Security and data handling
ZapBounce keeps a list until you delete the job, lets you delete it at any time, and hosts it in the United States.
What we store, and for how long
| Data | Why | Kept for |
|---|---|---|
| The addresses you upload | To verify them | Until you delete the job |
| The result per address | So you can download results | Until you delete the job |
| The MX host and response reason | So a result is auditable rather than a bare label | Until you delete the job |
| Job metadata: size, time, credits used | Billing and your own history | Life of the account |
| Your API keys | Authenticating requests | Rotate or revoke at any time |
DELETE /v1/jobs/{id} removes a job at once, with its addresses and results.
What leaves our infrastructure during a check
Verification is a conversation with someone else's mail server, so something does leave. Here is exactly what.
We query public DNS for the domain's mail servers. Then we open an SMTP connection to that server and name the recipient we are asking about. The receiving server therefore sees the address being checked and the address we connect from, which is unavoidable: that exchange is the verification.
No message is sent, so nothing arrives in the mailbox. The SMTP check is our own, so your list never goes to a third-party verification API. And ZapBounce never sells, shares or reuses the addresses you upload.
ZapBounce is hosted in the United States. A list leaves that region only for the SMTP probe to the receiving mail server. The 5 sub-processors are named on the data processing terms, and any change is announced 30 days ahead.
Built so addresses leave fewer traces
Verification is POST only. No endpoint takes an address in the query string. A URL ends up in access logs, proxy logs, browser history and analytics tools. An address sent in a request body stays out of all of them.
API keys can be rotated or revoked at any time, and each key carries its own scopes, so a key can be limited to the calls an integration needs.
Common questions
How long do you keep my list after the job finishes?
ZapBounce keeps a list until you delete the job. DELETE /v1/jobs/{id} removes a job at once, with its addresses, results and reasons.
Does my list go to a third party?
No verification vendor ever receives your list, because the SMTP check is our own. The sub-processors that host, store and bill are named on the data processing terms.
Can I verify without uploading a file?
Yes. The API checks addresses one at a time, so nothing has to be stored as a list at all.
Is verification GDPR compliant?
Verification is processing personal data, so the lawful basis for holding those addresses is yours as the controller. ZapBounce processes on your instructions, keeps data until you delete the job, and you can delete a job at any time with DELETE /v1/jobs/{id}.
What if an API key leaks?
Revoke it and issue a new one. Keys are independent, so rotating one does not disturb anything else.
Send the security questions first
Before the contract, not after.