Company
Terms of sale and use
What you buy, what Avalyz commits to, and what it does not promise. Version 2, in force since 2026-10-08.
1. The service
Avalyz tests a web application from the outside and produces a report of findings. By default, the test is read-only. On a non-production environment that you designate, you can turn on write mode: Avalyz then creates test accounts, fills in and submits forms and creates test data, all prefixed "avalyz-test". Even in write mode, Avalyz never makes a real payment and never deletes any data. Avalyz does not guarantee the absence of defects: it proves what it saw.
2. The account
An account is personal, or belongs to a team you invite.
3. Authorization and attestation
3.1 You only test applications you own, or for which you have obtained the written authorization of their owner, covering the type of test you run.
3.2 To turn on write mode outside production, you provide a test account on the target application and tick the attestation provided. For any production target, you must also prove your technical control of the domain (tag or file).
3.3 Your attestation is a statement of fact for which you alone are answerable. Avalyz may ask you at any time for proof of the authorization and suspend the test in the meantime.
4. Acceptable use
Use of Avalyz is subject to the Acceptable use policy, which is part of these terms. In particular, it is forbidden to: test a third party's application without its written authorization; run a write-mode test on a production environment without technical proof; exceed the declared or displayed load limits; use Avalyz to bypass an access protection.
5. Price, payment and cancellation
Prices are shown in US dollars, taxes included, on the Pricing page. Subscriptions are paid in advance, per period, with no commitment: you can stop at any time and access stays open until the end of the paid period. Payment is collected by Polar Software Inc., merchant of record, which issues the invoice.
6. Free trial and quotas
The free test without sign-up and the 14-day trial are offered within the limits stated on the site. Each plan has a monthly test quota and a number of pages per test; beyond that, the test stops and the report says so.
7. Refunds
Money-back guarantee: if Avalyz is not right for you, ask by e-mail within 14 days of your first payment and you get a full refund, no questions asked. Later payments are not refunded pro rata: you keep access until the end of the paid period. Refunds go through the merchant of record, to the payment method used.
8. What Avalyz does not promise
A report with no finding does not mean your application is defect-free: what was not tested is not covered. Avalyz is not liable for decisions taken on the basis of a report.
9. Your responsibility and indemnity
9.1 You alone are responsible for the choice of targets, the accuracy of your attestation and the use you make of Avalyz and its reports.
9.2 If you act as a professional, you indemnify Framework SARL AU against any claim, penalty, judgment and all reasonable costs (including defence costs) arising from a test you ran without authorization, an inaccurate attestation or a breach of the Acceptable use policy. Framework notifies you of any claim without delay and lets you take part in the defence.
10. Limitation of liability
10.1 The total liability of Framework SARL AU, for all causes combined, is limited to the amounts you paid for Avalyz during the twelve months preceding the event giving rise to the claim.
10.2 Framework is not liable for indirect damages (loss of revenue, of unsaved data, of reputation), nor for the consequences of a test run without authorization.
10.3 These limits do not apply in case of wilful misconduct, fraud or gross negligence by Framework, nor to bodily injury, nor to the extent the applicable law forbids them. If you are a consumer, the rights that the law of your country guarantees you and that cannot be waived remain intact.
11. Evidence and logs
To prove who ran which test, on which target and with which authorization, Avalyz records, each time write mode is turned on and for each test: your account identifier, your e-mail, the date and time, your IP address, your browser, the target address, the declared environment, the text and version of the accepted attestation, the identifier of the test account provided (never its password) and the list of actions performed. These records are binding between us unless proven otherwise. They are kept for five years after the test, then deleted.
12. Data
The data processed, how long it is kept and how to delete it are described on the Security and data page, which is part of these terms.
13. Suspension and termination
Avalyz may immediately suspend a test or an account in case of serious suspicion of unauthorized use, a report from an owner, an inaccurate attestation or a risk to a system. You are told the reason, unless the law forbids it, and you can prove your authorization. In case of a proven serious breach, Avalyz may terminate your account without refunding the current period, subject to your statutory consumer rights.
14. Cooperation with authorities
Framework responds to requests from the competent judicial or administrative authorities and may give them the records described in the "Evidence and logs" article. Framework may also give them to the owner of an application tested without authorization, to the extent necessary to defend that owner's rights or its own.
15. Governing law and jurisdiction
These terms are governed by Moroccan law. Failing an amicable agreement within 30 days, any dispute falls under the Commercial Court of Casablanca. If you are a consumer, you keep the protection of the mandatory rules of your country of residence and the right to go to the courts those rules designate.
Acceptable use policy
Avalyz is for testing your own applications. To keep it safe for everyone:
- Your target, your authorization. You only test what belongs to you, or what its owner has authorized you, in writing, to test.
- Write mode outside production. Write mode is used on a test environment, with a test account you provide. In production, technical proof of control of the domain is mandatory.
- No bypassing. You may not use Avalyz to get past an authentication, exploit a vulnerability, or collect or modify third-party data.
- Reasonable load. You respect the displayed or declared limits on pages, frequency and load.
- Test data only. No real personal data of third parties in forms; Avalyz uses fictitious data prefixed "avalyz-test".
- Report abuse. Is a test targeting your site without your consent? Write to us with the targeted address and the time: we suspend, check and reply to you within 2 business days. contact@avalyz.com
Any breach may lead to the immediate suspension of the test or the account and engages your liability.
Contact
For any question: contact@avalyz.com · Legal notice