Provision of an independent expert intermediation platform for bug bounty services and vulnerability disclosure program
At a glance
La Poste (PARIS, France) is tendering: Provision of an independent expert intermediation platform for bug bounty services and vulnerability disclosure program. Offers are due 1 Dec 2026, 11:00 CET. 60-month contract. Bidders must show, among other things: EMAS, references, bid deposit.
Already a customer? Open it in the app
Translated from the official notice. The original text is the legally binding one.
Key facts
- Deadline
- not published
- Estimated value
- 60 months
- Duration
- Negotiated with call
- Procedure
- 5 Nov 2026
- Published
- 767891-2026
- Notice number
- IT services: consulting, software development, Internet and support (72000000)
- Main CPV
- FRA
- Place of performance (NUTS)
The buyer did not publish an estimated value in the notice.
Dates
Every date of the notice and its changes, in order. Times: Brussels / Warsaw.
Notice published
Deadline for offers
Planned start of the contract
Planned end of the contract
What the buyer wants
La Poste's Anti-Criminality Service (SLCC) wants to use a SaaS intermediation platform to manage Bug Bounty and Vulnerability Disclosure Program (VDP) campaigns by cybersecurity researchers. The platform in a standard SaaS mode format "turnkey". This intermediation platform will have to offer the following features: - Creation and management of independent campaigns according to the applications of La Poste to be analysed.
A campaign is characterised by a technical description of the perimeter to be tested (URL concerned, exclusions).
The intermediation platform should be able to use independent cybersecurity experts to test this area: these are private campaigns. -Definition and launch, monitoring, modification or complete cessation of ongoing campaigns. -Management of the relationship with independent cybersecurity experts registered with the provider: -Invitations from independent experts to campaigns conducted with La Poste; -Treatment of vulnerability reports and exchanges of reports prepared by independent experts; -Possible payments by independent experts based on the criticality of the identified vulnerabilities. -Provide statistics on the operation of the platform (availability rate), client account activity and on each campaign independently.
Statistics should be accessible from the platform itself or via a specific API provided by the provider. -Establishment of a scoreboard on global activity for the benefit of La Poste from the platform. -Export vulnerability reports from the platform or via a specific API provided by the provider. -Establishment of expert lists for each campaign.
The possibility from the platform to assign access identifiers to relevant Post Office applications -Differentiated access to the platform by program administrators La Poste published independently their campaigns. -Implement a communication channel allowing the collection of vulnerabilities, outside Bug Bounty's campaign, by independent cybersecurity experts on La Poste's applications.
The services will also include technical support on the platform and its features, as well as functional support to support La Poste in the implementation and management of Bug Bounty campaigns through the following services: -Recommendation of independent experts according to the relevance of their work to other clients The maximum amount of the consignment shall be EUR 600 000 HT over the total duration of the contract, including renewal periods. The number of attribute is set at 1. The duration of the offer is one year.
CPV codes
- 72000000IT services: consulting, software development, Internet and supportmain
- 48000000Software package and information systems
Conditions for participation & required documents
What the notice asks bidders to prove, and the documents it requires. Full text below.
Conditions in the notice
- CertificatesEMAS
- ReferencesSimilar contracts delivered before
- Bid depositA deposit or guarantee with the offer
Detected automatically in the published notice. Always confirm against the tender documents.
Show the notice text (5)
Financial sustainability (weighted at 30%) The candidate will have to provide La Poste with the tax links or equivalent documents (i.e. balance sheets, profit and loss accounts, annexes numbered from 2050 to 2059 included and management reports) of the last 3 financial years available. In the event of a recent creation, the applicant will have to provide any other evidence of economic and financial capacity. If the candidate presents himself as a group, each member of the group shall provide all the information required under this heading
Customer references (40 % weighted criteria) The candidate will present 3 customer references under 3 years of age for services equivalent to those of the market to which he is applying, for customers with a similar organisation in Groupe La Poste. In this capacity, the applicant will provide for each of the references the following elements: The candidate will provide for each reference a certificate issued by the customer (name, quality, contact details). Failing this, he provides a certificate of honour mentioning the same information, La Poste reserving the right to verify the reality with the customer.
Staffing (20% weighted) The candidate will indicate the average annual staff to which he has had access over the last three years, and will specify: - the number of staff in the field of market competence; - the number of commercials, trainers, technician, support. For each of the categories, the candidate will specify whether he or she has the staff directly or indirectly.
Environmental Management Measures (weighted at 5%): The applicant shall indicate the environmental management measures that he or she may apply for the realization of benefits.
Environmental Management Certifications (5% Weighted Criterion): The applicant shall provide a certificate of quality issued by an accredited independent body certifying compliance with the following environmental management systems or standards:
- European Union Environmental Management and Audit System (EMAS);
- or any other environmental management system recognised in accordance with Article 45 of Regulation (EC) No 1221/2009;
- or any other environmental management standards based on European or international environmental standards developed by accredited bodies.
Bid bond & performance security
What the notice says about securities
Le candidat devra fournir à La Poste avant la signature du contrat une attestation d’assurance ( RC exploitation, RC professionnelle).
Original language: French
Options, renewals, framework
- Framework agreement without reopening of competition
- Up to 1 contractors in the framework
- Options: foreseen
This is how SalesDots checks this tender: the notice's conditions, this contract's own facts, the requirements typical for its category and your company's registers. The statuses below are an example; you see the real result after signing in.
3 met · 2 expiring · 0 missing · 4 to check
Conditions in this notice
- EMAScertificate in your profile, valid on the bid dateExpires before the deadline
- Referencessimilar contracts from your history matched to the conditionIn your profile
This tender's facts
- Bid depositamount in the tender documents — arrange it before the deadlineNeeds a look
- Framework agreementone supplier — every order during the agreement goes to the winnerNeeds a look
- Who wins at this buyerrecently: ELECTRICITE DE FRANCE (EDF), AIRSTREAM — 6 different winners in the last 6 awardsNeeds a look
Typical for: Software licences & SaaS
- Licence reseller authorisationpartner status with the software vendorIn your profile
- Licence model and quantitiesnamed-user, device or subscription terms as in the noticeIn your profile
- Data location and GDPREU hosting and a data processing agreement for cloud servicesNeeds a look
- Vendor support and updatessupport level and update rights for the contract periodExpires before the deadline
Registers — checked automatically
- SIRENE / RCS (Kbis)company active, extract under 3 monthsVerified
- Beneficial owners (RBE)filing matches the shareholdersVerified
- EU VAT (VIES)number active in VIESVerified
- LEI (GLEIF)LEI issued and renewed, data matches the registerVerified
- Sanctions screeningcompany and owners not listedVerified
Free · no account
Get tenders like this one by e-mail
Free check · 10 seconds
Does your company fit this tender?
Buyer
La Poste
- Address
- 9 RUE DU COLONEL PIERRE AVIA, 75015 PARIS, France
- Website
- www.laposte.fr
Register identifiers
- LEI
- 9695000YG7TR7PAP0L59
- Registration no. in the notice
- 356000000
What this buyer bought before
16 IT contract award notices 2020–2025, €2.5m in total.
Services d’hébergement sur deux sites Datacenter Tier III en colocation pour La Poste et La Banque Postale
Winner: ELECTRICITE DE FRANCE (EDF) +2 more contractors
value not disclosed
24 Oct 2025
Fourniture et intégration d'une solution logicielle de gestion de portefeuilles projets et de suivi financier en mode SaaS et prestations associées
Winner: AIRSTREAM
€1.8mFramework agreement — maximum value
13 Mar 2025
Vivier de plateformes en ligne d'intermédiation d'experts indépendants dans divers domaines
Winner: COLEVER +12 more contractors
value not disclosed
11 Apr 2024
France-Paris: Software package and information systems
Winner: SOGEC GESTION · 2 bids
value not disclosed
23 Jan 2024
France-Paris: Software package and information systems
Winner: INFFLUX INFORMATIQUE ET FLUX
value not disclosed
11 Jan 2024
France-Paris: Software package and information systems
Winner: ALTAYS · 2 bids
value not disclosed
5 Oct 2023
How to submit an offer
Offers are submitted only on the buyer's platform, before the deadline for offers.
- e-sourcing.extra.laposte.fr
- Platform
Questions & answers
What is the deadline for offers in "Provision of an independent expert intermediation platform for bug bounty services and vulnerability disclosure program"?
Offers are due by 1 Dec 2026, 11:00 CET.
What is the estimated value?
The buyer did not publish an estimated value in the notice.
Who is the buyer?
La Poste (PARIS, France); LEI 9695000YG7TR7PAP0L59.
Where and how do I submit an offer?
Offers are submitted electronically on https://e-sourcing.extra.laposte.fr.
Which procedure is used?
Negotiated with call.
Win it with SalesDots
Read the documents for you
SalesDots fetches the tender documents (or takes your upload when a platform does not allow it) and answers the two questions that matter first: what the buyer wants built, and what you must prove to take part, each with the exact quote and page.
Analyse documentsMatch it with your profile
Every certificate, reference and role is checked against your company: green when you have it, amber when it expires before the deadline, grey when it needs a look.
Check my fitPrepare your response
Turn the conditions into a bid checklist with owners and due dates, draft the questions to the buyer and keep the team on one plan.
Start a responseNever miss a change
Track the deadline, amendments and answers to clarification questions, and get similar tenders and re-tenders before they are published.
Track this tenderSource: Tenders Electronic Daily (TED), Official Journal of the EU. SalesDots is not the contracting authority; offers are submitted only through the buyer's platform. Data from the official notice, refreshed 5 Nov 2026, 02:26 CET.