Security and data handling
You are handing us a list of other people's email addresses. This says what happens to it.
What we store, and for how long
| Data | Why | Control |
|---|---|---|
| The addresses you upload | To verify them | Delete the job and they go with it |
| The verdict per address | So you can download results | Deleted with the job |
| The MX host and response reason | So a result is auditable rather than a bare label | Deleted with the job |
| Job metadata: size, time, credits used | Billing and your own history | Life of the account |
| Your API keys | Authenticating requests | Rotate or revoke at any time |
Uploaded lists are not retained indefinitely. Delete a job as soon as you have the results and nothing of that list remains.
What leaves our infrastructure during a check
Verification is a conversation with someone else's mail server, so something does leave. Here is exactly what.
We query public DNS for the domain's mail servers. Then we open an SMTP connection to that server and name the recipient we are asking about. The receiving server therefore sees the address being checked and the address we connect from, which is unavoidable: that exchange is the verification.
We do not send a message, so nothing arrives in the mailbox. We do not pass your list to a third-party verification API, because the SMTP check is ours. And we do not sell, share or reuse the addresses you upload.
What we do not hold
Common questions
Do you keep my list after the job finishes?
Only until you delete the job, which you can do as soon as the results are downloaded. Delete it and the addresses, verdicts and reasons all go.
Does my list go to a third party?
No. The SMTP check is our own, so there is no verification vendor behind us receiving your addresses.
Can I verify without uploading a file?
Yes. The API checks addresses one at a time, so nothing has to be stored as a list at all.
Is verification GDPR compliant?
Verification is processing personal data, so the lawful basis for holding those addresses is yours as the controller. We process on your instructions, keep the data only as long as the job exists, and delete on request.
What if an API key leaks?
Revoke it and issue a new one. Keys are independent, so rotating one does not disturb anything else.
Send the security questions first
Before the contract, not after.