Security

filtrat.io processes email addresses on behalf of B2B teams. We treat every address as personal data and protect it accordingly. This page describes what we do — honestly and specifically.

Encryption in transit

All connections to filtrat.io use TLS (HTTPS). API requests, dashboard sessions, and webhook callbacks are encrypted end-to-end. We enforce HSTS and do not support plaintext HTTP.

Encryption at rest

Sensitive data stored in our databases — including account credentials, API key hashes, and verification results — is encrypted at rest using AES-256 or equivalent.

Credential handling

Passwords are hashed using industry-standard algorithms (bcrypt). API keys are stored as cryptographic hashes — the raw key is shown once at creation and never stored or logged. OAuth tokens are managed by our authentication provider (SuperTokens) and are never accessible to our application code.

Access controls

Access to production systems and databases is restricted to authorised personnel on a strict need-to-know basis. We do not grant blanket access to engineering staff. Administrative actions are logged.

Data retention and deletion

Email addresses submitted for verification are cached per account for a maximum of 180 days, then automatically and permanently deleted. Users can clear their cached results at any time from account settings. API keys are deleted immediately upon revocation. Server logs are retained for 90 days. Full retention schedule is documented in our Privacy Policy.

Breach notification

In the event of a personal data breach likely to affect your rights, we notify the Polish supervisory authority (UODO) within 72 hours and affected users without undue delay, as required by GDPR Articles 33 and 34. Notifications are sent to the email address on your account.

Payment security

All payment processing is handled by Stripe, Inc. We never store, process, or have access to full card numbers. Stripe is PCI DSS Level 1 certified — the highest level of payment security certification.

Sub-processors

We share data only with the services required to operate filtrat.io. Each is bound by contractual data protection obligations. The full list with transfer mechanisms is maintained in our Privacy Policy and Data Processing Agreement.

What we don’t do

We do not sell personal data
We do not share verified email addresses with other customers or third parties
We do not use submitted addresses for any purpose other than returning verification results
We do not use marketing pixels, retargeting cookies, or cross-site tracking
We do not retain verification data beyond 180 days

Certifications

We do not currently hold SOC 2 or ISO 27001 certification. We are a small team and will pursue formal certification as we scale. In the meantime, we are transparent about what we do and how we do it. If your security review process requires specific documentation, contact us and we will provide what we can.

Report a security issue

If you discover a vulnerability or suspect a security incident, contact us at [email protected]. We appreciate responsible disclosure and will respond within one business day.