Deploy the best hunters. Keep the intelligence.
A bug bounty platform that runs inside your own walls — not on someone else's cloud.
Ethical hackers find the vulnerabilities before attackers do. Raksa governs the whole program — vetted researchers, SLA triage, server-authoritative CVSS — with zero vulnerability data ever leaving your jurisdiction.
15 min
SLA response target on new reports
24 hr
SLA resolution target, tiered by severity
Zero
Vulnerability data leaving your infrastructure
RCE via insecure deserialization on payment gateway
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SLA response
14:12 left
Reward (locked)
Rp58 jt
Queue
WORM audit · server in Indonesia · zero-egress
The gap
Your apps ship weekly. Your testing is annual.
Continuous exposure needs continuous testing — and crowdsourcing is how the rest of the world closes the gap. But for an organization that can't send its data offshore, the usual options each fail in their own way:
The eleven-month gap
A pentest is a photograph; your applications are a film. Annual testing certifies a version that shipped months ago — everything released since is untested and public.
The offshore data problem
Public crowdsourcing closes the coverage gap, but your unpatched-vulnerability reports — the single most sensitive dataset you own — end up on a foreign platform, under a foreign jurisdiction.
The unfiltered firehose
Run a raw program yourself and your team drowns: duplicate submissions, invalid reports, inflated severities, and no SLA. Coverage without governance is just noise with a payout.
The Raksa answer
Crowdsource the hunt. Keep the intelligence.
All the coverage of a bounty program, none of the data going offshore. The hunters are external and vetted; the platform, the reports, and the intelligence stay entirely inside your walls.
What Raksa is
A full bounty program, run on your terms.
Four things a serious program needs — vetting, SLA, honest scoring, and sovereignty — built into one platform.
Vetted hunters
Every researcher passes KYC — identity, experience, skill areas, portfolio, certifications — and signs an NDA under a zero-disclosure principle before a single report is accepted.
SLA-bound triage
Response and resolution clocks run on every report, tiered by severity, with breach monitoring against your maintenance-guarantee thresholds.
Server-authoritative CVSS
Severity is computed on the server against CVSS v3.1. A hunter proposes; a triager validates; the platform — not the submitter — sets the score.
In-country, zero-egress
Deployed on your infrastructure in your jurisdiction. Reports, triage, payout data, and even the AI dedup model stay on your servers. Nothing leaves.
Sovereignty
Runs in your infrastructure. Data never leaves.
The defining difference from every offshore platform. Aligned to UU PDP and PP 71/2019 — because a list of your unpatched vulnerabilities is the last dataset you want on someone else's servers.
Data residency
Every report, key, and backup stays within your jurisdiction — deployed on-prem or in your own cloud tenancy.
Zero-egress
No vulnerability data is sent to an external service at runtime. Even the ML deduplication runs locally and stateless.
You stay the controller
Zentara is a vendor, not a data processor. Control of, and accountability for, the data remains yours (Pengendali).
Even the AI is local
The duplicate-detection model — TF-IDF plus cosine similarity — runs on your servers, stateless, with zero data egress. Intelligence without a single packet leaving the building.
The lifecycle
From report to verified fix.
Every finding travels one governed path — validated, scored, remediated, and re-tested until it's genuinely closed, with each step logged to the tamper-evident trail.
Hunter submits — CVSS vector and in-scope asset required, or the server rejects it
Analyst validates the finding and recomputes severity
Reproduction gaps sent back to the hunter
Valid & in-scope — reward tier locked
Your team fixes; issue-tracker ticket raised
Fix re-verified — staff or hunter-driven
Confirmed resolved · reputation awarded · WORM-logged
One platform, two sides
Built for the organization and the hunter.
A marketplace only works when both sides are served. Raksa runs the program for your team and the experience for the researcher on one system.
For the organization
- Private bug bounty or public VDP — your scope, your rewards
- 24/7 SLA-bound triage with breach monitoring
- WORM tamper-evident audit trail
- Runs on your servers, in-country — data never leaves
- Technical + executive reporting, payout and tax handled
For the bug hunter
- KYC + NDA once, then apply to any program
- Reward by validated severity, on CVSS
- Build reputation and climb the researcher tiers
- Self-verify your own remediation retests
- Get matched to programs that fit your skills
The hunters
Bring your own. Or hunt with ours.
Raksa isn't just software — Zentara already runs a vetted researcher community with a live leaderboard, so you can launch against experienced, KYC-verified, NDA-bound hunters from day one. Invite your own specialists too; everyone onboards through the same gate.
Then hacker matching ranks whoever's eligible by skill-to-asset fit — web, API, mobile, cloud — then reputation and experience, so the right hunter is a one-click invite, not a guess.
Prefer it fully managed?Hall of Fame · by reputation
Live@zer0cool
4 valid findings
185
reputation
@d3czumo
3 valid findings
142
reputation
@radix.sec
3 valid findings
96
reputation
@nfx.corabid
2 valid findings
71
reputation
@reyhan.srn
2 valid findings
58
reputation
Illustrative · every hunter KYC-verified & NDA-bound
Capabilities
Everything measured. Everything logged.
From triage to audit, the platform is instrumented — because a bounty program you can't prove is a bounty program you can't defend.
WORM audit trail
Every state change hash-chained and tamper-evident, appended to a write-once log. Auditors verify integrity independently — no vendor in the loop.
On-prem AI dedup
TF-IDF + cosine similarity flags likely duplicates at triage and pre-submit. Advisory, stateless, and fully local — zero data leaves.
Hacker matching
Rank verified researchers per program by skill-to-asset fit (web · API · mobile · cloud), then reputation and experience. Invite the right hunter in one click.
Issue-tracker integration
Push accepted findings straight into Jira or GitLab, configured per program — the fix lives where your engineers already work.
Unlimited retesting
Re-verify every fix as often as needed for the life of the licence — remediation and retest loop until the finding is genuinely closed.
Activity monitoring
Researcher activity logged with IP, timestamp, and test payload; an Audit Explorer and per-report timeline make every action reviewable.
Pay by impact, not hours
Reward by validated severity
Each program sets its own table; rewards lock to the server-validated CVSS tier, capped to budget. (Illustrative bands.)
Governance
Role-based, per program
Separation of duties across the whole team, scoped per program — with an Auditor role and WORM trail so the numbers are independently verifiable.
Technical report per finding
Executive recap per period — SLA, reward, tax, severity mix
Jira / GitLab issue-tracker sync
Managed or self-run
Run it yourself, or let Zentara run it for you.
Raksa is your platform — deploy it and run your own program with your own bench. Or hand the operation to Zentara's Managed Bug Bounty Program: our analysts triage, our community hunts, we administer the rewards and the reporting — on this same platform, still inside your infrastructure.
Proven at scale
Bug bounty program design delivered at national social-security scale — continuous coverage for e-services used by millions.
FAQ
Common questions
Straight answers. If yours isn't here, ask us directly.
Genuinely self-hosted. Raksa deploys into your infrastructure — on-premise or your own cloud tenancy — and runs there. Reports, triage state, payout records, the audit log, and even the AI deduplication model live on your servers. There is no runtime call to an external Zentara service and no vulnerability data egress. That's the entire point: the most sensitive dataset a security program holds — a list of your unpatched, exploitable vulnerabilities — never sits under anyone else's control or jurisdiction. It's why regulated and government clients can run a bounty program at all.
Crowdsource the hunt. Keep the intelligence.
Continuous coverage from vetted hunters, governed like a program, running entirely inside your own walls. See Raksa on your infrastructure.