Last updated: July 2026
Security is foundational to VerifyBuddy. This page outlines the measures that protect your account and your data.
All traffic is encrypted in transit with TLS. Data is encrypted at rest. Sensitive fields — passwords, API keys, integration tokens and webhook secrets — are hashed or encrypted and never stored or returned in plaintext.
Our SMTP verification stops at the RCPT TO stage and never reaches the DATA command, so no message is ever delivered to the addresses you verify. We also never probe private/internal IP ranges, protecting against network-scanning misuse.
Role-based access control (OWNER / ADMIN / MEMBER / VIEWER), per-workspace isolation on every query, optional two-factor authentication, device-session management, and full audit logging of sensitive actions.
Rate limiting and abuse protection on all endpoints, signed webhooks (HMAC-SHA256), idempotent billing webhooks, automated data-retention cleanup, and continuous error monitoring.
Card payments are handled by PCI-DSS-compliant processors. VerifyBuddy never stores full card numbers.
Your data is yours. You can export or delete it at any time; account deletion triggers a full workspace erasure after a short grace period. See GDPR and Privacy Policy.
Found a vulnerability? We appreciate responsible disclosure. Email security@verifybuddy.xyz and we will respond promptly. Please do not publicly disclose issues before we have had a chance to remediate.