Legal Process Policy

Scope

This Legal Process Policy describes how CustodyComms, Inc. responds to subpoenas, court orders, and other forms of legal process (collectively, “Legal Process”) served on CustodyComms in connection with user accounts, communications, or use of the Service.

What CustodyComms can and cannot produce

The CustodyComms desktop application is local-first. Case content, message content, and related case data imported into it are stored on the user’s device. For case content a user never shares or sends, no copy reaches CustodyComms’ storage, and CustodyComms is unable to produce the substantive content of those communications in response to Legal Process, including subpoenas directed at message content. When a user turns on cloud AI for an incident, that incident’s messages pass through CustodyComms’ server to OpenAI and are not kept in CustodyComms’ databases.

Content a user uploads to the CustodyComms website, including a conversation file for the try-the-product demo at /try, is processed on CustodyComms’ servers as described in the Privacy Policy, and a report sent to a phone can be opened by CustodyComms for as long as it exists.

A shared case is different in what CustodyComms stores. When a user opts in to encrypted sharing, the case data is encrypted on that user’s device before it is uploaded, and the user’s own devices and each recipient’s devices are each given their own key to open it. CustodyComms stores the encrypted package but does not keep a key that opens a case shared from version 2.0 or later. A report sent to a phone from the CustodyComms website is different: CustodyComms can open it for as long as it exists. When a user invites someone whose CustodyComms is not yet set up to receive the case, and whenever a user invites a recipient by email from version 1.1 or later of the iPhone app, the invitation email carries a key made for that invitation, which passes through CustodyComms’ servers and email provider on its way to the recipient. CustodyComms does not record that key. It keeps a fingerprint of it and a copy of the case key that it unlocks, until the user revokes that recipient or deletes the share. For that time, the invitation key, the recipient’s email address, that copy and the stored package together could open the version of the case that was current when the invitation was sent. CustodyComms does not read the contents of cases shared from the applications.

A case shared from a version of CustodyComms earlier than 2.0 may also carry a further copy of the key, stored with the share and wrapped under a key CustodyComms’ own systems can derive, so CustodyComms holds the technical means to open it, and such a case is not beyond the reach of Legal Process directed at CustodyComms.

Revoking a recipient’s access means that recipient is given no key to any later update. Deleting a share removes its encrypted files from CustodyComms’ storage. Neither reaches anything a recipient has already exported, printed or copied, and a copy already on a recipient’s computer stays there. After a revoke, the CustodyComms iPhone app deletes its own copy of a case shared from the applications the next time that recipient opens it while online; deleting a share does not remove a copy already on a recipient’s iPhone.

Being technically able to open a record does not by itself mean CustodyComms may disclose it. Where a law restricts disclosure of stored content, CustodyComms discloses it only on a legal basis that law accepts. A private civil subpoena does not, by itself, authorize disclosure of communications content protected by the Stored Communications Act. Subject to that, CustodyComms may be able to produce account records that it does maintain on its servers, including the registered account email, account creation date, login event records, device identifier records, subscription status, the email addresses of a share’s recipients, and similar account records. A share also carries the matter’s name and any note the sender typed, which CustodyComms holds in readable form; these are things a user wrote, not account records. CustodyComms also holds the encrypted package of a shared case, and content uploaded to the CustodyComms website for as long as it keeps it. The specific records available depend on the user, the time period requested, and the state of CustodyComms’ data retention policies described in the Privacy Policy.

Fees and cost recovery

CustodyComms may seek reimbursement of reasonable costs of responding to Legal Process from an appropriate requesting party where permitted by law or ordered by a court, including reasonable attorney, engineering, certification, retrieval, production, and testimony-related costs. CustodyComms does not charge a user’s saved payment method for Legal Process, and it does not condition compliance with a binding order on prepayment. CustodyComms may publish a specific fee schedule in this Policy in the future; in the absence of a published schedule, any reimbursement sought will be calculated on a reasonable hourly basis at then-current rates and communicated to the requesting party before production.

Notice to users

Where permitted by law, CustodyComms will use reasonable efforts to notify the affected user that Legal Process has been served. CustodyComms will not provide such notice where prohibited by law (for example, by a court-ordered non-disclosure obligation attached to the Legal Process itself) or where CustodyComms determines, in its sole discretion, that notice would be likely to result in destruction of evidence, witness tampering, harm to the safety of any person, or violation of applicable law.

How to serve Legal Process

Subpoenas, court orders, and other Legal Process should be directed to CustodyComms, Inc., 131 Continental Dr., Suite 305, Newark, DE 19713, USA, or by email to legal@custodycomms.com with subject line beginning “Legal Process.” Acceptance of service by email is at CustodyComms’ discretion. CustodyComms does not agree to accept service of Legal Process by email unless it expressly says so for a particular matter.

Testimony and additional work

Lawful process may require testimony, a certification, or existing technical information, and CustodyComms complies with binding obligations. Voluntary expert services, or work beyond what the law requires, may require a separate written scope and fee agreement.

Changes

CustodyComms may update this Legal Process Policy from time to time. The version in effect at the time CustodyComms responds to a particular Legal Process governs that response. An update does not reduce obligations imposed by applicable law or override commitments in the Terms of Service and Privacy Policy.