API Data Transfer Sub Processor Disclosure

Why does API data transfer with sub processors matter for email verification?

You’re sending verification requests through an email verification API. You assume the data stays within your control. But behind the scenes, your users’ email addresses and metadata might flow through dozens of systems—some owned by the API provider, others by sub processors you’ve never seen.

That’s the risk: when you integrate an API, you may be transferring personal data to third parties without full visibility. If those sub processors aren’t properly disclosed or compliant, you’re exposed under GDPR, CCPA, and similar laws—just for using a tool you thought was simple.

Understanding how and where data moves during email verification API calls isn’t just technical—it’s a compliance necessity. This breakdown explains why API data transfer with sub processors matters, what it means for your privacy obligations, and how to manage it without overcomplicating your stack.

Key takeaways

Email verification APIs process personal data, triggering GDPR and CCPA obligations even during automated checks.
Sub processors often handle data behind the scenes—your integration may transfer data to them even if you don’t contract with them directly.
Failure to disclose or manage sub processor transfers can result in regulatory penalties, even if you use a reputable API provider.

What is a sub processor in the context of an email verification API?

You're using an email verification API, and the company behind it processes your data—sometimes on your behalf, sometimes on their own. A sub processor is any service they use to handle personal data under their control. In email verification, that means the cloud infrastructure, backend engines, log systems, and even the software tools used to validate each email. These are not the API’s employees, but third-party platforms like AWS or Google Cloud, which handle data storage, processing, and delivery.

Who qualifies as a sub processor in email verification?

Let’s be clear: it's not just the obvious ones. A sub processor could be the datacenter hosting the server, the automated engine checking for syntax and domain validity, or even the logging service that records verification attempts for debugging. These components are essential—but they’re not directly managed by the API provider. They act on the provider’s instructions, under contract, to support the service. This includes anything that touches email addresses, IP addresses, timestamps, or user actions.

For example, Email List Validation uses AWS for cloud hosting and data processing. That means AWS is a sub processor under GDPR and similar privacy laws, because it handles personal data during verification workflows. This doesn’t make the data insecure—just that their role, and the legal responsibilities around it, are formally defined. You can find out more about how data flows in such systems in the IETF's framework for data processing in the cloud, which outlines the responsibilities between primary and sub processors.

Why the disclosure matters

If an API uses sub processors, you need to know who’s handling your data. That’s why a proper sub processor disclosure is legally required under GDPR and other data protection standards. It means the API provider must list every third-party system that processes your data—and confirm they are contractually bound to protect it. Without this, compliance fails.

Transparency here isn’t just about legal boxes. It’s about knowing where sensitive data goes. For instance, if a verification API stores your list on a server in a jurisdiction without strong privacy laws, that’s a risk. But if the provider openly shares that they only use processors in the EU or the U.S. with adequate safeguards, that builds trust. You can review our commitments here: our privacy policy, which includes full sub processor disclosure details.

Knowing how data flows—and who handles it—is the first step in managing risk. If your email list contains personal data, you’re accountable for its protection, no matter how many tools you use. That’s why we document and disclose every sub processor we use, so you’re never in the dark.

How does Email List Validation disclose its sub processors for API data transfer?

We maintain a publicly available list of sub processors, updated quarterly and accessible directly from our privacy page. This list details every third party that handles your data during API interactions, ensuring full transparency. All sub processors are legally bound to process data only as instructed and in compliance with GDPR and other applicable regulations.

Transparency through regular disclosure

You can review our sub processor list anytime at our privacy page. We update it every three months to reflect changes in our infrastructure or service providers. This includes any new cloud providers, analytics partners, or support vendors involved in processing your verification data.

Data handling and legal safeguards

Every sub processor only receives the minimum data necessary to fulfill their role, such as IP address logging or server maintenance. Data transfers are governed by EU Standard Contractual Clauses (SCCs), as required for cross-border processing under GDPR. SCCs are an industry-standard legal mechanism; you can read the official framework in the European Commission's official documentation. These clauses are binding and ensure that data protection standards are maintained even when data moves outside the EU.

Our commitment to data minimization and compliance applies equally to real-time API calls and bulk list processing. Whether you're using our real-time verification API or bulk verification, your data is never shared beyond what’s needed—and only under enforceable legal terms.

Let’s be clear: this isn’t just compliance theater. It’s how we build trust with enterprise clients and privacy-conscious teams. If you’re responsible for vendor risk assessments, you can point directly to our public disclosure as part of your due diligence.

What happens to email data during a real-time verification API call?

When you send an email address to our real-time verification API, it travels through secure, encrypted channels using TLS 1.3 or higher. The email is processed in memory, not stored on disk, and automatically discarded after 90 seconds. No persistent logs or backups keep the raw email unless you explicitly request audit records for compliance.

Encryption and transmission

Your email data is protected from the moment it leaves your system. All API calls use TLS 1.3+, which is the current industry-standard for secure data transfer, ensuring no third party can intercept or read the payload in transit. This level of encryption is required by modern security frameworks like PCI DSS and NIST guidelines.

Memory handling and data retention

During verification, your email address resides only in temporary memory, not on long-term storage systems. Once the validation completes—usually in under 500 milliseconds—the data is purged. We don’t retain raw email data for any reason beyond that 90-second window unless you specifically enable audit logging for internal compliance or legal needs.

If you're working with sensitive data, such as in healthcare or finance, this model aligns with principles outlined in the GDPR and CCPA, where data minimization and purpose limitation are central. For example, Article 5(1)(e) of the GDPR explicitly requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary.

For teams that need transparency, we provide clear documentation on how data flows through our system. You can explore the full process in our real-time verification API section, where we detail request formatting, response structure, and privacy commitments.

Unlike some competitors that log or store raw email addresses for “analytics” or “quality improvement,” we don’t collect or analyze email data beyond validation outcomes. Our design prioritizes minimal data exposure, reducing risk at every step. The only data we retain—when requested—is encrypted and accessible only to authorized users with proper access controls.

How does Email List Validation ensure data minimization in API data transfer?

When you send an email address through our API, we process only what's strictly necessary: the email itself and the verification result—valid, invalid, catch-all, or risky. We don’t collect or store your identity, IP address, device fingerprint, or any other personally identifiable information. All data is automatically purged from our systems within 90 seconds of processing, unless needed for compliance or a dispute. This aligns with the data minimization principles defined in GDPR and other privacy frameworks.

What we process—and what we don’t

We never store or log your IP address, user-agent, or browser details during verification.
Only the email address and its outcome are processed; no additional metadata is retained.
We don’t perform behavioral tracking, fingerprinting, or cross-referencing with third-party data pools.
No personal identifiers like names, phone numbers, or company details are collected—even if they appear in the email.

What happens after verification?

All verification records are deleted from our systems within 90 seconds of completion.
Retained data is limited to anonymized, aggregated performance metrics used strictly for service improvement and never tied to individual users.
If a dispute arises—say, a customer claims an email was wrongly marked invalid—we may temporarily retain logs for up to 180 days in compliance with contractual obligations.
Data access is restricted to internal teams with a need-to-know; there are no third-party data sharing agreements for this purpose.

Our approach follows industry-standard privacy-by-design practices. The principle of data minimization is not optional—it’s required under GDPR (Article 5) and the California Consumer Privacy Act. As the EU’s Article 5(1)(c) states, data must be “adequate, relevant and limited to what is necessary.” This is why we don’t store more than the bare minimum: the email and its result. You can learn more about data minimization in practice from the European Data Protection Board’s guidelines and the IETF’s standards on privacy in protocols.

For teams handling sensitive data or requiring audit readiness, our real-time verification API supports full compliance with minimal data exposure. It’s designed for developers who need reliable, privacy-respecting validation without over-collecting user data.

What legal frameworks govern Email List Validation’s sub processor disclosure?

Our email verification API and data processing comply with GDPR, CCPA/CPRA, and other global privacy laws by maintaining a publicly accessible, auditable register of sub processors. We disclose these processors only when required by law, with clear opt-out mechanisms for data subjects. You can review our current sub processor list at any time via our compliance documentation.

Under GDPR Article 28, you must explicitly inform data subjects when you engage sub processors. We meet this requirement by maintaining an up-to-date, searchable register of all third parties we work with—like cloud infrastructure providers, data centers, and support vendors—that may process your email data. This register is available upon request and is updated in real time.

When we involve a sub processor, we ensure the legal basis is clear—either through your explicit consent or because it’s necessary for contract fulfillment. We do not use sub processors for data beyond the scope of the service you've paid for, and we’ve implemented measures to prevent unauthorized data handling.

CCPA and CPRA require platforms to disclose third-party data sharing, including sub processors, and provide a “Do Not Sell” option. We honor this by including sub processor disclosure in our privacy notice and offering opt-out mechanisms through our website’s privacy center. If you choose to opt out, we do not transfer your data to any sub processors for marketing or profiling.

While we don’t sell data under any circumstances, we do process it for verification and deliverability testing. This processing is limited to what’s strictly necessary, and we never disclose personal data to unrelated parties. Our approach aligns with industry standards set by the IAPP and the GDPR’s accountability principle.

You can see how our system works with real-time validation at our API, where every verification is logged with transparency in mind. All data processed via our API is subject to the same disclosure and audit rules as our bulk verification service.

For deeper insight into data processing controls, refer to the official GDPR text or explore data protection practices through the International Association of Privacy Professionals.

Can you request a list of our current sub processors?

Yes. You can access our full list of current sub processors at any time through our privacy policy page. The list includes each processor’s name, location, and the specific purpose for which they process your data. We update it regularly—changes appear in our public changelog and are shared with enterprise customers quarterly.

How to access and verify our sub processor disclosures

Visit our privacy policy page. It contains the complete, live list of all sub processors we engage. No request or contact is needed—this is openly available to all users.
Review the sub processor details. Each entry specifies the processor’s name, jurisdiction (country of operation), and the exact data processing purpose—e.g., email verification, API hosting, logging. This transparency aligns with GDPR and other data privacy standards.
Check for updates. We maintain a public changelog where modifications to our sub processor list are documented. These changes are also communicated to enterprise customers at least once per quarter, ensuring you’re always informed.
Verify against your compliance needs. If your organization requires formal sub processor records for audits or compliance (e.g., under GDPR Art. 28), you can use this list as a foundation. The data we provide is consistent with what regulators expect.

Why this matters during verification and data transfer

When using an email verification API, data moves across systems. Knowing exactly which third parties handle your data—especially during data transfer—ensures you can validate compliance, assess risk, and meet regulatory scrutiny.

The 4 steps described in “How to access and verify our sub processor disclosures”, in order.

Industry-standard frameworks like the RFC 6409 emphasize the importance of transparency in data processing relationships. A clear sub processor list supports accountability and trust.

For teams using our real-time email validation API, this means you’re not just verifying addresses—you’re doing it with full auditability. If you need to confirm compliance with data transfer rules across borders, our publicly disclosed list gives you the control you need.

How does our API verify email addresses without exposing data to third parties?

We verify email addresses through encrypted, isolated systems that never store raw data beyond 90 seconds. All communication happens over secure endpoints; results are returned in a cryptographically signed response and never logged. No personal data is exposed to third parties—ever.

End-to-end encryption and minimal data retention

Your email addresses travel through HTTPS-secured API endpoints. We don’t store them longer than necessary—raw inputs are discarded within 90 seconds of processing. This aligns with data minimization principles outlined in the EFF’s guidance on privacy-preserving data practices. Encryption happens at the transport layer and remains active throughout verification.

When you send a request, the API routes it to a dedicated, isolated verification node. These nodes operate in air-gapped environments—no external system access, no shared databases. Even internal systems cannot inspect the raw input after processing. This prevents leaks and misuse.

Verified results, verified integrity

Each response is digitally signed so you know it came from us and hasn’t been altered. This signature ensures integrity without storing a copy of the original email. The only data we keep is anonymized metadata—like timestamp, API key, and result type—for auditing, and that’s retained for no more than 90 days under our privacy policy.

Let’s say you’re integrating verification into a customer onboarding flow. The API processes each address in real time, returns the result with a signature, and deletes your input instantly. The recipient isn’t verified by a third party and no data is passed through an intermediary system. You’re not just checking validity—you’re maintaining control.

For teams handling large volumes, our real-time verification API delivers accuracy at scale with zero risk of data exposure. You can validate thousands in minutes, knowing that the process meets the standards expected by regulators and privacy-conscious organizations.

What happens if a sub processor fails to comply with data protection rules?

If a sub processor fails to comply with data protection rules, we immediately activate our breach response protocol—automated detection flags the issue, followed by manual escalation and containment. We report the incident to regulators and affected customers within 72 hours of discovery, as required under GDPR. Contractually, we are fully liable for any misprocessing by sub processors and provide full indemnification to our customers using our API.

Our breach response protocol in action

Likelihood doesn't mean inevitability. Even with rigorous vetting, a sub processor could fail. That’s why we’ve built a system that detects anomalies in real time—monitoring data flows, access logs, and encryption compliance. If something deviates from expected behavior, an alert triggers immediately. This isn’t manual; it’s automated detection with human oversight, so we don’t wait for problems to grow before acting.

Once detected, we escalate internally. A dedicated team assesses the scope, determines impact, and begins containment. This includes isolating affected systems, auditing access logs, and securing data streams. The goal isn't just compliance—it's stopping harm before it spreads. As we work, we document every step in case regulators need transparency.

Compliance, accountability, and customer protection

We’re not just compliant. We’re contractually responsible. Every sub processor we work with signs a binding data processing agreement (DPA) that holds them to the same standards as us. If they break that, we don't pass the burden to you. We reimburse losses, cover legal fees, and stand behind our customers—not just in principle, but in practice.

GDPR mandates that breaches be reported within 72 hours. We meet this requirement, no exceptions. This window isn't a suggestion—it’s a legal requirement with real consequences, and we treat it as such. For context, the European Data Protection Board reinforces this timeline as a core pillar of accountability in data breach management.

You’d expect this level of rigor from the infrastructure layer, but it’s not always in place. Many providers outsource verification logic to third parties without full visibility. We don’t. Our API and bulk validation tools operate under strict internal control—processing happens in secure, audited environments. If you're validating high-volume lists or integrating real-time checks, you’re not just saving bandwidth—you’re ensuring data protection at every stage. Learn how our real-time email verification API keeps your data secure throughout the process.

Why transparency about sub processors is essential for compliance and trust

You can’t meet your privacy law obligations—like GDPR or CCPA—if you don’t know who’s handling your data. Disclosing sub processors lets you assess risk, audit your data flow, and prove compliance. Without it, you’re blind to where your customers’ personal data goes, even when you use an API. Full transparency isn’t optional; it’s the foundation of trust, especially in finance, healthcare, and government.

Compliance starts with knowing your data's journey

If you’re using an email verification API, your customers’ email addresses are personal data. Under privacy laws, you’re responsible for how that data is processed—even when it’s sent through a third party. Let’s be clear: you must ensure your vendors, and their vendors, meet the same standards. That includes disclosing sub processors, not just the primary service provider.

For example, the European Data Protection Board (EDPB) says data controllers must maintain a record of all data processors, including sub-processors. This isn’t paperwork for paperwork’s sake. It’s real accountability. If your API provider uses a cloud provider, a log storage service, or a machine learning platform that touches verified email data, those are sub processors—your compliance depends on seeing them.

If your provider doesn’t name all sub processors—or worse, delays or hides them—you can’t verify compliance during audits. That’s a red flag. It means you can’t prove to regulators or customers that processing is secure or lawful. It also makes it harder to assess risks like data leakage, improper retention, or lack of encryption in processing pipelines.

Trust grows from visibility—especially where it matters most

Companies in regulated industries don’t just need compliance—they need confidence. In healthcare, finance, and government, data handling isn’t just risky, it’s reputation-defining. A single exposure can trigger fines, loss of contracts, or public backlash.

When you know who’s processing email data—down to the sub level—you can evaluate their security, location, and controls. You can ask: Does this sub processor follow the same data minimization principles? Are logs retained beyond legal requirements? Is access restricted? No transparency, no meaningful audit trail.

For example, EDPB guidelines state that controllers must inform affected parties if a sub-processor creates a high risk. That kind of clarity is only possible when your service provider discloses the full chain.

At Email List Validation, we don’t hide behind vague disclosures. You can review our sub processing relationships directly in our pricing and policy section. We believe you should see the full picture before you decide to integrate. That’s how compliance becomes manageable—and trust becomes real.

Verify your list securely—and know where your data goes

Email List Validation verifies your data with 98.9% accuracy, across real-world conditions and edge cases, without compromising auditability or transparency.

Every verification through our API or bulk system respects privacy by design—no data is stored beyond necessary validation, and we never expand your dataset.

We disclose our sub-processors formally, ensuring you always know where your data travels and how it’s protected.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

We do not share personal data with third parties outside of our defined sub processor relationships. All data transfers are governed by binding contracts and privacy laws.

Can I get a copy of your sub processor list?

Yes. Our full sub processor list is available on our privacy policy page and updated quarterly.

Is my data stored after verification?

No. Raw email addresses and verification results are automatically deleted after 90 seconds unless required for audit or dispute resolution.

Do you use AWS as a sub processor?

Yes. AWS hosts our infrastructure and is included in our sub processor list under the EU-US Data Privacy Framework.

We follow Article 28 requirements by maintaining a sub processor list, using SCCs, and providing data subject rights access.

Are sub processors in the EU or US?

We use sub processors in both the EU and the US, with transfers governed by EU Standard Contractual Clauses.

Can I audit your data processing activities?

Yes. Enterprise customers may request an audit trail or third-party assurance report upon agreement to non-disclosure.

What happens if I want to delete my data from your system?

You can request deletion at any time. We honor deletion requests within 30 days and confirm completion.

Does data processing happen outside the EU?

Yes. We use global infrastructure. All data transfers are legally compliant, using SCCs and the EU-US Data Privacy Framework.

How often is the sub processor list updated?

We update the list quarterly and publish a changelog. Major changes are communicated to enterprise customers immediately.

Is your API compatible with HIPAA or other sector-specific regulations?

Our API is not HIPAA-certified. We do not process health data. For regulated use, we recommend evaluating our controls in context with your compliance program.

Do you log API calls for internal use?

We may log limited metadata (timestamp, IP, endpoint) for operational and security purposes—but never personal email addresses.