Law Enforcement Request Guidelines

Subpoenas, court orders, search warrants, preservation requests, and other legal process should be directed to:

Accepting service by email is a convenience, not consent to service by email or a waiver of any defect in service or jurisdiction. Include a case number, the account or firm at issue, the precise records sought, and a return contact.

We produce data only to the extent legally compelled, and we match the instrument to the sensitivity of the record:

• Basic subscriber information — the name, email, firm, and account creation date associated with an account — requires a valid subpoena or equivalent.
• Non-content records — login timestamps, IP addresses, billing history — require a court order or equivalent showing more than a subpoena.
• Content— documents, prompts, conversations, agent output, and anything else inside a workspace — requires a search warrant issued on probable cause by a court of competent jurisdiction, or the customer's own instruction.

Requests from outside the United States must come through a mutual legal assistance treaty, letter rogatory, or other mechanism recognised under U.S. law.

Most content on this platform belongs to law firms and is likely privileged or protected work product. We are a service provider holding it for our customers; we are not the holder of the privilege and cannot waive it.

Where process seeks content, we will ordinarily object or move to quash on the ground that the request should be directed to the firm that holds the privilege, and we will give the firm the opportunity to intervene. We do not review customer content to assess a request beyond what is strictly necessary to respond.

Our default is to notify. Before producing anything, we give the affected customer a copy of the request and reasonable time to object, so the customer can seek protective relief.

We will delay or withhold notice only where:

• A court order or statute prohibits notice, for as long as that prohibition lasts.
• We have a good-faith belief that notice would create a risk of death or serious physical injury to an identifiable person, or of destruction of evidence in an investigation into such conduct.

Where notice is barred by a non-disclosure order, we ask for the order to be time-limited, and we notify the customer when it expires.

We may disclose limited information without legal process where we have a good-faith belief that an emergency involving imminent danger of death or serious physical injury requires disclosure without delay. Emergency requests must come from a law enforcement email domain, be marked urgent, and describe the nature of the emergency, the harm feared, and why the information sought will help prevent it. We disclose only what is necessary to address the emergency.

On a formal written preservation request we will preserve a snapshot of existing records for 90 days pending service of valid process, and once on renewal for a further 90 days. Preservation is not production, and a preservation request does not by itself entitle anyone to see anything.

We may seek reimbursement of the costs of responding where the law permits, and we object to requests that are overbroad, vague, unduly burdensome, defective in service, or not supported by the right instrument. Narrowing a request is usually faster than litigating it — we will engage in good faith to do so.

Parties to civil litigation should seek data from the customer that controls it, not from us. Our copy is a duplicate of what the firm already holds and can produce itself, and a subpoena to a vendor is rarely the least burdensome route to it.

We publish the number of government requests received, the number complied with, and the number of accounts affected, in aggregate and no more often than semi-annually. We do not currently receive enough requests to report meaningfully; when we do, the report will appear on this page.

Retention periods are set out in the Privacy Policy. Our processor obligations to customers, including our duty to assist with their own regulatory obligations, are in the DPA. Copyright notices go through the DMCA process instead.