Reporting a vulnerability

Found a security issue? Email security@verifyany.email with details and reproduction steps. Please give us reasonable time to remediate before public disclosure. We don’t currently offer a paid bounty, but we credit reporters who wish to be acknowledged.

Encryption

In transit: the site, API and dashboard are served over HTTPS (TLS) with certificates from Let’s Encrypt, auto-renewed. Our own mail servers offer STARTTLS.
Secrets at rest: sensitive configuration (payment provider keys) is stored encrypted in the database, not in plaintext.
API keys are stored hashed; the full key is shown only once at creation.

Authentication & access

Accounts support email-based two-factor authentication and Google sign-in.
The API authenticates with per-account bearer API keys you can rotate or revoke at any time.
Batch webhooks are signed with an HMAC-SHA256 signature (X-VAE-Signature) using your per-account secret, so you can verify authenticity.
Administrative actions are recorded in an internal audit log.

Data minimisation

By default we do not store the raw SMTP transcript of a verification.
Verification records can be purged and are subject to configurable automatic retention windows — see data retention.
Public tools run in-memory; the email header analyzer redacts recipient addresses and doesn’t store pasted headers.
We never sell customer data. Diagnostic tool queries are used only to return your result and enforce rate limits.

Infrastructure

VerifyAnyEmail runs on dedicated servers we operate directly, including our own SMTP infrastructure used for live mailbox checks. We do not resell a third-party verification API — the verification engine is ours. Servers run a firewall (UFW) and intrusion-prevention (fail2ban), receive OS security updates, and expose only the services required to operate the platform. Payment card data is handled entirely by our PCI-compliant processors (Stripe/PayPal); card numbers never touch our servers.

Your responsibilities

Keep your API keys secret, rotate them if exposed, verify webhook signatures against the raw request body, and use verification results in line with our acceptable-use policy and applicable law.