We are a host. Content on this network was put there by a customer, not by us, and we do not review it in advance. That is the position the law takes about hosts almost everywhere, and it is the position this page works from.
It does not mean nothing gets removed. Removal follows a process, applies the law of the place the server sits in, and produces a written outcome either way.
1. Where to send a report
Everything goes to [email protected]. The desk is staffed at all hours, an OpenPGP key for encrypted submissions is published on the security page (/security), and a case number comes back within four hours.
Reports sent to sales, to support, to a social account, or to an engineer whose address you found somewhere are not reports. They get moved to the right queue, which costs you the time we spend moving them.
2. What a useful report contains
A report has to be matchable to a customer without us guessing. That takes six things.
- The address on our network, exactly as observed.
- Timestamps with a UTC offset, in a format that has a year in it. This is the single most common reason a report cannot be actioned.
- Protocol and port.
- Unedited log lines, packet captures or headers. A screenshot of a paragraph is not evidence of anything.
- What was harmed, in one sentence.
- What you want done, and a contact address that a human answers.
Reports arriving without timestamps are closed with an explanation. Automated submissions from established feeds are welcome and are read by a person like everything else.
3. Response times
Acknowledgement inside four hours, with a case number you can quote. Most cases get a substantive human answer well inside the first working day.
The four categories in the acceptable use policy (/legal/aup) that carry no notice period are actioned as soon as they are confirmed, which in practice has been between twelve minutes and two hours. Everything else follows the escalation ladder in that policy: notice to the customer, then a null-route, then suspension, with a day at each rung.
4. Copyright notices
Send a notice with the work identified, the exact URL where it appears, a statement that you believe in good faith the use is unauthorised, a statement that the information is accurate and that you are the rights holder or authorised to act, and a signature. Where the law applying to the site requires the accuracy statement to be made under penalty of perjury, make it in those terms.
What happens next depends on where the server is, and this is the part most complainants are not expecting. A takedown built on one country’s statute does not travel automatically to an instance in Chișinău, Panama City or Singapore. We apply the law of the site, not the law of the sender. Where that law obliges a host to act on a compliant notice, we act inside the statutory window and tell the customer. Otherwise we forward the notice and let the two of you settle it, which is what a host without the right to judge the merits should do.
Misrepresenting ownership in a notice carries consequences in most of the jurisdictions we operate in, and we have referred senders to them.
5. What we do not remove
- Lawful adult content, including material somebody finds distasteful.
- Political speech, opposition media, leak archives and criticism of companies, including complaints from the company being criticised.
- Documents already published elsewhere, where the request is really about reputation rather than rights.
- Anything supported only by a threat, an unsigned letter, or a claim that we would understand if we knew who was asking.
- Content whose only defect is that it is legal where it sits and illegal somewhere else.
Requests of this kind get a short, polite refusal with a reference to this section. Persisting does not change the answer.
6. Counter-notice
A customer whose content has been removed under a copyright notice can file a counter-notice within ten working days. It needs the material and its location, a statement that the removal was a mistake or a misidentification, contact details, and consent to the competent jurisdiction where the applicable law requires it.
Once a valid counter-notice arrives, the complainant is informed and has ten working days to show that proceedings have been started. Absent that, the material goes back within a further four working days. Nobody is asked to prove their case to us, because deciding who owns what is not a job a hosting company should be doing.
7. Repeat infringers
We count substantiated notices, meaning ones the customer did not counter or where the counter-notice failed. Three inside ninety days triggers a review of the account and a conversation about what is being hosted. Five terminates it.
The counter is per account, not per instance, and moving content to a new city does not reset it. Notices that were withdrawn, refused, or found to be misdirected do not count towards anything.
8. Law enforcement
Requests must arrive through a channel the jurisdiction of the site recognises, from an address belonging to the requesting body. An email from a personal account is not a legal request no matter how it is worded, and it is declined in a single sentence.
What can actually be produced is listed in the privacy policy (/legal/privacy) and it amounts to an email address, a password hash nobody can reverse, invoice records with no identity in them, and a panel access log that is seven days old at most. There is no traffic log, no sign-up address, and no identity document, because none of those things is ever written down.
Where notification is permitted, the customer is told before anything is handed over. Emergency disclosure happens only where there is a credible, documented risk to someone’s life, and every instance of it appears in the transparency report (/transparency). The warrant canary (/canary) is signed monthly and its absence would say more than any statement we could make here.
9. Jurisdiction
Thirty-four sites sit in twenty-nine countries, and the law that governs a piece of content is the law of the country hosting it. Not ours, not the complainant’s, and not the customer’s. Choosing a site is choosing a legal regime, which is why the location index (/locations) lists them plainly and why a fair number of our customers pick a city before they pick a plan.