Terms of Service

1. About these terms

Proofsec is operated by Proofsec (“Proofsec”, “we”, “us”), Croatia, Europe. These Terms of Service (“Terms”) govern your access to and use of the Proofsec platform, its features and related services.

By creating an account, accessing the platform or using its services, you agree to these Terms and the other documents applicable to your use of Proofsec, including the Privacy Policy, Rules of Engagement and, where applicable, the Organization Terms and program-specific rules.

If you do not agree to these Terms, you must not create an account or use the platform.

If you use Proofsec on behalf of an organization, you represent that you have the authority to act for that organization and accept these Terms on its behalf. If you do not have that authority, you must not accept the Terms on the organization's behalf.

Certain programs, features or services may have additional conditions. If additional conditions apply, you must review and comply with them before using the relevant feature or participating in the program.

These Terms should be read together with applicable mandatory consumer protection, privacy and other legal rights. Nothing in these Terms removes rights that cannot lawfully be excluded or restricted.

2. Eligibility and your account

• You must meet the minimum age and other eligibility requirements applicable to your use of Proofsec and to the laws governing your participation.
• Provide accurate, current and complete information when creating and maintaining your account.
• Update your account information when it changes, particularly information necessary for account security, communication, organization verification or reward eligibility.
• Keep your credentials confidential and take reasonable steps to prevent unauthorized access to your account.
• You are responsible for activity carried out through your account, except to the extent that applicable law provides otherwise or the activity results from circumstances for which you are not responsible.
• Do not share, sell, rent, transfer or allow another person to use your account in a way that violates these Terms or compromises account security.
• Do not create additional accounts to evade restrictions, manipulate reputation, submit duplicate reports or obtain an unfair advantage.
• Do not impersonate another person or organization or misrepresent your identity, qualifications, affiliations or authority.
• Contact Proofsec promptly if you suspect that your account has been compromised or used without authorization.

3. What Proofsec is

Proofsec is a platform intended to connect security researchers and organizations through security programs, vulnerability reports, collaboration sessions and related research workflows.

The platform may provide tools for discovering programs, reviewing scope, coordinating research, documenting findings, communicating with teammates and managing report-related information, depending on the features available at the time.

Proofsec provides the platform and associated functionality. The organization responsible for a program determines its authorized assets, testing restrictions, eligibility requirements, triage decisions and reward conditions under the applicable program terms.

A program listing does not automatically authorize testing of every asset associated with an organization. Authorization is limited to the scope and conditions expressly provided by the relevant organization.

Proofsec does not own the targets listed by organizations and cannot independently grant permission to test systems owned or controlled by another party unless it has the relevant authority.

Proofsec does not guarantee that any program will remain available, that a report will be accepted, that a vulnerability will qualify for a reward or that a particular payment will be made.

The platform does not guarantee that a target is secure, free of vulnerabilities, stable or safe to test. Researchers remain responsible for following the applicable program rules and Rules of Engagement.

Proofsec is not a substitute for professional legal, tax, financial or security advice.

4. Researcher responsibilities

You are responsible for understanding the rules that apply to your research before testing a target.

You may test only assets that are explicitly in scope for an active program you are authorized to participate in, and only by using techniques permitted by that program.

You must follow the Rules of Engagement, the organization's program requirements and any applicable restrictions on automation, account use, data access, evidence collection and disclosure.

You must stop or pause testing when required by the program, when authorization becomes unclear or when continued activity could cause unintended harm.

You must submit accurate reports based on verified observations and must not fabricate evidence, exaggerate impact or knowingly misrepresent a finding.

You must protect personal data, confidential information, credentials and other sensitive material encountered during research.

You must not use Proofsec to facilitate unauthorized access, fraud, harassment, extortion, service disruption or other prohibited activity.

Participation in a research session does not expand your authorization or relieve you of responsibility for your own actions.

Detailed research restrictions are set out in the Rules of Engagement and in the applicable program terms.

5. Organization responsibilities

Organizations using Proofsec are responsible for providing accurate information about their identity, authority over program assets and the conditions under which research is authorized.

Organizations must define program scope, exclusions, permitted techniques and relevant restrictions clearly enough for researchers to understand the boundaries of authorized activity.

Organizations are responsible for their program-specific eligibility criteria, report assessments, remediation decisions, disclosure requirements and reward conditions.

Organizations must not represent that they have authorized testing of third-party assets unless they have the necessary authority.

Organizations must comply with the terms applicable to their use of Proofsec, including the Organization Terms where applicable.

Proofsec may require additional information or verification where reasonably necessary to establish an organization's authority, investigate misuse or maintain platform integrity.

6. Programs, reports and triage

Program availability, scope, participation requirements and reward conditions may differ between organizations and may change over time.

Researchers must review the current program information before beginning testing and must follow any material changes communicated by the organization.

Submitting a report does not guarantee acceptance, a particular severity classification, a reward or a specific response time.

Organizations may assess reports according to their program criteria, including scope, reproducibility, technical validity, impact, eligibility and whether the issue has already been reported.

Reports may be accepted, rejected, marked as duplicates, returned for additional information or assigned another outcome supported by the applicable workflow.

Proofsec may provide tools for submitting, storing, displaying or managing reports, but the final assessment may belong to the organization responsible for the program.

You must not submit fabricated, copied, knowingly duplicate or materially misleading reports to manipulate reputation, obtain rewards or interfere with another researcher's work.

If you disagree with a report outcome, use the review or support process available for the program or platform. A disagreement does not authorize continued exploitation or public disclosure.

Proofsec may correct records or outcomes when reasonably necessary to address errors, abuse, inaccurate information or inconsistencies with applicable program rules.

7. Rewards and payments

Rewards are available only where an organization offers them and a report satisfies the applicable program conditions. Not all programs offer monetary rewards.

Reward eligibility, amount, severity assessment, duplicate handling, researcher eligibility and payment requirements are determined by the applicable program terms and the responsible organization.

Proofsec does not guarantee any minimum income, reward amount, payment date, currency or number of accepted findings.

A submitted report, an accepted finding or participation in a session does not automatically entitle you to a payment unless the applicable program terms establish that entitlement.

Team submissions and reward allocations are subject to the program's rules and any applicable allocation process. Do not assume that Proofsec automatically divides or transfers rewards unless the relevant feature and terms explicitly provide for it.

Where payment-related functionality is enabled, you may need to provide information necessary for payment processing, identity verification, fraud prevention or legal compliance.

Payment processing may involve third-party providers operating under their own terms and privacy practices.

You are responsible for understanding and meeting your own tax, reporting and other legal obligations relating to rewards, except where applicable law places an obligation on another party.

Reward disputes must be handled through the applicable program or support process. They do not justify threats, extortion, unauthorized access or disclosure of confidential information.

Further details are provided in the Rewards and Payments document and the relevant program terms, where applicable.

8. Your content and ownership

Subject to the rights of third parties and applicable law, you retain ownership of the original content you create and submit through Proofsec, including reports, notes, messages, code snippets and files.

You must have the rights and permissions necessary to submit any content you upload, share or otherwise make available through the platform.

You must not upload content that unlawfully discloses personal information, confidential material, trade secrets, copyrighted works or other protected information.

By submitting content, you grant Proofsec a limited, non-exclusive license to host, store, reproduce, process, transmit and display that content to the extent reasonably necessary to operate, secure, maintain and provide the platform and the features you use.

This license may include displaying a report to the organization responsible for the relevant program and sharing session material with authorized session participants according to the applicable feature settings and permissions.

The license does not transfer ownership of your original content to Proofsec. It lasts for as long as necessary for the relevant purposes, subject to applicable law, contractual obligations, legitimate retention requirements and the Privacy Policy.

You are responsible for ensuring that content you share with teammates or organizations is appropriate for those recipients and complies with program confidentiality requirements.

Content submitted as part of a vulnerability report may need to remain available for triage, remediation, dispute resolution, security investigations or other legitimate purposes even after you stop participating in a program.

You must not assume that deleting a message, leaving a session or closing an account automatically removes every copy, report, backup or record held by the platform or its recipients.

9. Confidentiality and disclosure

Vulnerability reports, proof-of-concept material, internal communications and evidence may contain confidential or sensitive information. You must handle them in accordance with the applicable program terms, Rules of Engagement and Privacy Policy.

Do not publicly disclose an unresolved vulnerability, confidential report, private communication or sensitive evidence without the required authorization.

Follow any coordinated disclosure requirements and written agreements that apply to the program.

Do not use confidential information obtained through Proofsec to threaten an organization, demand an unauthorized payment, sell access or gain an unrelated advantage.

Share report details only with recipients authorized to receive them and only to the extent necessary for the relevant purpose.

These confidentiality requirements do not remove rights or protections that cannot lawfully be restricted, including applicable rights to make protected disclosures to competent authorities.

10. Collaboration sessions and communications

Proofsec may provide collaborative features such as research sessions, shared notes, code snippets, file exchange and chat, depending on the functionality available.

You are responsible for the content you submit or share through these features and must ensure that you have permission to share it with the intended recipients.

Do not share account credentials, unnecessary personal data, stolen material or evidence obtained outside the relevant authorization.

Session membership does not grant access rights beyond those provided by the platform and the applicable program.

Do not impersonate another participant, interfere with another user's work, misrepresent contributions or use collaboration features to coordinate prohibited activity.

Keep disagreements about authorship, contributions or reward allocation within appropriate private channels and use available review processes where necessary.

The availability, persistence, visibility and deletion behavior of session content depend on the implemented features and applicable policies. Do not assume that a private session is equivalent to an independently encrypted or legally privileged communication channel.

11. Prohibited conduct

• Testing assets that are outside the authorized scope of a program.
• Performing prohibited denial-of-service, destructive, disruptive or otherwise harmful testing.
• Accessing, collecting, changing, deleting or disclosing personal or confidential data beyond what is authorized and necessary to verify a finding.
• Using stolen credentials, compromised accounts or unauthorized access to conduct research.
• Phishing, impersonation, extortion, harassment or threats in connection with platform activity.
• Demanding payment outside the applicable program or threatening disclosure to obtain money or another benefit.
• Selling, transferring or disclosing confidential vulnerability information or unauthorized access to unrelated parties.
• Submitting fabricated, plagiarized, misleading or knowingly duplicate reports.
• Creating accounts or manipulating platform activity to evade restrictions or inflate reputation.
• Accessing another user's account, private messages, files or reports without authorization.
• Scraping, overloading, disrupting or abusing the platform or its infrastructure.
• Reverse engineering or attempting to bypass technical restrictions except where and to the extent such restrictions cannot lawfully prohibit the activity under applicable law.
• Uploading malicious code, unlawful content or material that infringes third-party rights.
• Using Proofsec to violate applicable law, third-party rights or the terms of a program.

12. Platform availability and changes

Proofsec may update, modify, add, restrict or discontinue features to improve the platform, address security issues, comply with legal requirements or respond to operational needs.

We aim to maintain a useful and reliable service but do not guarantee uninterrupted availability, error-free operation, permanent data availability or compatibility with every device or software environment.

The platform may occasionally be unavailable because of maintenance, technical failures, security incidents, third-party service interruptions or circumstances outside our reasonable control.

Where reasonably practicable, we may provide notice of material changes or planned interruptions that significantly affect users.

We may impose reasonable technical limits to protect platform stability, prevent abuse and maintain service integrity.

You must not attempt to bypass usage limits, access controls or technical restrictions designed to protect the platform or its users.

13. Third-party services and links

Proofsec may rely on third-party providers for hosting, data storage, authentication, communications, analytics, payment processing or other services.

Your use of a third-party service may be subject to that provider's separate terms, privacy notices and operational requirements.

Proofsec does not control every aspect of third-party services and cannot guarantee their uninterrupted availability, security or continued operation.

References to external websites, tools or services are provided for convenience or functionality and do not necessarily constitute an endorsement.

You are responsible for reviewing third-party terms where relevant and for ensuring that your use of external tools complies with the program's authorization and restrictions.

Nothing in these Terms authorizes you to test or access a third-party service merely because it is linked from Proofsec or used by an organization participating on the platform.

14. Privacy and data protection

The Privacy Policy explains how personal data is handled in connection with Proofsec, including the purposes of processing, relevant recipients, retention practices and available rights.

You must provide only information that is accurate and appropriate for the feature or process in which it is requested.

Do not submit another person's personal data unless you have an appropriate basis and permission to do so, and the submission is necessary for a legitimate platform or reporting purpose.

When a report contains personal data, minimize the information included and redact unnecessary identifiers wherever possible.

Account closure or removal of content from the visible interface may not immediately remove information that must be retained for security, legal compliance, dispute resolution, backup management or other legitimate purposes described in the Privacy Policy.

Personal data is handled in accordance with applicable data protection law. Nothing in these Terms excludes rights available to data subjects under mandatory law.

15. Intellectual property and platform rights

The Proofsec platform, including its software, interface, branding, design and original platform materials, is protected by applicable intellectual property laws.

Except where expressly permitted by law or authorized by Proofsec, you must not copy, redistribute, commercially exploit or create derivative works from protected platform materials in a way that infringes applicable rights.

These Terms grant you a limited, non-exclusive, non-transferable and revocable right to access and use the platform for its intended purposes while you comply with these Terms.

You must not use Proofsec branding or represent yourself as an official representative of Proofsec without authorization.

You retain rights in your own original submissions subject to the limited license described in these Terms and the rights of other parties.

You must respect third-party intellectual property and confidentiality rights when uploading code, documents, screenshots or other materials.

16. Reputation, moderation and platform decisions

Proofsec may provide reputation indicators, report outcomes, contribution records or other information intended to support research workflows and platform integrity.

The meaning and calculation of these indicators depend on the relevant rules and features. No particular score, ranking, status or outcome is guaranteed.

We may review or correct platform records when reasonably necessary to address errors, fraud, abuse, duplicate activity or inconsistencies with applicable rules.

Where a review process is available, users may use it to provide relevant information or request reconsideration of a decision.

We may moderate content or restrict features when reasonably necessary to protect users, organizations, the platform or compliance with applicable requirements.

Platform decisions do not replace decisions that an organization is entitled to make under its own program terms.

You must not manipulate reputation, interfere with another user's participation or misrepresent a platform outcome to obtain an advantage.

17. Suspension and termination

You may stop using Proofsec and request account closure through the available account or support process.

We may issue warnings, restrict features, suspend access or terminate an account where reasonably necessary to address violations of these Terms, the Rules of Engagement, applicable program rules or legal requirements.

We may take immediate protective action where we reasonably believe that an account presents a significant security risk, is being used for serious abuse or could cause harm if access continues.

Where reasonably practicable and legally permitted, we will provide information about the reason for a material restriction and any available review process.

We may preserve relevant records when reasonably necessary for security investigations, dispute resolution, legal compliance or the enforcement of applicable terms.

Account closure does not automatically cancel obligations relating to confidentiality, intellectual property, payment disputes, legal compliance or the handling of information that must legitimately be retained.

Closing an account does not guarantee the deletion of every report, message, backup or record held by Proofsec or by organizations and participants who previously received the information.

If you believe a suspension or termination was made in error, you may contact Proofsec through the designated support channel and provide relevant details.

18. Disclaimers

To the extent permitted by applicable law, Proofsec is provided on an “as is” and “as available” basis.

We do not warrant that the platform will be uninterrupted, error-free, secure against every possible threat, compatible with every environment or suitable for every particular purpose.

We do not guarantee that program information supplied by organizations is complete or current, that a target is free from risk or that a research result will be accepted.

We do not guarantee the conduct, availability, identity, competence or performance of other users, researchers, organizations or independent third-party providers.

Users and organizations remain responsible for their own actions, decisions, communications and obligations under the applicable program terms and law.

Nothing in this section excludes or limits a warranty, representation or statutory right that cannot lawfully be excluded or limited.

19. Limitation of liability

To the extent permitted by applicable law, Proofsec will not be liable for indirect or consequential losses arising from use of, or inability to use, the platform where such exclusion is legally enforceable.

To the extent permitted by applicable law, Proofsec is not responsible for independent actions or omissions of researchers, organizations or third-party providers that are outside its reasonable control.

Nothing in these Terms excludes or limits liability for fraud, intentional misconduct, gross negligence where such limitation is prohibited, death or personal injury caused by negligence where applicable law prohibits exclusion, or any other liability that cannot lawfully be excluded or limited.

Any financial liability cap, exclusion of specific loss categories or additional allocation of risk must be interpreted subject to mandatory law and the circumstances of the relevant claim.

These Terms do not remove mandatory consumer rights or other non-waivable protections available under applicable law.

20. Indemnification and claims

You are responsible for your own conduct and for ensuring that your use of Proofsec complies with these Terms, applicable program rules and applicable law.

If your actions violate another party's rights or create a claim against Proofsec, the matter will be handled in accordance with applicable law and any valid contractual obligations that apply.

Nothing in these Terms creates an obligation to indemnify Proofsec where such an obligation would be prohibited by applicable law or would unlawfully restrict mandatory consumer protections.

If you become aware of a claim, security incident or legal concern materially related to your platform activity, you should provide accurate information through the appropriate channel and cooperate where reasonably required by law.

21. Changes to these Terms

We may update these Terms to reflect changes in the platform, its features, legal requirements, security practices or operational processes.

The version number and effective date identify the applicable version of these Terms.

Where a change is material, we will provide notice before it takes effect where required by applicable law and, where reasonably practicable, through an appropriate platform or communication channel.

If a change requires renewed consent under applicable law, we will seek that consent before relying on the changed Terms for the relevant purpose.

Your continued use of Proofsec after an updated version takes effect may indicate acceptance where permitted by applicable law. Continued use does not replace any legally required express consent.

If you do not agree to an updated version, you must stop using the affected services and may request account closure, subject to any continuing obligations and applicable retention requirements.

22. Governing law and disputes

These Terms are governed by the laws of the Republic of Croatia, subject to any mandatory legal protections that apply to you.

Disputes are subject to the jurisdiction of the courts of the competent courts of the Republic of Croatia, except where mandatory law grants you the right to bring proceedings before another competent court or provides other non-waivable protections.

Before initiating formal proceedings, you may contact Proofsec to explain the issue and seek an appropriate resolution. This does not restrict any statutory right, limitation period or access to a competent authority or court.

If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions continue to apply to the extent permitted by law. The invalid provision should be interpreted or limited only as necessary to comply with applicable law.

A failure to enforce a provision on one occasion does not automatically waive the right to enforce it later.

23. Contact and effective date

These Terms take effect on September 14, 2026.

For questions about these Terms, account restrictions, platform use or related matters, contact contact@proofsec.net.

When contacting support about an account or report, provide enough information to identify the issue without including passwords, authentication tokens or unnecessary sensitive data.

Please identify the relevant program or report when requesting assistance with a program-specific decision.

24. Before using Proofsec

• Read these Terms and the Privacy Policy.
• Review the Rules of Engagement before conducting security research.
• Read the applicable program scope, exclusions and reward conditions.
• Provide accurate account information and protect your credentials.
• Share only content you are authorized to disclose.
• Respect confidentiality, personal data and third-party rights.
• Understand that report acceptance, reputation outcomes and rewards are not guaranteed.
• Use the available support or review process if a dispute or account issue arises.