Sign in Get up to 500 free credits

EU data residency

EU data residency: validated and stored in the EU. Send your API requests to https://api-eu.email-validation.org instead of https://api.email-validation.org, and the addresses you check are validated by our servers in the EU and we store their results only in the EU. It is the same API with the same keys, credits and prices, and any account can use either host, until an Owner or Admin turns on EU-only processing for the whole account: from then on https://api.email-validation.org refuses its requests, so nothing of the account is validated in the United States.

Use the EU endpoint

curl -s https://api-eu.email-validation.org/v1/validate \
  -H "Authorization: Bearer $EV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "valid@sandbox.email-validation.org"}'
  • Base URL: https://api-eu.email-validation.org. The endpoints of the API reference work there with the same requests, answers and errors, with two exceptions: GET /v1/validate (send a POST, below) and the A2A agent card (below). The OpenAPI document marks both as served on https://api.email-validation.org only.
  • Validate with POST only: on the EU endpoint, /v1/validate takes the address in a POST body. A GET with the address in the URL gets 400 invalid_request ("On the EU endpoint, send the address in a POST body, never in the URL."), because a URL can end up in edge and security logs. The SDKs always send a POST.
  • Keys and sign-in: the same API keys work on both hosts. An OAuth access token works on the host it was issued for: an app that signs in through the EU endpoint (for example an MCP client added as https://api-eu.email-validation.org/mcp) gets one for it. See OAuth for apps and AI agents.
  • MCP and A2A: the MCP server is at https://api-eu.email-validation.org/mcp and the A2A endpoint at https://api-eu.email-validation.org/a2a. Every link in their answers points to the EU endpoint. The A2A agent card is served on https://api.email-validation.org and on our website, not on the EU endpoint.
  • SDKs (some coming soon): pass https://api-eu.email-validation.org as the base URL option. Each SDK's next release adds a constant for it (EU_BASE_URL in JavaScript and Python, named the usual way in the other languages); the JavaScript release on npm does not have it yet, so write the URL itself (why). See SDKs.
  • OpenAPI: the OpenAPI document lists the EU endpoint as a second server.
  • Status: GET https://api-eu.email-validation.org/v1/status reports the EU path.
  • Credits and limits: one balance and one set of rate limits per account across both hosts; the per-IP limits are counted on each host separately. After too many invalid keys from one address, the EU endpoint can refuse that address's valid keys too, for up to a minute (details). Prices are the same: 1 credit per answer, and unknown results are free.

The EU and global result caches are separate and never copy into each other. The first check of an address on the EU endpoint is therefore a new check, even if it was checked on https://api.email-validation.org before, and it costs 1 credit like any other answer.

What is in the EU

For every request to https://api-eu.email-validation.org, whatever the account:

  • Our code that reads the addresses (the API, our gateway and bulk processing) runs on Cloudflare Workers placed in Frankfurt, Germany. Placement is best effort: if one of them ever runs outside the EU, it refuses the request with 503 service_unavailable instead of processing it there. An EU check never falls back to the United States.
  • Mailbox checks go to our email verification provider's EU service. It receives the address and, if you send one, the ip_address field, which we never store. The subprocessors page says who it is, and its limits what the provider has not yet confirmed.
  • We store results only in the EU: the result of a completed check for 12 months under a keyed hash of the address (never the address itself), in storage held in the EU, with short-lived copies in our EU servers' memory and in the Cloudflare location that runs them.
  • Bulk lists are uploaded, validated and stored in the EU, and their result files are produced there. They are deleted 30 days after upload, as on the global endpoint.

What stays in the United States

  • Account data: accounts, members, API key records, billing, the audit trail (including erasure records, which keep a keyed hash of the erased address), support messages, the details of bulk lists (file names, counts and statuses), and the contents of webhooks and notices about lists.
  • Credits: your account's credit ledger (balances, key hashes, counters) runs in eastern North America. A request to the EU endpoint whose answer is already stored in the EU is answered without asking the ledger when our EU server holds credits for your account in memory (after your first purchase). Every other request (a new check of an address, or one without credits held in memory) waits for one round trip to the ledger across the Atlantic. We publish no latency figure for the EU endpoint until we have measured it.
  • Payments: Stripe.
  • Usage records and logs: per-check usage records (no addresses), our operational logs (addresses removed) and Cloudflare's own logs and metadata.

Limits of EU data residency

  • Our email verification provider: where its EU service processes and keeps the addresses, for how long, and which of its companies runs it are the provider's own commitments, which it has not yet confirmed to us in writing. What this page places in the EU are our own servers and our own storage.
  • Encryption at the edge: Cloudflare ends the encrypted connection of a request at the data centre nearest to the client, which can be outside the EU, and passes the request on to our EU servers. Our code that reads addresses runs only in the EU, but we do not claim that a request is never handled outside it.
  • Cloudflare storage: results are stored durably in the EU; Cloudflare documents that copies of stored values can be cached outside the EU. Our EU servers read them only from EU data centres.
  • The website: dashboard checks, uploads and result downloads of an account with EU-only processing pass through our website's code at the Cloudflare location nearest to you. It relays them to the EU without reading or storing them.
  • Mail servers: a mailbox check contacts the address's own mail servers, wherever they are. That is how mailbox verification works.
  • Transfers: email-validation.org and its subprocessors are US companies, and our staff work from the United States. The Data Processing Agreement and its standard contractual clauses still apply. EU data residency decides where addresses and results are processed and stored; it does not replace the DPA.

EU-only processing for your account

In the dashboard, open Settings and tick Validate in the EU only in the Data processing card. It is off by default. Owners and Admins can change it; other members see it read-only.

  • It takes full effect within 10 seconds of saving.
  • Turning it on cancels the account's lists still being validated in the United States (their unprocessed rows are refunded) and its unfinished uploads there. The page says how many before you save.
  • Turning it off asks you to confirm with your passkey or an email code first.
  • Every change is emailed to the account's Owners.

While it is on:

  • API requests to https://api.email-validation.org are refused with 403 forbidden and the message "This account validates in the EU only. Send requests to https://api-eu.email-validation.org." Nothing is charged. Send them to https://api-eu.email-validation.org.
  • Checks in the dashboard are validated in the EU. The dashboard keeps no history of them.
  • Bulk lists uploaded in the dashboard are stored and validated in the EU.

Earlier data

Turning EU-only processing on does not move data. Checks made before stay where they were until they expire: stored results for up to 12 months, uploaded lists and their results for 30 days, and the dashboard history for 30 days. Completed lists from before stay downloadable in the dashboard until they expire. After you turn it off, results stored in the EU stay there until they expire.

Erasure

When someone asks us to delete the stored result of their address, we delete it in both regions. If the EU half fails, the request is not complete and we repeat it; we do not keep the address to retry later. The erasure record in our audit trail keeps only a keyed hash of the address and whether each half succeeded, in the United States.

What it does not cover

  • The free email checker on our website.
  • The check of a new account's address at sign-up.
  • Support chats and emails.
  • Webhook payloads (ids and counts only) and notices about lists (file names and counts).

Updated · Maintained by the email-validation.org team