Server-enforced access
Account access is scoped to the signed-in workspace, with separate permissions for operational tasks.
Read security controlsTrust should be inspectable.
Refresh List documents what the product does, which controls are implemented, and the boundaries customers should understand before using the service. No certification, accuracy guarantee, or security promise is implied beyond the evidence shown here.
Last reviewed 14 September 2026 · Read the limitations beside every control.THE SHORT ANSWER
What does the Refresh List trust center cover?
It covers account access, administrator boundaries, encrypted provider credentials, payment boundaries, list lifecycle, verification limits, and privacy choices. It is a plain-language evidence register—not a badge wall.
CURRENT RELEASEPublic service boundaries
Refresh List explains what is available, what is protected, and which limitations customers should consider before uploading data.
SECURITY RULENever compromise platform security.
When evidence is missing, Refresh List labels the gap instead of filling it with a claim.
01 / CONTROL REGISTER
Implemented controls, stated precisely.
Encrypted provider credentials
Sensitive provider credentials are protected and are not rendered into the browser interface.
Review the security boundarySigned payment events
Stripe and Cashfree webhook signatures are checked before a payment can settle credits. Duplicate events are idempotent.
See billing rulesEvidence-first results
Valid, invalid, and unknown remain distinct. Unknown is not converted into a confident-looking score, and no independent accuracy benchmark is claimed.
Read the methodology02 / DATA LIFECYCLE
Your list has boundaries.
Refresh List uses uploaded content to inspect records, map duplicates, send eligible addresses to the configured verification provider, and produce categorized reports.
- Original non-email columns stay in Refresh List storage for row-preserving exports.
- Eligible email addresses may be sent to the configured provider.
- Delete stored files is available after processing stops or completes.
- Provider-side retention is separate from Refresh List deletion.
RETENTION NOTEUp to 30 days intended
Files can be removed after processing stops or completes, and provider-side retention is separate. Review the privacy policy and provider terms before uploading sensitive data.
Read privacy information03 / PAYMENT BOUNDARY
Checkout is separated from card data.
Refresh List sends the customer to the configured payment gateway. The app records the order, provider reference, credit amount, and reconciliation state needed to deliver the purchased balance.
No card number stored by Refresh ListSigned webhooks before settlementTest and live balances kept separate
WHAT WE DO NOT CLAIM
Trust is not a shortcut around evidence.
Refresh List does not claim SOC 2, ISO 27001, an independent penetration test, a security SLA, a comprehensive disposable-domain dataset, or a universal delivery guarantee.
Those statements remain intentionally absent until independently verified and approved for publication.
Read the operating terms04 / BEFORE YOU UPLOAD
A responsible customer checklist.
01Confirm authorization
Only upload data your organization is authorized to process.
02Review the provider
Understand where eligible addresses go and which provider terms apply.
03Limit access
Protect workspace credentials and revoke exposed API keys promptly.
04Delete after use
Download the required reports, then remove stored files when processing is complete.
COMMON QUESTIONS
Trust questions, answered.
Is Refresh List SOC 2, ISO 27001, or GDPR certified?+
Refresh List does not claim SOC 2, ISO 27001, independent penetration-test, or blanket certification status. The trust center describes the controls and boundaries customers can review, alongside applicable legal obligations.
How are administrator permissions protected?+
Administrator actions are server-enforced and separated from normal customer workspace access. Opening an admin URL does not grant administrator privileges.
Are payment card numbers stored by Refresh List?+
No. Checkout is handled by the configured payment gateway. Refresh List stores payment references and credit records needed to reconcile an order, not the customer card number.
How long are uploaded lists retained?+
Uploaded files are retained for up to 30 days, with early deletion available after processing stops or completes. Provider-side retention is separate and governed by the applicable provider terms.
What should I verify before uploading sensitive data?+
Confirm that you are authorized to process the list, review the provider terms, check the retention controls, use least-privilege access, and delete stored files when processing is complete.
NO BADGES. JUST BOUNDARIES.
OPEN SECURITY PAGEPrivacy information · Data handling · Methodology · Support