Security Trust Center
Security Trust Center Updates
PHP2Shell Vulnerability
Company's statement regarding the critical PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619):
Our customer platform does not run on PHP, so it is not affected by these vulnerabilities.
We do run a small number of third-party applications that use PHP. Those have been updated to the patched PHP versions, and we confirmed this with a follow-up assessment. In addition to patching, we have further security measures in place through our web application firewall (WAF).
We're continuing to monitor the situation.
ZeroBounce adds a new sub-processor: Anthropic
Hello ZeroBounce customer,
In the Data Processing Agreement, we commit to notifying you before any new third-party subprocessor starts processing applicable data. We are sending this message because we are making updates to our current list of subprocessors on July 1st, 2026. No additional action is required from you.
Anthropic will help us generate analytical insights and improve our user experience.
This new third-party subprocessor has been verified to ensure it meets ZeroBounce's security and privacy standards. We have put in place a contract that meets the requirements of the ZeroBounce Data Processing Agreement (DPA) terms.
You can also view the full list of ZeroBounce's subprocessors here:
https://www.zerobounce.net/docs/about-zerobounce/subprocessors-and-service-providers
https://trust.zerobounce.net/item/subprocessors
If you have any questions, please feel free to reach out.
Sincerely,
The Compliance Team
Hello ZeroBounce customer,
In the Data Processing Agreement, we commit to notifying you before any new third-party subprocessor starts processing applicable data. We are sending this message because we are making updates to our current list of subprocessors on July 1st, 2026. No additional action is required from you.
Anthropic will help us generate analytical insights and improve our user experience.
This new third-party subprocessor has been verified to ensure it meets ZeroBounce's security and privacy standards. We have put in place a contract that meets the requirements of the ZeroBounce Data Processing Agreement (DPA) terms.
You can also view the full list of ZeroBounce's subprocessors here:
https://www.zerobounce.net/docs/about-zerobounce/subprocessors-and-service-providers
https://trust.zerobounce.net/item/subprocessors
If you have any questions, please feel free to reach out.
Sincerely,
The Compliance Team
ZeroBounce is an email validation, deliverability, and email finding platform helping 650,000+ customers reduce bounces and land their emails in the inbox.
Through its 99.6% accurate email validation service on most domains (96%+ on AOL / Yahoo / Office 365), ZeroBounce helps email senders ensure the data they use is up-to-date, so they can reach their customers and prospects successfully – in the inbox.
To further help senders arrive in the inbox, ZeroBounce also offers a mail server tester, an inbox placement tester, and a blacklist monitor. Companies can also use ZeroBounce's email authentication tools to comply with the industry's sending rules and ZeroBounce's email finder to connect with business professionals around the world.
ZeroBounce operates a top tier security infrastructure.
It is ISO/IEC 27001:2022 certified, SOC 2 Type 2 audited, HIPAA-ready (BAA available), GDPR-aligned, and an active participant in the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks.
Security presentation: https://www.zerobounce.net/security/
Privacy Policy: https://www.zerobounce.net/privacy-policy/
Terms: https://www.zerobounce.net/terms-of-use/
GDPR: https://www.zerobounce.net/gdpr.html
DPA: https://www.zerobounce.net/docs/about-zerobounce/data-processing-agreement/
Unilever
Strava
LinkedIn
Coca-Cola
Intel
HubSpot
Sephora
Amazon
Netflix
Airbnb
Samsung
