PHRASE BUG BOUNTY PROGRAM TERMS AND CONDITIONS
These Bug Bounty Program Terms and Conditions (“Program Terms”) govern participation in the Phrase Bug Bounty Program (the “Program”) operated by Phrase a.s., a joint-stock company organized under the laws of the Czech Republic, with its registered seat at Václavské náměstí 2132/47, Nové Město, 110 00 Prague 1, Czech Republic, ID No.: 24707139, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. B 20324 (together with its affiliates that operate the Phrase Language Intelligence Platform, phrase.com and related websites and services, collectively “Phrase,” “we,” “us,” or “our”). These Program Terms are a legally binding agreement between Phrase and any individual or entity who participates in the Program (“Researcher,” “Participant,” “you,” or “your”).
1. ACCEPTANCE OF THESE PROGRAM TERMS
1.1 These Program Terms are published at https://phrase.com/security/ (and/or such other URL as Phrase may designate) and are not executed by individual signature. By accessing any In-Scope Asset for security research purposes, submitting a vulnerability report, or otherwise participating in the Program, you acknowledge that you have read, understood, and agree to be bound by these Program Terms, as amended from time to time in accordance with Section 17. If you do not agree, you must not participate in the Program.
1.2 If you participate on behalf of a company, organization, or other entity, you represent that you have the authority to bind that entity to these Program Terms, and “you” refers to both you individually and that entity, jointly and severally.
1.3 Phrase may require an affirmative acknowledgment of these Program Terms (for example, a checkbox at the point of report submission) as a condition of processing a report or paying a Bounty. Any such acknowledgment is confirmatory of, and not a precondition to, the binding effect of these Program Terms under Section 1.1.
2. DEFINITIONS
• “Bounty” means the monetary reward described in Section 9.
• “Confidential Information” has the meaning given in Section 7.1.
• “CVSS” means the Common Vulnerability Scoring System, currently version 4.0 as published by FIRST.org (https://www.first.org/cvss/), or such successor version as Phrase may adopt and announce.
• “In-Scope Assets” has the meaning given in Section 4.
• “Report” means a written vulnerability submission made in accordance with Section 6.
• “Vulnerability” means a flaw, weakness, or misconfiguration in an In-Scope Asset that could reasonably be exploited to compromise the confidentiality, integrity, or availability of that asset or the data it processes.
3. ELIGIBILITY
3.1 You may participate in the Program only if: (a) you are at least 18 years old, or the age of majority in your jurisdiction of residence, or you have the consent of a parent or legal guardian; (b) you are not, and have not been within the preceding twelve (12) months, an employee, officer, director, contractor, or consultant of Phrase or its affiliates, and you are not an immediate family member or member of the same household as such a person; (c) you, and any bank account you provide under Section 10, are not located in, ordered from, a national or resident of, or otherwise subject to comprehensive trade or economic sanctions administered by the United States (including OFAC), the European Union, the United Kingdom, or any other applicable authority, and you do not appear on any restricted, denied, or blocked persons list maintained by such authorities; and (d) your participation, including any testing activity, does not violate any law applicable to you.
3.2 Phrase may, in its sole discretion, disqualify any Participant from the Program, and decline to pay or reclaim any Bounty already paid, if it determines that the Participant has violated these Program Terms, applicable law, or the eligibility criteria in this Section 3.
4. SCOPE
4.1 In-Scope Assets means the Phrase production websites, applications, and services identified as in-scope at Bugbounty scope page from time to time, which currently includes, without limitation, the phrase.com website and the production Phrase Language Intelligence Platform applications and APIs (Phrase TMS, Phrase Strings, and Phrase Studio) (the “In-Scope Assets”).
4.2 Out of Scope. The following are excluded from the Program and are not eligible for a Bounty regardless of severity: (a) third-party websites, products, or services not owned or controlled by Phrase, even if linked to or from an In-Scope Asset; (b) denial-of-service, resource-exhaustion, or load/stress testing of any kind; (c) social engineering, phishing, or physical-security attacks directed at Phrase personnel, contractors, offices, or facilities; (d) spam, content injection, or issues with no demonstrable security impact; (e) automated or unauthenticated bulk scanning that generates disproportionate traffic without a validated finding; (f) findings that require physical access to a device or network not owned by the reporting Participant; (g) vulnerabilities in software, plugins, or infrastructure not owned or operated by Phrase; (h) missing security best-practice recommendations, outdated software banners, or absent security headers without a demonstrated, exploitable impact; and (i) Vulnerabilities that are already known to Phrase or already public at the time of the Report.
4.3 Phrase maintains the current list of In-Scope Assets and any additional exclusions at the Bugbounty scope page. That list forms part of, and is incorporated into, these Program Terms and may be updated by Phrase from time to time in accordance with Section 17.
5. RULES OF ENGAGEMENT; LIMITED AUTHORIZATION; SAFE HARBOR
5.1 Subject to your continued compliance with these Program Terms, Phrase authorizes you to access and test the In-Scope Assets solely for the purpose of identifying and reporting Vulnerabilities to Phrase under this Program. This authorization is limited to that purpose and does not extend to any other use, asset, or activity.
5.2 You must not: (a) access, view, copy, modify, delete, or exfiltrate any data that is not your own, beyond the minimum necessary to demonstrate a Vulnerability; (b) degrade, disrupt, or deny service to any In-Scope Asset, Phrase system, or third party; (c) run automated tools in a manner that generates disproportionate load on Phrase’s infrastructure; (d) exploit a Vulnerability beyond what is reasonably necessary to establish and document its existence, including any lateral movement, privilege escalation, or persistence beyond that purpose; (e) engage in social engineering, physical intrusion, or any attack directed at Phrase personnel, contractors, or facilities; or (f) access, view, or otherwise interact with the personal data or content of any Phrase customer, employee, or other individual, except to the minimum extent necessary to demonstrate a Vulnerability, and never to view, copy, or retain the substance of such data or content.
5.3 Safe Harbor. Where you act in good faith, remain within the Scope, and otherwise comply with these Program Terms, Phrase considers your activity to be authorized security research and will not pursue civil or criminal legal action against you, or refer you to law enforcement, on account of that activity, including under computer-crime or anti-circumvention laws such as the U.S. Computer Fraud and Abuse Act, the U.S. Digital Millennium Copyright Act, or equivalent laws in your jurisdiction, to the extent Phrase is able to make that determination. This safe harbor does not apply to activity outside the Scope, activity undertaken in bad faith, or any breach of these Program Terms, and Phrase cannot bind independent third parties (such as a hosting or infrastructure provider) who are not party to these Program Terms.
6. REPORTING A VULNERABILITY
6.1 Submit Reports to security@phrase.com, or such other address or intake portal as Phrase may designate from time to time. A Report should include a clear description of the Vulnerability; the affected In-Scope Asset, URL, or endpoint; step-by-step reproduction instructions and, where applicable, a proof-of-concept; the potential impact; and, optionally, your own preliminary CVSS v4.0 vector string and score.
6.2 You must not include in a Report any personal data or confidential Phrase customer content beyond what is strictly necessary to demonstrate the Vulnerability, and you must redact or anonymize any such information wherever possible.
6.3 First-to-Report. Where more than one Participant reports the same or substantially the same Vulnerability, only the first valid Report received by Phrase, as determined by Phrase’s records of receipt, is eligible for a Bounty.
6.4 Phrase will use reasonable efforts to acknowledge receipt of a Report and to communicate a triage decision within a reasonable time, recognizing that timelines may vary with the complexity of the Report and Phrase’s then-current workload.
7. CONFIDENTIALITY AND NON-DISCLOSURE
7.1 Confidential Information. All information relating to a Vulnerability, including its existence, technical details, any proof-of-concept or exploit code, affected systems, and any other non-public information about Phrase’s systems, security posture, customers, or personnel that you learn, generate, or access in connection with the Program, is the confidential and proprietary information of Phrase (“Confidential Information”), whether or not marked confidential.
7.2 Non-Use and Non-Disclosure. You shall: (a) hold all Confidential Information in strict confidence and protect it using at least the same degree of care you use to protect your own confidential information, and no less than a reasonable degree of care; (b) not disclose, publish, post, present, or otherwise communicate any Confidential Information to any third party, including on social media, blogs, mailing lists, public forums, at conferences, or to vulnerability databases or aggregators, without Phrase’s prior written consent; (c) use Confidential Information solely to report the Vulnerability to Phrase under this Program and for no other purpose whatsoever, including not for competitive purposes, further exploitation, extortion, resale, or transfer to any third party; and (d) not further exploit, or assist any third party in exploiting, the Vulnerability against Phrase, its customers, or any other party.
7.3 Coordinated Disclosure. You may request Phrase’s consent to publish a write-up or otherwise disclose a Vulnerability after Phrase has remediated it. Any public disclosure requires Phrase’s prior written consent as to both timing and content, which Phrase will not unreasonably withhold once a fix has been deployed and a reasonable remediation-verification period has elapsed (ordinarily ninety (90) days from deployment of the fix, unless Phrase agrees to a different period in writing). Phrase may require redaction of exploit details, customer-identifying information, or other sensitive content prior to publication.
7.4 Exceptions. Your obligations under this Section 7 do not apply to information that: (a) was already lawfully in your possession, free of any confidentiality obligation, before Phrase disclosed it or you discovered it; (b) is or becomes publicly available other than through your breach of these Program Terms; (c) you independently develop without use of or reference to the Confidential Information; (d) you disclose to your own legal counsel, bound by professional obligations of confidentiality, solely to assess your rights and obligations under these Program Terms; or (e) you are compelled to disclose by a valid order of a court or governmental authority of competent jurisdiction, provided that, to the extent legally permitted, you give Phrase prompt written notice so that Phrase may seek a protective order or other appropriate remedy, and you disclose only the minimum required.
7.5 Duration. Your obligations under this Section 7 survive indefinitely and are not affected by whether a Report is accepted, validated, rejected, or rewarded, or by the expiration, suspension, or termination of the Program or these Program Terms.
7.6 Remedies. You acknowledge that unauthorized use or disclosure of Confidential Information may cause Phrase irreparable harm for which monetary damages alone may be an inadequate remedy, and that Phrase is entitled to seek injunctive or other equitable relief for any breach or threatened breach of this Section 7, in addition to any other remedy available at law or in equity, without the necessity of posting a bond.
8. SEVERITY ASSESSMENT (CVSS)
8.1 Phrase will assess the severity of each valid, in-scope, non-duplicate Vulnerability using the Common Vulnerability Scoring System, currently CVSS version 4.0, applying the official CVSS v4.0 calculator methodology (https://www.first.org/cvss/calculator/4.0) to the Base Score metrics applicable to the Vulnerability as it actually manifests in the relevant In-Scope Asset, rather than a theoretical worst case.
8.2 Severity tiers, and the corresponding Bounty, correspond to the standard CVSS v4.0 qualitative severity rating scale as follows:
| Severity | CVSS v4.0 Base Score Range | Bounty (USD) |
|---|---|---|
| Low | 0.1 – 3.9 | USD 50 |
| Medium | 4.0 – 6.9 | USD 150 |
| High | 7.0 – 8.9 | USD 350 |
| Critical | 9.0 – 10.0 | USD 1000 |
A Vulnerability with a CVSS v4.0 Base Score of 0.0 (None/Informational) is not eligible for a Bounty, though Phrase may, at its discretion, acknowledge the Report.
8.3 Phrase’s severity determination, including the CVSS vector string and Base Score it applies, is final and binding for purposes of the Program. Any CVSS vector string or score self-assessed and submitted by a Participant is advisory only and is not binding on Phrase.
8.4 Phrase may, acting reasonably and in good faith, adjust the assessed severity, and therefore the applicable Bounty tier, upward or downward from a strict mechanical CVSS calculation to account for factors the CVSS Base Score does not fully capture, including the Vulnerability’s actual exploitability in production, real-world business or customer impact, the quality and completeness of the Report, and whether the Report reflects a chain of otherwise low-severity findings that, combined, produce a higher-impact exploit (in which case Phrase will assess the severity of the combined impact).
9. BOUNTY ELIGIBILITY AND AMOUNTS
9.1 A Report is eligible for a Bounty only if it: (a) concerns an In-Scope Asset; (b) describes a genuine security Vulnerability not previously known to Phrase, with sufficient detail and, where applicable, a working proof-of-concept for Phrase to reproduce and validate it; (c) is the first valid Report of that Vulnerability received by Phrase (Section 6.3); (d) results from activity consistent with Section 5; and (e) is submitted by a Participant who satisfies Section 3 and is not otherwise disqualified.
9.2 Subject to Section 8 and this Section 9, Bounties are paid according to the severity Phrase assigns to the Vulnerability under Section 8, in the amount determined in Section 8.2.
9.3 Phrase determines, acting reasonably and in good faith and applying the criteria set out in these Program Terms, whether a Report is eligible, its assessed severity, and the resulting Bounty amount. Phrase is not obligated to pay a Bounty for a Report that does not meet the criteria in Section 9.1, including Reports that are out of scope, duplicative, previously known, or otherwise invalid. A contractual entitlement to a specific Bounty amount arises only once Phrase has confirmed, in writing, the Report’s eligibility, assessed severity, and corresponding amount.
9.4 Where a single root cause underlies multiple related findings, Phrase may treat them as one Vulnerability for Bounty purposes. Where a single Report identifies multiple, unrelated Vulnerabilities, each may be separately assessed and separately rewarded.
9.5 No Bounty is payable unless and until a Report has been submitted, validated, and approved by Phrase in accordance with this Section 9.
9.6 Phrase may, at its discretion, establish a reasonable annual or per-Participant cap on aggregate Bounties, update the amounts or severity mapping in Section 8.2, or suspend the Program at any time in accordance with Section 17. Any such change applies prospectively to Reports submitted after its effective date.
10. PAYMENT TERMS
10.1 Method. Bounties are paid exclusively by bank wire or ACH transfer, in United States Dollars (USD), to a bank account held in the Participant’s own name (or, for a Participant that is an entity, an account held in that entity’s own name). Phrase does not pay Bounties in cash, by check, by cryptocurrency or any other virtual or digital asset (including Bitcoin or similar), by gift card, or by any method other than bank transfer.
10.2 Information Required. To receive payment, you must provide accurate banking details (account holder name, IBAN or account number, and SWIFT/BIC or equivalent routing information), your legal name and address, and any tax documentation Phrase reasonably requests (for example, IRS Form W-9 or Form W-8BEN/W-8BEN-E, or an equivalent form applicable in your jurisdiction). Phrase may withhold payment until this information has been provided and, where applicable, verified, and may withhold or deduct amounts required by applicable tax law.
10.3 Fees; Currency; Taxes. Phrase remits payment in USD. You are responsible for any fees charged by your own bank and for any currency conversion applied by your bank, at that bank’s prevailing rate. You are solely responsible for determining, reporting, and paying any taxes owed on account of a Bounty you receive.
10.4 Sanctions and Export Compliance. Phrase will not make payment to any Participant, or to any bank account, that is subject to, located in a jurisdiction subject to, or otherwise implicated by, applicable trade or economic sanctions, or that appears on a restricted, denied, or blocked persons list (including but not limited to the U.S. OFAC Specially Designated Nationals list or the EU consolidated sanctions list). Phrase may conduct compliance screening before releasing payment.
10.5 Timing. Phrase will endeavor to process an approved Bounty payment within forty-five (45) days of final approval of the Report and Phrase’s receipt of complete and verified payment information. Phrase may apply a reasonable minimum payout threshold or aggregate smaller amounts.
10.6 Recoupment. If a Bounty is paid in error, for example, based on a Report later found to be duplicative, invalid, or fraudulent, or paid to a Participant later found ineligible under Section 3, Phrase may require repayment and pursue recovery of the amount paid.
11. INTELLECTUAL PROPERTY
11.1 By submitting a Report, you grant Phrase a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, sublicensable, and transferable license to use, reproduce, modify, and create derivative works from the Report and the information it contains, for purposes of investigating, remediating, and otherwise addressing the reported Vulnerability, and for Phrase’s internal security and product-improvement purposes, and any disclosure permitted under Section 7.
11.2 You represent that your Report, and any proof-of-concept code it contains, is your own original work or that you otherwise have the right to submit it, and that its submission does not infringe or misappropriate any third party’s intellectual property or other rights.
11.3 Nothing in these Program Terms transfers ownership of any pre-existing tools, scripts, or methodologies you use to identify a Vulnerability; the license granted in Section 11.1 applies to such materials only to the extent they are included in your Report.
12. NO EMPLOYMENT; INDEPENDENT PARTICIPATION
Participation in the Program does not create an employment, agency, partnership, or joint-venture relationship between you and Phrase. You are not an employee, contractor, or agent of Phrase by virtue of participating in the Program, and you are not entitled to any benefits Phrase provides to its employees or contractors.
13. PERSONAL DATA
Phrase will process personal data you provide in connection with the Program (for example, your name, email address, and, where applicable, banking and tax information) in accordance with Phrase’s Privacy Policy, available at https://phrase.com/privacy/, for purposes of administering the Program, communicating with you about your Report, making payments, and complying with applicable law, including tax and sanctions-screening obligations.
14. YOUR REPRESENTATIONS AND WARRANTIES
You represent and warrant that: (a) you have the legal right and capacity to enter into these Program Terms; (b) your participation, including any testing activity, complies with all laws applicable to you; (c) you will not violate any third party’s rights in the course of your participation; and (d) all information you provide to Phrase, including in a Report and for payment purposes under Section 10, is true, accurate, and complete.
15. DISCLAIMERS
THE PROGRAM IS PROVIDED “AS IS.” EXCEPT AS EXPRESSLY SET OUT IN THESE PROGRAM TERMS, PHRASE MAKES NO WARRANTY, EXPRESS OR IMPLIED, REGARDING THE PROGRAM, AND DOES NOT WARRANT THAT ANY PARTICULAR REPORT WILL BE ACCEPTED, VALIDATED, OR REWARDED, OR THAT THE PROGRAM WILL BE AVAILABLE ON ANY PARTICULAR TIMELINE OR ON A CONTINUOUS BASIS.
16. LIMITATION OF LIABILITY; INDEMNIFICATION
16.1 To the maximum extent permitted by applicable law, Phrase’s aggregate liability to a Participant arising out of or relating to the Program or these Program Terms shall not exceed the amount of the Bounty actually paid to that Participant in respect of the relevant Report (or, if none has been paid, USD 25), and Phrase shall not be liable for any indirect, incidental, consequential, special, or punitive damages, or for loss of profits, arising out of or relating to the Program.
16.2 You agree to indemnify, defend, and hold harmless Phrase, its affiliates, and their respective officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, and reasonable expenses (including reasonable legal fees) arising out of or relating to: (a) your breach of these Program Terms; (b) your violation of applicable law; or (c) any testing or other activity you conduct outside the scope of the limited authorization granted in Section 5.
16.3 Nothing in these Program Terms limits or excludes either party’s liability for (i) for fraud; (ii) for death or personal injury caused by its (or its employees’ or agents’) negligence; or (iii) to the extent that any applicable law precludes or prohibits any exclusion or limitation of liability.
17. MODIFICATION; SUSPENSION; TERMINATION
17.1 Phrase may amend, suspend, or terminate the Program, or these Program Terms, at any time and without prior notice, by posting updated Program Terms at https://phrase.com/security/ (or such successor URL as Phrase designates). Changes apply prospectively to Reports submitted after the effective date of the change, unless Phrase states otherwise. Continued participation in the Program after a change takes effect constitutes your acceptance of the updated Program Terms.
17.2 Sections 7 (Confidentiality and Non-Disclosure), 11 (Intellectual Property), 12 (No Employment), 13 (Personal Data), 14 (Representations and Warranties), 16 (Limitation of Liability; Indemnification), 18 (General), 19 (Governing Law; Dispute Resolution), and this Section 17.2 survive the expiration, suspension, or termination of the Program or these Program Terms, and your disqualification from the Program.
18. GENERAL
18.1 Entire Agreement. These Program Terms, together with the scope document referenced in Section 4.3, the Privacy Policy referenced in Section 13, and any other policy expressly referenced herein, constitute the entire agreement between you and Phrase regarding the Program, and supersede all prior or contemporaneous understandings, whether written or oral, regarding that subject.
18.2 Severability. If any provision of these Program Terms is held invalid or unenforceable, that provision will be reformed to the minimum extent necessary to make it enforceable while reflecting the parties’ original intent, and the remaining provisions will continue in full force and effect.
18.3 No Waiver. Phrase’s failure to enforce any provision of these Program Terms is not a waiver of its right to enforce that or any other provision at a later time.
18.4 Assignment. You may not assign or transfer any right or obligation under these Program Terms without Phrase’s prior written consent. Phrase may assign these Program Terms, in whole or in part, to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of the relevant business or assets.
18.5 Language. These Program Terms are drafted in English. Any translation is provided solely for convenience, and the English-language version controls in the event of any conflict or inconsistency.
18.6 Notices. Notices to Phrase under these Program Terms should be sent to security@phrase.com. Phrase may send notices to you at the email address from which you submitted your Report.
19. GOVERNING LAW; DISPUTE RESOLUTION
19.1 These Program Terms, and any dispute arising out of or relating to them or to the Program, are governed by the laws of England and Wales, without regard to its conflict-of-laws principles.
19.2 Subject to Section 19.3, the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or relating to these Program Terms or the Program.
19.3 Notwithstanding Section 19.2, Phrase may seek injunctive or other equitable relief in any court of competent jurisdiction where necessary to protect its Confidential Information, intellectual property, or other rights on an urgent basis.
Version: 1.0
Effective Date: 20 August 2026