Security

Your lists and your payment details matter. This page explains, plainly, what we do to protect them.

Payments

• Payments are processed by Stripe, a payment provider certified to PCI DSS Level 1, the highest level of the card-industry security standard.
• Checkout and the billing portal are hosted by Stripe. Your card number never reaches our servers.
• We keep only a Stripe customer reference, your plan and your subscription status.
• You can cancel any time from the billing portal; your plan stays active until the end of the period you paid for.

Your account

• Every connection to the service is encrypted (HTTPS), and browsers are told to always use it.
• Passwords are stored as one-way hashes (argon2id), so nobody here can read them.
• Sign-in sessions are short-lived and renew automatically; repeated failed sign-ins are slowed down and temporarily blocked.
• API keys are shown once, stored only as hashes, and can be revoked at any time.

Your lists

• Your lists and results are private to your account: other customers cannot see them.
• We never send email to the addresses you check. We only ask the receiving mail server whether the mailbox exists.
• We do not use your lists for our own marketing or sell them.
• Lists are deleted automatically 30 days after they finish, or immediately when you delete them.

Infrastructure

• The service runs on servers at Hetzner. The firewall allows only web traffic and administrator access; administrator access requires a cryptographic key (passwords are disabled) and repeated failed attempts are blocked automatically.
• Operating-system security updates are applied regularly.
• This site loads no third-party code, ads or trackers, and a strict content-security policy stops anything unexpected from running.

Backups

• The database is backed up every night. Backups are encrypted before they leave our server, using a key that is not stored on it, and are kept off-site in a separate cloud account.
• We test restoring from those backups. Backups are used only to recover from a failure and expire on a schedule (see our Privacy page).

Reporting a problem

If you believe you have found a security issue, please tell us so we can fix it quickly. Please give us reasonable time to respond before sharing details publicly.