Terms & Conditions

SwahiliTek Bug Bounty Platform ("Platform", "we", "us") is operated by SwahiliTek Ltd, a company registered in the United Republic of Tanzania. The Platform connects organisations ("Companies") with security researchers ("Researchers") to identify and responsibly disclose security vulnerabilities.

Contact: legal@swahilitech.co.tz

You must be at least 18 years old to register. By creating an account you confirm that:

• All information you provide is accurate and complete.
• You will maintain the security of your account credentials.
• You have the legal capacity to enter into binding agreements.
• You are not on any government or regulatory sanctions list.

Researchers must provide a valid NIDA number (20-digit National ID). Duplicate registrations using the same NIDA, email address, or phone number are prohibited and will result in account suspension.

By submitting a vulnerability report, you agree to:

• Only test against systems and assets explicitly listed in an active program's scope.
• Immediately cease testing upon discovery of any in-scope vulnerability and report it promptly.
• Not exploit vulnerabilities beyond the minimum necessary to demonstrate their existence.
• Not access, download, modify or delete data belonging to the company or its users.
• Not perform denial-of-service (DoS/DDoS) attacks or social engineering.
• Not disclose vulnerability details publicly before the company has had a reasonable time to remediate (minimum 90 days, unless a shorter period is agreed).
• Not conduct testing that interferes with platform availability or other users' experience.
• Comply with all applicable laws including the Tanzania Cybercrimes Act, 2015.

Any violation of these obligations may result in immediate account suspension, forfeiture of pending bounties, and referral to law enforcement.

Companies listing a bug bounty programme agree to:

• Define a clear and accurate scope before the programme goes live.
• Respond to valid reports within 14 business days of triage.
• Pay bounties within 30 days of validating a report (or as stated in the programme).
• Not pursue legal action against Researchers who comply with these Terms.
• Fund the bounty pool before activating a programme.
• Maintain accurate contact details and keep the programme status up to date.

Bounty amounts are set by the Company and displayed in the programme details in Tanzanian Shillings (TZS) unless otherwise stated. SwahiliTek charges a platform fee of 10% on each bounty paid.

• Payments are disbursed via mobile money (M-Pesa, Airtel Money, Tigo Pesa, or Halopesa) to the number registered on your account.
• Bounties are paid only for valid, in-scope reports that have not been previously reported.
• Duplicate reports receive no bounty — the first valid submission wins.
• SwahiliTek reserves the right to adjust bounty classifications based on severity assessment.
• Earned bounties are subject to applicable Tanzanian withholding tax (WHT).

The following are strictly prohibited on the Platform:

• Submitting fabricated, incomplete, or plagiarised vulnerability reports.
• Creating multiple accounts or colluding with other Researchers to inflate bounty claims.
• Harassing, threatening, or extorting Companies or SwahiliTek staff.
• Attempting to access the Platform's own infrastructure outside a designated test programme.
• Selling or transferring your account to any third party.
• Using automated scanning tools in a manner that degrades platform or target performance.

All vulnerability reports submitted to the Platform become the joint property of the Researcher and the Company for the purpose of remediation. SwahiliTek may use anonymised, aggregated data from reports for statistical and educational purposes, with no identifying information disclosed.

SwahiliTek's name, logo, and trademarks may not be used without prior written consent.

We collect and process personal data in accordance with our Privacy Policy. Researcher profiles (name, tier, reputation) are publicly visible on the leaderboard by default. You may request profile visibility changes via account settings.

To the maximum extent permitted by Tanzanian law, SwahiliTek shall not be liable for: indirect, incidental, or consequential damages; loss of profits or data arising from platform use; or actions taken by Companies or Researchers outside the Platform.

SwahiliTek acts solely as an intermediary. We do not guarantee that Companies will pay bounties or respond to reports, though we will make reasonable efforts to facilitate dispute resolution.

Any dispute arising from these Terms shall first be submitted to SwahiliTek for mediation. If unresolved within 30 days, disputes shall be referred to binding arbitration under the rules of the Tanzania Institute of Arbitrators, conducted in Dar es Salaam.

These Terms are governed by and construed in accordance with the laws of the United Republic of Tanzania.

We may update these Terms from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the Platform after that date constitutes acceptance of the updated Terms.