Dievio vs ZeroBounce

Dievio 28

Hosted reading, for the REST API with the MCP server it shares a database with. No public status page was found. None is linked from the docs or the footer, https://dievio.com/status answers 404 and status.dievio.com does not resolve (0). No readable incident history, so the floor (5). No rate limit is published for the REST API or the MCP tools. The only numbers are the export cap of 10 download starts a minute per connection and 100,000 contacts a file, the OAuth timers and input bounds such as 500 LinkedIn URLs a call, and the privacy policy mentions hashed rate-limit keys without a figure (5 of 15). No 429 or Retry-After is documented, and the REST errors are 401, 402, 500 and 502 with no retry guidance; every MCP mutation takes a request_id UUID replayed when retried with identical arguments, the workflows page says never to repeat a paid lookup with a new ID and to reconcile against the job list first, and a low balance returns fewer rows rather than failing, while a retried REST search has no idempotency key and is charged again (8 of 15). No SLA. The terms (last updated 31 October 2026) say uptime is not guaranteed and the service may change at any time (0). The REST API and the 30-tool MCP server carry no beta label, though the search response documents search_id as currently null and counting as currently false, and the server is unversioned (10). 0+5+5+8+0+10 = 28.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.

Dievio 28

Closed service with no changelog, release notes or version numbers. The latest dated changes on the vendor's pages are the terms and privacy policy of 31 October 2026, which describe the agent integration, token lifetimes and export expiry, and blog posts of 21 and 30 October 2026 on API billing; the MCP server, absent from the February and May 2026 archived copies, carries no date, and the API landing pages say content reviewed May 2026 (20 of 30). No release record, so no three dated entries in 90 days; 84 dated blog posts from 29 March to 30 October 2026 are articles, not releases (0). Support is one address, support@dievio.com, with email support on Starter and priority support on Growth; no public changelog, community channel, forum or issue tracker, and the Fazier launch page's comments are from other makers (3 of 15). Not in the official MCP registry and no official SDKs (0). No packages to judge (5 of 10). 20+0+3+0+5 = 28.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.

Dievio 27

Closed service. The terms (last updated 31 October 2026) cover use, credits, connected agents, a 30-day refund and availability in about 300 words but name no legal entity, address, governing law or jurisdiction, so the contracting party is unknown (8 of 30). The privacy policy (31 October 2026) lists the categories processed, the purposes, recipients by category, the agent connection data, and the access periods (authorization requests 10 minutes, codes 5, access tokens an hour, refresh 30 days, export links 15 minutes), says lead search uses Dievio's own contact database without saying where records are collected from, lets people in the database ask for access, correction, deletion or suppression by email, keeps records for as long as needed with no periods, and agrees with the terms and the docs on credits, revocation and link expiry; no DPA was found (14 of 30). No deprecation policy or notices; the terms allow the service to change at any time, and plan allowances and API prices changed between the 20 May and 31 October 2026 copies of the pricing pages with no dated notice (0 of 20). Service providers are named by category only (hosting, databases, authentication, contact processing, analytics, email delivery, payments), with no names, locations or transfer basis (4 of 20). 8+14+0+4 = 26.

ZeroBounce 63

Closed service under terms naming Hertza L.L.C. (ZeroBounce) of Nevada; SDKs and MCP server open source (15 of 30). The data protection page says uploaded data is never kept more than 30 days, the privacy policy of 30 June 2026 keeps account data 'as long as needed', and EU and UK DPAs are published (22 of 30). An API migration page, with no dated deprecation policy (6 of 20). A sub-processor list naming each provider and the data exchanged (16 of 20). 15+22+6+16 = 59.

Dievio 56

MCP uses OAuth with the authorization code flow, PKCE S256, dynamic registration of public clients, refresh tokens of 30 days, a revocation endpoint and six scopes, revoked per connection on the dashboard; REST uses a plain API key from the dashboard as a bearer or X-API-Key header, with no documented scopes, rotation, expiry or revocation, and nothing documents a secret in a query string (25 of 30). mcp:read is the required baseline and cannot spend credits, leads:search, lists:write, leads:export and team:manage are separate consents, team:manage works for the owner only, the permissions page asks agents to confirm before deleting saved data and to invite or remove people only when asked, and the terms ask users to review filters and the maximum result count before authorising a paid operation; nothing asks for confirmation inside the server and REST keys have no least-privilege mode (16 of 20). Returned records are third-party contact data, and the permissions page says to treat names, descriptions, URLs and other field values as data rather than instructions, with no further mitigation (8 of 15). get_account reports the selected account, permissions and balances, list_search_jobs lists recent jobs, the dashboard lists and revokes each connection, and the privacy policy says operation results are kept to prevent duplicate actions; no audit log or per-call record is exposed to the operator (7 of 15). No security.txt on either host (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001 (0 of 20). 25+16+8+7+0 = 56.

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.

Dievio 63

API reading. REST responses are sized with _per_page (default 25), max_results, include_emails, include_phones, _include_raw to drop the raw object and email_status; the MCP server lists 30 tools with no toolsets or read-only subset, previews mask contact fields and limit runs 1 to 500 (18 of 25). Page-based pagination with has_more and next_page over REST, offset and limit with next_offset over MCP, 20 filters, max_results caps and column selection on exports (20). Errors are 401, 402, 500 and 502 as status codes with one-line meanings and no error body, and a balance below the page size returns fewer rows with success true, which an agent must detect from count; MCP job errors are read from get_search_job (8 of 20). request_id on every MCP mutation with replay semantics, asynchronous searches polled by job id, save_search_results deduplicated by list, job and position, and only queued jobs cancellable; the REST search has no idempotency key and a repeat is charged, and readOnlyHint and destructiveHint are not documented (10 of 20). Every filter is optional with defaults for page size and max_results, and the MCP tools need only filters and a request_id; no official SDK or CLI, only a third-party MIT OpenClaw skill and an n8n template on GitHub (7 of 15). 18+20+8+10+7 = 63.

ZeroBounce 69

A compact JSON result per address, batch validation and a file API for lists (18 of 25). Little to paginate; file status and results by file id (10 of 20). Status and sub-status codes say why an address failed, and the error page explains 400, 404 and 429 (14 of 20). Unknown results are free and safe to retry; repeated validations are charged again (12 of 20). Many official SDK wrappers and an MCP server, with few required parameters (15). 18+10+14+12+15 = 69.