Refer, Resell or Integrate.
Earn €399 Per Pentest.

When someone clicks your referral link, a 180-day cookie tracks the attribution. If they order and pay for a pentest within that window (even after multiple visits), you earn €399. Repeat orders by the same client within 12 months of their first paid pentest earn the same commission. You can also manually attribute referrals by emailing us with the client's name.

We run monthly payouts via SEPA bank transfer on the 15th, for every client payment received in the previous month. Commission is earned when the client has paid, not when the test completes. You'll receive a self-billing credit note each month.

No. You can refer one client a year or one hundred. The program is designed to be zero-friction: refer when it makes sense for your clients, earn when they pay.

Not yet. White-label reporting is in development for the Reseller track (Track 3). Today Track 3 gives you volume pricing and 24-hour delivery, and you keep the client relationship end to end. Apply as a reseller and tell us white-label matters to you: that is what moves it up the roadmap.

That is the Technology & Integration path. The integration API is in development, so early partners help decide what it exposes and in what shape. Apply with "Technology / Integration Partner" and we'll walk through your use case; commercial terms are agreed per integration rather than fixed.

A structured pentest report with documented scope, test methodology, findings, criticality and concrete remediation actions. It helps your clients document their security testing and the effectiveness of their cybersecurity measures under NIS2 Article 21(2)(e) and (f), and for German entities under Section 30 BSIG, which requires compliance to be documented. For entities covered by Implementing Regulation (EU) 2024/2690, such as managed service providers and cloud providers, the documentation supports the security testing requirements in Annex point 6.5. It does not certify NIS2 compliance and it is not a submission format: NIS2 does not define one. Available to Active Ambassadors (Track 2) and above.

Not in those words. NIS2 requires organisations to handle vulnerabilities and to assess whether their cybersecurity measures are effective (Article 21(2)(e) and (f); Section 30(2) BSIG in Germany). For several regulated digital sectors, including MSPs, MSSPs and cloud providers, Implementing Regulation (EU) 2024/2690 goes further: it requires risk-based security testing with documented scope, timing, results and mitigation, and names penetration tests among the possible test types. A SQUR pentest supports all three duties. It finds and validates exploitable vulnerabilities, it tests whether existing controls actually stop attacks, and it records methodology, scope, findings, severity and remediation evidence.