1. Purpose and scope
Pepiva Technology, [TO BE COMPLETED: legal form, share capital, RCS or SIREN number, registered office address] (“Pepiva”), publishes ProxTrace, an online traceability, inventory and best-practice checking service for Proxmox VE environments (the “Service”).
These Terms of Service (the “Terms”) apply to any use of the console hosted by Pepiva at console.proxtrace.com, whatever the plan. They serve as both general terms of use and general terms of sale. The Service is intended for businesses and professionals; it is not offered to consumers.
The self-hosted edition, installed and operated by the customer on its own infrastructure, is outside the scope of these Terms: it is governed by its own licence [TO BE COMPLETED: reference of the self-hosted edition licence].
The contractual documents are, in decreasing order of precedence: the accepted quote or order form (Enterprise plan), the Data Processing Agreement for everything relating to personal data processed on the customer’s behalf, these Terms, then the list of sub-processors. The privacy policy describes the processing for which Pepiva is the controller. The customer’s general purchasing terms do not apply unless Pepiva agrees in writing.
2. Definitions
- Customer: the legal entity or professional that creates an organisation in the console or signs an order form.
- User: any person with an account in the console, invited by the Customer or acting on its behalf.
- Organisation: the Customer’s isolated space in the console, holding its infrastructures, Users and data.
- Collector: the ProxTrace agent that the Customer installs on its Proxmox VE nodes and that sends its observations to the console, read-only.
- Customer Data: data sent by the Collector or entered into the console on the Customer’s behalf: configuration, inventory, firewall rules, storage, backups, events, logs, reports and comments.
- Plan: Free or Enterprise, with the related limits and options.
3. Sign-up, verification and two-factor authentication
Sign-up is reserved for a person authorised to bind the Customer. It requires a valid business email address, verified through a link sent to that address, and acceptance of these Terms and of the privacy policy.
Two-factor authentication is mandatory for every console account. Each User keeps their password, second factor and recovery codes confidential. The Customer is responsible for actions performed with its Organisation’s accounts and promptly notifies Pepiva at contact@proxtrace.com of any unauthorised use it detects.
The Customer provides accurate information and keeps it up to date. Pepiva may refuse or suspend a sign-up that is clearly false or fraudulent.
4. Plans and trial
Free
The Free plan is free of charge and limited. Its limits (number of infrastructures, nodes and Users, retention period, options) are shown in the console and on the Pricing page; Pepiva may change them under the conditions of section 20. It is provided without any availability commitment or support response time.
Enterprise
The Enterprise plan is paid. Its scope, limits and price are set out in the quote or order form accepted by the Customer.
Trial
Pepiva may open a free trial of the Enterprise plan lasting [TO BE COMPLETED: trial duration]. The trial does not automatically turn into a paid subscription. When it ends, the Organisation returns to the Free plan, and data exceeding its limits is handled as follows: [TO BE COMPLETED: retention, freezing or deletion of data beyond the Free limits].
AI assistant
The AI assistant is an option, enabled depending on the plan and triggered at a User’s request. When it is used, the extracts of Customer Data needed for the answer are sent to the model provider named in the list of sub-processors, located outside the European Union. The Data Processing Agreement specifies what is sent and the applicable safeguards. The assistant’s answers may be incomplete or wrong: they must be checked before any decision.
5. Orders and prices
For the Enterprise plan, the price is set by quote. The order is formed by the Customer’s written acceptance of the quote or signature of the order form. Prices are exclusive of taxes; applicable VAT is added.
Pepiva may revise its prices for a renewal period by notifying the Customer at least [TO BE COMPLETED: notice period, for example 60 days] before the renewal date. A Customer who refuses the revision may choose not to renew.
6. Invoicing and payment
[TO BE COMPLETED: invoicing frequency (monthly or yearly), in advance or in arrears, accepted payment methods, payment provider if any, and payment term, within the legal limit of article L. 441-10 of the French Commercial Code.]
Any late payment automatically incurs, after the due date, penalties at the rate of [TO BE COMPLETED: rate, at least three times the French statutory interest rate] and a fixed recovery fee of 40 euros (article L. 441-10 of the French Commercial Code). If a formal notice remains unanswered for fifteen days, Pepiva may suspend the Enterprise plan until payment, under the conditions of section 8.
7. Term and renewal
The Free plan is concluded for an indefinite term. The Customer may end it at any time; Pepiva may end it with thirty days’ notice sent by email.
The Enterprise plan is concluded for the initial term stated in the order form [TO BE COMPLETED: default term, for example 12 months]. It then renews automatically for periods of the same length unless either party gives notice at least [TO BE COMPLETED: notice period] before the renewal date, in writing or by email.
8. Termination and suspension
If either party seriously breaches its obligations, the other party may terminate the contract thirty days after a formal notice that remains without effect, without prejudice to damages.
Pepiva may suspend, without notice, the access of a User, a Collector or an Organisation when necessary to stop a threat to the security of the Service or of other customers, a manifestly unlawful use, or an imminent risk to data integrity. The suspension is limited to what is necessary; Pepiva informs the Customer and gives the reason as soon as possible.
Termination does not release the Customer from amounts due for the elapsed period. Unless Pepiva is in breach, amounts already paid for the current period are not refunded.
9. Reversibility and export
Until the end of the contract and for thirty days afterwards, the Customer may request an export of its Customer Data at contact@proxtrace.com. Pepiva provides it within thirty days, in a structured and commonly used format [TO BE COMPLETED: format, for example JSON or CSV]. Self-service export and deletion from the console are under development; until they are available, Pepiva performs these operations on request.
After that period, Pepiva deletes the Customer Data from the production database. Copies held in backups are erased as the backups rotate, at the latest [TO BE COMPLETED: backup rotation period]. This period does not apply to data Pepiva must keep under a legal obligation, in particular accounting obligations.
The Collector remains installed on the Customer’s nodes until the Customer uninstalls it; the documentation describes the uninstall procedure.
10. Customer obligations
- Hold the rights and authorisations required on the Proxmox VE nodes, guests and Proxmox Backup Server instances on which it installs or connects the Collector, including when those systems belong to a third party.
- Install and configure the Collector according to the documentation, and enable optional profiles, in particular reading services, packages and listening ports inside guests, knowingly.
- Inform the people whose data appears in the transmitted observations, in particular administrators and users whose account names and IP addresses appear in the logs, and have a legal basis for this processing, in accordance with the Data Processing Agreement.
- Not knowingly place special-category data within the meaning of article 9 GDPR, or secrets, in the names, comments or free-text fields of its infrastructure.
- Use the Service lawfully and in accordance with these Terms; not attempt to access other customers’ data, circumvent its limits or security, deliberately overload it, or resell it without Pepiva’s written consent.
- Keep its own backups: the Service is not a backup tool for the Customer’s infrastructure.
11. Nature of the Service
ProxTrace observes the infrastructure read-only and executes no command received from the console. It does not administer the Customer’s systems and does not replace its monitoring, its backups or its own procedures.
Best-practice checks and mappings to frameworks (for example NIS2, ISO/IEC 27001 or CIS) are an aid to analysis. They are neither a certification, nor an audit, nor a guarantee of compliance or security. Their results depend on the sources the Collector can read; a check that cannot be evaluated is reported as such. Any corrective action remains decided and carried out by the Customer, under its responsibility.
12. Availability and maintenance
Pepiva uses reasonable means to provide access to the Service. The Free plan is provided without any availability guarantee. For the Enterprise plan, the availability commitment, its calculation method and any service credits are those of the order form [TO BE COMPLETED: Enterprise availability commitment; failing that, no quantified commitment].
Pepiva may interrupt the Service for maintenance. It endeavours to announce planned work in advance and to schedule it at low-activity times. While the console is unavailable, the Collector keeps its observations in a bounded local queue and sends them when service resumes, within the limits of that queue.
New Collector releases are published signed. The Customer may need to update the Collector to benefit from certain changes or fixes.
13. Support
Support is available at contact@proxtrace.com. For the Free plan, it is provided without any response-time commitment. For the Enterprise plan, support channels, hours and response times are those of the order form [TO BE COMPLETED: Enterprise support levels].
Never send passwords, private keys or infrastructure secrets to support.
14. Security
Pepiva implements the technical and organisational measures described in annex 2 of the Data Processing Agreement, including TLS encryption in transit, mandatory two-factor authentication, isolation between Organisations, a restricted read-only account on the nodes, verification of host SSH keys and Ed25519 signatures on Collector releases. Pepiva may change these measures without lowering the overall level of protection.
15. Personal data
For personal data contained in Customer Data, the Customer is the controller and Pepiva acts as processor. The Data Processing Agreement forms an integral part of the contract and applies as soon as these Terms are accepted.
For console accounts, sign-in security and the commercial relationship, Pepiva is the controller; this processing is described in the privacy policy.
16. Confidentiality
Each party keeps confidential the non-public information received from the other party under the contract, including Customer Data, and uses it only to perform the contract. This obligation does not apply to information that is public, already known to the receiving party, lawfully obtained from a third party, or whose disclosure is required by law or by an authority; in the latter case, the party concerned informs the other where the law allows.
It extends to each party’s staff and subcontractors, who are bound in writing, and lasts for the term of the contract and five years after it ends.
17. Intellectual property
Pepiva retains all rights in the Service, the console, the Collector, their documentation and the ProxTrace trademark. It grants the Customer, for the term of the contract, a non-exclusive, non-transferable right to use the Service and to install the Collector on its own systems, for its internal needs. [TO BE COMPLETED: if the Collector is published under an open-source licence, that licence prevails for the Collector.] Third-party components remain governed by their own licences.
The Customer retains all rights in Customer Data. It authorises Pepiva to host, reproduce and process it only to the extent necessary to provide the Service, support and security. Pepiva does not cite the Customer’s name or brand as a commercial reference without its written consent.
Proxmox VE is a trademark of Proxmox Server Solutions GmbH; ProxTrace is an independent project, not affiliated with that company.
18. Liability
Pepiva has an obligation of means. It is not liable for indirect damage, such as loss of business, revenue, customers or reputation, nor for the consequences of decisions the Customer takes based on observations, reports, checks or assistant answers. It is not liable for damage resulting from the Customer’s breach of its obligations, from its infrastructure configuration or from a third-party service it does not control.
For the Enterprise plan, Pepiva’s total liability, for all causes combined, is limited to the amount paid by the Customer in the twelve months preceding the event giving rise to liability. For the Free plan and the trial, provided free of charge, it is limited to [TO BE COMPLETED: cap for the free plan].
These limitations do not apply in case of gross negligence or wilful misconduct, to personal injury, or where the law prohibits them. They are a decisive element of the contract’s economic balance.
19. Force majeure
Neither party is liable for a failure caused by force majeure within the meaning of article 1218 of the French Civil Code. If the impediment lasts more than thirty days, either party may terminate the contract in writing, without compensation.
20. Changes to these Terms
Pepiva may change these Terms. Each version is dated and numbered. Pepiva informs Customers of any significant change by email or in the console at least thirty days before it takes effect.
For the Enterprise plan, a change unfavourable to the Customer applies only from the next renewal, unless required by law or by the security of the Service; the Customer may then terminate without penalty before it takes effect. For the Free plan, a Customer who refuses the change may close its Organisation; continued use after the effective date constitutes acceptance.
21. Miscellaneous
The Customer may not assign the contract without Pepiva’s written consent. Failure to exercise a right is not a waiver. If a clause is held void, the others remain in force. Notices are validly given by email to the Customer’s administrator account address and, for Pepiva, to contact@proxtrace.com.
22. Governing law and jurisdiction
The contract is governed by French law. The parties first seek an amicable solution for thirty days from written notice of the dispute. Failing that, any dispute relating to its formation, performance or termination falls under the exclusive jurisdiction of the courts of [TO BE COMPLETED: jurisdiction of Pepiva’s registered office], including in case of multiple defendants or summary proceedings.