1.1 "ARES" means the company operating the Platform, incorporated in France.
1.2 "Platform" means the ARES mobile security compliance SaaS, including the device agent, backend processing engine, dashboard, and report generation system.
1.3 "Customer" means the legal entity that creates an account and uses the Platform under these Terms.
1.4 "Device" means any Android or iOS device on which the ARES agent is installed.
1.5 "Customer Data" means all device signal data, pseudonymous device tokens, and reports generated from or associated with the Customer's account.
1.6 "Free Gap Assessment" means the no-cost tier providing fleet dashboard access with total devices enrolled and framework compliance scores across all Tier 1 frameworks, as described in Section 3.
1.7 "Subscription" means a paid annual licence to access the Platform under Tier 1 or Tier 2, as described in Section 4.
By creating an account or using the Platform, the Customer agrees to these Terms. These Terms form a binding agreement between the Customer and ARES. If the Customer does not agree, they must not use the Platform.
3.1 Scope. The Free Gap Assessment provides: fleet dashboard (total devices enrolled, framework compliance scores across all Tier 1 frameworks). The Free Gap Assessment does not include per-device detail, CEO executive risk summary, audit-ready PDF generation, or the signed JSON and CSV evidence export. Per-device detail, CEO report, audit-ready PDFs, and the signed JSON and CSV evidence export are unlocked at Tier 1.
3.2 No time limit. The Free Gap Assessment does not expire automatically. Access continues until the Customer converts to a Subscription or requests account deletion.
3.3 Conversion. The Customer may convert to a Tier 1 or Tier 2 Subscription at any time. Conversion unlocks full fleet detail, unlimited audit-ready PDF reports, the signed JSON and CSV evidence export for the frameworks included in the selected Tier, and the CEO executive risk summary. Monitoring history accumulated during the Free Gap Assessment is preserved and counts toward the Tier 2 NIST 800-124 history requirement.
3.4 Limitations. ARES reserves the right to limit Free Gap Assessment accounts if usage patterns indicate automated or abusive use.
4.1 Tier 1 — Audit. €6,800 per year, up to 100 devices. Includes continuous fleet monitoring, NIS2, ANSSI, ISO 27001, BSI, CyFun, and FNCDP reports, unlimited audit-ready PDFs, signed JSON and CSV evidence export for all Tier 1 EU and UK frameworks, CEO executive risk summary, and OVH secure key container.
4.2 Tier 2 — Audit + NIST. €12,000 per year, up to 100 devices. Includes everything in Tier 1 plus NIST 800-124 full gap analysis, CMMC Level 2 mobile device evidence support, the extension of the signed JSON and CSV evidence export to NIST 800-124 and CMMC Level 2 evidence, and a dedicated Customer Success Manager. Requires a minimum of 3 months of Tier 1 continuous monitoring history before the first NIST 800-124 report can be generated.
4.3 Billing. Subscriptions are billed annually in advance. All prices are exclusive of applicable taxes.
4.4 Renewal. Subscriptions renew automatically at the end of each annual term unless the Customer provides written notice of non-renewal at least 30 days before the renewal date.
4.5 Device limit. Customers with more than 100 devices must contact ARES for a custom quote before activating a Subscription.
The Customer may use the Platform solely for the purpose of monitoring and assessing the security posture of devices under its operational control. The Customer must not use the Platform to monitor devices without the knowledge of the employing organisation, resell access to the Platform, reverse-engineer the Platform or its framework mappings, or use the Platform in any manner that violates applicable law.
ARES targets 99.5% monthly uptime for the Platform, excluding scheduled maintenance windows. Scheduled maintenance will be notified to Customers at least 48 hours in advance. ARES does not guarantee uninterrupted access and is not liable for downtime outside its reasonable control.
Framework mappings are built from primary official sources and reviewed by qualified compliance experts. They represent ARES's interpretation of how device configuration signals relate to specific regulatory requirements. They do not constitute legal advice. Use of the Platform does not guarantee regulatory compliance or acceptance of reports by any specific regulatory authority. The Customer remains solely responsible for its own regulatory compliance obligations.
ANSSI certification of the ARES platform is not available at launch. The ARES claim of EU-sovereign architecture on OVH is valid and independent of any certification status.
8.1 Zero personal data by architecture. ARES collects only technical device configuration signals. No device identifiers (IMEI, serial number), no application lists, no location data, and no behavioural signals are collected. Device identity is represented by an opaque RSA-token generated and controlled by the Customer. ARES is not a data controller for device signals under GDPR Art. 4.
8.2 Customer key control. Each Customer account is provisioned with a dedicated OVH secure key container. The Customer's RSA key is stored in this container. ARES has zero access to the Customer's key material.
8.3 Infrastructure. All Customer Data is stored exclusively on OVH infrastructure located in France. No Customer Data is transferred outside the European Economic Area.
8.4 Sub-processors. OVH SAS (France) is the sole sub-processor engaged by ARES in connection with the Platform.
8.5 Data Processing Agreement. A full Data Processing Agreement (DPA) governing the parties' respective obligations under GDPR will be provided to the Customer prior to or at the time of account activation. The DPA forms part of these Terms. In the event of conflict between the DPA and these Terms on data protection matters, the DPA prevails.
8.6 Security. ARES implements AES-GCM and RSA-OAEP encryption for all Customer Data in transit and at rest. Access to Customer Data is restricted to the Customer via authenticated sessions. ARES personnel do not have access to Customer Data payloads.
9.1 During the contract. Customer Data is retained and fully accessible for the duration of the active Subscription or Free Gap Assessment.
9.2 Grace period. Following the expiry, termination, or non-renewal of a Subscription, or when a Free Gap Assessment account is closed without conversion, ARES retains Customer Data for a grace period of 12 months. During the grace period, the Customer retains read-only access to the Platform for data export and report retrieval. Device signal ingestion is suspended during the grace period.
9.3 Automatic deletion. At the end of the 12-month grace period, all Customer Data is permanently and irreversibly deleted, including all device signal payloads, pseudonymous device tokens, stored PDF reports, and the Customer's dedicated OVH secure key container. ARES will notify the Customer at the start of the grace period and again at month 11. A deletion confirmation certificate is issued automatically upon completion.
9.4 Right to erasure. The Customer may request immediate deletion of all Customer Data at any time via the self-service dashboard. ARES will complete deletion within 72 hours of the request and issue a deletion confirmation certificate. The Customer acknowledges that exercising the right to erasure prior to report generation will permanently destroy the monitoring history required for NIST 800-124 Tier 2 reporting, and that this consequence is irreversible.
9.5 ARES retained records. Notwithstanding the above, ARES retains billing records, invoices, and contract metadata for 10 years in accordance with Article L123-22 of the French Code de Commerce. Anonymised aggregate statistics that cannot be linked to any Customer or Device may be retained indefinitely for product improvement purposes.
The Platform, including all software, algorithms, framework mappings, compliance logic, and reports generated by ARES, remains the exclusive intellectual property of ARES. These Terms do not transfer any intellectual property rights to the Customer.
The Customer retains all rights to its own Customer Data. By using the Platform, the Customer grants ARES a limited licence to process Customer Data solely as necessary to deliver the Platform services.
Each party agrees to keep confidential all non-public information received from the other party in connection with these Terms that is designated as confidential or that reasonably should be understood to be confidential given its nature. This obligation does not apply to information that is publicly available, was already known to the receiving party, or is required to be disclosed by law or regulation.
ARES will not disclose Customer Data to any third party except OVH as sub-processor, or as required by a binding order of a French or EU court or competent authority. ARES will notify the Customer of any such order to the extent permitted by law.
12.1 Exclusions. Neither party is liable for indirect, incidental, consequential, or punitive damages, including loss of profit, loss of data, or business interruption, arising from or related to these Terms, even if advised of the possibility of such damages.
12.2 Cap. ARES's total aggregate liability to the Customer for any and all claims arising under or in connection with these Terms is limited to the total fees paid by the Customer to ARES in the 12 months preceding the event giving rise to the claim. For the Free Gap Assessment, where no fees have been paid, ARES's total liability is limited to €500.
12.3 Exceptions. Nothing in these Terms limits either party's liability for fraud, gross negligence, wilful misconduct, death or personal injury caused by negligence, or any other liability that cannot be limited under applicable French law.
ARES warrants that the Platform will perform materially in accordance with its documentation under normal use. ARES does not warrant that the Platform constitutes legal advice, that use of the Platform guarantees regulatory compliance, or that audit reports generated by the Platform will be accepted by any specific regulatory authority. The Customer remains solely responsible for its own regulatory compliance obligations.
14.1 Term. These Terms come into effect on the date the Customer creates an account and remain in effect until the end of the applicable Subscription term or, for Free Gap Assessment users who do not convert, until account closure and the end of the grace period described in Section 9.
14.2 Termination for cause. Either party may terminate these Terms immediately on written notice if the other party materially breaches these Terms and fails to remedy the breach within 30 days of written notice.
14.3 Termination for convenience. The Customer may terminate a Subscription at any time. No refund is provided for the unused portion of a prepaid annual Subscription unless termination is due to a material breach by ARES.
14.4 Effect of termination. On termination, the Customer's access to the Platform is suspended and the data retention provisions of Section 9 apply.
ARES may modify these Terms at any time. Customers will be notified by email at least 30 days before any material change takes effect. Continued use of the Platform after the effective date of a modification constitutes acceptance. If the Customer does not accept a modification, it may terminate its Subscription before the effective date without penalty.
These Terms are governed by French law. In the event of a dispute arising from or in connection with these Terms, the parties will attempt to resolve the matter amicably within 30 days of written notice. If no resolution is reached, the dispute will be submitted to the exclusive jurisdiction of the competent courts of Paris, France.
Entire agreement. These Terms, together with the DPA and any applicable order form, constitute the entire agreement between the parties regarding the Platform and supersede all prior agreements.
Severability. If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force.
No waiver. Failure by either party to enforce any provision of these Terms does not constitute a waiver of the right to enforce it in the future.
Assignment. The Customer may not assign its rights or obligations under these Terms without ARES's prior written consent. ARES may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its assets.
Language. These Terms are drafted in English. In the event of any conflict between an English version and any translation, the English version prevails.