Bug bounty program terms for New Zealand organisations

They help define the legal and operational boundaries for external security testing. Without clear terms, researchers may not know what systems are in scope, what behaviour is permitted, how to report findings, or whether any reward applies. That can create confusion at exactly the point where your business needs certainty. Well-structured terms can also help separate authorised testing from conduct that falls outside the programme, which is important if your systems, customer data or internal tools are sensitive or business-critical.

These terms often cover programme scope, eligible participants, permitted testing methods, prohibited conduct, reporting channels, response expectations, reward criteria if you offer rewards, confidentiality, privacy-related wording, intellectual property treatment and liability limitations. Some programmes also need wording around duplicate reports, public disclosure timing, employee or contractor exclusions, and how submissions are assessed. The exact content turns on the systems involved and the way the programme is intended to operate, rather than on a standard set of clauses that suits every organisation.

Because the legal risk is closely tied to what researchers may access and what your business does with the information they submit. If your environment includes customer-facing applications, internal admin tools, third-party integrations or sensitive datasets, the terms may need different boundaries and warnings. The document needs to line up with your actual privacy practices, including how information moves through the business. A programme involving live user data, for example, may need different wording from one limited to a test environment or a narrow set of public-facing assets.

You can use a template as a reference point, but relying on one without adjustment can leave gaps. Many templates assume a particular programme model, reward structure or risk appetite, and they may not match your systems, reporting process or internal escalation path. They can also be too broad or too vague about what is authorised. This service is for businesses that want the document aligned with their actual programme settings. It can help you assess and reduce risk, but it focuses on helping you prepare clearly and understand the practical risks in every scenario.

Timing depends on how clearly defined your programme already is. If you know which assets are in scope, whether rewards apply, who can participate and how reports will be handled internally, the drafting process is usually more straightforward. If those decisions are still being worked through, the legal document may take longer because the terms need to reflect those operational choices accurately. Once we have the relevant information, we prepare the draft and then work through any changes needed before finalising the document.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Bug Bounty Program Terms service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.