Frequently asked questions
Where your data goes, how checks work, and how billing works. Can't find an answer? Email support@validitool.com.
Where Validitool and its services run
Every place your data is stored or handled, and every registry a check is sent to. Choose a location for details, or show the whole world to see the rest.
Frankfurt, Germany
- Your account and check dataYour data
Your account and login, check history, certificate records, monitoring lists, webhooks and bulk uploads are stored here, encrypted, with encrypted backups. Sanctions screening runs here too.
- GLEIFRegistry
The global LEI index, for LEI lookups.
Everywhere
Not tied to one place.
- Website and APIYour data
Served from a worldwide network: each request is handled at the data centre nearest the person making it, in more than 300 cities. Page visits are counted without cookies.
- PaymentsYour data
Card details, invoices and tax are handled by our payment provider, the merchant of record named on your invoice. Validitool never sees or stores card details.
- Domain registriesRegistry
Email domain checks look up only the domain (never the full address) with the registry responsible for that domain.
All locations as a list
- Your account and check dataYour data
Your account and login, check history, certificate records, monitoring lists, webhooks and bulk uploads are stored here, encrypted, with encrypted backups. Sanctions screening runs here too.
- GLEIFRegistry
The global LEI index, for LEI lookups.
- European CommissionRegistry
VIES for EU VAT numbers (which asks the member state's own tax database), the EU EORI service, and the EU sanctions list.
- UK governmentRegistry
HMRC for UK EORI numbers, Companies House for UK company lookups, and the UK sanctions list (FCDO).
- Peppol DirectoryRegistry
Peppol e-invoicing registrations.
- Swiss UID registerRegistry
Swiss company and VAT (MWST/TVA/IVA) numbers.
- Brønnøysund Register CentreRegistry
Norwegian organisation and VAT (MVA) numbers.
- Alert emailsYour data
Monitoring and security alert emails are sent from here: your email address and the alert itself pass through.
- US Treasury (OFAC)Registry
The US sanctions list (Washington, D.C.).
- United NationsRegistry
The UN Security Council sanctions list (New York).
- Emails you send usYour data
Emails to our support, privacy and billing addresses are stored here.
About Validitool
What is Validitool?
A service for checking business counterparties: EU VAT and EORI numbers against the official registries, company names against the EU, UN, UK and US sanctions lists, supplier email domains for fraud signals, plus Peppol, LEI, IBAN and company register lookups. It works on the website, in a dashboard with bulk uploads and monitoring, and through a JSON API, with a PDF certificate for every VAT, EORI and company check.
Checks and results
Where do the results come from?
From official sources at the moment you check: the European Commission's VIES (which asks the member state's own tax database) for EU VAT numbers, the EU EORI service and HMRC for EORI numbers, and the sanctions lists published by the EU, the UN Security Council, the UK government and the US Treasury, refreshed daily. VAT and EORI answers are cached for 24 hours.
What happens when VIES or a member state is down?
You get a clear "could not check" answer, never "invalid", and you can try again; bulk upload rows can be re-checked for free. On the Scale plan, API requests can opt in to the last successful answer (up to 30 days old), clearly marked as stale.
Live VIES status →Why is there no company name for some countries?
Some member states, including Germany and Spain, confirm through VIES whether a number is valid but do not return the name or address. Validitool shows exactly what the registry returns and never guesses.
Can I check UK VAT numbers?
No. UK (GB) VAT numbers aren't in VIES since Brexit, and Validitool doesn't currently check them. UK EORI numbers are checked with HMRC, and Northern Ireland XI VAT numbers are checked through VIES.
What does a sanctions "potential match" mean?
A name is similar to a person or company on a sanctions list. It is not a finding that the company is sanctioned: compare the list entry (country, addresses, registration numbers) with what you know before deciding, and take advice if it may be a true match.
Can I check a whole list at once?
Yes, on the Growth and Scale plans: upload a CSV of up to 5,000 numbers in the dashboard (optionally with sanctions screening) and download the results as a spreadsheet, or use the batch API.
Bulk checks in the docs →Can Validitool tell me when a customer’s VAT number stops being valid?
Yes. Monitoring re-checks the numbers on your list and alerts you by email or signed webhook when one changes status, and screens the companies against sanctions lists whenever a list is updated. Monitoring is on paid plans (up to 2,500 numbers on Scale).
Your data and security
Where is my data stored?
Your account, check history, monitoring lists and bulk uploads are stored in Frankfurt, Germany, encrypted. The website and API are served from a worldwide network, from the data centre nearest each visitor. Alert emails are sent from the eastern United States, and emails you send to our support addresses are stored in the United States. The map above shows every location, including the registries each check is sent to.
Is my data encrypted?
Yes. Everything travels over HTTPS, and the database and its backups are encrypted at rest. API keys and passwords are stored only as one-way hashes, so even Validitool cannot read them, and payment card details go to our payment provider, never to Validitool.
Who can see my data?
Only your account and the teammates you invite: each account's data is kept apart by row-level security in the database. We reach it only for support and administration. The registries you check receive only the number or name being checked.
How long is data kept?
Check history is kept while your account exists. Bulk uploads and their results are deleted after 90 days (or when you delete them), cached registry answers after 30 days, and sanctions alert records after a year.
Retention in the Privacy Policy →Can I download or delete my data?
Yes, yourself, from the dashboard: "Download my data" gives you everything stored under your login as a JSON file, and "Delete account" permanently deletes your login and all your data at once (and cancels any subscription).
Do you use cookies or tracking?
Only the cookies that keep you signed in. Website visits are counted without cookies, there is no advertising or cross-site tracking, and your data is never sold.
How do I report a security issue?
Email support@validitool.com with the subject "Security". Security reports are read promptly; if your data was affected, we tell you and the relevant authorities within the legal deadlines.
How do I make a data protection request?
Email privacy@validitool.com. We reply within one month.
Plans and billing
Is there a free plan?
Yes: 50 API requests a month, no card needed. The free checkers on the website allow 3 checks a day without an account and have no daily limit once you sign in. Paid plans start at $9 a month.
Pricing →Who charges me, and can I get a VAT invoice?
Payments are handled by Paddle, the merchant of record: Paddle is the seller on your invoice, charges any VAT or sales tax due, and issues invoices you can download. Business customers can add their VAT number at checkout.
Can I cancel at any time?
Yes, from the billing portal in your dashboard. Your plan stays active until the end of the period you have paid for and then is not renewed.
Can I get a refund?
First-time subscribers can ask for a full refund within 14 days of their first payment: email billing@validitool.com or support@validitool.com.
Refund Policy →