Your list is sensitive. We treat it that way.
Email lists are some of the most valuable data a business owns. We encrypt yours in transit, restrict who can touch it, and tell you exactly where it goes — because trust you can't inspect isn't trust.
Specifics, not adjectives.
Anyone can write 'enterprise-grade'. Here is exactly what we commit to.
GDPR
CompliantLawful processing, data-subject rights and a DPA. EU data handled under documented, enforceable terms.
Audited annually · report on requestMoney-back guarantee
In writingCut your bounce rate 95% or get refunded. Trust you can hold us to, not just claim on a homepage.
Six commitments we'll put in writing.
Not vague promises — specific, inspectable practices your security team can verify.
Encrypted end to end
Every list is encrypted in transit with TLS 1.3. Keys are managed and rotated — never embedded in code or shared.
Retained only as long as needed
Uploaded lists are processed and purged on a strict schedule. Delete a job and its data is gone — verifiably, not just hidden from the UI.
Never sold, never shared
Your contacts are yours. We don't sell, rent or build marketing databases from your lists. Verification is the product — your data isn't.
Least-privilege access
Access to production is scoped, logged and reviewed. Engineers see what they need to operate the service — and nothing more.
Hardened & monitored
After a real incident, we rebuilt the platform on hardened infrastructure with locked-down internal services and automated availability checks.
Data residency you can ask about
Need EU-only processing or a DPA for your compliance team? Talk to us — we'll put the specifics in writing.
Upload, verify, return, purge.
Your data follows one controlled path and leaves on a schedule. Here's the whole journey — nothing happens to your list that you can't trace.
- 01Upload. Your list arrives over TLS 1.3.
- 02Verify. Addresses are checked in an isolated pipeline. Results are scored, never enriched or resold.
- 03Return. You download clean results or sync them back to your tools. The verdict is the only thing that leaves.
- 04Purge. Source data is deleted on schedule — or instantly when you delete the job. Gone means gone.
$ elc verify --email [email protected] → resolving MX… stripe.com ✓ → SMTP handshake… 250 OK → catch-all probe… not accept-all → disposable / role… clean VALID confidence 0.98 mailbox confirmed $ elc verify --email [email protected] CATCH-ALL confidence 0.55 accept-all domain $ elc verify --email [email protected] INVALID confidence 0.04 domain typo → gmail.com?
Our sub-processors, in the open.
The vendors that help us run the service — what each one does and where. A DPA and the full current list are a request away.
| Sub-processor | Purpose | Region |
|---|---|---|
| Cloud infrastructure | Compute & encrypted storage | EU / US |
| Email delivery | Transactional & account email | US |
| Payment processing | Billing & subscriptions | EU / US |
| Product analytics | Aggregate usage metrics | EU |
Need the named entities and a DPA for procurement? Request the documents— we'll send your compliance team the named sub-processors and our DPA terms.
We'll never fake a green light.
The same honesty that drives our security drives our verdicts. When an address is genuinely undeterminable, we say so — and we don't charge you for it. You pay only for answers we're sure of, your credits never expire, and we show our work on every result. Security and honesty aren't separate features here; they're the same promise.
See how the AI explains a verdictWe were hit. We rebuilt in the open — and locked it down.
- Hardened infrastructure
- Internal services locked down
- Least-privilege access
- Automated availability checks
Radical transparency includes owning what went wrong.
Security questions, answered.
Verify with confidence. Start free.
100 free verifications, no card. GDPR and encryption in transit — and credits that never expire.