Feranor

This English text is a translation, provided for information. The French text, "Conditions générales de licence et de services Feranor PQC Suite" of the same version, is the only one that binds the parties.

Article 1. Purpose

These general terms (the "Terms") set the conditions under which Feranor, a société à responsabilité limitée (limited liability company) with a share capital of €1,000, registered with the Lyon trade and companies register under number 937 926 020, whose registered office is at 27 rue Charton, 69600 Oullins-Pierre-Bénite, France ("Feranor"), grants the Customer a license to use Feranor PQC Suite, provides its maintenance and support, and performs the services ordered.

They apply to every Order and are given to the Customer with each quotation; they are provided at any time on request. The Customer's general terms of purchase do not apply, unless Feranor accepts them in writing.

Article 2. Definitions

Term	Meaning
Product	Feranor PQC Suite: Feranor PQC SDK for .NET (the Feranor.Net.Cryptography.* packages), Feranor PQC CLI (fpqc), Feranor PQC Sidecar and Feranor PQC Console, in executable form, with their documentation and updates
Customer	The legal person that places the Order
Entity	The legal entity named in the Order, identified by its SIREN number or equivalent; a group counts as many Entities as legal persons that use the Product
Order	The purchase order, the accepted quotation or the public contract that names the Entity, the Product, the Services, the prices and the term
Subscription	The right to use the Product and to receive its maintenance and support for a period of 12 months, renewable
License Key	The key given by Feranor that identifies the Subscription; it is checked offline and conditions no cryptographic function of the Product; Feranor PQC Console serves only with a valid License Key (article 6)
Major Version	A version of the Product whose first number changes (1.x, 2.x)
Support Period	The time during which a Major Version is maintained: 5 years from its first release, the end date being stated in the Order
Maintenance and Support Policy	Feranor's document describing the versions, maintenance and support (SUPPORT.md, restated in the guide delivered, chapter Operating), in its version at the date of the Order
Security Policy	Feranor's document describing the reporting and handling of vulnerabilities (SECURITY.md, restated in the guide delivered, chapter Operating)
Services	The services ordered in addition to the Subscription: audit, integration, connection to an HSM, training

Article 3. Contractual documents

The contract is made of, in decreasing order of precedence: the Order and its specific conditions, these Terms, the Maintenance and Support Policy, the Security Policy, then the documentation of the Product. In case of contradiction, the higher-ranking document prevails.

For a public buyer, the documents of the public contract (acte d'engagement, cahier des clauses administratives particulières) prevail over these Terms.

Article 4. Order and entry into force

The Order takes effect when signed by both parties, or when the Customer accepts the quotation in writing. By signing the Order or accepting the quotation, the Customer acknowledges that it received these Terms before committing, and accepts them.

The Subscription starts on the date stated in the Order, failing which on delivery of the License Key.

Article 5. License

5.1 Rights granted

During the Subscription, Feranor grants the Customer, for the Entity's own needs, a non-exclusive, non-assignable and non-transferable right:

• to install and use the Product, with no limit on the number of applications, servers, containers, environments or developers;
• to integrate Feranor PQC SDK for .NET into the Entity's applications, and to run these applications, including to provide services to the Entity's customers, as long as the Product itself is not handed over to these third parties;
• to reproduce the Product to the extent needed for these uses, including in the Entity's container images and deployment pipelines;
• to have these acts performed by its contractors, on behalf of the Entity only and under its responsibility.

Development and test environments are covered by the Subscription, at no extra cost.

5.2 Limits

Unless Feranor agrees in writing, the Customer shall not:

• distribute, rent, lend, assign or make the Product available to third parties, including embedded in a product or software handed over to third parties (this use is the subject of an offer on quotation);
• use it for the benefit of a legal person other than the Entity;
• modify it, remove its proprietary notices, or circumvent its License Key.

The Customer keeps the rights granted to it by article L. 122-6-1 of the French Intellectual Property Code: backup copy, observation, study and testing of its operation, decompilation under the conditions it sets for interoperability. Feranor reserves the right to correct errors in the Product.

5.3 Evaluation

Feranor may, at its sole discretion, provide the Product for an evaluation outside production, for the duration and on the conditions it sets in writing. The evaluation is provided without any warranty; at its end, the Customer stops using the Product or places an Order.

5.4 Audit

For 2 years after the end of the Subscription, Feranor may have an independent auditor, bound by confidentiality, verify that the Customer no longer uses the Product, at most once a year, giving it 30 days' written notice. The audit is carried out on documents or, during business hours, on site, in compliance with the Customer's security rules and without access to its data or keys. It is at Feranor's expense, unless it reveals a use not covered: the Customer then pays, at the price list in force, the corresponding Subscriptions from the start of that use, and reimburses the cost of the audit.

Article 6. License Key

Feranor gives one License Key per Subscription. It is checked offline, without any call to Feranor.

It conditions no cryptographic function of the Product: Feranor PQC SDK for .NET, Feranor PQC CLI and Feranor PQC Sidecar encrypt, decrypt, sign and verify with a missing, invalid or expired key, which they only report in their logs.

Feranor PQC Console, which neither encrypts nor signs, serves only while the Sidecar it calls has a valid License Key. It closes on the day the License Key expires, with no grace period; its administration page warns 30 days before. During the 90-day period of article 11.3, the data remain accessible through the other components of the Product.

The Customer does not disclose the License Key to third parties.

Article 7. Intellectual property

Feranor is and remains the owner of all intellectual property rights in the Product, its updates and its documentation. The contract transfers to the Customer only the rights of article 5.

The Product relies on third-party components under open source licenses (notably the .NET runtime, OpenSSL for the container images, OpenTelemetry for the sidecar), which remain governed by their own licenses. They are listed in the software bill of materials (SBOM) delivered with each version.

Feranor indemnifies the Customer against any claim by a third party alleging that the Product, used in accordance with the contract, infringes its intellectual property rights in France, provided that the Customer informs Feranor without delay and lets it conduct the defense. Feranor may then, at its choice, obtain the right for the Customer to continue using the Product, modify the Product so that it no longer infringes, or, failing that, terminate the Subscription and refund the part of the price corresponding to the remaining period.

Article 8. Maintenance and support

During the Subscription, Feranor provides the maintenance and support described in the Maintenance and Support Policy: new versions, fixes, cryptographic updates, and support by e-mail on business days, in French or in English.

First response times are best-effort targets. Support covers the Product; it does not cover the development of the Customer's applications, the design of its architecture or infrastructure, or unsupported versions or platforms.

Security fixes are provided free of charge to every user until the end of the Support Period of the Major Version concerned, within the time limits of the Security Policy.

Article 9. Services

Services are performed according to the accepted quotation, at the daily or fixed price stated in it. Feranor is bound by an obligation of means. The Customer provides the information, access and contacts needed; a delay on its side postpones the time limits accordingly.

Travel expenses are invoiced in addition, at cost. Deliverables are deemed accepted unless a written and reasoned reservation is made within 10 business days of their delivery. Upon full payment, the Customer acquires the right to use the deliverables for its own needs; Feranor keeps its know-how, tools and generic components.

Article 10. Prices, invoicing and payment

The prices are those of the Order, set according to Feranor's price list in force at its date (the commercial offer, provided with the quotation and on request) and any discounts stated in it. They are in euros excluding taxes; VAT is added at the applicable rate.

• The Subscription is invoiced annually, at its start and then at each renewal.
• Services are invoiced on completion, or in installments for those longer than 10 days.
• Invoices are payable within 30 days of their issue date, by bank transfer. No discount is granted for early payment.
• Any late payment automatically incurs penalties at three times the French legal interest rate, and the fixed indemnity for recovery costs of €40 (articles L. 441-10 and D. 441-5 of the French Commercial Code).

If an invoice remains unpaid 15 days after a formal notice, Feranor may suspend support, the delivery of new versions and that of the License Key for the following period, until full payment. Security fixes continue to be provided (article 8).

At each renewal, Feranor may, without being bound to, revise the price of the Subscription. It informs the Customer of the new price in writing at least 3 months before the renewal date; failing that, the price remains unchanged for the following period. A Customer that refuses the revision terminates the renewal under the conditions of article 11.1.

Article 11. Term, renewal and end of the contract

11.1 Term and renewal

The Subscription is entered into for 12 months. It renews tacitly for periods of 12 months, unless either party gives written notice at least 1 month before its renewal date. For a public buyer, the term and renewals are those of the public contract.

11.2 Termination

In the event of a serious breach by a party of its obligations, not remedied 30 days after a formal notice by registered letter with acknowledgment of receipt, the other party may terminate the contract by operation of law, without prejudice to any damages it may claim.

11.3 At the end of the Subscription

At the end of the Subscription, whatever the cause, the right of use of article 5.1 ends. The Customer has 90 days to stop using the Product and, within this period, to decrypt or migrate the data it processed with the Product. It no longer receives new versions or support.

After this period, the Customer no longer has any right to use the Product. Its data do not depend on the Product: they follow public formats (CMS messages per RFC 5652 and its extensions published by the IETF, keys in the PKCS#8 format), which any conforming implementation can read.

11.4 Reversibility

To prepare for the end of the Subscription, the Customer may, on written request at least 1 month before the renewal date:

• extend the 90-day period of article 11.3, by periods of 3 months, pro rata to the price of the Subscription;
• obtain, on quotation, a right limited to decrypting and verifying its existing data, with no new encryption or signature;
• entrust Feranor, on quotation, with assistance in decrypting or migrating its data.

11.5 Surviving clauses

Articles 5.2, 5.4, 7, 11.3, 11.4, 12, 13, 14 and 20 survive the end of the contract.

Article 12. Warranties and obligations of the Customer

Feranor warrants that the Product substantially conforms to its documentation. If the Customer finds a reproducible non-conformity, Feranor corrects it or provides a workaround under the conditions of the Maintenance and Support Policy; this is the Customer's sole remedy under this warranty.

Feranor does not warrant that the Product operates without any interruption or error, nor that a cryptographic algorithm remains secure against advances in cryptanalysis that are not known at the date of the version concerned. Following these advances is part of the maintenance.

The Customer is responsible for:

• the infrastructure on which it operates the Product and compliance with its prerequisites (notably OpenSSL 3.5 or later outside containers);
• the safekeeping and protection of its private keys, their secrets and their backups: a lost key makes it impossible to decrypt the data encrypted for it, and Feranor holds no copy of it;
• the validation of the certificates of its correspondents and its own trust decisions;
• its use of the Product and its compliance with the rules that apply to it, including for the transfer or export outside France.

Article 13. Liability

Each party is liable for the direct and foreseeable damage it causes to the other through a proven breach of its obligations.

Feranor is not liable for indirect damage, such as loss of business, revenue, customers or reputation, nor for loss of data resulting from the loss, disclosure or mismanagement of the Customer's keys and secrets.

Feranor's total liability, for all causes combined, is limited to the amounts paid by the Customer under the contract during the 12 months preceding the event giving rise to the claim.

These limitations do not apply in the event of gross negligence or willful misconduct, nor to personal injury.

Article 14. Confidentiality

Each party keeps confidential the information of the other that is disclosed to it as such or that is confidential by nature (notably the financial terms, the non-public technical elements of the Product, and the Customer's architecture and data), during the contract and for 5 years after its end. This obligation does not cover information that is public, already known to the receiving party, or that it must disclose under the law.

Article 15. Personal data

The Product runs entirely at the Customer's premises: it sends no data to Feranor, neither telemetry nor content. Feranor therefore does not process, under the license, the data that the Customer processes with the Product.

Feranor processes, as controller, the contact details of the Customer's contacts (name, position, business e-mail address, telephone) to manage the commercial relationship: Orders, invoicing, License Keys, delivery of versions and security advisories, support. They are kept for the term of the contract and then for the legal limitation periods, and are neither sold nor transferred. These persons exercise their rights with legal@feranor.com.

The Customer does not send to support any private key, secret or plaintext content; none is needed for diagnosis. If a Service leads Feranor to access personal data, the parties enter into the agreement required by article 28 of the General Data Protection Regulation.

Article 16. Regulation of cryptology

The Product is a means of cryptology within the meaning of article 29 of French law no. 2004-575 of 21 June 2004. Feranor declares its supply in France to the ANSSI before any supply, in accordance with article 30 of that law; the date and reference of the acknowledgment of receipt are provided to the Customer on request. The transfer of the Product to another Member State of the European Union or its export outside the Union, including by the Customer, may be subject to specific formalities; the Customer consults Feranor before any such operation.

Article 17. Security and vulnerabilities

Feranor handles the vulnerabilities of the Product according to its Security Policy and its obligations under Regulation (EU) 2024/2847 on cyber resilience. The Customer reports the vulnerabilities it discovers to security@feranor.com and does not disclose them before they are fixed, or at the latest 90 days after its report.

Article 18. Source code escrow

At the Customer's request and expense, Feranor deposits the source code of the Product with a trusted third party, the Agence pour la Protection des Programmes (APP) or another agreed between the parties, and updates it at each Major Version. The Customer may access it, solely for the maintenance of the Product for the Entity, if Feranor ceases its activity without a successor or stops providing security fixes during the Support Period. The terms are set out in an escrow agreement between Feranor, the Customer and the third party.

Article 19. References

Feranor cites the Customer as a reference only with its written consent, which may be given in the Order.

Article 20. Assignment and subcontracting

The Customer may not assign the contract without Feranor's written consent, which Feranor may not refuse without legitimate reason in the event of a merger or transfer of the business concerned. Feranor may entrust part of the Services or support to subcontractors, for whom it remains responsible.

Article 21. Force majeure

Neither party is liable for a failure caused by force majeure within the meaning of article 1218 of the French Civil Code. If the impediment lasts more than 60 days, either party may terminate the contract in writing, without compensation.

Article 22. General provisions

• The contract expresses the entire agreement of the parties on its subject matter and supersedes any prior agreement on the same subject matter.
• The invalidity of a clause does not affect the others.
• Failure to invoke a breach does not constitute a waiver of the right to invoke it later.
• Notices are given in writing, by registered letter with acknowledgment of receipt or by e-mail with acknowledgment of receipt, to the addresses in the Order.
• The parties acknowledge the evidential value of electronic writings and electronic signatures (articles 1366 and 1367 of the French Civil Code): an accepted quotation, an Order or a notice signed or exchanged electronically binds them as on paper.
• Feranor may amend these Terms; the applicable version is the one in force at the date of the Order or of its last renewal.

Article 23. Governing law and disputes

The contract is governed by French law. The parties first seek an amicable solution, for at least 30 days from the notice of the dispute. Failing that, any dispute falls under the exclusive jurisdiction of the courts of Lyon, including for summary proceedings or in the case of multiple defendants, unless a mandatory rule provides otherwise.