Zerocopter
Dutch security testing vendor combining bug bounty, pentesting, recon and coordinated vulnerability disclosure
Quick Overview
| Company | Zerocopter B.V. |
|---|---|
| Category | Bug Bounty Platforms |
| Headquarters | Groningen, Netherlands |
| Founded | Not stated |
| EU Presence | Yes - Netherlands (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Bug bounty, pentesting with formal report, 24/7 recon, coordinated vulnerability disclosure, focused hunts, researcher community |
| Pricing | Pricing on request |
| Best For | Dutch and Benelux organisations that want bounty, pentest and CVD from one local vendor |
| Replaces | HackerOne, Bugcrowd |
Detailed Review
Zerocopter sells four programs under one roof: a coordinated vulnerability disclosure policy, recon that scans for new and forgotten systems, pentesting with a formal report, and a bug bounty with vetted hackers. The company says it was founded by hackers.
The terms of sale name Zerocopter B.V. as the contracting party. The terms list an address in Amsterdam, while the privacy statement gives Groningen, so confirm the address on your order form.
Starting Point Depends on Maturity
The site frames the offer as a ladder: start with a CVD policy, add 24/7 recon to find forgotten assets, order a pentest with a report suitable for audits and compliance, then run a bug bounty as continuous testing.
Focused hunts are available as a shorter, targeted form of crowdsourced testing.
Researcher Relationship
Pages named Meet the 1337 and Behind the hoodies introduce the researcher community. The terms define researchers as third-party ethical hacker suppliers to Zerocopter, so the customer contracts with Zerocopter, not with individual hackers.
Legal Documents in the Open
The terms and conditions of sale (version of 19 July 2024) and a privacy and cookie statement are public, along with a coordinated vulnerability disclosure policy and a code of conduct for researchers.
The privacy statement lists service providers and says transfers outside the EEA rely on standard contractual clauses.
Limitations to Consider
Zerocopter publishes no prices, no researcher counts and no hosting location on the pages checked, so a buyer has little to compare before a sales conversation. The site is smaller in scope than the Paris and Antwerp platforms, and parts of it are in Dutch. The two legal pages give different cities for the company. For larger public programs see YesWeHack.
Who Should Use Zerocopter
Dutch and Benelux companies that want a local vendor for a first CVD policy, a pentest and later a bounty.
Pros and Cons
Pros
- Four programs from one Dutch contracting entity
- Terms of sale and CVD policy published
- Recon service for forgotten assets
- Researchers contracted through Zerocopter, not individually
- Entry route via CVD policy
Cons
- No prices published
- Hosting location not stated
- No researcher numbers published
- Legal pages list two different cities
Alternatives to Zerocopter
Other European bug bounty platforms worth comparing before you decide:
YesWeHack
France · Paris bug bounty and exposure platform hosted in an EU private cloud
Intigriti
Belgium · Antwerp bug bounty platform with managed VDP and PTaaS
Yogosha
France · Vetted researcher community for pentests and private bounties
Detectify
Sweden · Stockholm attack-surface and application scanner with ethical-hacker payloads
See all European bug bounty platforms or compare them directly against HackerOne on our alternatives page.
Frequently Asked Questions
Four things: a coordinated vulnerability disclosure policy, 24/7 recon, pentesting with a formal report, and a bug bounty with vetted hackers.
The terms and conditions of sale define Zerocopter as Zerocopter B.V., a Dutch limited liability company, and define researchers as third-party suppliers to Zerocopter.
No. The service pages ask you to request an offer.