Security

1. Overview

EmailVerifyerAPI is built by a small independent team in Montréal. We'd rather describe what we actually do than list controls we haven't implemented yet. Our security approach rests on two simple ideas: hold as little data as possible, and encrypt everything in transit.

Because our public verification tool runs entirely in your browser, the most sensitive data (the email addresses you check) never reaches our servers in the first place. That's the strongest security control of all: data we never receive cannot be lost.

2. How the verifier handles your data

• Client-side processing. Single-address and bulk-CSV checks run in your browser. The addresses you verify are not transmitted to EmailVerifyerAPI, not logged, and not stored.
• No account required to use the free tool, so there is no account data to protect for anonymous use.
• Data minimisation. When we add accounts and a hosted API, we will collect only what's needed to run them, primarily your email and authentication credentials.

3. Encryption

In transit

All traffic between your browser and EmailVerifyerAPI is encrypted with TLS 1.2 or higher (TLS 1.3 preferred), and we serve the site over HTTPS with HSTS enabled.

At rest

For the current browser-only tool there is no stored verification data to encrypt at rest. As we introduce account and billing data, it will be stored on managed infrastructure with encryption at rest enabled by the provider.

Before launch: confirm and state the at-rest encryption standard (e.g. AES-256) and key-management approach once hosted storage is live.

4. Application security

Our day-to-day engineering practices include:

• Code review before changes ship to production.
• Automated dependency scanning to catch known vulnerabilities (CVEs) in third-party packages.
• Keeping frameworks and dependencies patched and up to date.

As the product and team grow, we plan to add formal static/dynamic analysis and engage an independent firm for periodic penetration testing. We'll update this page when those are in place rather than imply them now.

5. Access controls

Access to any production systems is limited to the people who need it, protected by strong authentication, and removed when no longer required. We follow the principle of least privilege and keep the operating team small, which keeps the attack surface small too.

6. Incident response

If a security incident affecting personal data were to occur, we would investigate promptly, contain it, and notify affected users and any relevant supervisory authority in line with our legal obligations. This includes the 72-hour breach-notification window under GDPR Article 33 where it applies.

7. Report a vulnerability

We welcome responsible disclosure. If you find a potential security issue, please email us with the details and give us a reasonable chance to investigate and fix it before disclosing publicly. We're grateful to researchers who help keep EmailVerifyerAPI safe.

8. Contact