On 7 March 2019, security researcher Bob Diachenko reported a 150GB MongoDB database left open on the internet with no password. It belonged to Verifications.io, an email verification service. It held 808,539,939 records, 798,171,891 of them in the main email collection, many carrying a name, phone number, address, date of birth, gender or IP address (securitydiscovery.com, read September 2026).
Diachenko's write-up explains where the data came from. Customers uploaded addresses to be checked, and the service kept them in plain text after each check was done. Verifications.io took its site offline the day it was told.
That's the lesson. The breach wasn't a flaw in how verification works. It came from what the service decided to keep. A verifier needs your list for the minutes it takes to check it, and every day it holds the file after that is exposure you carry without any benefit.
So the question to ask before you upload isn't only whether a vendor is secure. It's how long your list stays on its servers, and whether you can make that shorter. Our answer on uploading a list safely covers the short version.
Six questions to ask before you upload a list
How long is my list kept by default? At ZapBounce, uploaded addresses and results are kept for 30 days, then deleted. The window is a setting on each API key, from 0 days, where the file is deleted once you download it, up to 90.
Can I delete a job right now? DELETE /v1/batches/{id} removes a batch and every address in it at once, and POST /v1/erasure removes one address across your whole account for a GDPR request. Both are documented under data retention and GDPR deletion.
Does my list feed anything else? ZapBounce never sells uploaded addresses, never adds them to a shared database, never contacts the people on a list and never reuses a list to improve the product.
Who else touches the data? Our sub-processors are exactly Vercel, Amazon Web Services, Cloudflare, Google and Stripe, listed on the data processing terms, and changes are announced 30 days ahead. ZapBounce is hosted in the United States, and a list leaves that region only for the SMTP check to the receiving mail server.
Does verification send email to my contacts? Not with ZapBounce. We open an SMTP connection, ask about the recipient and close before DATA, so no message is ever sent. The steps are on how it works.
Can I skip the upload entirely? For a signup form or a CRM sync, the API checks one address per call, with that key's retention window applied to each result. More on keeping a list clean sits on the ZapBounce blog.
Why a short window matters more than a strong lock
The short version
- Ask every verifier how long it keeps your list by default and whether you can set that to zero.
- Delete each batch once you've downloaded the results, or set a short retention window on the key.
- Read the sub-processor list before you upload, and check that the vendor never adds your addresses to a shared database.
Questions people ask
What was the Verifications.io data breach?
In March 2019 researcher Bob Diachenko found an unprotected 150GB MongoDB database belonging to Verifications.io, an email verification service. It held 808,539,939 records, including addresses customers had uploaded for checking, stored in plain text.
Is it safe to upload my customer list to an email verification service?
It is safe when the service keeps your list only as long as you choose and lets you delete it. ZapBounce keeps uploads for 30 days by default, lets you set 0 to 90 days per API key, and deletes any batch at once on request.
Does ZapBounce keep or reuse my list?
ZapBounce deletes uploads after 30 days by default, or on download if you set the window to 0. It never sells addresses, never adds them to a shared database and never reuses a list to improve the product.
Where is ZapBounce hosted?
ZapBounce is hosted in the United States. A list leaves that region only for the SMTP check to the receiving mail server.