ZeroFlare (0flare.com) has an office in Marseille for organizations that want authorized penetration testing scoped from France, with the same rules the firm uses in Doha. The city is a place to start the work. It is not a different product.
The office
The address is Rue de la République, 13002 Marseille, France. Email hello@0flare.com. Book a conversation on the contact page. Reports, rules of engagement, and the definition of a finding do not change because the meeting was in Marseille. If you also work with the Doha office, you get one method and one kind of report.
What the work usually is
French and European buyers tend to arrive with a system and a sentence from a customer or a regulator. A product team wants a web application penetration test or an API penetration test before a contract. An operator wants an external or internal network test. A platform team wants a cloud security assessment of the accounts in use. A security lead wants a vulnerability assessment they can put next to a control list. A red team is available and is usually the wrong first purchase. The service pages say how to tell them apart. The methodology says what happens after you pick one.
EU and French context, without the costume
NIS2 asks a lot of entities for a security program, including testing. A ZeroFlare report can be one input to that program. It is not a statement that you comply with the directive. DORA asks financial entities for resilience testing of a specific kind. We will scope a technical test you can authorize. We will not call it a DORA audit.
GDPR shows up as a constraint on evidence. When a check would expose personal data, we keep the minimum that proves the issue and we stop. We do not export a customer table to demonstrate that the table was reachable. The website’s own privacy policy is a separate document from the contract that covers an engagement.
ANSSI publishes guidance that French teams already use. We will follow a technical recommendation you want the test designed around. PASSI is different. It is ANSSI’s qualification for providers of information-systems security audits. ZeroFlare is not a PASSI-qualified provider. Writing that clearly is more useful than implying the qualification with a paragraph of adjacent vocabulary. If your tender requires PASSI, say so at the start and we will tell you we are not the firm for that line item.
None of this is legal advice. Your counsel’s reading of an obligation is the one the scope should follow.
How an engagement runs from Marseille
You get a written scope, rules of engagement, a named stop contact, a report with evidence, and a retest of the fixes you ship. Denial of service and social engineering stay out unless the rules allow them. The report is in English unless the contract says otherwise. We accept English, French, and Arabic for disclosure reports about our own systems, which is what security.txt says. That is not the same thing as a French edition of every client deliverable.
What we will not imply
We do not list French clients we cannot name, and we do not borrow ANSSI, CNIL, or a bank’s authority. We do not describe a vulnerability scan as a test d’intrusion. If the honest answer to a scoping call is that you need an accredited audit or a qualified PASSI provider, that is the answer. The penetration test is still available for the question it actually answers.
Start with the system and the sentence you were asked to satisfy. We will tell you whether a test from this office fits, and what it will not be able to say when it is finished.