Your data stays yours.

Every connection to Operelio is encrypted with TLS 1.2 or higher. Unencrypted requests are rejected outright. Once your data reaches our servers, it's encrypted at rest using AES-256-GCM with keys managed through AWS Key Management Service. Keys rotate on a schedule and are backed by hardware security modules.

When you connect a CRM, the OAuth tokens and API credentials are encrypted separately from your account data. They're never logged, never shown in the UI after initial setup, and revoked the moment you disconnect.

Uploaded files are stored in isolated S3 buckets with server-side encryption. File retention depends on your plan: 24 hours on Free, 30 days on Pro and Team, and 90 days on Agency. After the retention window, files are permanently deleted.

Billing is handled entirely by Stripe, a PCI Level 1 certified payment provider. Card details are entered directly into Stripe's secure forms, tokenised, and never transmitted through or stored on our servers. The only payment information we receive is the card type, last four digits, and expiry date.

Your spreadsheets, CRM credentials, and processing history are yours. We will never sell, rent, or share your data with advertisers or third parties. We don't run tracking pixels or third-party analytics inside the app, and there are no external marketing tools watching what you do.

Your files will never be used to train machine learning models. We collect only the minimum data needed to run the service: your account details, the files you upload, and the processing configuration you choose. Nothing more.

Full details are in our privacy policy, which is written in plain language rather than legalese.

When you upload a file to Operelio, two questions about lawful processing apply. The first is your question: do you have a lawful basis under GDPR, UK GDPR, CCPA, or your local regime to process the personal data in that file? The second is ours: what's our role in that processing? This section explains the split.

Your basis to upload. You upload the data, so the lawful basis question starts with you. In practice that's usually consent (the contact opted in), a contractual relationship (they're a customer or a prospect at a live opportunity), or legitimate interest (you have a documented reason to process them and that reason outweighs their privacy interest). The Operelio Terms of Service require you to warrant that you have a lawful basis for every file you upload. We don't ask you to prove it, but you sign that warranty when you sign in.

Our basis to process. We process your file as your data processor under a standard Data Processing Agreement. Our lawful basis is your contract with us: you've asked us to run a specific transformation, and we run it. For the Email Verifier & Finder specifically, that processing is a quality check: we confirm whether an inbox accepts mail, using EU-based verification providers. If you ask Operelio to recover missing or failed addresses, it rebuilds them only from the email patterns already in your own file, never from an outside contact database. We don't look up an address's owner, and we never sell or rent your list. Your file stays inside your account for your plan's retention window, then it's deleted. Separately, we keep a one-way hash of each verified address alongside its verdict for 7 days, so a recent verdict can be reused instead of re-checking the same address. That record can't be turned back into an address, and it carries nothing about you or your file.

What's shared, and what never is. Your files, recovered addresses, and any send outcomes you upload stay scoped to your own workspace. One thing is shared, and it's worth being precise about: when an address has already been verified anywhere on Operelio in the last 7 days, we reuse that verdict rather than re-checking the address. That record holds a one-way hash of the address, the verdict, and the score. No name, no company, no file, no account, and it's deleted after 7 days. Your list, your columns, and your uploaded send results are never shared, and your bounce history only ever tunes your own workspace's scoring.

Where Operelio doesn't help. Verification is not a consent check. If you upload a list you scraped from the web or bought from a source with no documented consent chain, we'll happily verify which addresses accept mail. We can't tell you whether you have permission to send to them. That's on you. Every paid plan includes a Do Not Contact list you can suppress against as an additional safeguard, but even that won't replace your own basis to process.

Full details on our role as your processor are in the privacy policy and the standard DPA, which we'll send on request. Email hello@operelio.com if your legal team needs to review.

If you discover a vulnerability, email security@operelio.com with details of the issue. Please don't disclose it publicly until we've had time to investigate and patch.

We aim to acknowledge reports within 24 hours, assess severity within 48 hours, and begin remediation within five business days. Critical vulnerabilities are prioritized for immediate patching. We'll keep you updated weekly until the issue is resolved.