Best email verifiers for GDPR
GDPR makes your verifier a processor of personal data. Seven verifiers compared on retention, deletion, published terms, data use and where they host.
How this was compared
Disclosure: ZapBounce is our product. Figures were read from each vendor's own pages in September 2026, and the criteria below were applied to every entry, ours included.
The short version
- Retention: how long the vendor keeps uploaded addresses and results, and whether you can change it.
- Deletion: whether you can delete a batch, and erase one person's address, yourself and on demand.
- Published processor terms and a named sub-processor list you can read before you sign up.
- Data use: whether the vendor says it never sells your list or adds it to a shared database.
- Where the vendor says your data is hosted, as stated on its own pages in September 2026.
- Disclosure: ZapBounce is our product, and the same criteria were applied to it.
At a glance
| 10,000 addresses | Credit expiry | Bills unknowns | |
|---|---|---|---|
| ZapBounce | $25 | Credits never expire | No |
| CaptainVerify | $71 | Not on their public pages | No |
| Bouncer | $60 | Credits never expire | No |
| Truelist | See their pricing page | See their pricing page | See their pricing page |
| EmailHippo | Behind their pricing calculator | Not on their public pages | Not stated |
| Clearout | Not listed | Credits never expire and roll over | No |
| Scrubby | See their pricing page | See their pricing page | See their pricing page |
Vendor figures read from their own pricing pages in September 2026. Confirm before purchase, because prices move.
The ranking
Best first, with the situation each one fits.
ZapBounce
Disclosure: ZapBounce is our product. Addresses and results are kept 30 days by default, and each API key can set its own window from 0, deleted on download, to 90 days. DELETE /v1/batches/{id} removes a batch at once, and POST /v1/erasure removes one address across your account.
- Best for:
- Teams that answer access and erasure requests themselves and want the processor terms in writing. Read the data processing terms and what GDPR asks of verification.
CaptainVerify
CaptainVerify runs on servers in France, holds ISO 27001 and SOC 2, and recredits unknowns. Its 10,000 tier costs $71.
- Best for:
- Buyers whose policy asks for French hosting and a named certification.
- Less suited to:
- Buyers who want credit expiry terms before they buy, since those are not on its public pages.
Bouncer
An EU-based verifier with a flat, published price ladder, which never charges for duplicates or unknowns.
- Best for:
- Teams whose policy names an EU-based vendor.
- Less suited to:
- Large lists on a tight budget, where its 100,000 tier costs $400.
Truelist
Truelist says validation data is deleted after 30 days and lists AWS in the US and OVH in France as sub-processors, read on truelist.io on 24 September 2026.
- Best for:
- Buyers who want a fixed deletion window without setting one.
- Less suited to:
- Hard rows on a fixed budget, since its Enhanced pass costs extra credits on catch-all and unknown rows.
EmailHippo
EmailHippo is a British verification and fraud-intelligence business with ISO 27001 and ISO 9001 behind it.
- Best for:
- UK buyers who want a UK vendor with ISO certificates.
- Less suited to:
- Buyers who want a volume price on the page, since volume sits behind a calculator.
Clearout
Clearout holds ISO and SOC 2 Type II certifications, and its credits never expire. Its tier prices are not listed on the pricing page, so this row carries no figures.
- Best for:
- Vendor reviews that ask for Clearout's stated SOC 2 Type II certification.
- Less suited to:
- Buyers who want a dollar price per tier before a sales step.
Scrubby
Scrubby's GDPR page puts its data on AWS in US West, and its deep check sends a real message and reports back days later, read on scrubby.io on 24 September 2026.
- Best for:
- Catch-all heavy B2B lists where a result days later is acceptable.
- Less suited to:
- Lists where no message may reach the recipient before consent is checked, since the deep check sends one.
Why ZapBounce ranks first
How to choose
- Retention: Truelist deletes validation data after 30 days (read 24 September 2026). ZapBounce also defaults to 30 days, and each API key can shorten that to deletion on download or extend it to 90.
- Erasure: ask each vendor how you remove one person's address. With ZapBounce it's POST /v1/erasure, which removes that address across your account.
- Hosting: CaptainVerify hosts in France and Bouncer is EU-based. ZapBounce hosts in the United States and names every sub-processor on its /dpa page, so your transfer assessment starts from a full list.
Questions people ask
Is email verification allowed under GDPR?
Yes, when you have a lawful basis to hold the addresses and a processing agreement with the vendor. Checking data you already hold lawfully does not need a separate basis, and it never creates consent to email anyone.
Does a verifier have to be hosted in the EU?
GDPR does not require EU hosting. It requires a lawful basis for any transfer outside the EEA and processor terms that cover it. Read where each vendor hosts and who its sub-processors are, then run your own transfer check.
How long does ZapBounce keep my list?
Thirty days by default. Each API key can set its own window from 0, which deletes the file on download, up to 90 days, and you can delete any batch at once with DELETE /v1/batches/{id}.
How do I handle an erasure request for one address?
Call POST /v1/erasure with the address. ZapBounce removes it across every batch in your account, so one call answers the request.
Who are ZapBounce's sub-processors?
Vercel for the edge and API, Amazon Web Services for storage, Cloudflare and Google for DNS resolution, and Stripe for billing. The list is published with the processing terms, and changes are announced 30 days ahead.
Run the same sample through two of them
100 free checks a month, no card. Compare how many addresses each one declined to judge, which matters more than either accuracy claim.