--- title: "Refresh List Trust Center | Security, Privacy & Data Handling" description: "Review Refresh List security controls, data lifecycle, payment boundaries, verification limitations, and privacy choices." url: https://refreshlist.net/trust last_updated: 2026-10-09 --- [Refresh List](/) › Trust center EVIDENCE REGISTER / TRUST CENTER # Trust should be inspectable. Refresh List documents what the product does, which controls are implemented, and the boundaries customers should understand before using the service. No certification, accuracy guarantee, or security promise is implied beyond the evidence shown here. Last reviewed 9 October 2026 · Read the limitations beside every control. THE SHORT ANSWER ## What does the Refresh List trust center cover? It covers account access, administrator boundaries, encrypted provider credentials, payment boundaries, list lifecycle, verification limits, and privacy choices. It is a plain-language evidence register—not a badge wall. CURRENT RELEASE Public service boundaries Refresh List explains what is available, what is protected, and which limitations customers should consider before uploading data. SECURITY RULE Never compromise platform security. When evidence is missing, Refresh List labels the gap instead of filling it with a claim. 01 / CONTROL REGISTER ## Implemented controls, stated precisely. ### Server-enforced access Account access is scoped to the signed-in workspace, with separate permissions for operational tasks. [Read security controls](/security) ### Encrypted provider credentials Sensitive provider credentials are protected and are not rendered into the browser interface. [Review the security boundary](/security) ### Signed payment events Stripe and Cashfree webhook signatures are checked before a payment can settle credits. Duplicate events are idempotent. [See billing rules](/pricing) ### Evidence-first results Valid, invalid, and unknown remain distinct. Unknown is not converted into a confident-looking score, and no independent accuracy benchmark is claimed. [Read the methodology](/verification-methodology) 02 / DATA LIFECYCLE ## Your list has boundaries. Refresh List uses uploaded content to inspect records, map duplicates, send eligible addresses to the configured verification provider, and produce categorized reports. - Original non-email columns stay in Refresh List storage for row-preserving exports. - Eligible email addresses may be sent to the configured provider. - Delete stored files is available after processing stops or completes. - Provider-side retention is separate from Refresh List deletion. [Read the full data lifecycle](/data-handling) RETENTION NOTE Scheduled cleanup eligibility Files can be removed after processing stops or completes, and provider-side retention is separate. Review the privacy policy and provider terms before uploading sensitive data. [Read privacy information](/policies/privacy) 03 / PAYMENT BOUNDARY ## Checkout is separated from card data. Refresh List sends the customer to the configured payment gateway. The app records the order, provider reference, credit amount, and reconciliation state needed to deliver the purchased balance. No card number stored by Refresh List Signed webhooks before settlement Test and live balances kept separate WHAT WE DO NOT CLAIM ## Trust is not a shortcut around evidence. Refresh List does not claim SOC 2, ISO 27001, an independent penetration test, a security SLA, a comprehensive disposable-domain dataset, or a universal delivery guarantee. Those statements remain intentionally absent until independently verified and approved for publication. [Read the operating terms](/policies/terms) 04 / BEFORE YOU UPLOAD ## A responsible customer checklist. 01 Confirm authorization Only upload data your organization is authorized to process. 02 Review the provider Understand where eligible addresses go and which provider terms apply. 03 Limit access Protect workspace credentials and revoke exposed API keys promptly. 04 Delete after use Download the required reports, then remove stored files when processing is complete. COMMON QUESTIONS ## Trust questions, answered. Is Refresh List SOC 2, ISO 27001, or GDPR certified?+ Refresh List does not claim SOC 2, ISO 27001, independent penetration-test, or blanket certification status. The trust center describes the controls and boundaries customers can review, alongside applicable legal obligations. How are administrator permissions protected?+ Administrator actions are server-enforced and separated from normal customer workspace access. Opening an admin URL does not grant administrator privileges. Are payment card numbers stored by Refresh List?+ No. Checkout is handled by the configured payment gateway. Refresh List stores payment references and credit records needed to reconcile an order, not the customer card number. How long are uploaded lists retained?+ Uploaded drafts and completed, partial and failed lists become eligible for scheduled deletion 30 days after upload or their last update. Download results before then. Provider-side retention is separate and governed by the applicable provider terms. What should I verify before uploading sensitive data?+ Confirm that you are authorized to process the list, review the provider terms, check the retention controls, use least-privilege access, and delete stored files when processing is complete. READ THE EVIDENCE ## NO BADGES. JUST BOUNDARIES. [OPEN SECURITY PAGE](/security) Privacy information · Data handling · Methodology · Support ## Sitemap - [All Public Pages](https://refreshlist.net/sitemap.md) - [Email Glossary](https://refreshlist.net/glossary) - [Read This Page And Use Interactive Features](https://refreshlist.net/trust)