Law enforcement requests

The content of your mail can be released only on a decision of a court or a prosecutor. Where police request content without one, we require that decision before we disclose anything.

Account details and connection records are treated differently. Who holds a mailbox, and the addresses and times it connects from, can be obtained by police and security services on a written request, without a court order. This follows from the law that applies to us.

Live interception requires a court order. The law asks a business of our size to cooperate through the systems it already operates. It does not require us to build an interception capability.

Since August 2026, authorities in other EU member states can send us production and preservation orders directly.

We tell you when your data has been handed over, unless the law or the order forbids it, or telling you would damage an investigation. Where notice is only delayed, we tell you as soon as the restriction lifts.

Some measures are classified. Where that applies, we are forbidden both to tell you and to tell you that we cannot.

We keep server logs for fourteen days, after which they are deleted automatically. Logs are not included in our backups. The mail server itself is backed up every night, so mail you delete can remain in an encrypted backup for up to a further two weeks.

We can be ordered to preserve specific data we already hold, in a named case, for up to ninety days.

We hold as little data as running the service requires.

A request from an authority outside the EU, including a subpoena or warrant sent to us directly from the United States, does not by itself oblige us to disclose your data, and we do not act on one. The lawful route runs through mutual legal assistance, and a valid request reaches us as a decision of a court or prosecutor in the country where we are established. The rules above then apply.

In an emergency where somebody's life is at risk, we point the authority at police channels in our own country, which have their own lawful powers and can act faster than we can.

Two facts belong on this page. Your outgoing mail passes through Amazon in Frankfurt and our encrypted backups sit with Cloudflare. Both are US companies, answering to US law for what they hold. Our server stands in Finland, where Finnish authorities could act on it without us.

Send requests to legal@inboxfamily.com. We accept properly served orders only, we check every request with the authority that issued it, and we log every request we receive.

We do not publish statistics on the requests we receive. If that changes, this page will say so.