Limits and refund

Cadran reads your answers and the public records of your domain, then produces a score, a list of findings and an ordered remediation plan.

Each finding points to a public reference: an ISO/IEC 27001:2022 control, a CIS Controls v8 safeguard, a NIST CSF 2.0 function, or an article of the ordonnance-loi n°23/010 du 13 mars 2023.

The document pack is a set of templates written from your answers, in your organisation's name. They take effect when you date and sign them.

Cadran does not replace an independent on-site review and issues no official attestation. Nobody visits your premises and no penetration test is performed.

The score rests on what you declare. An inaccurate answer gives an inaccurate score, and the report says so.

The exposure scan reads public records only: DNS, published mail servers, your site certificate. It touches no internal system.

Cadran does not replace legal advice. Qualified counsel remains necessary to assess your situation under applicable law.

We keep your answers, your email and, if you provided it, your domain. The link you receive by email is the key to your report.

We read a domain only after your written confirmation that it belongs to your organisation.

Write to us for a copy of your data or for its deletion. We answer within seven days.

The Diagnostic report opens right after payment.

The exposure scan and the document pack of the Dossier are available within 48 hours of payment, and usually straight away.

The 90-day review in the Programme is scheduled on the date you pick, counted from the day of payment.

If the report teaches you nothing you did not already know, write to us within seven days of payment. We refund the full amount.

No detailed justification is required. Just give the link to your report.

The refund goes back to the original payment method, within ten working days.