Researcher verification & accountable testing
Trusted ethical hackers.
Clear controls.
Real accountability.
Choose a testing model with clear researcher requirements, defined access, and accountable communication. Hackrate brings together KYC identity verification, selected Elite researchers, and customer-approved rules for the engagement you choose.
Identity. Expertise.
Defined authorization.
MATCH THE ASSURANCE MODEL TO THE ENGAGEMENT
A REASONABLE QUESTION. A PRACTICAL ANSWER.
“What if a hacker
has criminal intent?”
With Hackrate, you can choose private testing with individually selected researchers, agree their verification requirements, and define their authorized access before work begins. KYC identity checks, Elite selection, confidentiality obligations, and managed coordination give your team a concrete basis for deciding who tests what.
Identity verification establishes who a person is; it does not predict future conduct. The engagement also needs limited access, clear testing boundaries, named contacts, and a response process for concerns. Combine these controls around your risk requirements, or choose Hackrate’s internal-team-only pentest for systems that require a restricted delivery model.
Identity behind the account
Hackrate uses ComplyCube for KYC identity verification. For an engagement requiring verified participants, confirm the applicable checks and eligibility before access is granted.
People selected for the work
Choose invitation-only participation when your organization needs to approve individual researchers. Match the specialists, expertise, and access conditions to the systems being tested.
Written testing boundaries
Define authorized targets, permitted activities, confidentiality, and disclosure expectations. A researcher’s invitation is permission to follow an agreed scope, rather than unrestricted access to your organization.
An accountable working relationship
Keep researcher communication and findings in a coordinated workflow. Named contacts, escalation routes, and managed validation give your team a practical way to ask questions and act on concerns.
Verify identity
Establish the identity assurance required for participation.
Select participants
Agree who can take part and how they are approved.
Authorize scope
Set targets, access, exclusions, and testing conditions.
Plan oversight
Define coordination, escalation, and optional monitoring.
Keep accountability
Connect findings, decisions, and follow-up to their owners.
KYC / KNOW YOUR CUSTOMER
A verified identity
behind the profile.
Hackrate uses ComplyCube identity verification for selected, verified researcher participation. The process includes document and identity checks with a live photo, helping connect the person completing verification with the identity presented. The required document and identity checks must both clear for successful verification.
Confirm the verification requirement for the work you are commissioning. A community account, technical reputation, KYC result, and Elite selection each tell you something different. Agree which are required before the researcher receives the access appropriate to your engagement.
WHAT THE CONTROL ANSWERS
Identity is one layer.
Authorization completes the picture.
- Document and identity verification
- Establish the identity assurance required for the selected participant.
- Program-specific eligibility
- Confirm which requirements apply to the proposed testing model.
- Scope and access approval
- Determine which systems and activities that person is authorized to test.
KYC is identity verification, rather than a universal criminal-record check. Discuss any additional screening requirements explicitly.
How personal information is handledHACKRATE
ELITE
SELECTED RESEARCHER COMMUNITYEXPERTISE WITH A SELECTION PROCESS
Meet the people.
Discuss the fit.
Hackrate Elite brings selected ethical hackers into a dedicated researcher community. The public application process asks candidates for a CV, certificates, and answers to application questions. This creates a basis for reviewing their professional background and expertise.
For your engagement, discuss the skills the target needs and the participants you want to approve. Elite researchers are distinct from Hackrate’s internal employees and from the wider public community. Identity verification and Elite selection are separate considerations; neither should be inferred from a username alone.
Discuss whether interviews, reference calls, or additional background screening form part of your project’s selection requirements. The objective is a suitable specialist working within your approved scope, with the right communication and support around the assessment.
CHOOSE THE PARTICIPATION MODEL
Your systems.
Your approval boundaries.
The right model depends on your confidentiality requirements, targets, and need for individual participant selection.
Hackrate’s internal team only
Choose a traditional penetration test for a restricted assessment performed exclusively by assigned Hackrate internal pentesters. Scope, access, and findings remain within that delivery model rather than being shared with external researchers.
Explore internal-team testingPrivate, selected participation
Use invitation-only participation when you need to choose individual researchers. Discuss approved Elite specialists, verification requirements, permitted access, confidentiality, and the target scope for the engagement.
Explore private bug bountyBroader community participation
A public program invites wider participation under published eligibility, scope, and reporting rules. It is a different access model from individually selected testing. Choose private participation if approving each researcher is a requirement.
Explore public bug bountyNeed different approaches for different assets? Continuous Pentest can combine internal work and customer-approved Elite researcher participation by target.
TURN ASSURANCE INTO OPERATING RULES
Define access.
Keep an escalation route.
Set the authorized assets, environments, accounts, testing window, and exclusions before work begins. Provide the access needed for the task, use test data where practical, and agree how evidence should be handled. Document confidentiality and disclosure expectations through the applicable program and engagement terms.
Name the people who can answer a scope question, escalate unusual activity, and stop testing. If a concern arises, use the agreed contact and preserve the relevant evidence. Plan how your organization can revoke credentials or close access while the concern is assessed.
Managed coordination keeps researcher questions and validated findings connected to the responsible team. The same discipline supports a professional response when a rule needs clarification or an issue requires escalation.
OPTIONAL / HACKGATE
Add visibility to authorized testing traffic.
Where selected and configured for the engagement, HackGATE can provide an additional view of testing traffic routed through the gateway. Agree the routing, access controls, and activity evidence your team needs.
Monitoring complements identity, selection, and scope controls. Its coverage depends on the agreed configuration and traffic path.
Explore HackGATE oversightASK FOR CONCRETE ANSWERS
Bring your assurance
requirements to the table.
Use these questions when scoping your project. The answers should explain the people, permissions, and operating process you are buying.
- 01
Who will perform the work?
Confirm internal or external participation, required expertise, and how individual approval works.
- 02
Which checks apply?
Agree identity verification, selection requirements, and any additional screening needed for the engagement.
- 03
What access is authorized?
Record targets, accounts, testing conditions, exclusions, data handling, and confidentiality expectations.
- 04
Who responds to a concern?
Name escalation contacts, stop procedures, access revocation responsibilities, and expected communication.
- 05
What evidence will we receive?
Agree reporting, validation, and optional HackGATE activity evidence appropriate to the engagement.
YOUR QUESTIONS, ANSWERED
Ethical hacker
trust & verification FAQs.
Understand identity checks, Elite participation, and the controls available for your testing engagement.
Discuss a specific requirementWhat if a hacker has criminal intent?
Hackrate can structure testing around verified, individually selected researchers, written authorization, restricted access, and an agreed escalation process. In a private program, you choose which researchers to invite and which systems they may test. KYC verifies identity; it does not predict future conduct. Selection, confidentiality, scope controls, and optional HackGATE oversight add further layers. An internal-team-only pentest is available when external participation is unsuitable.
What does Hackrate’s KYC verification check?
Hackrate uses ComplyCube for document and identity checks, including a live-photo identity check. These help connect an account with a verified identity. Identity verification is different from a criminal-record check, a technical qualification, or a guarantee of future behavior. Confirm the verification requirements that apply to the proposed engagement.
Is every researcher on Hackrate KYC verified?
Do not assume that registration, a public profile, or participation in the broader community means a researcher meets the verification requirements of a particular engagement. Verification and selection are separate requirements. If your organization needs individually approved, verified participants, discuss a private or selected-researcher testing model before launch.
How are Hackrate Elite researchers selected?
Hackrate Elite is a selected researcher community. Its application process asks for a CV, certificates, and responses to application questions for review. Elite selection adds a specialist participation model; it is separate from identity verification and does not make a researcher a Hackrate employee. Discuss the expertise and participant approval appropriate for your targets.
Can we choose which ethical hackers test our systems?
Yes, private programs allow the customer to choose which researchers to invite. Agree the participant list and access conditions for the engagement. Public programs use broader participation under published eligibility and scope rules, so choose an invitation-only model when individual approval is a requirement.
Are ethical hackers bound by confidentiality and an NDA?
Hackrate’s FAQ describes confidentiality obligations and directs customers to its Terms. Before testing, confirm the applicable program rules, NDA or confidentiality terms, permitted handling of evidence, and disclosure approval process for your engagement. Public participation does not automatically authorize publication of a vulnerability report.
What happens if a researcher appears to break the rules?
Use the agreed escalation contact and stop procedure. Your team and Hackrate can assess the concern, preserve relevant evidence, and coordinate the next step under the engagement and program rules. Plan who can pause testing or withdraw access, and how your organization can revoke its test credentials, before work begins.
Is HackGATE monitoring included in every engagement?
No. HackGATE is optional and must be agreed and configured for the engagement. It can provide visibility into authorized testing traffic that passes through the configured gateway. Agree the traffic route, access controls, and evidence requirements. It complements researcher selection and rules of engagement; it does not guarantee visibility into every activity or prevent every misuse.
Can we use only Hackrate’s internal pentesters?
Yes. Hackrate’s traditional penetration testing service is delivered exclusively by its assigned internal security team. Scope and findings are not shared with the external researcher community. Continuous Pentest can also select an internal, approved Elite researcher, or hybrid approach for each target under the agreed framework.
CONFIDENCE STARTS WITH A CLEAR PLAN
Choose the expertise.
Agree the controls.
Tell us which systems you need to test and what researcher assurance your organization expects. We will help define the participation, verification, and working model that fits.
Discuss Researcher Assurance
Hackrate
Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.
US Patent Applied for HackGATE #63/645,845
Products
From the Blog
-
Hackrate Ranked 1st in Hungary and 22nd Globally at Hack The Box’s Global Cyber Skills Benchmark 2026
May 29 • 13 min read
-
Press release: Hackrate becomes Hungary’s first CVE Numbering Authority
Jan 13 • 5 min read ★
-
Let 2026 be the year bug bounty becomes part of how you build and operate
Jan 05 • 4 min read
Numbering Authority