Security

1. Overview

Security is a core part of how EmailLabs is built. This page describes the practices we use to protect your account and the data you send us. Our strongest control is simple: we store as little as possible.

2. Data minimisation

The addresses you verify are processed in memoryand discarded once we return a result — we don't keep a verification history. The only personal data we retain is the account information of team members who log in (name, login email, plan).

This means there is no dataset of verified addresses in our systems to lose, leak, or be compelled to hand over.

3. Encryption

• In transit — all traffic to our API and dashboard is encrypted with TLS.
• At rest — account data and secrets are encrypted at rest.

4. Access control

• Least-privilege access for staff, granted only when needed.
• Authentication protected by secure, httpOnly session cookies.
• Administrative access is logged and reviewed.

5. API keys

API access uses scoped keys that you can rotate or revoke at any time from your dashboard. Treat keys like passwords — never embed them in client-side code or public repositories.

6. Infrastructure

We run on reputable cloud infrastructure with isolated environments and regular patching. Sub-processors are bound by data-protection terms; see our DPA.

7. Vulnerability disclosure

We welcome responsible disclosure. If you believe you've found a security vulnerability, email security@emaillabs.iowith details and steps to reproduce. Please give us reasonable time to investigate and fix before public disclosure, and avoid accessing or modifying data that isn't yours.

8. Incident response

We monitor our systems and maintain an incident-response process. If a security incident affects your data, we'll notify you and the relevant authorities as required by law and without undue delay.

9. Contact

Security questions or reports: security@emaillabs.io. For privacy matters, see our Privacy Policy.