD, monitoring) through integrations and the API;
• any other lawful use aimed at improving the security of the User or their clients.

7.2 Services for third parties

The Service may be used to provide security services to clients, within the limits of the plan subscribed. Reselling access to the Service as such is only permitted under the Partner programme (Article 15).

7.3 Monitored URLs and imports

Monitoring a URL leads TechWatchAlert to query the declared site regularly to detect its technologies and read its certificate. Users only declare sites they operate or are authorised to analyse. They only upload files (SBOMs, manifests, scan reports) they are entitled to use.

Prohibited uses and content

Users must not:

8.1 Attacks on security and integrity

• attempt to compromise, bypass or disable the platform's security measures, including the encryption of Discussions;
• carry out penetration tests or vulnerability scans on TechWatchAlert's infrastructure without prior written authorisation (Article 12);
• introduce malware or any harmful code, or attempt to access other Users' data or unauthorised resources;
• exploit a vulnerability in the Service without reporting it through the responsible disclosure process in Article 12.

8.2 Attacks on availability

• generate a volume of requests likely to degrade the Service for other Users, or carry out unauthorised mass extraction;
• circumvent rate limits and quotas (API, AI features, trial without an account);
• use bots or scripts on the web interface in a way that does not comply with its intended use.

8.3 Malicious uses

• use information from the Service to design or carry out attacks on third-party systems, or for any unauthorised intrusion, espionage or intelligence gathering;
• share information from the Service in a way that facilitates malicious activity.

8.4 Prohibited content

In any User Content (Discussions, comments, cases, registers, requests to Vigie or to support), it is prohibited to post or send:

• unlawful content, or content whose distribution is prohibited by law;
• threats, harassment, or abusive, defamatory, hateful or discriminatory statements;
• malware, phishing links or links to malicious code intended to be run against third parties;
• content that infringes third-party rights: intellectual property, privacy, trade secrets, personal data processed without a legal basis;
• unsolicited commercial messages, or content impersonating another person.

Exchanging technical information on vulnerabilities (CVEs, public proofs of concept, patches) for defensive purposes is the very purpose of the Service and is not covered by this Article.

8.5 Infringement of TechWatchAlert's rights and circumvention of plans

• reproduce, sell, rent or distribute all or part of the Service without written authorisation, outside the Partner programme;
• reverse engineer the Service, except where permitted by law, or remove the proprietary notices and warnings it contains;
• use TechWatchAlert's trade marks and logos without authorisation;
• share Credentials or create several Accounts to exceed the limits of the plan subscribed.

Discussions: end-to-end encrypted team messaging

9.1 How it works

Discussions let the members of an Organisation talk in the Organisation’s # général channel and through direct messages between two members. No other channel can be created. Access depends on the permissions set by the Organisation: level of access to Discussions (none, read, write), access to the Organisation channel, sending direct messages. A direct message is only possible between two members of the same Organisation who both have that permission; if one of them leaves the Organisation, the conversation stays readable for the other but becomes read-only.

Messages, reactions and edits are end-to-end encrypted in the browser, using the MLS protocol (RFC 9420). Private keys are generated and kept on each User's device and are never sent to TechWatchAlert. The server relays and orders encrypted messages; it holds no keys.

9.2 Consequences of encryption

• TechWatchAlert can neither read nor moderate the content of messages exchanged in Discussions;
• TechWatchAlert carries out no automated moderation or analysis of encrypted content;
• TechWatchAlert cannot restore a message: a new device cannot read messages sent before it joined, and “Forget this device” erases the messages kept on it;
• the confidentiality of a conversation also depends on Users: verifying participants (verification emojis), and protecting and locking their devices.

9.3 What TechWatchAlert knows

To operate the service, the server only knows metadata: who writes in which channel and when, the size of messages, the people mentioned (to notify them, without the text), channel members, registered devices (name and public key) and presence status. Displaying an alert or CVE record quoted in a message goes through the server, like any other viewing of that record.

9.4 Exceptions: Vigie

The private conversation with Vigie is not end-to-end encrypted: its messages are sent to TechWatchAlert and to the AI provider to obtain the reply (Article 11). Vigie takes part neither in the Organisation channel nor in direct messages: none of their messages is sent to it.

9.5 Users' responsibility

Each User is solely responsible for the messages they send and complies with Article 8. The Organisation's Administrators set the access rights to Discussions, on which the members of the Organisation channel and the ability to exchange direct messages depend. Discussions are not an archiving tool: the Customer keeps elsewhere any information it is required to retain, since TechWatchAlert can neither read it nor export it in plain text.

9.6 Reports and requests from authorities

Any User may report abusive content or behaviour to [email protected], attaching the material they choose to share (excerpts, screenshots). As TechWatchAlert cannot access the encrypted content, it handles reports and lawful requests from authorities using only the metadata it holds (Account, channel, date and time, size of messages), not the content.

Depending on the seriousness, TechWatchAlert may warn the User concerned, suspend their access to Discussions or to their Account, revoke their devices, or terminate their Account (Article 21). It responds to requests from authorities within the limits of the data it holds and of the law.

Communicating with support

10.1 Channels

TechWatchAlert support can be reached by email at [email protected] and, where this feature is offered, by live conversation from the application. The level of support depends on the plan (Article 12 of the Terms of Sale).

10.2 Confidentiality of exchanges

Exchanges with support are not end-to-end encrypted, unlike Discussions. They are stored on TechWatchAlert's servers and read by authorised members of the support team to handle the request.

Users must not send passwords, API keys, secrets or sensitive personal data through support. Support does not need your password and will not ask for it.

10.3 Access to Account content

Support only accesses the content of an Account or Organisation at the User's explicit request for assistance; such access is then recorded in the audit log. The content of Discussions remains inaccessible in any event.

10.4 Retention

Exchanges with support are kept for the lifetime of the Account, unless a different period is stated in the Privacy Policy. The rules in Article 8 apply to them.

Artificial intelligence features (Vigie)

11.1 Description

Vigie answers the User's questions about vulnerabilities, end-of-life dates and their stack, in a private conversation; it does not take part in Discussions. The Organisation can withdraw the use of Vigie from some of its members. It can suggest actions in the application (add a component, follow an end-of-life date, monitor a URL, build a dashboard): these actions are only carried out after the User approves them. Depending on the plan, Vigie can also build workflows and add an analysis to a workflow's notifications. Usage is limited by quotas specific to each plan.

11.2 Model provider

Replies are produced by an AI model supplied by a third-party provider, chosen and configured by TechWatchAlert as platform administrator: Mistral AI by default. TechWatchAlert may change provider; the provider in use is listed in the Privacy Policy.

11.3 Data sent to the provider

• Private conversation: the User's messages and the recent history of the conversation, with technical context from the active project (components, recent alerts, followed end-of-life dates, monitoring articles). TechWatchAlert adds no email addresses, member lists or internal identifiers.
• Workflows and dashboards: the public technical data of the event (CVE, end-of-life cycle, certificate) or the User's request, with email addresses masked, and no data that identifies a person.

Text entered by the User is sent as written: Users should not include unnecessary personal data or secrets.

11.4 Use by the provider

TechWatchAlert does not use User Content to train AI models. Processing of the data by the provider (retention, any reuse, location) is governed by that provider's terms applicable to the service used by TechWatchAlert. TechWatchAlert does not guarantee that the provider will not reuse data beyond what those terms provide.

11.5 Reliability of outputs

Vigie's replies are generated automatically. They may be inaccurate, incomplete, out of date or unsuitable, even when they sound assertive. They do not constitute professional advice. Users have them checked by a qualified person before any decision, in particular before a fix, a risk acceptance or an incident notification.

Users remain responsible for how they use the replies and for the actions they approve. AI features may be limited, suspended or unavailable, in particular if the provider fails or a quota is used up.

Platform security

12.1 Security measures

TechWatchAlert implements appropriate technical and organisational measures to protect the Service and data, including: hashed passwords, two-factor authentication available on all Accounts, encryption of data in transit and at rest, end-to-end encryption of Discussions, an audit log of sensitive actions and encrypted daily backups. Details are given on the Securitypage, which only lists measures actually in place.

12.2 Responsible vulnerability disclosure

Any vulnerability discovered in the Service must be reported to [email protected] before any public disclosure, allowing reasonable time for it to be fixed.

TechWatchAlert undertakes to acknowledge every report within 5 working days, to handle vulnerabilities diligently, and not to take legal action against any researcher who has acted in good faith as part of responsible disclosure.

12.3 User responsibility

Users undertake not to carry out security tests (scans, fuzzing, injection) on TechWatchAlert's infrastructure without prior written authorisation. Any action likely to compromise the security or availability of the Service is prohibited and constitutes a criminal offence that may be prosecuted under the Godfrain Act (Articles 323-1 et seq. of the French Criminal Code).

Security Data from third-party sources

13.1 Sources

Security Data comes from third-party sources, including CVE List (MITRE), NVD (NIST), the CISA KEV catalogue, EPSS (FIRST), GitHub Security Advisories, OSV.dev, PoC-in-GitHub, VulnCheck, CERT-FR (ANSSI), the EUVD (ENISA) and endoflife.date for end-of-life dates, as well as editorial monitoring sources. The list and licences are detailed in Data sources.

13.2 Provided as is

This data is provided as is, as published by its sources and subject to their own terms. TechWatchAlert guarantees neither its completeness, nor its accuracy, nor its timeliness: a source may publish late, be wrong about affected versions, correct a record or be unavailable, and synchronisation introduces a delay.

Matching against the User's inventory depends on the accuracy of that inventory and of product identifiers: both false positives and omissions are possible. The absence of an alert does not mean the absence of a vulnerability.

13.3 Calculated indicators

Priorities, remediation deadlines and other indicators calculated by TechWatchAlert are based on rules and parameters, some of which can be configured by the Organisation. They are indicative.

13.4 Not a substitute

The Service is not a substitute for a security assessment by a qualified professional, a penetration test or the advisories of the vendors concerned. The Customer remains responsible for its remediation decisions and for the security of its systems.

NIS2 compliance module

14.1 Purpose

On the Team and Enterprise plans, the NIS2 Module supports part of the obligations under Directive (EU) 2022/2555 and its implementing acts: monitoring including national CSIRTs, a register of accepted risks, remediation deadlines, inventory reviews, suppliers, an incident register with notification deadlines, and a management report.

14.2 Nature of the module

The NIS2 Module is a decision-support and evidence-keeping tool. It is neither legal advice, nor an audit, nor a certification or accreditation, and does not make the Customer “compliant”. It does not cover all the measures required by the Directive. References to legal texts and frameworks may change, in particular with transposition into national law; TechWatchAlert does not guarantee that they are up to date at all times.

14.3 Customer responsibility

The Customer remains solely responsible for determining whether it is subject to NIS2, for its compliance, for the content of its registers and for the notifications it makes to the competent authorities, which it makes itself. The deadlines displayed are an aid and do not replace the Customer's own analysis.

14.4 Registers

Registers keep the history of decisions, which are never rewritten. An Organisation that holds a NIS2 incident register cannot be deleted from the application: the Customer exports the register and then contacts support.

Partner space and delegated access

15.1 Partner programme

The Partner programme is open, on application, to service providers that manage security for several clients; admission is decided by TechWatchAlert. Its financial terms are set out in Article 14 of the Terms of Sale.

15.2 Delegated access

The Owners and Administrators of the Partner's organisation have access to all Managed Clients' Organisations, where they appear as “Partner” members. In particular, they can create projects there, invite contacts, choose each Managed Client's plan, view alerts and produce reports.

An existing Organisation is only entrusted to a Partner with the agreement of its Owner, through a single-use, time-limited attachment link. Detachment requires the Managed Client to have its own Owner.

15.3 Partner's responsibilities

• hold a mandate or contract from each Managed Client authorising it to create and administer its Organisation and to access its data;
• inform Managed Clients and their users of these Terms and the Privacy Policy, and ensure compliance with them;
• be responsible for the actions of its technicians, restrict access to what is strictly necessary and promptly remove access for people who leave its team;
• agree with each Managed Client how their respective roles are allocated under data protection law.

15.4 White label

The Partner may display its logo on the PDF reports and in the application of its Managed Clients; the “via TechWatchAlert” mention is removed above a number of Managed Clients set by TechWatchAlert. The Partner warrants that it holds the rights to the logos it uploads, does not present itself as the publisher of the Service and does not mislead its clients about the origin of the data. White labelling does not transfer any intellectual property rights.

15.5 End of participation

When the Partner subscription ends, Managed Clients lose the plan assigned by the Partner; they may subscribe to their own plan. The Partner informs them beforehand.

Integrations, API and exports

16.1 Integrations

Depending on the plan, the Service can be connected to third-party tools: Jira, GitLab and GitHub tickets; webhooks to Slack, Microsoft Teams, Discord or any JSON endpoint (HMAC-signed); GLPI and Microsoft Intune inventory connectors; OpenID Connect single sign-on. Users provide the addresses and access needed, limited to the rights strictly required.

Data sent to these tools leaves the Service and is governed by their publishers' terms. These tools are the Customer's own, not TechWatchAlert's sub-processors, and TechWatchAlert is not responsible for their operation, availability or changes.

16.2 API and API keys

The REST API v1 is available on the Team and Enterprise plans, within an hourly call quota. API keys are created at Organisation level; they give read access, except for uploading scan reports, and can be limited to certain resources, certain projects and in time. A key is displayed only once. The Customer is responsible for keeping it safe; TechWatchAlert may limit or revoke a key in the event of abuse or a security risk.

16.2a MCP connector (Claude and other clients)

The User may authorize a Model Context Protocol client, such as Claude, to access the Service on their behalf, for an Organization and permissions they choose on the authorization screen. The authorized application never has more rights than the User in that Organization; the read and write permissions granted can only restrict them. Actions taken by this client are the User's, with the same checks and the same audit log trail. The User, or an Organization administrator, may revoke this access at any time; removal from the Organization also ends it.

The authorized client is the User's tool, not a subprocessor of TechWatchAlert: the data the Service sends back to it is governed by its publisher's terms. TechWatchAlert may rate-limit calls, and suspend or revoke an access in case of abuse or security risk.

16.3 Exports

Depending on the plan, Users can export CVEs and alerts in Excel format, NIS2 registers as CSV or PDF, and PDF reports. The Customer is responsible for the security of exported files.

Whatever the plan, Free included, the Owner and the administrators of an Organisation can export all of its data free of charge (article 22.1).

16.4 External links

The Service contains links to third-party sites (data sources, vendor advisories, articles). TechWatchAlert controls neither their content, nor their availability, nor their personal data practices.

User Content

17.1 Ownership and licence

The User, or the Customer on whose behalf they act, retainsfull ownership of User Content. They grant TechWatchAlert a limited, non-exclusive, non-transferable licence, for the time necessary, solely in order to:

• host, process and display User Content in order to provide the Service;
• send it to the integrations configured by the User and, when the User uses AI features, to the AI provider within the limits of Article 11;
• improve the Service using aggregated and anonymised data;
• comply with its legal obligations.

17.2 Responsibility for content

Users are solely responsible for the accuracy, lawfulness and relevance of User Content. TechWatchAlert does not review this content in advance, and cannot access the content of Discussions.

Intellectual property

18.1 TechWatchAlert's rights

The components of the Service are owned by TechWatchAlert or licensed to it: source code, algorithms, architecture and databases; interfaces, mock-ups and visual elements; trade marks, logos and domain names; texts, documentation and methodologies; the structuring, enrichment and organisation of Security Data (calculated scores, correlations, indexing). They are protected by intellectual property law.

18.2 Public data

Raw data from public sources remains subject to its own reuse terms; TechWatchAlert claims no exclusive rights over it.

18.3 Right of use

The plan subscribed grants a non-exclusive, non-assignable and non-sublicensable right to use the Service, limited to its term and features. This right does not entail any transfer of ownership.

18.4 Feedback

TechWatchAlert may freely use the suggestions and feedback Users send it to improve the Service, without compensation.

Personal data and cookies

19.1 Roles

TechWatchAlert acts as controller for Account management, the commercial relationship, the security of the Service and audience measurement. For the personal data the Customer places in the Service (members, inventories, comments, cases, registers, incidents), TechWatchAlert acts as processor, on the Customer's instructions; a data processing agreement (DPA) is available under the conditions of the Terms of Sale.

19.2 Sub-processors

TechWatchAlert uses sub-processors for hosting (in France), delivery and protection of the website and application, audience measurement, payment and billing (Paddle, merchant of record) and, when AI features are used, the AI provider. Emails are sent from its own mail server. The named list and transfer safeguards are given in the Privacy Policy and on the Security page.

19.3 Retention, rights and cookies

The data processed, its purposes, retention periods, individuals' rights and the use of cookies are described in the Privacy Policy. Cookie preferences can be set from the consent banner.

Availability and maintenance

20.1 Availability target

TechWatchAlert endeavours to keep the Service available with an availability target of 99.5% per calendar month, calculated excluding scheduled maintenance and force majeure. This target is not a contractual guarantee, except for Customers who have an availability commitment set out in a contract signed with TechWatchAlert. TechWatchAlert is bound by an obligation of means (best efforts).

20.2 Scheduled maintenance

Maintenance operations are, as far as possible, scheduled outside peak hours and announced by email or in-app notification with at least 48 hours' notice.

20.3 Incidents

In the event of an incident, TechWatchAlert endeavours to inform Users as soon as possible through the available channels, to restore the Service as quickly as possible and to provide a report for significant outages.

20.4 Changes

TechWatchAlert may change the Service, in particular by adding, modifying or removing features, under the conditions of Article 25.

Suspension and termination

21.1 Suspension

TechWatchAlert may suspend all or part of a User's access (including to Discussions or AI features), with or without notice depending on the seriousness, in the event of:

• suspected or actual breach of these Terms, in particular Articles 8 and 9;
• a well-founded abuse report, or abnormal activity on the Account (attempted compromise, abuse of the API);
• non-payment, under the conditions of the Terms of Sale;
• a request from a competent authority.

The User is informed by email as soon as possible, unless doing so is likely to increase the risk.

21.2 Termination by TechWatchAlert

TechWatchAlert may terminate an Account in the event of a serious or repeated breach of these Terms, the provision of manifestly false information, use of the Service for unlawful purposes, or persistent non-payment beyond the period set out in the Terms of Sale.

21.3 Termination by the User

The Owner of an Organisation can cancel the plan from the Billing tab or delete the Organisation from the application (Article 22.4). Users can delete their Account from their settings (Article 22.6).

21.4 Effects

On termination, whatever the cause, rights of use end and data is handled in accordance with Article 22. Provisions intended to survive (intellectual property, limitation of liability, governing law) remain in force.

Export, switching provider and data deletion

22.1 Full export, free on every plan

Whatever its plan, Free included, the Customer can at any time export, by itself and free of charge, all the data of its Organisation from the application (Data page of the Organisation settings), in open, structured and commonly used formats (JSON, CSV, CycloneDX). The exportable data, their structures and formats are described in a public, up-to-date register published in the Service documentation. Access secrets (passwords, keys, tokens) and end-to-end encrypted messages are not exported.

The per-domain exports and the API provided for in article 16 remain available according to the plan. A copy of an Account’s data can also be requested at [email protected].

22.2 Moving to a lower plan

Moving to a lower plan deletes no data: creating new items beyond the new plan's limits is simply blocked for as long as usage exceeds them.

22.3 End of the subscription

When a subscription expires, the Customer has 30 days to export its data, in accordance with Article 9 of the Terms of Sale. After that, TechWatchAlert may delete it.

22.4 Deleting an Organisation

The Owner requests the deletion of an Organisation from the application, once it has no other member left, then confirms it through the link sent to their Account's address. From the confirmation, the Organisation is no longer accessible and the current subscription is cancelled; its projects, groups, API keys, tags and settings are permanently deleted 30 days later, a period during which support can restore it. It is refused while the Organisation manages Clients as a Partner or keeps a NIS2 incident register (Article 14.4).

22.5 Discussions and backups

A channel's encrypted log is deleted with it. Decrypted copies kept in browsers remain on Users' devices until they erase them (“Forget this device”): TechWatchAlert cannot delete them. Deleted data may remain in encrypted backups until they are rotated, for at most twelve months.

22.6 Deletion of an Account

Users delete their Account from their settings, by entering their password again (and their two-factor authentication code if enabled), then confirm through the link sent to their address. The Account is deactivated from the confirmation and its personal data is deleted 30 days later; until then, support can restore it. Deletion is refused while the User is the only Owner of an Organisation that has other members: they first transfer its ownership or remove the members. Organisations of which they are the only member are deleted with the Account (Article 22.4). What they posted in a team's spaces (comments, cases, discussions) remains with the Organisation, detached from their identity; the audit log keeps its entries, with the author anonymised.

22.7 Switching provider

In accordance with Regulation (EU) 2023/2854 (the Data Act), the Customer may switch to another provider or to its own tools, on the following terms:

• notice: the Customer starts the switch at any time, from the application or by email to [email protected], with a notice period of at most two months;
• transition period: it lasts at most 30 days; the Service and the export remain available and TechWatchAlert provides reasonable assistance to the Customer and to the third parties it designates. If this period is technically unfeasible, TechWatchAlert notifies it within 14 working days of the request, gives the reasons and indicates an alternative period of at most seven months;
• data retrieval: the data remains retrievable for at least 30 days after the end of the transition period;
• erasure: at the end of the retrieval period, or earlier at the Customer’s request after a successful switch, all exportable data is erased, subject to the backups described in article 22.5;
• no charges: no switching, exit or export fee is charged.

The contract ends when the switch is completed, or at the end of the notice period if the Customer only requests the erasure of its data.

Limitation of liability

23.1 Exclusions

To the fullest extent permitted by law, TechWatchAlert cannot be held liable for damage resulting from:

• a temporary interruption of the Service for maintenance or an incident;
• inaccuracies, omissions or delays in Security Data from third-party sources;
• decisions taken on the basis of information from the Service, Vigie's replies or the NIS2 Module without verification by a qualified person;
• content posted by Users, in particular in Discussions;
• use that does not comply with these Terms, or unauthorised access due to a User's negligence;
• the failure of third-party services (integrations, AI provider, data sources);
• a force majeure event within the meaning of Article 18 of the Terms of Sale.

23.2 Indirect damage

TechWatchAlert is not liable for indirect damage, including loss of data, revenue or customers, damage to reputation or loss of profit.

23.3 Cap

For Customers on a paid plan, TechWatchAlert's total liability is limited in accordance with Article 17 of the Terms of Sale. For Users of the Free plan and of the trial without an account, it is excluded to the fullest extent permitted by applicable law.

Warranties and nature of the Service

The Service is provided “as is” and “as available”. TechWatchAlert does not guarantee that it will be error-free, uninterrupted or fit for any particular purpose beyond the features described.

Information provided by the Service, including Vigie's replies and the content of the NIS2 Module, is informative and indicative. It does not constitute legal advice, certified security recommendations or compliance audits.

Changes to the Service and to these Terms

25.1 Changes to the Service

TechWatchAlert may modify, improve or discontinue all or part of the Service's features. Significant changes are announced in the application and, where they substantially affect a paid plan, by email with reasonable notice.

25.2 Changes to these Terms

Any substantial change to these Terms is notified to Account holders by email at least 15 days before it takes effect. Continued use of the Service after that date constitutes acceptance. Users who do not accept the new Terms stop using the Service and may terminate under the conditions of Article 21.3.

The current version is always available at techwatchalert.com/cgu, with its update date and version history.

Miscellaneous

26.1 Entire agreement

These Terms, read together with the Terms of Sale and the Privacy Policy, constitute the entire agreement between TechWatchAlert and the User regarding use of the Service and supersede any prior agreement.

26.2 Severability

If a provision is declared void or unenforceable, the others remain in force; it is replaced by a valid provision as close as possible to the original intention.

26.3 No waiver

Failure to enforce a provision does not constitute a waiver of the right to enforce it later.

26.4 Assignment

Users may not assign their rights and obligations under these Terms without TechWatchAlert's written consent. TechWatchAlert may assign these Terms as part of a merger, acquisition or transfer of all or part of its business, informing the User.

26.5 Communications

Official communications from TechWatchAlert are sent by email to the Account address or by in-app notification. Users ensure that their email address is valid.

Governing law and jurisdiction

These Terms are governed by and construed in accordance with French law, to the exclusion of any other law and of conflict-of-laws rules.

For professional Users: any dispute relating to the formation, interpretation, performance or termination of these Terms will be submitted, after an attempt at amicable resolution within 30 days, to the exclusive jurisdiction of the competent courts for the place of TechWatchAlert's registered office.

For Consumer Users: Consumer Users may bring proceedings before the court for their place of residence or any court with jurisdiction under ordinary rules. The mandatory provisions of the Consumer User's country of residence remain applicable to the extent provided for by applicable regulations.

For Consumer disputes, recourse to mediation is provided for in Article 20 of the Terms of Sale.

Version history

• 19 October 2026: full export free on every plan, Free included, and switching provider (Data Act) (articles 16.3, 22.1 and 22.7).
• 8 October 2026: MCP connector (Claude and other clients) (article 16.2a).
• 3 October 2026: Discussions: a single channel per Organisation, whose members follow the permissions set by the Organisation, and direct messages between two members (Article 9); Vigie no longer takes part in Discussions (Articles 9 and 11).
• 3 October 2026: deletion of the Account from the application; deletion of an Account or an Organisation confirmed by email and effective 30 days later, restorable until then (Articles 21.3, 22.4 and 22.6).
• 2 October 2026: Terms rewritten to cover the whole Service. New Articles on organisations and roles (6), end-to-end encrypted Discussions (9), support (10), AI features (11), third-party security data (13), the NIS2 module (14), the Partner space (15), integrations and the API (16) and data export (22); other Articles renumbered; clarifications on Account deletion.
• 13 April 2026: previous version.

Contact details

For any question about these Terms, your Account or use of the Service: