YesWeHack
Paris-based bug bounty and exposure management platform hosted only in the EU, with an in-house triage team
Quick Overview
| Company | Yes We Hack S.A.S. |
|---|---|
| Category | Bug Bounty Platforms |
| Headquarters | Paris, France |
| Founded | 2015 |
| EU Presence | Yes - France (EU) |
| Data Location | EU only, in a SecNumCloud-qualified private cloud (per vendor trust page) |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Bug bounty programs, vulnerability disclosure policy, agentic pentest, exposure management, vulnerability management, in-house triage, SAML 2.0 SSO, 2FA, hunter VPN, OpenAPI integrations |
| Pricing | Pricing on request; the vendor site publishes no price list |
| Best For | Security teams that want a managed bounty with in-house triage and EU-only hosting |
| Replaces | HackerOne, Bugcrowd |
Detailed Review
YesWeHack is the Paris-based platform where a company sets a scope and a rewards grid, invites a private group of researchers or opens a public program, and pays for valid findings. The contracting entity on the legal notices page is Yes We Hack S.A.S., registered in Paris (RCS 814 037 214).
The vendor describes a community of more than 160,000 ethical hackers and says the product range now also covers agentic pentests, exposure management and vulnerability management, with a human-in-the-loop approach.
Triage Done by Employees
YesWeHack states that incoming reports are triaged by its own team and not outsourced to bug hunters or third parties. The team removes duplicates, reproduces the proof of concept, sets severity and advises on the exchange with the researcher.
A customer success team helps with the first program: private or public, budget, rules and rewards grid, researcher selection and later tuning of scope.
Hosting and Certifications
The trust page says the platform runs in a SecNumCloud-qualified private cloud with European providers only, with processing inside the EU. The information security management system is certified to ISO/IEC 27001 (2022) and ISO/IEC 27017 (2023), and the about page also lists CREST accreditation.
Customers can enforce two-factor authentication, connect SAML 2.0 single sign-on and route hunter traffic through a fixed-IP VPN that can be allow-listed.
Beyond the Bounty
A vulnerability disclosure policy product gives outsiders a branded, encrypted reporting channel. The agentic pentest runs AI agents on demand against external assets and promises same-day results, with a pentest manager guiding each campaign.
Integrations push findings into Jira, ServiceNow, GitHub, GitLab and Azure DevOps, and the platform lists vulnerability management partners such as Hackuity.
Limitations to Consider
YesWeHack publishes no prices, so a budget needs a sales call. The managed service model suits programs of some size; a small team that wants a self-serve bounty with no customer success contact will find the offer heavier than needed. The platform also covers a wider scope than before (exposure management, agentic pentest), so check which modules your contract really includes. For a Belgian alternative with the same product shape see Intigriti.
Who Should Use YesWeHack
European companies and public bodies that want a managed bounty or VDP, triage by the vendor's own staff, and a contract with a French entity hosting in the EU.
Pros and Cons
Pros
- Triage performed in-house, not outsourced
- EU-only hosting in a SecNumCloud-qualified cloud
- ISO 27001 and ISO 27017 certified
- Bounty, VDP and agentic pentest on one platform
- SSO, 2FA and fixed-IP hunter VPN
Cons
- No published prices
- Managed model is heavy for very small programs
- Broad module list needs scoping in the contract
- Offices also in Singapore, so check which entity signs the order form
Alternatives to YesWeHack
Other European bug bounty platforms worth comparing before you decide:
Intigriti
Belgium · Antwerp bug bounty platform with managed VDP and PTaaS
Yogosha
France · Vetted researcher community for pentests and private bounties
Detectify
Sweden · Stockholm attack-surface and application scanner with ethical-hacker payloads
Pentest-Tools.com
Romania · Bucharest pentest toolkit with scanners, exploiters and reporting
See all European bug bounty platforms or compare them directly against HackerOne on our alternatives page.
Frequently Asked Questions
The trust page says the platform is hosted in a SecNumCloud-qualified private cloud with European providers only, and that data is processed within the EU.
Yes. The bug bounty page states that triage is done by an in-house team and is not outsourced to bug hunters or other third parties.
Yes. YesWeHack sells a vulnerability disclosure policy product that gives a branded and encrypted reporting channel, and an on-demand agentic pentest for external assets.