Report confidentiality

DEFENZ handles two families of confidential information:

–vulnerabilities reported by researchers (description, PoC, HTTP requests, screenshots);

–information provided by companies (scopes, bounty tables, internal documents, authorization letters).

Every report is handled as sensitive from the moment it is received, throughout the cycle (triage, fix, payment, any disclosure) and after closure.

A report's content is visible only to three circles:

–the reporting party (the researcher);

–the affected company and, where applicable, the hosting provider it designates;

–the authorized DEFENZ triage team.

Nothing is published, shared or reused without the explicit agreement of both parties. Any anonymized extracts (statistics, trends) never contain technical details that would identify the target.

Public disclosure is voluntary and coordinated.

–Default embargo of 90 days from the verified fix; the program's terms may adjust it.

–Disclosure requires the written agreement of the researcher and the company, through the report on the platform.

–The Hall of Fame lists a researcher only with their consent, under the public alias they chose.

–Any premature disclosure breaches the platform's terms and may lead to suspension.

The following data are never published: real name, KYC documents, phone, addresses, bank details.

–Public pages (leaderboard, Hall of Fame, hacktivity) display only the account's public alias.

–The payment team accesses the strictly necessary data to pay the reward.

–The researcher can hide their alias from public pages from their profile.

A company's scopes, bounty tables and internal documents are not exported to other accounts or programs.

–Company-side access to reports is logged for 3 years (legal obligation).

–Members of an organization see only the programs that concern them.

–Authorization documents (signed letters) are stored encrypted and deleted when the program closes.

Escrow movements are logged in a tamper-evident register.

–Committed amounts, payments and receipts are visible to the company.

–Payment receipts reference the researcher's alias and the report ID, never their real name.

–The audit log is kept for 3 years (tax obligation) and is accessible only to authorized staff.

–Report access is protected by mandatory two-factor authentication (programs may enforce it).

–Sessions expire; API keys are revocable at any moment.

–Phones and payment data are encrypted at rest.

–Any abnormal access is logged and may trigger a security alert.

–When a program or account closes, PoCs and HTTP traces attached to reports are anonymized or deleted on request, except where legal retention applies (tax audit log).

–Deletion is confirmed by email and traced in the audit log.

–Payment data are kept for the strict duration of accounting obligations.