Law enforcement

Cloudflare generally requires a court-issued warrant or other court order before providing any other type of information regularly requested by law enforcement. Cloudflare rarely has data responsive to court orders seeking transactional data related to a customer’s website, such as logs of the IP addresses visiting a customer’s website or the dates, because we retain such data (if at all) for only a limited amount of time. We provide limited forward looking metadata in response to US court orders for that purpose that we periodically receive. Cloudflare is not generally a hosting provider or an email service provider and does not have customer content -- like email or other types of customer-generated material -- in the traditional sense.

In accordance with US law, Cloudflare may disclose information without delay to law enforcement if the request involves imminent danger of death or serious injury to any person. Cloudflare will evaluate emergency disclosure requests on a case-by-case basis. Law enforcement officials with emergency requests can contact us at abuse+law@cloudflare.com.

Cloudflare has long held the view that non-US governments should have to follow the same due process requirements to obtain any records about our customers. A number of US laws, like the Stored Communications Act or the Electronic Communications Privacy Act restrict companies from providing particular types of data, such as the content of communications, to any person or entity, including foreign law enforcement agencies, without US legal process. While there may be situations in which it might be appropriate to provide basic subscriber information in response to non-US legal process that complies with principles of due process, we generally believe that the best way forward at this time is for governments outside the United States to issue requests to us through a US court by way of diplomatic process like a mutual legal assistance treaty (MLAT) request.