The terms the platform runs on.

• Account data: your name, email address, and a salted, hashed password.
• Report data: the findings you submit — titles, descriptions, reproduction steps, CVSS vectors, attachments, and the conversation thread with our triage team.
• Platform activity: report state changes, reputation, and the audit trail of administrative actions.
• Technical logs: standard server logs held by our hosting provider (requests, timestamps, IP addresses) for security and availability.

We process this data to run the program: to triage and verify reports, to credit and reward researchers, and to keep the platform secure. We never sell data. Where the platform depends on an external service, it does so under a data-processing agreement covering only the purposes stated below.

• Database hosting

  Managed PostgreSQL

  All platform data lives in a managed PostgreSQL database operated for us in the European Union (Frankfurt).

• Application hosting

  Managed infrastructure

  The application runs on a managed hosting platform, which holds standard access logs under its own security programme.

• Transactional email

  Email delivery

  Verification, password reset and report notifications are delivered through a managed email service on our behalf.

• One session cookie, required to keep you signed in. It is first-party and carries no tracking identifiers.
• Your theme choice is stored locally in your browser and never leaves your device.
• No third-party analytics, no advertising, and no cross-site tracking. The site works without any other storage.

• Access and correction: ask us what we hold about you and correct it.
• Deletion: ask us to delete your account and personal data. Reports with live triage value are retained until the underlying issue is resolved; the audit trail is retained because it is the record that protects researchers.
• Hall of fame: public credit lists only your chosen name and reputation. If you would rather not be named, tell us and we will list you anonymously.
• Withdrawal: you can stop participating at any time; already-submitted reports remain governed by the program policy.

Data protection and privacy requests go to security@propfirmmatch.com. We aim to answer within 30 days.

1. 01You must comply with all local, national, and international laws.
2. 02You are responsible for any taxes on rewards you receive.
3. 03Prop Firm Match may modify or terminate this program at any time. Changes do not apply retroactively.
4. 04You warrant that reports you submit are your own work, produced within the program policy's rules of engagement.
5. 05By submitting a report you grant Prop Firm Match the right to use it to fix, verify, and — after the issue is resolved and only with your agreement — publicly credit the finding.
6. 06The platform is provided without warranty. Prop Firm Match's liability is limited to the extent permitted by applicable law.

This document is reviewed whenever the platform changes. Substantial changes are announced in the report thread and on this page; continuing to use the platform after a change means you accept it. This page is the current version for all purposes.

Questions for the team: security@propfirmmatch.com