Security & privacy
Your list is yours. We only borrow it.
Verification means handling other people's addresses, so security is the baseline of the product, not a tier. Encryption at rest, hashed keys, deletion that actually deletes, GDPR processing terms and abuse protection on every endpoint.
Data handling
What we store, for how long, and what we never do.
Encryption at rest and in transit
Disks are encrypted, every connection is TLS (HTTP redirects to HTTPS with HSTS), and integration credentials are encrypted with AES-256-GCM under a key that never leaves the server.
Hashed API keys and passwords
API keys are stored as SHA-256 hashes and shown once. Passwords are bcrypt. Sessions are server-side, httpOnly and revoked on sign-out or password change.
No retention after deletion
Delete a job and every address in it is removed at once. Lists are kept only while you want the results, never pooled, never sold, never used to build a dataset.
GDPR processor terms
Addresses are processed on your instructions as a data processor. A DPA is available for business customers, with the sub-processor list published on the GDPR page.
Hosted in Europe
Own servers in Helsinki, Finland (Hetzner). Cloudflare can sit at the edge for bot filtering and country lookup. Stripe handles card payments; we never see card numbers.
Cookieless analytics
Site analytics use a daily-rotating salted hash of IP and user agent. No analytics cookie, no third-party tracker, no personal data in the stats.
Abuse protection
Protected before launch, not after an incident.
Every form, login and public endpoint ships with the same defences, verified with real requests after each deploy.
Forms
Honeypot field, signed minimum-fill-time token, Cloudflare Turnstile, per-IP rate limits, small bodies, link-spam heuristics.
Sign-in
Escalating per-IP lockout, per-account throttling that cannot lock the owner out, constant-time credential checks.
Whole site
Scan tools and raw HTTP libraries refused, search and preview crawlers allowed, every bot kept out of the admin, scanner probes banned.
Repeat offenders
A blocked IP is refused on every request; repeat abuse is banned at the firewall. Free tools are rate-limited per network per hour.
Reporting
Found something? Tell us first.
We take reports of vulnerabilities seriously and respond within two working days. Please give us a reasonable time to fix an issue before publishing it, and never test against other customers' data.
- Security contact
- security@verifyre.co
- Response time
- Two working days
- In scope
- verifyre.co, the API, the widget, the WordPress plugin
- Out of scope
- Denial of service, social engineering, third-party services
FAQ