Your data is encrypted,
isolated, and never sold
We treat the contact lists, SMTP credentials, and DKIM keys you trust us with like the asset they are. Here is exactly how we protect them.
How we protect your data
Encryption at rest
Every SMTP password and DKIM private key is encrypted with AES-256-GCM before it is stored — never kept as plain text.
Encryption in transit
All API requests, dashboard traffic, and outbound SMTP connections are wrapped in modern TLS end to end.
Per-account DKIM keys
Each sending identity gets its own RSA key pair and DKIM record, isolating one account’s sender reputation from another’s.
Least-privilege access
Internal staff access is role-gated by permission, not by account — support and engineering only see what their role requires.
No data sharing
We never sell, rent, or share your contact lists or campaign content with third parties. Period.
Protected API
API keys are stored hashed, can carry an expiry and an IP allowlist, and can be revoked at once. Plan-based rate limits apply, and addresses that repeatedly present invalid keys are blocked.
Bot protection on public forms
Contact, registration, chat and signup forms are protected by Cloudflare Turnstile, and text submitted through public forms is stored as plain text, not as markup.
Responsible disclosure
Found a vulnerability? Our disclosure program tells you exactly how to report it and how we respond.
Compliance-ready data handling
GDPR-aligned data handling with on-demand export, deletion, and audit trails is built into every account — read the full details in our policies below.
Frequently asked questions
How is my data encrypted?
SMTP credentials and DKIM private keys are encrypted at rest with AES-256-GCM before they ever touch disk. All API and SMTP traffic is wrapped in TLS in transit — nothing is sent in plain text.
Do you sell or share my contact lists?
No. We never sell, rent, or share the email lists, contacts, or campaign content you upload with third parties. Your data is used to run the verification and sending you asked for — nothing else.
How is the API protected from abuse?
Every request is authenticated with an API key stored only as a hash. Requests are rate-limited by plan, addresses that repeatedly present unknown keys are blocked, keys can be IP-restricted, given an expiry or revoked, and credits for a send are reserved atomically before an email leaves so parallel calls cannot send for the price of one.
How do I report a security vulnerability?
See our Responsible Disclosure Policy for how to report a vulnerability and what to expect from us in response.
Can I delete my account and data?
Yes. Account deletion and data export are available on demand — see our Privacy Policy for the full breakdown of data subject rights and retention periods.