Starter
The baseline for launching a first programme with submissions.
990USD/ yr
Minimum escrow 750 USD
- Programs
- 1
- Assets
- 2
- Always-on VDP (public disclosure channel)
- Ack-only triage (48 h)
- Submissions dashboard + CSV export
For companies
Launch your bug bounty program in 7 days.
A signed scope, a pre-funded escrow, in-house triage and USD rewards paid within 14 days. Acknowledgement in 48 hours, USD pricing, VAT invoice.
MSA contract + safe harbor · escrow from USD 500,000 · 19.25% VAT invoice · quote within 24 business hours
- TeamIn-house triage, FR + EN
- EscrowPre-funded, released before any test
- ComplianceWritten scope, exportable audit log
- PayoutUSD rewards, paid within 14 days
The journey
Live in 7 days
From contract to go-live, guided by our team.
Contract
MSA + initial 750 USD escrow.
Scope
URLs, apps, versions + signed authorization letter.
Rewards
P1–P5 USD table + 48h / 5d / 14d SLA.
Hunters
Hunters invited after identity verification (L0 minimum).
Public page
Program live + leaderboard.
Dry run
Test report + 25 USD test payout.
Go-live
Announcement + D7 review (MTTA, alerts).
The offering
What you get
Strict scope
No authorized scope, no testing. Contractual safe harbor with a signed testing authorization.
Pre-funded escrow
750 USD minimum locked before a program can go live.
Managed triage
Our expert team qualifies every report — you only receive actionable signal.
Escrow & billing
USD vault, 20% commission, receipts and reconciliation.
Dashboards
MTTA, escrow and earnings: every role gets a live space.
Legal traceability
Append-only audit log, encrypted personal data, exportable evidence.
Our commitments
- 48h acknowledgment
- 5-day triage
- Payout within 14 days
- Min. 750 USD escrow
Legal framework
Security & compliance, by design
Every test, state transition and payout is written to an append-only audit log retained 3 years. Personal data is encrypted and coordinated disclosure is the default.
- OWASP-aligned testing process (WSTG)
- Coordinated 90-day disclosure by default
- KYC & anti-Sybil researcher vetting
- Written scope, rules accepted before publication, pre-funded escrow and an exportable audit log.
Pricing
Company pricing
Business
Recommended for teams that want triage handled for them.
2,490USD/ yr
Minimum escrow 2,500 USD
- Programs
- 3
- Assets
- 10
Everything in Starter, plus:
- DEFENZ-managed triage · CVSS · 48h/5d/14d SLA
- Monthly activity reports
Professional
Researcher coordination, retest and oversight for critical lines.
5,990USD/ yr
Minimum escrow 8,000 USD
- Programs
- 5
- Assets
- 25
Everything in Business, plus:
- Outbound webhook integrations
- Researcher coordination · retest · exec dashboard
Enterprise
Unlimited coverage, dedicated TAM and quarterly review.
14,990USD/ yr
Minimum escrow 16,000 USD
- Programs
- Unlimited
- Assets
- 100
Everything in Professional, plus:
- Dedicated TAM · priority triage · quarterly exec review
- Setup fee waived on annual plans.
- 2 months free · Annual = 10× monthly.
- 20% commission on rewards paid out.
- Unused escrow is refunded at program close.
Estimating your bounty budget? See the severity ladder (P1–P5) →
Trust centre
What our mechanisms guarantee
Each item below describes a mechanism we operate, not a compliance claim. Evidence is exportable.
Pre-funded escrow, reconciled nightly
Our escrow is credited before a program opens and reconciled daily against payouts and invoices. Any discrepancy blocks disbursements.
Append-only audit log, 3 years
Every transition (submission, triage, verification, payout) is timestamped and immutable. CSV export on request.
Bilingual safe harbor per program
Scope and testing rules are written and accepted before publication, in French and English. Out-of-scope work is neither tested nor paid.
Researcher levels L0 → L3
Phone verification, identity document and enhanced checks. Programs can require 2FA, proof of concept or invitation.
Evidence with short-lived signed URLs
PoC and supporting files stored outside the application server. Read via a 5-minute signed URL, every access logged.
Public disclosure under a pseudonym
Published reports use a masked identifier. The public pseudonym is configurable by the researcher.
Programme reporting
What you get as a program owner
A program-owner dashboard that answers the only question that matters: is my budget being spent well?
Board-ready security metrics, in $.
Time to acknowledge
Time from report opening to acknowledgement.
Time to triage
Time from acknowledgement to validated severity (P1–P5).
Escrow utilisation
Share of escrow already converted into validated rewards.
Cost per validated vuln
Average reward paid per validated report, after commission.
Reports by severity
P1–P5 breakdown of reports received over the period.
Duplicates grouped
Share of reports automatically grouped as duplicates.
Retest rate
Share of fixes verified by a second testing pass.
Metric illustrations: real values appear as soon as a program is running. No data is simulated.
Transparency
The platform in numbers
Real statistics from the DEFENZ database, reported unfiltered.
- Reports received
- 2
- USD paid
- —
- Average first response
- —
The severity breakdown will appear once reports have been triaged.
Reports per month (last 6 months)
Good to know
Frequently asked questions
What if a researcher goes out of scope?
No scope = no test. Out-of-scope testing is rejected and logged under a contractual safe harbor.
How are rewards paid?
In USD, within 14 days of a verified fix. Funds are pre-funded and escrowed for the life of the program.
Who triages reports?
An expert team: 48h acknowledgment, severity validated in 5 days. Duplicates are grouped, never penalized.
Is my data protected?
Encrypted personal data, 3-year audit log, bilingual safe harbor, deletion on request.
What does a program cost?
SME from 99 USD/month + 20% per reward, or on quote. 249 USD setup, 19.25% VAT extra.
For companies
Launch your program
Describe your scope: we reply within 24 business hours with a quote in USD.