// tomba enterprise
Contact data at scale, with the receipts attached
Find, verify and enrich B2B emails and phone numbers for every team, CRM and data pipeline you run. Each address shows the public pages it was found on, every seat signs in through your identity provider, and one annual contract covers the rest.
Talk to sales opens app.tomba.io: sign in or create a free account, then send your request. We reply within one business day.
// trusted by teams at
// 01 · provenance
Every address comes with its receipts
Tomba returns addresses it found on public web pages, and shows you where. Your compliance team can check any record before it reaches a sequence.
- Up to 20 public sources per address, each with the page, the date Tomba first found it, and whether it is still there.
- Verified before you send, with syntax, MX record, SMTP mailbox, catch-all and greylisting checks.
- Anyone can remove their data at app.tomba.io/claim, without an account. Removed addresses go on a suppression list, and the API answers 451 for them.
- A confirmed hard bounce on an address Tomba returned as valid is credited back under the data-quality guarantee.
{
"data": [
{
"uri": "https://piedpiper.com/about",
"website_url": "piedpiper.com",
"extracted_on": "2024-06-01T09:14:07+01:00",
"last_seen_on": "2025-01-10T17:02:44+01:00",
"still_on_page": true
}
],
"email": "richard@piedpiper.com"
}- 450M+verified contactsvia Tomba internal count, October 2026
- 80M+company domainsvia Tomba internal count, October 2026
// 02 · 5,000-lead benchmark
Measured in the open, with the raw data published
We ran the same 5,000 leads through nine email finders, counted only the addresses each tool marked valid or verified, and published every export.
| Rank | Tool | From websites | From company names | Total |
|---|---|---|---|---|
| 1 |  Tomba.ioSites 2,026 · 81.0% Names 1,989 · 79.6% | 2,02681.0% | 1,98979.6% | 4,015 |
| 2 | 1,91876.7% | 1,95778.3% | 3,875 | |
| 3 | 1,88075.2% | 1,87775.1% | 3,757 | |
| 4 | 1,48359.3% | 1,61364.5% | 3,096 | |
| 5 | 1,00140.0% | 1,14145.6% | 2,142 | |
| 6 | 88735.5% | 99539.8% | 1,882 | |
| 7 | 1,05142.0% | 74930.0% | 1,800 | |
| 8 | 98839.5% | Under 1% found from company names: the tool needs a website or domain:190.8% | 1,007 | |
| 9 | 82433.0% | Under 1% found from company names: the tool needs a website or domain:220.9% | 846 |
Tomba.io found 4,015 valid emails from 5,000 leads: #1 of 9 tools tested.
Tomba’s own test, February 2026. One file of 5,000 leads, 2,500 with the company website and 2,500 with only the company name, ran through each tool with no manual cleanup. Only addresses a tool labelled valid or verified count; percentages are of the 2,500 inputs of each kind.
Under 1% found from company names: the tool needs a website or domain.
// 03 · workflows
One source of contact data for every team
The same API, credits and records behind inbound routing, CRM hygiene, outbound lists, data pipelines and AI agents.
Enrich every inbound lead before it is routed
Send the email address from a form or your CRM, and get the person and the company back in one call.
- 01 Your form, CRM or workflow tool sends the email address to the Combined API.
- 02 Tomba returns the person (name, position, department, LinkedIn) and the company (industry, size, location).
- 03 Route, score and assign the lead on those fields.
Keep the CRM deliverable
Re-verify the records you already own before they cost you sender reputation.
- 01 Export your contacts and start a bulk verification job, with up to 20,000 addresses per job.
- 02 Each address comes back deliverable, risky or undeliverable, with catch-all, webmail and disposable flags.
- 03 On Enterprise, Tomba for Salesforce verifies and enriches Leads, Contacts and Accounts in place. It is licensed separately.
Build lists from the accounts you can describe
Start from your ideal customer, not from a spreadsheet someone bought.
- 01 Describe your target accounts in Reveal and filter by industry, size, location and technology.
- 02 Domain Search lists the people Tomba knows at each company, with their sources.
- 03 Email Finder fills in named contacts, and every address is verified before export.
Run enrichment as a scheduled job
Bulk jobs through the API, for warehouses and enrichment pipelines.
- 01 Create bulk jobs through the API, with up to 25,000 domains for a domain search or 20,000 addresses for a verification.
- 02 A signed webhook (HMAC-SHA256) tells your pipeline when the job is done.
- 03 Download the results as CSV; a job stays available for 180 days.
Give your agents verified contact data
The same data and credits, as tools your agents can call.
- 01 Connect an MCP client to Tomba's remote server at mcp.tomba.io/mcp, with 28 tools.
- 02 Sign in with OAuth, or send an API key and secret from clients that support headers.
- 03 Works with Claude, ChatGPT, VS Code, Cursor, Windsurf and other MCP clients.
// 04 · developers
Built for the engineers who integrate it
A REST API with an OpenAPI 3 spec, 13 official SDKs, a CLI and a remote MCP server, all on the same credits.
| Method | Path | Returns |
|---|---|---|
| GET | /email-finder | A named person's address at a company, with a score and sources |
| GET | /domain-search | The people Tomba knows at a domain, with positions and departments |
| GET | /email-verifier | Deliverability, from SMTP, MX, catch-all and greylisting checks |
| GET | /combined/find | The person and the company behind an email address |
| GET | /email-sources | The public pages where an address was found |
| GET | /phone-finder | Phone numbers from an email, a LinkedIn profile or a domain |
| POST | /reveal/search | Companies that match your filters |
| POST | /bulk/{type} | A bulk job over a list, with a webhook when it is done |
Enterprise has no per-second or per-minute limit; each endpoint takes up to 100,000 requests a day.
curl -G "https://api.tomba.io/v1/email-finder" \
-d domain=piedpiper.com -d first_name=Richard -d last_name=Hendricks \
-H "X-Tomba-Key: $TOMBA_API_KEY" \
-H "X-Tomba-Secret: $TOMBA_SECRET_KEY"import { TombaClient, Finder } from "tomba";
const client = new TombaClient()
.setKey(process.env.TOMBA_API_KEY)
.setSecret(process.env.TOMBA_SECRET_KEY);
const result = await new Finder(client).emailFinder({
domain: "piedpiper.com",
firstName: "Richard",
lastName: "Hendricks",
});
console.log(result.data.data.email);import os
from tomba import Client, Finder
client = Client()
client.set_key(os.environ["TOMBA_API_KEY"]).set_secret(os.environ["TOMBA_SECRET_KEY"])
result = Finder(client).email_finder("piedpiper.com", "Richard", "Hendricks")
print(result["data"]["data"]["email"]){
"data": {
"email": "richard@piedpiper.com",
"full_name": "Richard Hendricks",
"company": "Pied Piper",
"position": "CEO",
"department": "executive",
"score": 100,
"verification": {
"date": "2025-01-15T10:32:00+01:00",
"status": "valid"
},
"sources": [
{
"uri": "https://piedpiper.com/blog/engineering",
"website_url": "piedpiper.com",
"extracted_on": "2024-06-01T09:14:07+01:00",
"last_seen_on": "2025-01-10T17:02:44+01:00",
"still_on_page": true
}
]
}
}13 official SDKs
C#, Dart, Deno, Elixir, Go, Lua, Node.js, Perl, PHP, Python, R, Ruby and Rust.
SDK docs (opens in a new tab)Command-line interface
Search, verify and enrich from a terminal, a script or a CI job.
Tomba CLIRemote MCP server
28 tools for Claude, ChatGPT, Cursor and other MCP clients, with OAuth or an API key.
MCP serverOAuth 2.0
PKCE, device flow and dynamic client registration, with scopes for search, verify, enrich, leads and account.
Authentication (opens in a new tab)Signed webhooks
A webhook URL per request, HMAC-signed bulk completion events, and lead webhooks.
Webhooks (opens in a new tab)No-code and add-ons
Zapier, Make and n8n, the Google Sheets and Excel add-ons, and browser extensions.
Integrations
// 05 · governance
Your identity provider decides who gets in
Provision people from your directory, enforce single sign-on, and see who used what, by member and by source.
| Capability | Owner | Admin | Member | Guest |
|---|---|---|---|---|
| Search, verify and enrich from the shared credits | Allowed | Allowed | Allowed | Allowed |
| Run bulk jobs and export results | Allowed | Allowed | Allowed | Not allowed |
| Set each member's monthly search and verification limits | Allowed | Allowed | Not allowed | Not allowed |
| Invite, edit and remove members | Allowed | Allowed | Not allowed | Not allowed |
| See every member's usage | Allowed | Allowed | Not allowed | Not allowed |
| Manage workspace settings and domains | Allowed | Allowed | Not allowed | Not allowed |
| Configure SAML SSO and SCIM (Enterprise) | Allowed | Allowed | Not allowed | Not allowed |
| Delete the workspace | Allowed | Not allowed | Not allowed | Not allowed |
- seats and 2,000 API keys on Enterprise
- 5,000
- SSO with just-in-time provisioning; enforcement off, optional or required
- SAML 2.0
- users provisioned and removed from your identity provider
- SCIM 2.0
- maximum API key lifetime; OAuth 2.0 with read, search, verify, enrich, leads and account scopes
- 365 days
Roles as enforced by the Tomba API, October 2026. SAML SSO and SCIM are Enterprise features.Invite your team
- Enterprise
SAML single sign-on
SP- and IdP-initiated sign-in with Okta, Microsoft Entra ID, Google Workspace or Salesforce as the identity provider. Enforce SSO for the workspace after verifying your domain.
Set up SAML SSO (opens in a new tab) - Enterprise
SCIM 2.0 provisioning
Create, update and deactivate members from Okta, Microsoft Entra ID, OneLogin or JumpCloud.
- All workspaces
Roles and member limits
Owner, admin, member and guest roles, and a monthly credit limit for each member.
- All workspaces
API keys and OAuth apps
Named API keys that expire within 365 days, rotation with reminders, and connected OAuth apps you can review and revoke.
- All workspaces
Usage by member and source
Credits used by each person and by each source (API, bulk, extensions, add-ons), exportable as CSV.
- All workspaces
Account security
Two-factor authentication, passkeys, active sessions and sign-in alerts for every user.
// 06 · security and privacy
Answers ready before your security review starts
What we do, written down, with the documents to check it against. Tomba holds no third-party security certification of its own; our hosting and payment providers hold theirs.
Encryption in transit and at rest
TLS 1.3 on every endpoint and AES-256 for stored data.
Platform controls
Cloudflare WAF in front of every request, multi-factor authentication on administrative access, least-privilege permissions and regular penetration testing.
Data location
Primary storage and processing in the European Union. Transfers outside it are covered by the 2021 Standard Contractual Clauses, the UK Addendum and the Swiss FADP.
DPA terms
Breach notice within 72 hours, return or deletion within 90 days of termination, 30 days' notice of new subprocessors, and one audit a year.
Opt-out and erasure
Anyone can remove their data at app.tomba.io/claim without an account. The address is suppressed, and the API answers 451 for it.
Status and incidents
Live status and incident history at status.tomba.io, and an X-Request-ID on every API response for support.
Found a vulnerability? Write to security@tomba.io.
// 07 · plan and pricing
One plan, priced in the open
A published price on an annual contract, with seats, API keys and limits sized for large teams.
Enterprise
Sales-assistedFor teams that need volume, single sign-on, a security review and a signed contract.
Annual contract, $59,988 a year
Contact salesNo checkout. Sign in to app.tomba.io and send the request; we reply within one business day.
What Enterprise includes:
3,000,000 searches and 3,000,000 verifications a month
Two separate monthly allowances. Each endpoint takes up to 100,000 requests a day, with no per-second or per-minute limit.
SAML single sign-on and SCIM provisioning
Okta, Microsoft Entra ID, Google Workspace and other SAML 2.0 providers. Enforce SSO for your workspace.
Up to 5,000 seats and 2,000 API keys
Roles, per-member monthly limits, and usage by member and source.
A named account manager and a custom SLA
A 99.9% uptime SLA is available as part of the contract.
Tomba for Salesforce
Find, verify and enrich Leads, Contacts and Accounts inside Salesforce. Licensed separately.
Scale 350k and Enterprise, side by side
| Scale 350k | Enterprise | |
|---|---|---|
| Price | $2,499/mo | $4,999/mo |
| How you buy | On request | Annual contract |
| Search credits a month | 350,000 | 3,000,000 |
| Verification credits a month | 350,000 | 3,000,000 |
| Rate limits | None | None per second or minute; 100,000 a day |
| Seats | 700 | 5,000 |
| API keys | 700 | 2,000 |
| SAML SSO and SCIM | Not included | Included |
| Tomba for Salesforce | Not included | Licensed separately |
| Support | Priority support | Named account manager |
| Uptime SLA | Not included | 99.9%, by contract |
From first call to production
- 01
Tell us what you need
Send the request from app.tomba.io with your volumes, number of users, identity provider and security questions.
- 02
Scope it together
We confirm allowances, the SSO and SCIM setup, and the documents your review needs.
- 03
Sign once
One annual contract and the DPA. Enterprise is switched on for your workspace.
- 04
Go live
Connect your identity provider, provision your users and create your API keys.
// 08 · switching
Moving from another provider
See how Tomba compares with the tool you use today, and follow a migration guide where one exists.
Apollo
ZoomInfo
Cognism
Lusha
Clearbit
RocketReach
Hunter
Kaspr
ContactOut
Snov.io
Tomba.io consistently delivers accurate results and is incredibly easy to set up using the API key. It has become my go-to solution for email enrichment.
Andrei KholkinFounder, superpage.ioTomba is my go-to to validate emails. Even in a waterfall process with multiple tools, Tomba is usually the top choice.
Nuno PoçoSales automation architect, clickworks.io