Security

ClearMX is built and run by a small team, and this page describes what that actually means rather than what a compliance page usually implies. Everything below is a description of the running system. Where we do not have something, it says so.

Where it runs

• Application servers and the database are hosted in the European Union — Hetzner, Helsinki, Finland.
• All traffic to clearmx.app is served over HTTPS; the site sends HSTS and redirects plain HTTP.
• Backups are encrypted at rest and stay within the EU.

What happens to the addresses you verify

• We never send mail to an address you are verifying. The SMTP probe opens a conversation with the receiving mail server and stops before any message is delivered — a list of real customers can be checked with none of them noticing. The full method is on the methodology page.
• Anonymous lookups through the free tools are not stored — no address, no result.
• Addresses verified inside an account are stored so you can filter, export and re-check them. You can delete an import, which deletes its rows.
• We do not sell, rent or share verification data, and we do not use one customer's list to build a product for another.

Access and accounts

• Passwords are stored as bcrypt hashes; we never see or store the plaintext.
• Two-factor authentication is available on accounts that enable it.
• API tokens are stored as SHA-256 digests and shown once at creation. Revoking a token takes effect immediately and keeps its usage history.
• Every record is scoped to a team; a request that resolves to no team you belong to is refused rather than falling back to another.

Payments

Card details never reach our servers. Checkout is handled entirely by Stripe, and credits are granted by a verified Stripe webhook — idempotently, so a retried delivery cannot grant twice. We store a customer id and the invoice metadata, never a card number.

What we do not claim

We hold no SOC 2, ISO 27001 or equivalent certification, and we do not publish an uptime SLA. We are a small team and would rather say that plainly than imply an audit that has not happened. If your procurement requires certification today, a larger vendor is the right answer, and the comparison page says so too.

Data processing and sub-processors

The third parties that can touch data on our behalf are listed, with what each one does and where it runs, on the sub-processors page. A data processing agreement is available on request — email support@clearmx.app.

Reporting a vulnerability

Email support@clearmx.app with steps to reproduce. We will confirm receipt and tell you what we found. We do not run a paid bounty programme, and we will not pursue you for a good-faith report that avoids privacy violations, data destruction and service degradation.