Skip to content

Security and privacy

Security and Privacy at RocketVerifier

We verify your addresses without ever emailing them, encrypt every request in transit and delete uploaded lists on your schedule. Here is how we keep your data safe.

Visit the Trust Center System status
  • We never email the addresses we verify
  • TLS encryption in transit
  • 90-day default auto-deletion
  • GDPR processor with DPA

Data handling

Your lists are used for one thing: verifying them

You stay in control of the data you upload, how long we keep it and when it is deleted.

  • No email is ever sent

    Verification uses DNS lookups and an SMTP handshake that stops before any message is delivered. The people on your list never hear from us.

  • We act as your processor

    You decide what is verified and why. We process the addresses only to return verification results, and we never sell or share your lists.

  • Retention you control

    Uploaded lists and results are deleted automatically after 90 days by default. Choose a different retention period in your account settings.

  • Export and delete any time

    Export your data or delete your account yourself, without waiting on support.

Infrastructure and access

Protected in transit and behind tight access controls

Security is built into how the platform stores secrets and who can reach production.

  • TLS in transit

    Every request to the API, the dashboard and the website is encrypted with TLS.

  • API keys shown once

    Keys are displayed a single time when you create them and stored securely after that. Lost a key? Revoke it and create a new one.

  • Hashed passwords

    Passwords are stored as secure hashes, never in plain text.

  • Restricted production access

    Access to production systems is limited to the people who need it, with audit logging on that access.

Account security

Controls that keep your account yours

Protect every login and see exactly where your account is signed in.

  • Two-factor authentication

    Add a second factor to your login for an extra layer of protection.

  • Single sign-on

    Organizations can verify their domain and let members sign in with SSO.

  • Session management

    See the devices signed in to your account and revoke any session remotely.

  • Bot protection

    Signup and login are protected against automated abuse, and our free tools and forms use Cloudflare Turnstile.

API controls

Limit what every API key can do

Give each integration exactly the access it needs, and nothing more.

  • Monthly spend caps

    Set a monthly credit cap per key so a bug or a leaked key cannot drain your balance.

  • Expiry dates

    Give temporary keys an expiry date so they stop working automatically.

  • IP allowlists

    Restrict a key to known IP addresses. Requests from anywhere else are rejected.

  • Organization keys

    Share pooled credits across a team with organization keys, instead of passing personal keys around.

GDPR

Built to support your GDPR obligations

RocketVerifier processes the lists you upload on your behalf, as a data processor. Everything you need for your records is a request away.

GDPR documentation Request a DPA
  • Data subject rights: access, rectification, export and erasure
  • Data Processing Agreement available from legal@rocketverifier.com
  • Subprocessor list available on request from privacy@rocketverifier.com
  • Configurable retention with 90-day default auto-deletion

Transparency

See for yourself

Status page

Live status of the API, dashboard and verification services.

View status

Trust Center

Our security and privacy practices in one place, kept up to date.

Open the Trust Center

Privacy policy

What we collect, how we use it and how to exercise your rights.

Read the policy

Responsible disclosure

Found a security issue?

We appreciate reports from security researchers. Email us with a description of the issue, the steps to reproduce it and any proof of concept. Please do not access or change other users' data, and give us a reasonable chance to fix the issue before sharing it publicly.

Send reports to

support@rocketverifier.com

Use the subject line "Security report". We reply within 24 hours.

FAQ

Security questions, answered

For privacy requests, email privacy@rocketverifier.com.

Does RocketVerifier send emails to the addresses I verify?

No. RocketVerifier checks syntax, DNS and MX records, and then holds an SMTP conversation with the mail server that ends before any message is sent. The people on your list are never contacted.

How long do you keep my uploaded lists?

Uploaded lists and their results are deleted automatically after 90 days by default. You can change the retention period in your account settings, export your data, or delete your account at any time.

Is RocketVerifier GDPR compliant?

RocketVerifier acts as a data processor for the lists you verify and supports data subject rights for access, rectification, export and erasure. A Data Processing Agreement is available from legal@rocketverifier.com, and our subprocessor list is available on request.

How are API keys protected?

API keys are shown once when you create them and stored securely afterwards. You can add monthly spend caps, expiry dates and IP allowlists to each key, and revoke a key from the dashboard at any time.

Does RocketVerifier support two-factor authentication and SSO?

Yes. Every account can turn on two-factor authentication, and organizations can verify their domain to enable SSO sign-in. You can also review active sessions and revoke any of them remotely.

How do I report a security issue?

Email support@rocketverifier.com with a description of the issue and steps to reproduce it. Please give us a reasonable chance to fix it before sharing it publicly. We reply within 24 hours.

Verify with confidence

Accurate verification, without ever emailing your contacts. Unknown results are always free.

Start free See pricing

100 free credits · No card required · Credits never expire