A payment is created every time a program awards a bounty on an accepted report, or raises one (bounties are never reduced). On a report signed by several researchers, each one gets a separate payment for their share (see Reporting as a team).
There are two ways a bounty reaches the researcher:
In Settings → Payouts, choose:
We ask for your RootBounty password to save, replace or remove them, and we email you whenever they change. They are stored encrypted; only the RootBounty finance team can read them, and only to pay you. You must have signed the researcher agreement first.
Tick Let companies pay me directly if you want companies that owe you a bounty in euros to see your name, IBAN and BIC and transfer it themselves. Without it, RootBounty always pays you.
The Earnings list on the same page shows every bounty and its payment:
| Status | Meaning |
|---|---|
| Pending | Waiting to be paid. If you have no payout details yet, add them. |
| Being paid | The transfer is on its way. |
| Paid | Done, with the transfer reference. |
| Failed | With the reason. Fix your details and we try again. |
When a company pays you directly and marks the transfer as sent, you are asked The company says it sent it. Has it arrived? Check your bank and answer:
Company dashboard → Payments lists every bounty you awarded with its status, the researcher and the totals. You get a notification when each one is paid. Only the company account and administrators can see payments (see Company teams).
If the researcher accepts direct payments, the bounty shows Pay by bank transfer:
These bank details are shared with you only to pay this bounty. Do not use them for anything else. Every time they are shown is recorded.
Bounties of researchers who don't accept direct payments are paid by RootBounty on your behalf, as set out in the company agreement.