Security & Compliance | BounceZero
CSA STAR Listed - GDPR Compliant - UK Ltd Registered

Security You Can Trust With Your Contact Data

Every email you verify with BounceZero is processed under strict security controls. Here's exactly how we handle your data.

Start Free - 100 Credits Report a Vulnerability

How We Handle Your Data

End-to-end protection from the moment your data enters our pipeline to the moment it leaves.

Data in Transit

TLS 1.3 encryption on all API connections. Your email list never travels unencrypted.

Data at Rest

AES-256 encryption. Verification results stored in EU-based infrastructure (OVHcloud, France).

Data Retention

Bulk job results kept 90 days then permanently deleted. Single-check results purged after 24 hours.

GDPR & Privacy Compliance

BounceZero Ltd is a UK registered company (No. 17153835) operating under UK GDPR. We act as a data processor when verifying your contact lists.

We do not sell, share, or use your email data for any purpose other than verification. Your data is yours - we just tell you which addresses are real.

Compliance Checklist

  • UK GDPR compliant (UK Ltd, No. 17153835)
  • EU data residency - servers in France (OVHcloud)
  • No third-party data sharing
  • Right to erasure - request via [email protected]
  • Data Processing Agreement (DPA) available on request
  • API keys are hashed - not stored in plaintext
  • Webhook signing secrets to verify payload integrity
  • CSA STAR Level 1 - publicly listed in the registry

Infrastructure Security

Multiple layers of protection across every component of our stack.

API Authentication

Bearer token auth. API keys are SHA-256 hashed in the database.

Rate Limiting

Per-endpoint rate limits prevent abuse and protect your account.

Webhook Signatures

HMAC-SHA256 signed payloads. Verify every webhook delivery.

No Plaintext Storage

Email addresses in bulk jobs are never logged to disk.

Audit Logging

All credential reveals and sensitive actions are audit-logged.

UK Company

Incorporated in England & Wales. Accountable to UK regulatory framework.

Certifications & Registries

Independently verifiable third-party registrations - not self-declared. Click any badge to verify.

CSA STAR Level 1
✓ Listed Apr 2026

Self-assessment against the CAIQ v4 questionnaire - 261 controls across 17 security domains. Publicly verifiable in the CSA STAR Registry.

View our registry entry
Google Postmaster
✓ All Green

All 8 sender compliance checks passing - domain reputation, SPF, DKIM, DMARC, spam rate, and delivery errors all verified.

View Postmaster Tools
G2
G2 Verified Vendor
✓ Listed Apr 2026

Verified vendor profile in the Email Verification and Data Quality categories on G2 - the world's largest B2B software review platform.

View our G2 profile
NVIDIA Inception Program
NVIDIA Inception
✓ Program Member

Accepted into NVIDIA's Inception Program for AI/ML startups - recognising BounceZero's use of machine learning in email deliverability intelligence.

Learn about Inception
Microsoft SNDS
✓ Registered

All probe IPs registered with Microsoft Smart Network Data Services. IP reputation monitored and clean across Outlook and Hotmail infrastructure.

Learn about SNDS

Found a Security Vulnerability?

We take security seriously. Email [email protected] and we'll respond within 48 hours.

Report to [email protected]

Legal & Policy Documents

Privacy Policy

How we collect and protect your data

Terms of Service

Rules governing use of BounceZero

Data Processing Agreement

DPA for enterprise and compliance teams

Follow BounceZero

LinkedIn
Follow us