Terms of Service

These Terms of Service ("Terms") govern your use of Proofline, a vulnerability disclosure, bug bounty and audit competition platform operated by BESC LLC, a New Hampshire limited liability company ("BESC", "we", "us"). By creating an account or using Proofline, you agree to these Terms and to our Privacy Policy. If you use Proofline on behalf of an organization, you agree on its behalf and confirm you have authority to do so.

#1. Who can use Proofline

You must be at least 18 years old and able to form a binding contract. You may not use Proofline if you are subject to sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), the United Nations, the European Union or the United Kingdom, or if you're located in a country or region subject to comprehensive U.S. sanctions. We may screen users against sanctions lists and may require identity verification before a payout (see section 8).

#2. Accounts and security

You are responsible for your account and everything done through it. Keep your password and second factor secure and tell us immediately at legal@proofline.systems if you suspect unauthorized access. Project and mediator accounts must enable two-factor authentication before acting on cases. Don't share accounts. Organizations manage their members' roles and are responsible for who they invite.

#3. What Proofline does, and doesn't do

Proofline provides the tools and the record: locked program rules, encrypted case files (Casefiles), a hash-chained history of every event and decision, structured decisions, rebuttals, independent mediation, and payout tracking.

• We are not a party to the bounty. A program is an offer from the project to researchers. Rewards are owed by the project to the researcher under the program's locked rules. BESC is not a guarantor of any payment.
• We don't hold reward funds. Rewards are paid by projects directly to researchers' verified wallets, or through a project-owned on-chain vault that we can't withdraw from. See section 9.
• We don't decide validity for projects. Projects triage and decide, with reasons recorded. Researchers may rebut, and either side may request mediation as described in section 7.

#4. Programs and locked rules (projects)

When you publish a program version, its rules (scope, impacts, rewards, exclusions, SLAs, and the duplicate, disclosure, mediation and payment policies) are fingerprinted and locked. Each Casefile is judged under the version in force when it was submitted. By publishing, you agree that:

• you are authorized to invite testing of every asset in scope, and your program accurately describes what is permitted;
• you'll evaluate reports in good faith, record the reason for every decision, and respond within your published SLAs;
• a report you accept as valid creates an obligation to pay the reward calculated under the locked rules, including when you choose not to fix the issue ("Won't Fix");
• you won't use report contents except to assess and remediate the issue, and you won't take action against researchers acting in good faith within your rules;
• if you adopt the SEAL Whitehat Safe Harbor or similar terms in your program, you are bound by them as written in your locked rules.

#5. Researcher conduct

When testing and reporting, you agree to:

• test only assets in scope and only in ways the program permits;
• avoid harm: no access to, modification of, or retention of other people's data beyond what's strictly necessary to demonstrate the issue; no service degradation, social engineering, physical attacks or spam;
• never exploit a vulnerability for gain, demand payment outside the program, or threaten disclosure (extortion);
• keep findings confidential until disclosure is permitted under the program's disclosure policy;
• submit only your own work, honestly described. Don't submit spam, AI-generated filler, or reports you know to be invalid;
• comply with applicable laws.

Program authorization comes from the project, not from BESC. If you're unsure whether something is in scope, ask through the program before testing.

#6. Confidentiality and content

Report contents, evidence and messages are encrypted and visible only to the researcher, the project's authorized members and, if requested, the assigned mediator. You keep ownership of what you submit. You grant BESC a limited license to host, encrypt, process, transmit and display your content to authorized participants to operate Proofline, and you grant the project the license described in its program rules to use your report to assess and fix the issue. Public pages show only what the platform's disclosure rules allow (for example, researcher profiles, acknowledgements, program track records, and disclosed reports).

Uploaded files are scanned for malware where scanning is available. Even so, treat proofs of concept as untrusted and open them in an isolated environment.

#7. Decisions, rebuttals and mediation

Decisions about a Casefile must cite a reason under the locked rules. The researcher may file one rebuttal per decision within 48 hours. Either party may then request independent mediation where the program allows it. Mediators are independent of the parties and must disclose conflicts. A mediation decision is final for the purposes of the Casefile and the program rules, and the project agrees in advance to honor it when publishing a program. Mediation on Proofline isn't arbitration and doesn't waive either party's legal rights, except that you may not use Proofline to relitigate a case already decided through mediation.

#8. Rewards, identity verification and taxes

Rewards are calculated by the locked rules and paid only to a wallet the researcher has verified by signature. Projects or BESC may require identity and sanctions screening before a payout, especially above the platform threshold. A verification hold delays payment. It never cancels a valid finding's reward. You're responsible for any taxes on rewards you receive. We may hold or refuse to facilitate a payout where required by law.

#9. On-chain payout vaults

Projects may fund a non-custodial smart-contract vault that pays rewards attested by Proofline, and that lets a researcher claim directly if a payout is overdue. Smart contracts and blockchains carry risks, including bugs, network congestion, forks, key compromise, and token or stablecoin failure. Transactions are public and irreversible. You use vaults at your own risk. BESC doesn't control vault funds and isn't liable for losses arising from smart contracts, blockchains, wallets or third-party tokens.

#10. Fees

Projects pay a platform fee on rewards paid through Proofline, as shown on the Pricing page or in your order form at the time a program version is published. The fee is billed to the project on top of the reward. It's never deducted from what researchers receive. Fees are not tied to the outcome of any decision. Proofline does not require anyone to buy, hold or stake a token.

#11. Integrations and API

If you connect integrations (webhooks, Slack, GitHub, Jira) or use API keys, you're responsible for the destinations you configure and for keeping keys secret. Integrations carry metadata and links by default, and you choose whether titles are included.

#12. Prohibited uses

You may not: use Proofline to violate any law or anyone's rights; access accounts or data you're not authorized to access; probe, scan or test Proofline itself outside our own published disclosure policy; interfere with the platform's operation or integrity; scrape non-public data; impersonate others; or upload malware except as inert, clearly labeled proof-of-concept material that a program requires.

#13. Suspension and termination

We may suspend or close accounts that breach these Terms, endanger users, or create legal risk, and we'll explain why where we lawfully can. You may close your account at any time. Casefile records are kept even after an account closes, because they're part of other participants' records and of the tamper-evident history (see the Privacy Policy). Sections that by their nature should survive termination will survive.

#14. Disclaimers

Proofline is provided "as is" and "as available". To the fullest extent permitted by law, BESC disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We don't warrant that Proofline will be uninterrupted or error-free, that any program is complete or accurate, or that any project will pay.

#15. Limitation of liability

To the fullest extent permitted by law, BESC will not be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenues, data or digital assets. BESC's total liability for any claim relating to Proofline is limited to the greater of (a) the fees you paid BESC in the 12 months before the claim arose, and (b) US $100. Some jurisdictions don't allow these limits, so they apply only to the extent permitted.

#16. Indemnity

You'll indemnify BESC against third-party claims arising from your breach of these Terms, your programs or testing activity, or your violation of law or of anyone's rights.

#17. Governing law and disputes

These Terms are governed by the laws of the State of New Hampshire, without regard to its conflict-of-laws rules. The state and federal courts located in New Hampshire have exclusive jurisdiction over any dispute arising from these Terms or Proofline, and you consent to their jurisdiction.

#18. Changes

We may update these Terms. For material changes, we'll give notice in the product or by email at least 14 days before they take effect, unless the change is required sooner by law. Locked program rules aren't affected by changes to these Terms. Continuing to use Proofline after changes take effect means you accept them.

#19. Contact

BESC LLC, New Hampshire, USA · legal@proofline.systems