StartupKit

StartupKit, commonly referred to as Kit, is an all-in-one hiring and security operations platform that bundles applicant tracking, vulnerability disclosure, compliance training, and cold outreach into a single account under a single per-seat subscription. The product addresses a familiar startup problem: people and security workflows live in separate tools, so records, context, and audit evidence fragment across vendors. Kit consolidates those workflows so a small team can move a candidate to offer, approve a bug bounty, export a training register, and draft a prospecting email without switching products.

Overview

StartupKit is a multi-product SaaS account built for early-stage companies that need hiring, security disclosure handling, compliance training, and outreach without assembling four separate vendors. Candidates, security researchers, and trainees interact through passwordless magic links on the company's own domain, while internal teams work either in the browser or through an AI assistant connected over the Model Context Protocol. Pricing starts at €6,99 per seat per month after a 30 day trial, and the vendor positions the suite as a way to keep people operations and security evidence in one place.

Key Features

• Hiring pipelines with role templates. Teams can configure a pipeline for each open role or start from 20 ready-made hiring process templates across 7 categories and 5 languages, covering positions such as Software Engineer, Product Designer, Registered Nurse, Accountant, and Truck Driver. Templates ship with predefined stages, candidate instructions, timing guidance, and paid-stage details where configured, and they can be copied into Kit and edited.
• Branded candidate portals with magic links. Applicants receive one private link instead of an account and password. Through that link they check their current stage, pick an interview time from real interviewer availability, and view or respond to an offer. Interview scheduling is bundled with hiring rather than sold as a separate add-on, and interview details appear on the candidate record alongside team feedback.
• Vulnerability disclosure and bounty workflow. Kit handles a security report from intake through triage, SLA tracking, duplicate detection, severity assignment, bounty approval, and audit export. A researcher portal displays report status, payout state, tax document uploads, and an appeal path. Agent tools such as csirt_list_reports, csirt_triage_report, and csirt_approve_bounty are annotated so the client can flag actions that write ledger credits or notify people outside the company.
• Compliance training with a completion register. Security awareness courses covering SOC 2, ISO 27001, GDPR, and HIPAA are included with no per-learner fee. Trainees submit their own evidence, such as a screenshot of a locked screen with capture date and machine name, and administrators export a register listing names, employee IDs, departments, roles, and completion dates as CSV or PDF, along with individual evidence bundles for auditors.
• Outreach with enforced human approval. Cold email is researched one prospect at a time and nothing sends until a draft is reviewed. There is no prospect portal, so replies land in the prospect's own inbox, while the operator sees replies from every campaign in one priority-ordered inbox with detected sentiment. A silver medalist lookup matches campaign prospects against prior applicants and application records.
• Model Context Protocol integration. More than 190 MCP tools let ChatGPT, Claude Code, Cursor, GitHub Copilot, or another MCP client read applications, advance stages, triage reports, and check training completion. Access uses scoped tokens and existing Kit permissions, and each tool declares whether it reads data, makes a destructive change, or contacts someone externally.

How It Works

A team creates an account and begins a 30 day trial. From there it copies a hiring template or builds a pipeline, publishes roles to a careers portal, and shares magic links with candidates. Security reports arrive through an intake channel and progress through triage and SLA tracking toward a recorded bounty payout. Training programs are assigned, learners submit proof, and the register stays exportable for auditors. Work happens in the browser or through a connected assistant, and integrations include Slack, GitHub, Google Calendar, Google Meet, webhooks, and any MCP client.

Who It's For

StartupKit suits seed to Series A startups and small companies, typically between two and fifty people, that lack dedicated recruiting operations and security engineering staff. The buyer profile spans founders, operations leads, HR generalists, and the person accountable for security or compliance evidence during an audit. Agencies and professional services firms running repeatable hiring processes may also find the template library useful, while the separately priced Outreach module keeps the base plan sensible for teams that only need hiring, security, and training.

Pricing, Data, and Compliance

The published plan costs €6,99 per seat per month, with equivalents of $8, 29,99 zł, and £5.99 depending on currency. A card is required at signup, though it is not charged during the 30 day trial, and seats can be added or removed with automatic billing adjustments. Outreach is the only separately billed add-on at €17,99 per month and includes reply detection, bounce handling, and MCP tools. Compensation Research is included in beta and gathers advertised salary ranges from live job postings. Customer data is stored on EU infrastructure, a Data Processing Agreement is available to every customer, and accounts can be cancelled from settings with a data export beforehand. The interface and marketing site are offered in English, German, French, Spanish, and Polish.