Terms of sale

Last updated 23 September 2026

Written in plain language on purpose. If anything here is unclear, ask before you buy — not after.

Who you are contracting with

Breakpoint is operated by Issa Prunier, an independent practitioner based in France. Contact and registration details are in the legal notice. These terms apply to every audit purchased through this site.

What is sold

A single fixed-scope, manually-delivered security audit of one application or agent, at one URL, together with the tools it can call. The deliverable is a written findings report mapped to the OWASP Top 10 for LLM Applications (2025), plus one walkthrough call of approximately 30 minutes. Separate agents require separate audits.

Price and payment

The price is 99 EUR per audit, payable in advance through Stripe. This is an introductory price and may change for future purchases; the price shown at the time of your purchase is the price that applies to it. Card details are handled entirely by Stripe and are never received or stored by Breakpoint.

Order of operations

Payment is only possible after you have (a) demonstrated control of the target domain and (b) electronically signed the rules-of- engagement agreement. No testing is performed before both steps are complete. The signature, its timestamp and the originating IP address are recorded as evidence of authorization.

Your obligations

You warrant that you own or operate the submitted target and are authorized to permit security testing against it. You are responsible for providing working access (a staging endpoint, a test account, or API documentation) and for ensuring that the environment you nominate contains no real production personal data. Supplying a target you are not entitled to authorize is a material breach and ends the engagement without refund.

Scope and exclusions

Testing is confined to the target and window named in the signed agreement. Excluded in all cases: load, stress and denial-of-service testing; testing against real production data; and testing of third-party systems, vendors or infrastructure not owned by you, even where reachable from the target. Three OWASP LLM categories (supply chain, data and model poisoning, and unbounded consumption) are outside the scope of this tier and are not tested, as stated on the landing page.

Turnaround

The 72-hour delivery window begins when workable access is received, not at the time of payment. If access is incomplete or non-functional the clock is paused until it is resolved. Where a delay is caused by Breakpoint, the window is extended at no cost to you.

The guarantee and refunds

If no reproducible vulnerability is found, the full purchase price is refunded to the original payment method. For this purpose, a reproducible vulnerability means:

A reproducible behavior matching at least one OWASP LLM Top 10 category and producing a demonstrable impact: leakage of information not intended for the user, execution of an action outside authorized scope, bypass of a safety rule, or exfiltration via attacker-controlled input. Refusals and cosmetic outputs do not count.

Where at least one such finding is delivered in the report, the engagement is complete and no refund is due. A finding is treated as delivered when the report containing it is sent to the email address on your submission. If you run the documented reproduction steps and the behaviour does not reproduce, tell us within 14 days and, if we cannot demonstrate it, you are refunded in full.

Right of withdrawal

Where you contract as a consumer, the statutory 14-day right of withdrawal applies. Because the audit begins as soon as access is supplied, you expressly request that performance start before the withdrawal period expires and acknowledge that the right lapses once the service is fully performed. Purchases made in a professional capacity are not covered by this right.

Confidentiality

Findings and the material you share are treated as confidential and are not disclosed to third parties. Nothing identifying you is published without your prior written consent. Findings may inform anonymised, non-identifying research.

Liability

Testing is performed with care and strictly within the authorized scope, but security testing carries inherent risk. Breakpoint is not liable for indirect or consequential loss, loss of profit, or loss of data. To the extent permitted by law, total liability arising from an engagement is limited to the amount you paid for it. Nothing here excludes liability that cannot lawfully be excluded, including for gross negligence or wilful misconduct. An audit reduces risk; it does not certify that a system is secure, and no such certification is offered or implied.

Governing law

These terms are governed by French law. Where a dispute cannot be resolved amicably, the competent French courts have jurisdiction. Consumers may also use the European Commission's online dispute resolution platform.