RootBounty is not a registered company yet. For now it is a website run by its founder as an individual. When the company is incorporated, this document will be updated with its legal name, tax ID and registered office, and you will be asked to accept the new version. Until then, the rights and obligations described here are those of the person who runs RootBounty.
This agreement is between Pau Valls Peleteiro (“RootBounty”) and the organisation on whose behalf it is signed (“the company”). It completes the terms of use and applies to every program the company runs on RootBounty. The person signing declares that they are authorised to bind the company.
1. Authorisation over assets
The company declares that it owns, or is authorised by their owner to have tested, every asset it lists in scope. If an asset belongs to a third party (a provider, a cloud service, a client), the company is responsible for obtaining their permission and for excluding what it may not authorise. The company indemnifies RootBounty and the researchers against claims caused by listing assets it was not entitled to list.
2. The program
- The company is responsible for the content of its programs: scope, guidelines, rewards and disclosure rules. RootBounty reviews programs before publishing them and may ask for changes, pause or remove them.
- The company keeps its programs truthful and up to date, and does not change the rules of a report already submitted to the detriment of the researcher.
3. Handling reports
The company will:
- acknowledge and triage reports within a reasonable time, and within the times its program publishes;
- decide in good faith on validity, severity and duplicates, and give reasons when it closes a report as duplicate, informative or not applicable;
- keep the researcher informed through the report until the issue is fixed or the report is closed.
4. Safe harbor
The company declares that research carried out in good faith within the scope and guidelines of its program is authorised, including for the purposes of criminal law. It will not take legal action against researchers for such research, nor support action by others, and if a third party takes action it will make clear that the research was authorised. This commitment covers only research that respects the scope, the guidelines and the law.
5. Bounties
- In a bug bounty program, the company pays the bounties it awards for valid, in-scope issues, according to the amounts it publishes. A bounty, once awarded, can be increased but not reduced.
- The company pays each bounty either by direct bank transfer to the researcher, when the researcher allows it and the platform offers it, or as RootBounty indicates when RootBounty pays on its behalf. When it pays directly, it uses the researcher's bank details only for that transfer, marks the payment as sent on the platform and keeps proof of it.
- Bounties are paid without deductions other than the withholdings the law obliges the company to make.
- In a vulnerability disclosure program no bounties are owed.
6. Confidentiality and researchers' data
The company keeps confidential everything it learns about researchers and uses their personal data, including bank details shared for direct payments, only to run its program and pay bounties. It will not contact researchers outside the platform for purposes unrelated to the program without their consent.
7. Disclosure
The company may publish the title of a closed report; the full report is published only when the company and the researcher agree, under the disclosure policy. The company does not publish researchers' personal data beyond their username.
8. Price
RootBounty currently charges nothing to companies. If fees are introduced they will be announced at least 30 days in advance and will require the company's acceptance.
9. Name, logo and publicity
- The company authorises RootBounty to use its name, logo and other distinctive signs, and to say that it runs a program on RootBounty, on the RootBounty website and in its social networks (such as LinkedIn, X, Instagram, TikTok or YouTube), newsletters, press releases, presentations and other promotional material, to make the platform and the company's program known.
- This authorisation is non-exclusive, free of charge, worldwide and limited to those purposes. It does not transfer any intellectual property right: the company keeps all rights over its signs, and RootBounty uses them as the company provides them, without altering them.
- RootBounty will never publish the content of reports, vulnerabilities that are not fixed or any other confidential information, nor attribute to the company quotes, testimonials or figures it has not approved in writing.
- The company may withdraw this authorisation at any time by writing to RootBounty, without having to give reasons and without affecting the rest of this agreement. RootBounty will stop new uses within 15 days and remove what it can reasonably remove from its own channels; it is not obliged to withdraw material already printed or shared by third parties.
10. Liability
RootBounty is an intermediary and does not guarantee that researchers will find issues, nor that a program will stop attacks. It is not liable for the acts of researchers, which are governed by their own agreement, nor for indirect damages or loss of profits. Each party is liable for its own breaches; these limits do not apply to intent or gross negligence.
11. Duration and termination
This agreement applies from its signature until the company's account is closed. Either party may end it with 15 days' notice, or immediately if the other breaks it seriously. On termination the company's programs are closed; bounties already awarded must still be paid, and sections 4, 6 and the data processing annex survive for the reports already received.
12. Electronic signature
The parties agree to sign this agreement electronically on the platform, by drawing a signature or uploading a signed copy. The signature, together with the date, the IP address, the browser and the fingerprint of the exact text signed, is recorded as evidence and is valid as an electronic signature under Regulation (EU) No 910/2014 (eIDAS).
13. Law and jurisdiction
Spanish law applies. The parties submit to the courts of the owner's domicile.
Annex: data processing agreement (GDPR art. 28)
Reports may contain personal data for which the company is responsible (for example, data of its users found while proving an issue). For that data, the company is the controller and RootBounty the processor.
- Subject, nature and purpose. RootBounty hosts, shows and transmits the reports, comments and attachments of the company's programs, only to provide the platform.
- Duration. While the agreement is in force and, afterwards, while the reports are kept as the privacy policy describes.
- Types of data and data subjects. Any personal data a report may contain, of the company's users, employees or customers. The company does not ask researchers to send special categories of data and asks them to minimise any personal data.
- Instructions. RootBounty processes the data only on the company's documented instructions, which are this agreement and the company's use of the platform, unless the law requires otherwise, in which case it will inform the company first where allowed.
- Confidentiality. Only authorised RootBounty staff, bound to confidentiality, can access reports, and only when needed for the service, moderation or support.
- Security. RootBounty applies the measures described in the privacy policy: encryption in transit, mandatory two-factor authentication, role-based and audited staff access, encrypted backups.
- Sub-processors. The company authorises the sub-processors listed in the privacy policy (OVH SAS for hosting, Cloudflare, Inc. for network transport, IONOS Cloud S.L.U. for email). RootBounty will announce new ones in advance so the company can object, and imposes on them the same obligations.
- Assistance. RootBounty helps the company, with the means available on the platform, to answer data subjects' requests and to meet its obligations on security, breaches and impact assessments.
- Breaches. RootBounty will notify the company without undue delay, and in any case within 48 hours of becoming aware of it, of any breach affecting this data, with the information available.
- End of the service. When the agreement ends, RootBounty will delete the data or return it at the company's request, unless the law requires keeping it.
- Audits. RootBounty makes available the information needed to show compliance with this annex and allows reasonable audits, announced in advance, at the company's expense.
Parties
RootBounty:
- Owner: Pau Valls Peleteiro
- Legal form: an individual; RootBounty is not a registered company yet
- Contact: pauvalls@rootbounty.com
The company: the organisation identified in the company account, represented by the person identified by the signature below.