Vaadata
Lyon offensive security company for web, mobile, LLM and infrastructure pentests, red teaming and assumed breach exercises
Quick Overview
| Company | VAADATA SARL |
|---|---|
| Category | Bug Bounty Platforms |
| Headquarters | Lyon, France |
| Founded | 2014 |
| EU Presence | Yes - France (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Web, mobile, LLM, cloud, infrastructure, IoT and social engineering pentests, red team, assumed breach, black, grey and white box testing, CREST accreditation (site logo) |
| Pricing | Quote on request |
| Best For | French and European teams that want a human-led pentest or red team from a French SARL |
| Replaces | HackerOne, Bugcrowd, pentest-as-a-service |
Detailed Review
The legal notices page names VAADATA, a SARL with share capital of EUR 36,000, registered office 33 quai Arloing, 69009 Lyon, RCS 797 558 590 Lyon. The about page says the company was created in 2014 and describes itself as financially independent.
The vendor claims more than 800 clients and sells offensive security services, not a bounty marketplace.
Pentest Catalogue
Pentests run as black, grey or white box and cover web applications, mobile apps, LLM systems (RAG, agents, MCP servers), cloud (AWS, Azure, GCP), infrastructure and network, IoT and social engineering.
The LLM pentest is listed as its own service, next to the classic scopes.
Red Team and Assumed Breach
Red team audits test detection and reaction against realistic attack scenarios. Assumed breach exercises start after a compromise to evaluate detection and response procedures.
Buying
The site offers a quote request rather than a price list. Content is published in French and English, with the French version more complete.
Limitations to Consider
Vaadata is a human-led pentest vendor, so there is no continuous crowd, no reward pool and no self-serve platform. No prices are published. The legal notices state that the website is hosted by Kinsta Inc. in the United States, which concerns the marketing site, not your engagement data, but ask how test data is handled. For continuous crowd testing see YesWeHack.
Who Should Use Vaadata
French and European companies that want a one-off or periodic pentest or red team with a French contracting entity.
Pros and Cons
Pros
- French SARL with register number published
- Wide pentest scope including LLM and IoT
- Red team and assumed breach offered
- Financially independent per its own about page
- Site in French and English
Cons
- No bounty or crowd
- No published prices
- Point-in-time engagements
- Marketing website hosted by a US company
Alternatives to Vaadata
Other European bug bounty platforms worth comparing before you decide:
YesWeHack
France · Paris bug bounty and exposure platform hosted in an EU private cloud
Intigriti
Belgium · Antwerp bug bounty platform with managed VDP and PTaaS
Yogosha
France · Vetted researcher community for pentests and private bounties
Detectify
Sweden · Stockholm attack-surface and application scanner with ethical-hacker payloads
See all European bug bounty platforms or compare them directly against HackerOne on our alternatives page.
Frequently Asked Questions
No. It sells pentests, red team audits and assumed breach exercises delivered by its own team.
VAADATA, a French SARL registered in Lyon under RCS 797 558 590.
Yes, it lists a dedicated LLM pentest covering proprietary and open source models, RAG, agents and MCP servers.