Security and data handling

• There are no passwords. You sign in with a one-time code sent to your email, with Google, or with a passkey.
• Sessions live in secure, HTTP-only cookies bound to our domain. You can see and end your sessions in your settings.
• Sensitive actions, such as creating API keys, changing webhooks or deleting your account, ask you to confirm it is you again.
• We email you when your account is used from a new device.

• A key is shown once, when you create it. We store only a hash of it, so nobody at email-validation.org can read it back.
• The API accepts keys only in a request header (Authorization: Bearer or X-Api-Key). Requests that put a key in the URL are refused, so keys do not end up in logs or browser history.
• Each key can have its own scopes, daily credit cap, rate limit and allowed origins, and you can roll or revoke it at any time.
• Keys start with ev_live_ and end with a checksum, so leaked keys are easy to spot in code scanning.

• Uploaded lists and their results are deleted 30 days after upload. Checks you run in the dashboard stay in your history for 30 days. API checks are not stored.
• To answer repeat checks without checking an address again, we keep the result of a completed check for 12 months under a keyed hash of the address, never the address itself.
• Our logs never contain the addresses you check, API keys, IP addresses or URL query strings.
• Page statistics are counted on our servers without cookies or tracking scripts.
• We never sell addresses and never send email to the addresses you check. They are processed only to run your checks, under our data processing agreement.
• The website and API run on the Cloudflare global network; mailbox checks are processed in the United States. The subprocessors page lists every provider.

• Every connection uses HTTPS, with HTTP Strict Transport Security for the whole domain.
• Our public pages load no third-party scripts and use a strict Content Security Policy. The bot check loads only when you use a form that needs it.
• Payments are handled by Stripe. Card numbers never reach our servers.
• The admin area runs on its own site behind an access gateway and requires a passkey. Every admin sign-in and every credit adjustment is logged.

Email security@email-validation.org with the details and steps to reproduce. A person reads every report. Please give us reasonable time to fix the problem before you share it, and do not access other people's data or disrupt the service while testing. Our security.txt has the same contact.