Terms and Conditions

1. Scope

These terms apply to all orders placed with Viewconic GmbH, Ammerseestr. 23, 82131 Gauting (Munich Local Court, HRB 257528), via audit.viewconic.de, in all language versions of the website. We work only for businesses (Unternehmer) within the meaning of § 14 BGB (German Civil Code), not for consumers. Deviating terms of the customer do not apply, even if we do not object to them or perform the service. The order confirmation, the non-disclosure agreement (NDA) and the data processing agreement (DPA) take precedence over these terms.

2. Services

The audit runs automatically with analysis tools and AI agents. Scope, delivery time and price follow from the package description at the time of ordering and from the order confirmation. The result is a report in PDF format.

• Code audit: we read the source code. We do not run it and change nothing in your repository.
• App audit: we actively test the running application with your test accounts, for example login, sessions, rate limits and access rights. This may create test data or lock test accounts. We start only after your approval in text form, email is sufficient (address, environment, time window).
• Full audit: app and code audit combined, every finding checked by an expert, with a review meeting and a re-check.

An audit is not a manual penetration test, not a load or performance test, not a certification and not a conformity assessment (for example under NIS2 or the Cyber Resilience Act). We test third-party systems only with the consent of their operator.

3. No guarantee of completeness

We audit carefully according to the state of the art. However, no audit finds every vulnerability. We owe the described audit and a comprehensible report, not the security of your software. The fact that a vulnerability was not found is not in itself a defect. The report describes the audited version at the time of the audit.

4. Conclusion of contract

Before submitting, you can review all details and correct them via “Edit”. By clicking “Place binding order” you make a binding offer; the automatic acknowledgement of receipt is not yet an acceptance. The contract is concluded with our order confirmation by email. If we do not accept within five working days, you are no longer bound by your offer. You can retrieve, save and print these terms on this page at any time; with the order confirmation you receive your order details and these terms in text form. Working days are Monday to Friday, excluding public holidays in Bavaria.

5. Your cooperation

You warrant that you are entitled to have the application and code audited, as owner or with the owner’s consent, and you indemnify us against third-party claims based on a lack of such entitlement, insofar as you are responsible for it. You provide in good time: the code or read access, for the app audit two test accounts without MFA and captcha, and the approval. Remove credentials, keys and real customer data beforehand. For active tests we recommend a test environment; for a production system, you make sure an up-to-date backup exists.

6. Delivery time

The delivery time starts once payment has been received and the code, access and approval are complete. With Express, we deliver within 24 hours from that point; hours on Saturdays, Sundays and public holidays in Bavaria do not count. If your cooperation is delayed, delivery is postponed accordingly. If it has not been provided 60 days after conclusion of the contract, we may terminate after setting a deadline; we then charge for the services rendered and expenses incurred up to that point and refund any amount paid beyond that.

7. Prices and payment

The fixed prices shown on the website at the time of ordering apply, net plus VAT; for customers in other EU member states with a valid VAT ID, the reverse charge procedure applies. You pay in advance: by bank transfer within 14 days of the invoice, or by card or SEPA direct debit via our payment link. We start after receipt of payment.

8. Cancellation

Until we start the audit, you can cancel free of charge by email; we refund any amount paid. After that, you can terminate at any time; we then charge the price less the expenses we save as a result (§ 648 BGB). We notify you by email when the audit starts.

9. Re-check and workshop

The re-check verifies once whether the findings from the report have been fixed. You can request it within three months of delivery and hand over the current version again for this purpose; new features are not included. The workshop lasts two hours online; we agree with you on a date within three months of delivery. The offer to fix the vulnerabilities is free and non-binding; an order for it requires a separate contract.

10. Confidentiality and data

Before accessing anything, we conclude an NDA and, if personal data may be affected, a DPA. We use code and access only for the audit and delete the code no later than 30 days after delivery of the report. The provider of the AI models we use does not train on your data. How we process personal data is set out in our privacy policy.

11. Use of the report

Once paid in full, you may use the report within your company without limitation and pass it on to customers, auditors, insurers and investors. Third parties do not acquire any claims of their own against us from it.

12. Acceptance and defects

The report is deemed accepted if you do not notify us of a defect within 14 days of delivery; we point this out on delivery. If the report is defective, for example because a finding is incorrectly substantiated or a described check is missing, we remedy it. If this fails, you may reduce the price or withdraw from the contract; damages are governed by section 13. Claims for defects become time-barred twelve months after acceptance, except in cases of intent, gross negligence, fraudulent concealment, assumption of a guarantee and injury to life, body or health.

13. Liability

We are liable without limitation for intent, gross negligence, fraudulent concealment, assumption of a guarantee, injury to life, body or health, and under the German Product Liability Act. In cases of slight negligence, we are liable only for breach of material contractual obligations, meaning those whose fulfilment makes the proper performance of the contract possible in the first place and on which you may rely, and only for the damage that is typical for the contract and foreseeable. This liability is limited to €50,000 per order. For loss of data, we are liable only for the effort that would have been needed to restore it had regular backups been made.

14. Free security check

The free security check evaluates only publicly visible information of a website, without login and without attacks. Request it only for domains that you own or for which you are authorised. It is non-binding; there is no entitlement to have it carried out or to a particular time frame. We are liable for it only in cases of intent, gross negligence and injury to life, body or health.

15. Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). If you are a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or if you have no general place of jurisdiction in Germany, the exclusive place of jurisdiction is the registered office of Viewconic GmbH (Gauting); we may also sue you at your registered office. The contract language is German; if the English or French version deviates, the German version prevails.