Law enforcement requests

What exists, and what doesn’t

What exists is account information: for an account with an email address, the address; when the account was made and last used; its plan and payments (card details are held by Stripe, not us); how much it stores and downloads; its files, as encrypted blocks no one can read without keys we’ve never had; and which Sealed Links it has, but not what they open.

What doesn’t exist: file contents, file and folder names, passphrases, recovery keys, the keys to anyone’s vault, IP addresses, and any record of which file was opened or downloaded, or when. One exception, labelled wherever it appears: objects a program stores through our S3 endpoint with a plain key are kept as sent, so we could produce them under a valid legal order.

The complete list, for accounts with and without an email address and for visitors, is on What we can give the police; how long each record is kept is on What we keep, and for how long.

How a request must reach us

1. In writing, by email to legal@terebyte.com.
2. As valid legal process: we check every request, and answer only one that is lawful and properly made.
3. Naming the account it’s about, by email address or Account ID.

We hand over only what a valid request lawfully covers, and nothing else. A request for something that doesn’t exist gets that answer.

Telling the member

Where the law allows, we tell the member by email. Accounts without an email address can’t be reached that way.

The yearly count

Every request is counted in our transparency report, never naming the account: how many requests came from governments and police, how many were court orders, subpoenas or warrants, and how many we answered with any information at all. Every other request got nothing, because nothing existed to give or the request wasn’t valid. The yearly report also counts copyright notices, reported Sealed Links and what we did about them.