SOC 2 is an audit, not a badge. An independent CPA firm tests a company's security controls against the AICPA's trust services criteria and writes a report. A Type I report checks that the controls are designed properly on one date. A Type II report checks that they worked across a review period of months, so it's the version a security team usually asks for.
Here is what each vendor says about itself, read on its own site on 24 September 2026. ZeroBounce lists SOC 2 Type 2 on its security page, alongside ISO 27001, HIPAA and PCI-DSS. Clearout lists SOC 2 Type II, renewed on 19 March 2026, next to ISO 27001:2022 and ISO 27701. Emailable states SOC 2 Type II on emailable.com, and Truelist lists SOC 2 Type II with ISO 27001 on its security page. Validity, which runs BriteVerify, shows SOC 2 Type 2 and ISO 27001 and 27701 on its trust center.
Three more vendors use softer wording, and your reviewer will spot the difference. Allegrow's privacy policy states SOC 2 Type I, which covers design on a single date. Kickbox's security documentation describes "current progress towards SOC2 compliance". MillionVerifier's site mentions "SOC 2 Controls" but names no report type or auditor.
A line on a website is where the check starts. Ask the vendor for the report itself, which is normally shared under an NDA. Then read two things: the end date of the audit period, and whether the verification service sits inside the audit scope. A report that's more than a year old, or one scoped to a parent company's other products, answers a different question from yours.
SOC 2 is one question among several when you hand a vendor a list of email addresses. You'll also want to know how long the vendor keeps your file, who else processes it and whether it ever reuses the addresses. Our answer on whether it's safe to upload a list covers those checks, and the GDPR-compliant email verifiers roundup compares vendors on them.
ZapBounce puts its data answers in writing on the security page and in the data processing terms. Uploads and results are kept for 30 days by default, and you can set anything from 0 to 90 days per API key. Sub-processors are named: Vercel, Amazon Web Services, Cloudflare, Google and Stripe. Verification starts at $5 for 1,000 checks on the pricing page.
Related questions
Is ZeroBounce SOC 2 compliant?
ZeroBounce lists SOC 2 Type 2 on its security page, read 24 September 2026, together with ISO 27001, HIPAA and PCI-DSS. Ask ZeroBounce for the report to confirm the audit period and what it covers.
Is Kickbox SOC 2 certified?
Kickbox's security documentation, read 24 September 2026, describes "current progress towards SOC2 compliance". Ask Kickbox for its current status and any report before your security review.
What is the difference between SOC 2 Type I and Type II?
A Type I report tests whether security controls are designed well on a single date. A Type II report tests whether those controls worked across a review period of months. Buyers who hand a vendor customer data usually ask for Type II.
Does GDPR require an email verifier to have SOC 2?
No. GDPR asks for a lawful basis, a data processing agreement and appropriate safeguards. SOC 2 is a US audit standard that many procurement teams request on top of those.