Law enforcement
& data requests.
We require valid legal process, disclose the minimum necessary, and tell you when your data is requested — unless the law forbids us from saying so.
Effective Date: October 14, 2026 Last Revised: October 14, 2026
This policy explains how maildx responds to requests for customer data from government agencies, courts, and law enforcement, and what we will do if we receive one affecting your workspace.
1. Principles
- We require legal process. We do not voluntarily hand over customer data to an authority that merely asks.
- We review every request. Each is checked for validity, scope, and jurisdiction before anything is disclosed.
- We disclose the minimum. Where we are compelled to disclose, we provide the narrowest set of records that satisfies the request.
- We push back on overreach. Requests that are vague, excessive, or outside the issuing authority's jurisdiction are challenged or narrowed.
- We tell you, unless we are legally barred. You should not learn about a request for your data from someone else.
2. Submitting a request
Send requests to legal@maildx.dev, marked for the attention of the Legal & Compliance team.
A valid request must include:
- The issuing authority and the name and contact details of the requesting officer.
- The specific legal instrument — court order, warrant, summons, or statutory provision — and the jurisdiction it derives from.
- The precise data sought, and the workspace, domain, or account it relates to.
- The offence or matter under investigation, to the extent disclosable.
- The deadline, and the legal basis for that deadline.
We will not accept requests sent only through a support channel, a chat message, or a phone call. An informal request may be actioned only for an emergency as described in section 5.
3. What we can and cannot provide
Because of how maildx is built, some categories of data are more available than others, and we will tell you plainly which is which.
| Data | Availability |
|---|---|
| Account identity: name, email, workspace, role, sign-in timestamps | Held as data fiduciary for our own customers |
| Support conversations, messages, and attachments metadata | Held as data processor on behalf of the customer (the data fiduciary) |
| AI run records: model, sources cited, confidence, decision | Derived records, held as processor |
| Audit events: settings changes, ticket actions, kill switch, exports | Held; retained per policy |
| Passwords | We do not hold any. Sign-in uses emailed one-time codes |
| Payment card data | We do not hold any. There is no payment integration at this time |
| Email bodies of conversations deleted by the retention purge | Irrecoverable — permanently erased, with no backup copy |
We cannot produce data that has been permanently erased, and we will not represent otherwise.
4. Notice to the customer
Unless legally prohibited — for example by a gag order or a statutory non-disclosure obligation — we will:
- Notify the affected customer that we have received a request for their data.
- Tell them what is sought and by whom, to the extent we are permitted.
- Give them a reasonable opportunity to object or to seek a protective order.
Where we are prohibited from notifying, we will say so if and when the prohibition is lifted, and we will seek permission to notify where a prohibition is discretionary rather than mandatory.
5. Emergency requests
Where there is an imminent risk of death or serious physical harm, we may disclose limited data without prior legal process. We will:
- Require the request in writing from a named officer, stating the emergency and the specific risk.
- Disclose only what is necessary to address that risk.
- Document the disclosure and follow up to obtain the legal process that would ordinarily be required.
This is a narrow exception, used only for genuine emergencies.
6. Cross-border requests
maildx processes data using infrastructure located in the regions described on our Sub-Processors page. A request from an authority outside the jurisdiction where the data is held must be routed through the appropriate mutual legal assistance process, or be independently enforceable in that jurisdiction.
We will not transfer data in response to a foreign order where doing so would breach the law applicable to the data.
7. Cost recovery
Where the law permits, we may charge the requesting authority the reasonable cost of locating, reviewing, and producing the records, particularly for requests that are broad or repeated.
8. Transparency reporting
We intend to publish an annual transparency report stating the number of requests received, the number complied with in whole or in part, the number rejected or challenged, and the number of customers notified — reported in bands, and only where doing so does not breach a legal prohibition or compromise an investigation.
At present, we have received no such requests.
9. Preservation requests
We may preserve records on receipt of a valid preservation request pending legal process, for up to 90 days, renewable where the law allows. Preservation suspends the normal retention purge for the specific records identified, and we will tell the affected customer unless prohibited.
10. Contact
- Legal & Compliance:
legal@maildx.dev - Privacy matters:
privacy@maildx.dev - All contacts: see the Contact & Grievance page