This agreement covers the confidential information you receive by operating through HUNT. It is a condition of being assigned to any mission.
1What is confidential
1.1Confidential information means anything you learn through this platform that is not already public, including:
(a) the identity of any client, and the fact that they engaged HUNT; (b) the contents of any scope agreement, including target lists, testing windows, architecture and asset inventories; (c) any material a client supplies: documents, builds, credentials, diagrams, prior reports; (d) any weakness, finding, evidence or report, whether yours or another operator's, and whether or not it has been published to the client; (e) any data belonging to a client or to a third party that you encounter during an engagement; (f) the identity of other operators, their assignments, and the composition of houses; (g) HUNT's own internal process, review criteria, tooling and commercial terms.
1.2Information is not confidential if it was already public without any breach, if you already held it lawfully and without obligation before receiving it here, or if you develop it independently without reference to anything you received here. You should be able to show which of these applies.
2What you must do
2.1You keep confidential information confidential. You do not disclose it to anyone, including a colleague, an employer, a co-researcher, a client other than the one it belongs to, or a member of your own household.
2.2You use confidential information only to perform the mission it belongs to. Not for research, not for tooling, not for a portfolio, not for a talk.
2.3You store it securely, encrypted at rest, on systems you control, and only for as long as the engagement requires.
2.4You destroy it when the engagement ends or when HUNT asks, and confirm that you have. Copies on personal devices, in cloud storage, in note-taking applications and in shell history are covered by this.
2.5You do not train, fine-tune or submit confidential information to any machine-learning system, including a third-party assistant, unless HUNT has authorised that system in writing for that engagement.
3Disclosure required by law
If you are legally compelled to disclose confidential information, you tell HUNT immediately and before disclosing where you lawfully can, disclose only what you are compelled to disclose, and cooperate with any effort to limit or contest it. Where telling HUNT first is itself prohibited, that prohibition governs.
4No licence, and no ownership of findings
4.1Nothing here transfers any right in a client's systems, data or intellectual property to you.
4.2A finding you produce in the course of a mission (its description, evidence and report) is delivered to HUNT and through HUNT to the client. You retain the right to be recognised as its author, subject to the mission's disclosure policy.
4.3Techniques and general knowledge you develop remain yours. The line is that you may carry forward what you learned about how to test; you may not carry forward anything specific to a client.
5Duration
5.1These obligations begin when you are given access to any confidential information and continue for five years after your last engagement ends.
5.2Obligations over personal data, and over anything a client has designated as a trade secret, continue for as long as the law protects it, which may be indefinitely.
5.3Termination of your account does not end this agreement.
6If you breach it
A breach may cause harm that money cannot repair, so HUNT and the affected client may seek an injunction in addition to any other remedy. You may also be removed from the platform and forfeit outstanding payouts on the affected engagement.
This document describes how the HUNT platform operates and is binding on the platform as an operational policy. It has not been reviewed by counsel for any particular jurisdiction. HUNT will publish a counsel-reviewed version, and you will be asked to accept it, before it is relied on in any legal proceeding.