Procurement Pack — Hyperion

• Hyperion Consulting
• SASU (Simplified Joint Stock Company with a Sole Shareholder)
• RCS Nanterre
• SIRET: 948 041 710 00013
• EU VAT: FR73948041710
• APE Code: 7022Z (Business and Management Consulting)
• 126 Avenue du Général Leclerc
• 92100 Boulogne-Billancourt
• France

• OVHcloud
• 2 rue Kellermann, 59100 Roubaix, France
• Data Centre Location: France (EU)
• Hosted on ISO 27001 / SOC 1 & SOC 2-certified OVHcloud infrastructure
• GDPR-aligned data residency in the EU

• Hyperion Consulting maintains professional liability insurance (Responsabilité Civile Professionnelle) covering the professional activities declared in the policy.
• Cover depends on the terms, exclusions and limits of the policy.
• Certificate of insurance is available upon request.
• Hyperion Consulting's total liability arising from an engagement, on any legal basis, is limited to the fees, excluding VAT, paid and payable by the Client for that engagement. For a recurring engagement, the limit is the fees paid and payable for the twelve months before the event giving rise to the claim, and no less than the fees agreed for the first monthly period of the engagement. Refunds and repayments of fees under these Terms are not damages and do not count towards the limit. The Proposal may set a different limit.
• For a breach of the confidentiality obligations in section 8, and for third-party claims covered by the intellectual property warranty in section 9, the limit is two times the amount above or, if higher, the amount that Hyperion Consulting's liability insurer actually pays for that claim. This higher limit replaces the general limit for those claims and is not added to it; the defence costs Hyperion Consulting bears count towards it.

• Unless otherwise specified in the Proposal, payment is due within 30 days of invoice date. Payment shall be made by bank transfer to the account specified on the invoice.
• Any amount unpaid at the payment date shown on the invoice bears late-payment interest, without any reminder being necessary, from the day after that date, at three times the French legal interest rate in force
• A fixed indemnity of €40 for recovery costs is owed as of right for each invoice paid late. If the recovery costs incurred are higher, Hyperion Consulting may claim the difference on presentation of proof
• After a written warning that has had no effect, Hyperion Consulting may suspend services, to a proportionate extent, until an invoice that is due and unpaid is settled, subject to the mandatory rules that apply to insolvency proceedings

• Per-request Content-Security-Policy nonce on every page.
• Primary hosting in the EU (France), via OVHcloud.
• Cloudflare-only ingress in front of the production server.
• Automated web-only ban rules for abusive traffic patterns.
• HTTPS certificate renewal is automated; a renewal can still fail.
• Local secrets are backed up as an encrypted file in off-site Cloudflare R2 storage.
• Secret scanning runs in CI over every commit range pushed to main, and locally before each commit where the scanner is installed.
• Automated checks review site copy for factual and stylistic consistency before release.

Where an engagement requires Hyperion to process personal data on the client's behalf, the parties sign the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915) before that processing starts, as the terms of sale provide.

• By email: contact@hyperion-consulting.io
• By mail: Hyperion Consulting, 126 Avenue du Général Leclerc, 92100 Boulogne-Billancourt, France