Law Enforcement Guidelines
This page explains how law enforcement and other government agencies can request information from Bitfoo, what legal process we require, and what data we hold.
BITFOO LLC is a limited liability company organised in Pennsylvania, United States. We provide web hosting, virtual private servers, domain registration, and SSL/TLS certificates. We respond to valid legal process issued under United States law.
These guidelines are for informational purposes. They are not legal advice, and they do not waive any objection or right available to us or to our customers.
How to serve process
- By email — preferred
- legal@bit.foo
Attach the process as a PDF. Email is faster and we treat properly-served process received this way as validly served for our purposes. We reserve the right to require formal service. - By formal service
- Northwest Registered Agent, LLC
502 W 7th St, Ste 100
Erie, PA 16502, United States - By post
- BITFOO LLC, 146 East King St, Unit #1283, Lancaster, PA 17602, United States
What to include
What process is required
The Stored Communications Act, 18 U.S.C. § 2701 et seq., sets what is required for each category of data. We apply it strictly. Disclosing more than the process authorises exposes us to civil liability under 18 U.S.C. § 2707, so we are not able to be accommodating on this point.
| What you are seeking | What we require |
|---|---|
| Basic subscriber information — name, address, email address, telephone number, account creation date, length of service, session times and durations, and means and source of payment | Subpoena |
| Non-content records — server and network access logs, IP assignment records, and other metadata | Court order under 18 U.S.C. § 2703(d) |
| Content — customer files, databases, website content, email contents, and backups | Search warrant issued on probable cause |
What data we hold
We are a hosting provider. Much of what our customers do runs on servers we do not administer, and we hold less than agencies often assume.
We generally hold:
- Account and registration information — name, company, postal address, telephone number, email address, and where provided a tax identification number
- Billing records — transaction history, the card brand and last four digits, and a payment token. We do not hold full payment card numbers. These are held by our payment processor and never reach our systems
- Support tickets and live chat transcripts
- Server, network, and access logs
- For shared hosting, the content stored in the account
We may not hold, or may not be able to provide:
- Content on a virtual private server. These are administered by the customer, not by us. We do not routinely access them, and content may be encrypted by the customer in a manner we cannot decrypt
- Domain registration records. Domains are registered through a third-party registrar. Where you need registrar records, that request should be directed to them
- Payment card data, which is held by our payment processor
- Anything past its retention period — see below
How long we keep it
Retention periods are set out in our Privacy Policy, section 7. In summary:
- Account and contact information — while the account is open, then 12 months
- Billing and transaction records — 7 years
- Support tickets and chat transcripts — 3 years
- Operational server, network, and access logs — 90 days
- Security, fraud, and abuse investigation records — 12 months
Log retention is the constraint that matters most in practice. If your matter concerns activity more than 90 days old, submit a preservation request before the records age out.
Preservation requests
We accept preservation requests under 18 U.S.C. § 2703(f) by email to legal@bit.foo.
- We will preserve records for 90 days
- We will extend once for a further 90 days on request
- Include the same identifiers described above — an IP address with a date, time, and timezone, a domain name, or the account email address
- A preservation request does not require a subpoena or court order, and it does not by itself compel disclosure. Legal process is still required for us to produce anything
If your matter may become time-sensitive, send a preservation request early. It costs you nothing and it stops the 90-day log window closing while process is being obtained.
Emergency requests
Under 18 U.S.C. § 2702(b)(8) we may voluntarily disclose information where we believe in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay.
- Email legal@bit.foo with URGENT in the subject line
- Describe the nature of the emergency, the danger, and why the information is needed immediately
- We assess each request on its facts. Disclosure under this provision is voluntary, not compelled, and we may decline
Notifying our customers
It is our policy to notify a customer when we receive legal process seeking their information, and to give them an opportunity to respond, before we produce anything.
We will not notify where we are prohibited from doing so by a court order or statute, or where we have reason to believe that notice would endanger a person or prejudice an investigation involving a risk to life.
If you require non-disclosure, obtain an order to that effect and provide it with your request. A statement in a covering email that we should not notify the customer is not sufficient.
Requests from outside the United States
We are a United States company subject to United States law.
Requests from foreign law enforcement should be made through the Mutual Legal Assistance Treaty process, letters rogatory, or another recognised channel of international legal cooperation. We are generally unable to respond directly to process issued by a foreign court or agency.
Preservation requests and emergency requests under the provisions above may be sent directly and we will consider them on their merits.
Costs
Under 18 U.S.C. § 2706 we may seek reimbursement for costs reasonably necessary and directly incurred in searching for, assembling, reproducing, and providing records, including costs arising from disruption to normal operations.
Where we intend to seek reimbursement we will tell you before we begin work.
Objections
We review every request. We may object to, seek to narrow, or move to quash process that is overbroad, unduly burdensome, defective, or that seeks material beyond what the process authorises. Where we do, we will tell you why and we will engage constructively about scope.