# Guidelines for law enforcement

This page tells authorities how to make a request, and tells everyone else what
we are able to produce. Both audiences matter, so nothing here is written to be
read only by lawyers.

## Who we are

Skudo is operated by a private individual in Italy, subject to the Italian
courts. The operator's name and postal address are given in the
[privacy notice](/legal/privacy). Service of process should be preceded by
contact at the address below.

## Where to send a request

legal@skudo.org, stating the legal basis, the issuing authority, the addresses concerned
and the period. Requests arriving by other channels are redirected here rather
than acted on.

We do not accept requests by telephone. We do not act on a request from an
individual claiming to represent an authority without documentation.

## What we can produce

Everything we hold is listed in the privacy notice, and there is nothing else.
In practice a request about an alias can reach:

- the alias address itself, which is stored in plaintext because the relay has
  to read it to route mail;
- the counters and last-used timestamps attached to it;
- the address it forwards to, which is encrypted under a separate key that we
  hold and can therefore be compelled to use;
- records of messages sent through it in the last 7 days, which contain no
  content;
- delivery failures from the last 7 days;
- if the account holder has written to support, the correspondence itself,
  kept for 7 days after a ticket is closed, or 24 months where the ticket
  concerned abuse or a legal order;
- abuse reports made about the address, kept 24 months.

## What does not exist

**Message content.** Forwarded mail is not stored. There is no archive to
produce, no mailbox to image and no backup containing message bodies. Where a
user has enabled the optional mailbox, stored messages are encrypted to that
user's own OpenPGP key and we do not hold the private key, so we cannot decrypt
them for you or for anyone.

**Anything older than the retention periods above.** Deletion is automated and
we do not keep a copy against the possibility that somebody may later ask.

**Data about deleted aliases.** An alias deleted more than 24 hours ago is gone.

## Preservation orders

We comply with a valid preservation order to the extent that the data exists at
the moment the order arrives.

We will not begin collecting data that we do not otherwise collect in order to
satisfy a preservation order, unless separately and lawfully compelled to do so.
An order to preserve is not an order to start recording.

## Emergency requests

We respond to a credible request concerning an imminent risk to life or of
serious physical harm without waiting for formal process, and we report the
number of such requests in the transparency report.

## Orders we refuse

We refuse orders that are defective on their face, that come from an authority
without jurisdiction over us, or that demand more than is proportionate to the
matter stated. Where the law allows, we contest them.

Foreign orders are actioned through mutual legal assistance or an equivalent
recognised route, not directly.

## Telling the user

We notify the user whose data is requested, before disclosure where possible and
afterwards where not, unless we are legally prohibited from doing so or unless
notification would create a risk to life.

Where a prohibition has a time limit, we notify when it expires. The expiry is
recorded against the request when it arrives and comes back as a reminder, so
that notifying does not depend on somebody remembering.

## What we publish

Periodically, and at least once a year: how many orders arrived, how many sought
an identity, how many forwarding addresses were disclosed, how many accounts
were affected, and how many requests were refused. Figures are published even
when they are zero.

## One thing we will not pretend

This is one operator in one country. A valid Italian order compels what we hold,
and there is no second party who could refuse on your behalf. What we can
promise is that we hold as little as the service allows, and that we say exactly
what that is.