Law Enforcement Guidelines

These guidelines explain how Arct Technology LLC ("Arct Cloud", "we", "us") handles requests from government and law enforcement authorities, and from other parties, for information about its customers. They describe our practice and do not create rights for any third party. Section 11 explains their legal status.

1. Requesting customer information

Our disclosures are governed mainly by the US Stored Communications Act (18 U.S.C. 2701 to 2713), part of the Electronic Communications Privacy Act. A request must identify a specific Account, server or IP address, with the date, time and time zone of the activity. IP addresses are reassigned between customers, so a request without a time cannot be matched. We do not process requests that are vague or that would cover customers who are not the subject of the investigation.

To report spam, attacks or other abuse from a server on our network, use our Report abuse page. Section 9 of our Acceptable Use Policy explains how we handle those reports. If a request indicates that a server or Account may breach our Terms of Service or Acceptable Use Policy, we may also act under those documents, including by suspending the server or the Account, unless the law or a court order prevents that step.

2. Information that may be available

Depending on the Account, we may hold the following categories of information. The list is not exhaustive.

• Account data: email address, name, Account creation date and SSH public keys.
• Billing data: orders, invoices, amounts and payment dates. For card payments, the card brand, the last four digits and payment references. For crypto payments, invoice details and transaction references.
• Console sign-ins and actions, with IP addresses and times.
• Server records: server names, locations, plans, assigned IP addresses, and creation and deletion dates.
• Support tickets and their attachments.
• The contents of server disks, backups and snapshots that have not been deleted.

Customers enter Account details themselves, and we may not have verified them. Whether a record exists depends on the Account and on how long ago the activity took place. We do not guarantee that we hold any particular information, or that information we hold is complete, accurate or current. Our Privacy Policy describes the information we collect.

3. Information that is not available

• Full card numbers and card security codes.
• Account passwords.
• Data a customer has encrypted with keys we do not hold, in readable form.
• Server data that has been deleted. Deletion is permanent, and we cannot recover it.
• Information we have not collected or no longer hold.

Customers control the operating system and data on their servers, including whether data is encrypted, and can delete server data at any time. We do not generally monitor the contents of customer servers.

4. Legal process we require

Except in an emergency under section 5, with the customer's lawful consent, or in a report we make on our own initiative where the law requires or permits it (such as a report to NCMEC under 18 U.S.C. 2258A), we disclose information to a US authority only on the following process, and only where the process is valid and specifically identifies the information sought:

We require a search warrant for content, including where the law would otherwise permit another form of process.

Authorities outside the United States must use a US court order or warrant, a mutual legal assistance treaty or letters rogatory, or an order covered by an executive agreement under 18 U.S.C. 2523, except as the next paragraph describes. US law (18 U.S.C. 2702) restricts our disclosure of the contents of customer data to authorities outside the United States other than through these routes.

Where Regulation (EU) 2023/1543 applies to a European Production Order or European Preservation Order addressed to us, we handle it under that Regulation. Its time limits apply: production generally within 10 days of receipt, or 8 hours in an emergency, and preservation for 60 days, extendable by 30 days, or longer where the Regulation requires. Where we consider that complying with a European Production Order would conflict with the law of a third country, such as the restriction on disclosing content in 18 U.S.C. 2702, we raise that conflict through a reasoned objection under Article 17 of the Regulation. The Regulation's confidentiality rules take priority over our notice practice in section 6.

We review each request for legal sufficiency. We may reject a request, ask the requester to clarify or narrow it, or object to or challenge it in court, where it is overbroad, unclear, not supported by the required process, issued without jurisdiction over us, or otherwise defective. We disclose only the information within the scope of valid process, and we may ask the requester to obtain information directly from the customer where appropriate. For Customer Personal Data that we process under our Data Processing Agreement, the commitments in section 12.6 of that agreement also apply.

5. Emergency requests

US law permits us, but does not require us, to disclose information without legal process when we believe in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay (18 U.S.C. 2702(b)(8) and (c)(4)). Emergency disclosure is voluntary. We decide each request in our discretion and may decline it, limit it or ask for legal process. Send emergency requests to [email protected] with "Emergency disclosure request" in the subject line. Describe the emergency, the person at risk, why it cannot wait for legal process and the information needed. We verify each request before we disclose and disclose only what the emergency requires.

These exceptions permit emergency disclosure of content only to US governmental entities. For an authority outside the United States, we may disclose non-content information in an emergency to the extent the law permits. We may refer a request that we believe is false or fraudulent to the appropriate authorities.

6. Notice to customers

Our practice is to notify the customer at the email address on its Account before we disclose, and to send a copy of the request, unless a law or court order prohibits it, such as an order under 18 U.S.C. 2705(b). Where the deadline allows, the customer has 7 calendar days to send proof of a legal challenge, and we pause disclosure while it is pending where the law allows. When a prohibition on notice ends, we may notify the customer. In an emergency, we may notify the customer after disclosure.

We may also delay or withhold notice where we believe it would be futile or ineffective, for example because the Account has been compromised, or where it could put a person at risk of harm or the request concerns the sexual exploitation of a child. For Customer Personal Data, section 12.6 of our Data Processing Agreement also applies.

7. Preservation requests

We act on preservation requests under 18 U.S.C. 2703(f). We keep the requested data that exists when we receive the request for 90 days, and for one further 90 days on a renewed request received before the first period ends. A preservation request must identify the Account, server or IP address and say whether it covers Account information or server content. Preservation is not disclosure.

Preservation covers only the data the request specifically describes. It does not extend to data created after we receive the request. We may preserve data without notifying the customer. When the preservation period ends without our receiving legal process, we may stop preserving the data. Other laws may require us to preserve some data for longer, such as 18 U.S.C. 2258A for reports to NCMEC. We may, but need not, act on a preservation request from an authority outside the United States while it pursues a route in section 4, for no longer than the periods above. European Preservation Orders follow Regulation (EU) 2023/1543.

8. Sending legal process

Send legal process and preservation requests to [email protected] from an official government email address, with the signed document attached as a PDF. Address legal process to Arct Technology LLC. Include:

• the issuing authority and the requesting agency;
• the name and badge or ID number of the responsible officer, and an official email address and telephone number;
• the Account, server or IP address, with the date, time and time zone of the activity;
• the information requested and the date range;
• any order that prohibits notice to the customer.

Requests should be in English or include an English translation. We do not act on requests by telephone, chat or support ticket, except emergency requests under section 5. We may verify the identity and authority of a requester through independent sources, such as the authority's published contact details, and may decline to act until we have done so.

Accepting a request by email does not waive any objection, including to jurisdiction, venue, the method of service or the scope of the request, and is not consent to the jurisdiction of any court or authority. Except where the law sets a deadline, we do not commit to respond within any particular time.

9. Reimbursement

We may seek reimbursement of the reasonable costs of responding to legal process, as 18 U.S.C. 2706 allows, and of responding to requests from private parties or authorities outside the United States where the applicable law or a court allows it.

10. Requests from private parties

Civil litigants and other private parties must serve valid legal process on Arct Technology LLC that is enforceable against us. US law (18 U.S.C. 2702) does not permit us to disclose the contents of customer data in response to a civil subpoena or other civil process, so private parties should seek content from the customer directly. Except with the customer's consent, or where the law otherwise permits disclosure, such as to protect our rights or property, we disclose non-content information to a private party only on valid legal process. We may notify the customer under section 6, object to the request, and seek our costs under section 9.

11. Status of these guidelines

These guidelines are not legal advice and are not a contract with any requester. They do not create any right, remedy or expectation for a requester, a customer or any other third party, and they do not waive or limit any right, objection, privilege, immunity or defence available to us or to a customer under applicable law. Our obligations to customers are set out in our Terms of Service and, for Customer Personal Data, our Data Processing Agreement. We may depart from these guidelines where the law requires it, and we may change our practices and these guidelines at any time in our sole discretion.