When authorities ask for data
Every serious provider receives these requests. What matters is the process they are held to, so here is ours in plain terms.
What we actually hold
Less than people assume. We hold what is needed to run the business and the network: your account and contact details, your invoices and payments, the tickets you have opened, which addresses and machines are assigned to you, and operational logs kept for a short period.
We do not perform data retention. There is no general obligation in the Netherlands to retain traffic data for hosting services, and we do not keep logs for the purpose of handing them over later. We do not hold the contents of your servers — the machines are unmanaged and the data on them is yours, as what unmanaged means explains.
What we hold about you is set out in our privacy statement, and the roles are defined in the data processing agreement.
What we require before disclosing anything
A request has to be lawful and it has to be addressed properly. In practice that means:
- It comes from a competent authority with jurisdiction over us — Dutch authorities, or a foreign request routed through the proper mutual legal assistance channel. An email from a foreign police force is not in itself an order we can act on.
- It is specific. A request naming a particular address, account or timeframe can be answered; a general trawl cannot.
- It has a legal basis we can verify, and we disclose no more than that basis requires.
We take legal advice where a request is unclear or appears to exceed what the authority may ask for, and we have refused requests that did not meet these standards.
Removal orders
Separate from data requests, an authority may order content removed. Under EU Regulation 2021/784 an order concerning terrorist content must be acted on within one hour, and we are set up to do that. Other orders are handled on their own terms and within their own deadlines. The obligations this places on you, if you host content for others, are in the acceptable use policy — see also streaming and high-bandwidth delivery.
Whether you are told
Our default is to tell you that your data has been requested, so that you can take your own legal advice. We will not do so where the law forbids it, or where an order explicitly prohibits notification — which does happen in criminal investigations.
Where we are prevented from telling you at the time, we will tell you afterwards if and when that prohibition lifts.
Abuse complaints are a different thing
Most of what reaches our abuse desk is not law enforcement: it is copyright notices, spam reports and security reports. Those are handled under the AUP, and you get the complaint and a chance to deal with it. See what to do with an abuse notice.
If you are the one who needs this
If you have been asked for data about your own customers, remember that for the content of your servers you are the controller and we are not. We cannot answer for you and we cannot access your machines to produce it. Build the ability to respond into your own systems; it is much harder to retrofit under a deadline.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base