Security

The site and the API are served over HTTPS (TLS) by our host, Vercel. Call POST /v1/check if you can: GET puts the address in the URL, where our host’s logs may see it.

• Passwords, with bcrypt.
• API keys, with SHA-256. We keep a short prefix so you can recognise one, and show the full key once.
• Login sessions and one-time email links, with SHA-256. Links expire within 24 hours.

Your email address and account details, and how many checks you ran. From the checks themselves, only the domain: the part after the @, and how often it came up. We never save the full address or the part before the @.

What your checks found is deleted after 13 months, and when your account is deleted. The privacy policy has the full list.

• Card details. Paddle takes payment, and we never see them.
• Google and GitHub access tokens. We use them during sign-in and drop them.
• What you enter into the free tools.

The session token is in an httpOnly cookie, so page scripts can’t read it. It’s marked Secure and SameSite=Lax. Paddle webhooks are verified with an HMAC signature before we act on them.

We don’t send email to the addresses you check, and we don’t connect to their mail servers. We only look up public DNS, and that lookup carries the domain name, not the address.

The website and application run on Vercel, and the database is on Neon. Some providers may process data outside your country. Subprocessors lists everyone involved.

No SOC 2, ISO 27001 or other certification, no outside audit and no penetration test. We don’t promise an uptime figure. The status page shows what we can measure right now.