What we store
The addresses you check and their results, the files you upload and the results files we make from them, your account and organisation details, and records of purchases and of actions in your organisation. The privacy policy lists it all.
Card details never reach us: payments happen on Stripe's own checkout page.
Signing in
- There are no passwords to leak or reuse. You sign in with a six-digit code we email you, which expires after 10 minutes, or with Google.
- With Google, we only accept accounts whose email address Google has verified, and each sign-in carries a one-time check that it was started from our site.
- Your session is a signed token in a cookie that scripts on the page can't read, sent only over HTTPS. It expires after 12 hours.
API keys
- We store only a one-way (SHA-256) hash of each API key, plus a short hint so you can tell keys apart. We can't show a key again after it is created.
- Keys can have an expiry date, and you can deactivate or regenerate a key at any time from the dashboard.
- Every API request is checked against an active, unexpired key, and the verification endpoints are rate-limited.
Encryption
- All traffic to the website, dashboard and API uses HTTPS.
- Connections from our servers to the database and to the cache use TLS.
- Our database and file storage providers (Neon and DigitalOcean) encrypt stored data at rest.
Files and results
- Uploaded files and results files are stored privately. Downloads use signed links that expire after a few minutes.
- Files are kept in a separate location for each organisation, and jobs, files, results and API keys are only returned to members of the organisation they belong to, or to its API keys.
- Results files are protected against spreadsheet formula injection: cells that would start a formula are escaped.
Payments and webhooks
- Credit purchases go through Stripe Checkout. We keep only the amount, credits and Stripe's payment and invoice references.
- Messages from Stripe are accepted only with a valid Stripe signature.
Abuse protection
- The free tools have daily limits per visitor and use Cloudflare Turnstile to tell people from bots.
- Sign-ups from known throwaway email domains are refused.
- Domain lookups normally go through our own DNS resolver rather than a public DNS service.
Access
Only the small team that runs SimpleCold has access to production systems, and only to operate and support the service. Administrative tools sit behind their own sign-in. We don't look at the contents of your lists except to fix a problem you have reported or when the law requires it.
How long we keep it
We don't delete data automatically yet. Files, results and account data are kept while your account exists, and deleted within 30 days when you ask at [email protected]. Sign-in codes last 10 minutes and sessions 12 hours.
What we don't claim
- SimpleCold is not SOC 2 or ISO 27001 certified.
- We don't offer two-factor sign-in yet. Your email inbox, or your Google account, is what protects your SimpleCold login, so secure it well.
- We'll add to this page when that changes, not before.
Reporting a problem
If you find a security issue, email [email protected] with the steps to reproduce it. We read every report and reply. Please give us a reasonable time to fix it before telling anyone else.
While you look: only test against accounts you own, don't access or change other people's data, and don't run denial-of-service or spam tests. If you follow these rules in good faith, we won't take action against you for your research.