Spaw is a verification API: the data you send is mostly other people's email addresses. This page states, specifically, what happens to it. It only describes measures that are in place today.
Transport
All traffic to spaw.co, including the API, the dashboard, the form widget, and the MCP server, is served over HTTPS. Plain HTTP requests are redirected.
API keys
- Secret keys (
sk_live_…) are shown once at creation and stored hashed. Spaw cannot show a secret key again; if you lose it, create a new one and revoke the old one. Revocation is immediate. - Publishable keys (
pk_…) are made for the browser and are stored and displayed in plain text by design. They can only run email lookups, only from the origins you list, and can be limited with a daily credit cap. A key can also require a Cloudflare Turnstile token per lookup, which stops scripted abuse without ever blocking a real form submission. - Rate limits. The API allows 5 requests per second per key. The browser endpoint and the free tools have their own per-visitor throttles.
- Request ids. Every response carries an
X-Request-Idheader, repeated inside the JSON body, so a support question can be matched to the exact request.
The addresses you verify
- An address is used to answer your query and for nothing else. Spaw does not sell submitted data, build shared datasets from it, or contact the addresses.
- No message is ever sent to an address you check. The mailbox check is an SMTP handshake that ends before any message data is transmitted.
- Only addresses that reach the mailbox step are sent to the mailbox verification partner. Addresses at disposable domains, typo-squat domains, and domains with no working mail server are answered from DNS and open lists alone and never leave Spaw.
- The six
@spaw.testtest addresses answer fixed verdicts and are never logged.
Retention
- Lookup history is kept for 30 days, then deleted automatically. Bulk job files follow the same window.
- Repeat-lookup markers last 7 days; they are what makes a repeat free.
- Your suppression list and bounce feedback are stored per account and stay until you remove them. Suppression entries older than 90 days are re-verified rather than trusted.
- The credit ledger is kept for the life of the account as your billing record.
- Deleting your account from the settings page removes the account, its keys, history, jobs, monitors, suppression list, and feedback.
Reporting
Report a security issue, or ask anything about how your data is handled, at [email protected].