Law Enforcement and Legal Requests

How we approach these

We hold data that belongs to our customers. We disclose it when we are legally required to, and not because a request is forceful, urgent-sounding or on letterhead.

Every request is reviewed for validity and scope. We narrow requests that ask for more than the stated purpose supports, and we push back on ones that are overbroad or improperly served.

What we require

• Valid legal process issued under the law of a jurisdiction that applies to us, and properly served.
• The identity of the requesting agency and a named, contactable officer or official.
• A specific identifier — a domain, an account email, an IP address with a timestamp and time zone. “All data relating to” a person is not an identifier we can act on.
• The date range being requested, and the statutory basis being relied on.

Requests from outside the jurisdiction in which we operate generally need to come through the relevant mutual legal assistance process or an equivalent recognised mechanism.

An email asking us to hand over customer data, without legal process behind it, is not a request we can act on however serious the underlying matter is. That protection is the reason it exists.

What we actually hold

It is worth knowing before you ask. We typically hold:

• Account and billing records — the name, contact details and payment history associated with an account. Card numbers are held by the payment processor, not by us.
• Server logs, including connection records, for the retention period applicable to the service.
• Customer content stored on the service — website files and databases — where the account is live.
• Backups, until they age out on the retention schedule for the plan.

We do not hold registrant data for a domain as the registry's record of it, and we do not hold the contents of encrypted data for which we have no key.

Preservation requests

We accept requests to preserve existing records pending legal process. Preservation freezes what already exists at the moment we act; it does not create data that was never collected, and it does not recover data that had already aged out.

Preservation is not disclosure. Preserved records are released only on valid legal process.

Emergency requests

Where there is a credible risk of death or serious physical harm to a person, we can act on an emergency request faster than normal process allows, and we will. Mark it clearly as an emergency, describe the nature of the risk, and give us a way to call you back.

We verify that requests of this kind come from the agency they claim to, because the emergency route is an obvious target for social engineering.

Telling the customer

Our default is to notify the customer whose data has been requested, with enough detail and enough time for them to seek legal advice before we produce anything.

We will not give notice where a court order or statute forbids it, where there is a genuine risk to someone's life or safety, or where notice would be self-defeating because the account itself appears to be the source of ongoing harm. Where a non-disclosure obligation expires, we will notify the customer then.

This is a default we intend to keep, not a formality. A host that quietly hands over customer data and never mentions it is not one anyone should trust with theirs.

Costs

Where the law permits, we may recover the reasonable cost of responding to a request that requires substantial work. We do not charge for routine preservation or for emergency requests.

How to send one

Send legal process to Support@serverlys.com with “Legal request” in the subject line, addressed to Serverlys, LLC. Include a return email address and a direct telephone number — we frequently need to clarify scope before we can respond properly.

Abuse reports, phishing and malware complaints are not legal requests and are handled faster through the abuse report process. Copyright complaints follow the separate DMCA process.