Terms of Service

1. Who these terms are with

This platform is operated by Prop Firm Match Global - FZCO ("we", "us", "our"), whose registered office is at IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates.

"You" means the individual who holds the account. These terms apply to you personally, even where you also act for an employer. If you are entering into them on behalf of an organisation, you confirm you are authorised to bind it.

This platform is the security program for Prop Firm Match, at a subdomain of https://propfirmmatch.com. It is the same company and the same legal entity — not a separate service and not a separate counterparty.

These terms therefore supplement, and do not replace, the Prop Firm Match Terms of Service at https://propfirmmatch.com/terms-and-conditions. Those govern your use of https://propfirmmatch.com generally. These govern the bug bounty program and this platform, and where the two differ on anything to do with the program, these prevail.

Contact for all notices under these terms: security@propfirmmatch.com.

2. Your account

You must be at least 18 years old, or the age of majority where you live, whichever is greater.

One account per person. You are responsible for everything done through your account and for keeping your credentials secure.

You must give us accurate registration details and keep them current. We may suspend an account where the details are false.

We may suspend or close an account that breaches these terms, the Researcher Agreement, or the program policy. Where we close an account, findings you have already submitted remain governed by the terms in force when you submitted them.

3. Acceptable use of the platform

Testing our systems is governed by the Researcher Agreement and the program policy, not by this section. This section is about the platform itself — the site you are reading.

You must not attempt to access another researcher's reports, disrupt the platform's availability for others, or use it to store or transmit unlawful material.

You must comply with all laws that apply to you, including those of your country of residence and of any country whose systems you touch.

4. Eligibility, sanctions and payment screening

Recognition — hall-of-fame credit, reputation and leaderboard standing — is open to any researcher whose report qualifies under the program policy.

Monetary rewards are different, and are conditional. We may not lawfully pay everyone.

You confirm that you are not resident in, ordinarily located in, or acting on behalf of any person in a country or territory subject to comprehensive sanctions, and that you are not a person designated on any applicable sanctions list. You must tell us promptly if this stops being true.

Before we pay a monetary reward we may require identity documentation, proof of residence, tax documentation, and any other information we reasonably need to satisfy our sanctions, anti-money-laundering and tax obligations. We may use third-party screening providers for this.

We may withhold, delay or decline a monetary reward where screening is incomplete, where documentation is not provided within a reasonable period, where payment would breach applicable sanctions or other law, or where we reasonably believe the reward was obtained in breach of these terms or the program policy.

Withholding a payment under this section does not remove recognition already granted for a valid finding, and we will tell you the reason to the extent we are lawfully able to.

You are responsible for any taxes arising on a reward you receive. We may deduct or withhold amounts where law requires it.

5. Reward decisions, duplicates and disputes

Reward decisions are based on severity, reproducibility, and report quality, assessed against the published reward matrix at the time the report is triaged.

Duplicates: where two reports describe the same underlying issue, the earliest report that contained enough detail to reproduce the issue is treated as the original. A later report is marked duplicate. Where a later report materially advances our understanding of an issue we already held — a working exploit for a finding we had assessed as theoretical, for instance — we may treat it as a separate finding, at our discretion.

Disputes: if you disagree with a severity assessment, a duplicate marking or a reward decision, you may ask us to review it by replying on the report thread or by writing to security@propfirmmatch.com within 30 days of the decision. A reviewer who was not involved in the original decision will consider it and give you a written answer. That answer is our final position under this process; it does not affect any right you have to bring a claim under section 9.

This process replaces the previous statement that reward decisions were simply final.

6. Your reports and our use of them

You keep ownership of what you submit.

You grant us a worldwide, irrevocable, royalty-free licence to use, reproduce and adapt your report for the purpose of investigating, reproducing, fixing and verifying the issue, and for our internal security records.

Public credit is separate and is opt-in: we will name you publicly only with your agreement, and you may ask to be listed anonymously or removed from public credit at any time.

You confirm that the report is your own work, produced within the rules of engagement in the program policy, and that sharing it with us does not breach any obligation you owe someone else.

7. Availability and changes to the program

The platform is provided on an 'as is' and 'as available' basis. We do not promise it will be uninterrupted or error-free.

We may modify or discontinue the bug bounty program at any time. A change to the program or to these terms applies from its effective date and does not apply retroactively: a report is assessed under the version in force when it was submitted, and each version of this document carries a number and an effective date so that version can be identified.

Where a change to these terms is material, we will ask you to accept the new version before you continue to use the platform.

8. Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited under the laws of Dubai, United Arab Emirates.

Subject to that, we are not liable for indirect or consequential loss, loss of profit, loss of opportunity, or loss of data.

Subject to that, our total liability to you arising out of or in connection with these terms, the Researcher Agreement or the program is limited to the total rewards we paid you in the twelve months before the claim arose, or USD 50, whichever is greater.

The Prop Firm Match Terms of Service cap our total cumulative liability at USD 50. This section deliberately raises that cap for claims arising from the bug bounty program, to the rewards actually paid — you are doing security work for us, and the general cap for a visitor reading a comparison site is not the right measure of that relationship. For anything outside the program, the general cap continues to apply.

Nothing in this section limits our obligation to pay a reward we have already confirmed in writing.

9. Governing law and jurisdiction

These terms, and any dispute arising out of or in connection with them, are governed by the laws of Dubai, United Arab Emirates.

The courts of the courts of Dubai, United Arab Emirates have exclusive jurisdiction, save that we may bring proceedings to protect our systems or intellectual property in any court of competent jurisdiction.

Nothing in this section removes any right you have to bring proceedings in the courts of your country of residence where consumer protection law gives you that right.

Before starting proceedings, both of us will use reasonable efforts to resolve the matter through the dispute process in section 5.

10. General

If any provision is found unenforceable, the rest continues in force.

Our failure to enforce a provision is not a waiver of it.

You may not transfer your rights under these terms. We may transfer ours to a group company or to a buyer of the business, on notice to you.

These terms, the Researcher Agreement and the program policy together form the whole agreement between us about the bug bounty program, and they sit under the Prop Firm Match Terms of Service as section 1 describes. The Privacy Notice is a separate instrument and is not part of this contract.