Transparency report
Published every January and July. First report covers the period from general availability.
What this report is
This report counts the government and legal requests for customer data that PacinfraX Corporation receives for the PXCMail service, and says how we responded. It exists so that a practice, firm or adviser can show an auditor, carrier or client that its email vendor does not hand over records informally. The count is 0 as of this report because the service has not yet had a reporting period; the table format below is the one we will keep using.
Our principles
- We require valid legal process (subpoena, court order, warrant) before disclosing customer data, and we review every request for scope and validity.
- We notify the affected customer before disclosure unless legally prohibited or where notice would endanger someone; we notify afterwards when a prohibition lifts.
- We disclose the minimum data responsive to the request; message content is disclosed only under a warrant or equivalent.
- We publish counts of requests and our responses here.
Requests received
| Period | Subpoenas | Court orders | Warrants | National security requests | Requests where data was disclosed | Customers notified |
|---|---|---|---|---|---|---|
| Prototype — no service period yet | 0 | 0 | 0 | 0 | 0 | — |
What the report covers
- Legal requests from US federal, state and local authorities and from courts: subpoenas, court orders under 18 U.S.C. § 2703(d), search warrants, and national security requests to the extent we are allowed to report them.
- Categories of data requested: subscriber information (organization name, contact, service dates), non-content metadata (addresses, timestamps, IP logs), and message content, which we disclose only under a warrant or equivalent.
- Customer notice: how many affected customers we told before disclosure, how many after a prohibition lifted, and how many we could not notify.
- Outcomes: requests where some data was disclosed, requests narrowed after we challenged their scope, and requests rejected as invalid.
- Preservation and emergency requests, counted separately because they do not by themselves disclose data.
The report does not include customer-initiated exports, which are your own data leaving at your request, and does not include civil discovery between private parties, covered below.
How requests are handled
The full procedure is in our law enforcement guidelines. In short: a request is served on PacinfraX Legal, checked for valid process and precise identification of the account, and challenged if overbroad. The data type determines the process we require: a subpoena for subscriber information, a 2703(d) order for metadata, a warrant for content, and process satisfying 45 CFR 164.512 where PHI is involved, in which case the covered entity is brought in. Unless a non-disclosure order or a risk of harm prevents it, the customer is notified before anything is produced. Emergency requests involving imminent danger are reviewed immediately by a designated officer. Preservation requests under 18 U.S.C. § 2703(f) are honored for 90 days, renewable once, and do not disclose data.
Reporting cadence
Reports are published every January and July and cover the preceding six months. Each period stays on this page as its own row rather than replacing the last, so the history is visible in one table. If a legal prohibition on reporting a request expires, the request is added to the period in which it was received, with a note.
How to read the table
Each row is one period. The first four columns count requests by type of process, not by number of accounts; one subpoena naming two organizations is one request. “Requests where data was disclosed” counts requests where any data at all was produced, even if narrowed. “Customers notified” is the number of customers told, before or after disclosure. A dash means no value for the period, not zero.
Example
Suppose a court order seeks six months of sender and recipient metadata for one mailbox at Harbor Title. Legal confirms the order is valid and narrowly drawn, notifies Harbor Title’s account owner and Security Officer, and produces only metadata for the named mailbox and period from the audit trail. Message content is not produced because no warrant was presented. The next report shows one court order, one disclosure, one customer notified.
Civil requests
Requests from private parties (for example in litigation) are directed to the customer, who controls the data; we respond only to valid process compelling us directly, and notify the customer.
FAQ
Will you tell me if my organization’s data is requested?
Yes, before disclosure, unless a court prohibits it or notice would endanger someone. When a prohibition lifts, we notify afterwards. Notice goes to the account owner and Security Officer on file.
Can a litigant in a lawsuit against me get my email from you?
They should ask you, because you control the data and can export it from the archive. We respond only to process that compels PacinfraX directly, and we notify you.
Do you receive requests from outside the United States?
Foreign requests must come through a mutual legal assistance treaty or letters rogatory. We do not act on direct foreign requests, and any that arrive are counted here.
How precisely are national security requests reported?
US law restricts how precisely those requests can be reported. We report them as precisely as the law allows.
Contact
Legal process must be served on PacinfraX Corporation, Attn: Legal, 19900 MacArthur Boulevard, Suite 915, Irvine, CA 92612. Questions: [email protected].