Law-enforcement requestsA demand is correspondence until a court with jurisdiction says otherwise.

Five different things get called “the police asking”

The phrase covers five instruments with almost nothing in common but an official letterhead, and confusing them is how a reader ends up frightened of the harmless one and relaxed about the dangerous one. They differ in who issues them, what they can compel, and whether a judge was involved at any point.

Only the last two are orders in the sense the phrase implies. The first three are requests, and a request is answered by a decision rather than by an obligation. That is worth sitting with: three of the five never reach a judge, and those three are the ones almost nobody asks a prospective host about.

The five stages a demand passes through

A well-run provider puts every demand through the same sequence regardless of who sent it, and the sequence is worth knowing because you can ask any host to describe theirs. A host that has never written one down is a host that improvises under pressure.

1. It arrives, usually at the wrong company. An estate spread across several countries is several companies, and process served on one of them binds one of them. This is the most common reason a demand achieves nothing, and it is entirely the sender’s to avoid.
2. The entity is identified. Which company operates the region, in which register it is filed, and whether the issuing court has any authority over it. A foreign order is not self-executing anywhere on earth.
3. Counsel in that jurisdiction reads it. Not the support desk, and not the founder at midnight. Valid and in scope is a legal question with a local answer, and the answer to an invalid one is a letter explaining why, in writing.
4. What is asked for is checked against what exists. This is where most demands die quietly. An order for a category the schema does not contain produces a letter, not a file, and no amount of pressure converts one into the other.
5. The customer is told. Before anything is produced, unless the order expressly forbids it. This is the stage most providers leave out of their process entirely, and it is the only one that lets you do anything at all.

The published version of that sequence for this estate is on the law-enforcement guide, which is written for the counsel serving the order rather than for the customer reading about it. It is worth opening for a reason that has nothing to do with us: it is the shape of the document you should be looking for at any host, and most do not have one.

The arithmetic of a transparency report

Almost every transparency report leads with the total received, which is the least informative number in it. Volume measures how visible a provider is. What you want is the ratio between what arrived and what came out, because that measures how much the provider was holding.

Run that arithmetic on any host that publishes enough to allow it. A high produced-to-received ratio is not evidence of cooperation and a low one is not evidence of courage — both are mostly evidence about the inventory. A provider holding identity documents and a year of sign-in addresses will produce something almost every time, however it feels about doing so. The full quarterly series is in the transparency report.

Why the entity you contracted with decides everything

A judgment is enforceable against a person or a company, in a place. It does not travel on its own. For a foreign order to bind a company abroad it has to be recognised by a court where that company is incorporated, through mutual legal assistance or the local recognition procedure — a route that is formal, slow, reviewable, and refusable on grounds the requesting authority does not control.

That is ordinary private international law rather than anything clever, and it is the entire mechanical content of the word offshore. It is also why the corporate structure matters more than the map: eight jurisdictions operated by one company is one legal target with eight addresses, and a ruling against it reaches every machine it owns. Eight separate companies is eight separate proceedings, each starting from nothing. Which arrangement a host uses is on its terms page, and the guide on choosing a jurisdiction sets out what else changes between them.

• Ask which company, not which country. The country is on the marketing page. The company name and its registration number are the thing an order has to name, and a host that will not tell you cannot be relied on to have one.
• Ask where it is filed. A named entity in a public register is checkable in about two minutes and costs nothing to verify. Eight of them, in eight registers, are listed here for exactly that reason.
• Ask what happens to a request for the wrong entity. The honest answer is that it is answered in writing saying so. The revealing answer is that it gets handled anyway, helpfully.

The emergency route, which is the one nobody watches

Every major framework has a channel that skips the court entirely. In the United States it is 18 U.S.C. §2702(b)(8), which permits a provider to disclose voluntarily where it believes in good faith that an emergency involving danger of death or serious physical injury requires it. Most other jurisdictions have an equivalent. There is no judge, no warrant and no adversary: the provider decides, in hours.

It exists for good reasons and it is abused for obvious ones. Requests forged on compromised law-enforcement mail accounts have been used to extract subscriber data from some of the largest platforms in the world, because the whole channel is built on a plausible letterhead and a provider that does not want to be the one who hesitated. Forty such requests have reached this estate.

The defence is not to refuse the category, which would be indefensible in the case the channel exists for. It is to have almost nothing to volunteer, to review each one as a person rather than as a queue, to tell the customer afterwards in every case, and to count them publicly as their own line. An exception nobody counts stops being an exception and becomes a door.

Preservation: the order that stops the clock

A preservation demand does not ask for anything to be handed over. It asks that records which exist right now stop being deleted, so that they are still there when the order to produce them arrives weeks later. In the United States it runs under 18 U.S.C. §2703(f) for 90 days, renewable once, and it needs no judge to issue. Sixty-six of them have arrived here.

It is the quietest instrument on this page and the most instructive, because it is precisely the thing a retention policy cannot survive. A timer is a promise to destroy on a schedule; a preservation hold is an instruction to stop keeping that promise, effective the moment it lands. Everything already written is frozen from that second, and the customer is usually the last to know.

Which is the whole argument for absence over deletion, made concrete. A record that was never created cannot be preserved, cannot be frozen, and cannot be produced ninety days later by a provider that has changed its mind. The distinction is drawn out at length in the guide on what no-logs actually means, and the list of what is never created here is published as part of the privacy and logging policy rather than as a claim on a pricing page.

Seizure: what taking the machine actually gets

Seizure is the scenario everybody imagines and almost nobody thinks through. It is also the one where the outcome depends least on the provider and most on decisions the customer made months earlier, at install time, in about an hour of work.

Read down the last column and one entry appears twice in effect: a key that was never in the building. Every other control on this page is legal, procedural or contractual, which is to say every other control depends on somebody continuing to behave as they said they would. Encryption does not. A hypervisor operator can copy the disk of a guest it runs — a provider claiming otherwise is misunderstanding its own stack — and what it copies is either readable or it is noise.

The runbook is in the knowledge base: full-disk encryption inside the guest, unlocked over SSH at boot, so the key arrives from you each time the machine starts and lives nowhere else. It is the same recommendation as the no-logs guide makes, repeated deliberately, because it is the only advice on this page whose effect does not depend on anybody’s good behaviour, including ours.

The gag, and why a canary is the only answer to it

A gag is not a separate instrument. It is a clause attached to one, forbidding the provider from telling the person the order concerns that it exists. National Security Letters in the United States carry one by default; several jurisdictions have equivalents, and the point of all of them is that the fifth stage above — telling the customer — is removed, and you have no way to learn it was.

A warrant canary is the one available answer, and it works by inverting the problem. A provider can be forbidden from making a statement. It is far harder to compel one to keep repeating a statement that has become false. So the claim is published on a schedule, and its absence carries the meaning that its presence no longer can.

Most canaries in this market are decoration. Six things separate one that means something from a paragraph on an about page, and every one of them is checkable in a browser in five minutes.

1. It is cryptographically signed, against a key published somewhere you can find independently. An unsigned canary can be edited by anyone who can edit the website, which includes anybody who has taken it over.
2. It cites something recent and unpredictable. A Bitcoin block height and hash is the usual choice: that block did not exist before it was mined, so the statement cannot have been signed months in advance and left on a shelf.
3. It names a period, a due date and an expiry. A canary with no schedule cannot go missing, because nothing was due. The schedule is the entire mechanism.
4. It enumerates specific claims rather than one sentence. One line saying “we have received no secret orders” can only fail all at once. Separate clauses fail separately, and a clause quietly dropped from the next signing is a signal with a shape.
5. It covers every entity. On an estate of several companies, a canary that speaks for one of them is a canary about a fraction of the infrastructure you are buying.
6. Previous signings are still published. A removed clause is only visible against what it replaced, so a canary with no archive asks you to have been paying attention all along.

The canary published here is signed quarterly, cites a recent block, names its due and expiry dates, covers all eight entities, and makes seven separate claims: no National Security Letter or equivalent, no order accompanied by a prohibition on telling the customer, no contents of any disk or database ever given to anyone, no prospective interception, no equipment seized or imaged, no compelled weakening of a cryptographic protection, and sole administrative control of the infrastructure. Check it against the six above. Then check whoever else you are considering against the same six.

What to ask a host before you buy

Every question below has a document as its answer, or it does not have one. That is the test: not whether the reply sounds reassuring, but whether it points at something written down before you asked.

1. Which legal entity am I contracting with, and in which public register is it filed?
2. What exists about me once I have signed up — as an inventory with a retention period against every row, not as an adjective.
3. What is never created? That list is the only part of the answer that a court cannot reverse.
4. Will I be told if a request names me, and what would have to be true for you not to tell me?
5. How many requests have you received, how many met the legal bar, and how many produced anything at all?
6. Are emergency disclosures counted and published as their own line?
7. Is your canary signed, recent, specific, and does it cover every entity you operate?

None of this makes anybody untouchable, and a page that suggested otherwise would be the kind of page this one exists to argue with. What it does is move the question from trust to inventory. A host that can produce little produces little, whatever it believes about itself on the morning the letter arrives.

Questions people actually ask

Every price on this estate is published in full, in one place. See the whole catalogue