Parties
Full legal names and contact details for the payer and payee, including entity type and authorized signatory information to support enforceability and payment authorization.
A written agreement clarifies scope, payment terms, IP rights, and tax responsibilities to reduce disputes and ensure consistent handling of claims and payments.
The agreement is used by organizations running bounty programs and by participants who claim rewards. It documents mutual expectations and reduces legal ambiguity.
Use the agreement to centralize approvals, confirm identity and tax status, and provide a repeatable process for handling claims and payments.
Security researchers, referral partners, or independent contractors who submit claims. Their role is to provide required identification, comply with program rules, assign necessary IP rights, and accept tax reporting responsibilities associated with payment.
Company signatory (legal, HR, or finance) who approves awards, confirms eligibility, and authorizes payment. This person ensures compliance with corporate policy, tax withholding, and record retention requirements.
A large software vendor offers rewards for verified vulnerabilities, with clear reproduction steps required and triage criteria.
A SaaS company pays a commission for qualified customer referrals that convert to paid accounts under defined criteria.
Full legal names and contact details for the payer and payee, including entity type and authorized signatory information to support enforceability and payment authorization.
A precise definition of eligible outcomes, required evidence or reproduction steps, exclusion criteria, and the review or triage process used to validate claims.
Payment amount or tiering, calculation method, payment method, timing, reimbursement of expenses if any, and conditions that can void or reduce awards.
Obligations to provide W-9/EIN or foreign tax forms, backup withholding rules, and who is responsible for information returns and tax filings.
Assignment or license provisions that transfer or license IP rights arising from the bounty deliverable, with scope and exceptions clearly stated.
Nondisclosure obligations, permitted disclosures for remediation, and who may speak publicly about the finding or referral.
Participant submits claim with required evidence and contact details.
Company validates eligibility and required remediation or proof.
Authorized representative approves award and triggers finance.
Finance issues payment and records metadata for tax reporting.
Obtain W-9 before payment; payer may withhold 24% backup withholding for missing TIN.
Issue Form 1099-NEC to recipient and IRS by January 31 for the preceding tax year.
Typical payment occurs within 30–60 days after approval unless contract states otherwise.
Keep payment and contract records for at least three years for IRS purposes; longer for certain industries.
Specify the period for disputing awards, commonly 30–90 days from notification.
| Criteria | Bounty Agreement | Referral Agreement |
|---|---|---|
| Payment Trigger | verified deliverable | customer conversion |
| IP Assignment | often required | rarely required |
| Tax Reporting | 1099-nec likely | 1099-nec possible |
| Typical Use Case | bug or task payment | lead or sale referral |
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | No | No | Yes, limited | Yes, limited |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
Choose a signing platform that supports required authentication, audit trails, and integrations with your finance and contract systems.
Ensure chosen solutions support legal requirements (ESIGN, UETA) and any industry-specific compliance such as HIPAA or 21 CFR Part 11 when applicable.