We have published these guidelines to provide guidance for law enforcement authorities seeking information about our customers from Fastly.
Nothing in these guidelines is meant to create any enforceable rights against Fastly, and our guidelines (including descriptions of our business and data handling practices) are subject to change. These guidelines are not intended for requests for information by private parties in civil litigation, criminal defendants, or third parties seeking information about our customers’ content or use of our services. Complaints about customers’ content or use of the Fastly services should be directed to email@example.com as specified in our Acceptable Use Policy.
Fastly offers content delivery, security, and computing services across a global network. These services are used to secure and enhance websites and internet-facing applications. Fastly is not a traditional hosting provider, and we are unlikely to have in our possession content that a hosting provider has such as web pages or user messages. Our delivery and security services protect and accelerate web content published by our customers. That content is ultimately hosted, however, on servers or other services controlled by our customers even though delivery to our customers’ end-users is made over Fastly-controlled IP addresses. Because we use Fastly-controlled IP addresses when providing our internet intermediary services, certain internet records (such as WHOIS search results) might indicate Fastly is “hosting” a particular website or content, even though the content is hosted elsewhere.
Fastly is not subject to the Communications Assistance for Law Enforcement Act, 47 U.S.C. §§ 1001, et. seq. (“CALEA”), because it is not a telecommunications carrier as defined by CALEA. Further, Fastly’s services do not support interception capabilities.
For all Fastly customers, Fastly has account information that includes customer names, contact information, services purchased, and billing information. Fastly may have additional business (and non-content) information, depending on the product or services a customer uses, which may include Fastly service usage history, and records of access to administrative systems by customer personnel.
As a service provider, Fastly also processes customer content, such as data that our customers submit or caused to be submitted to our services.
We empower our customers to collect the data they need. We enable our customers to capture real-time request log information, but we do not keep such information unless either instructed by our customer or when limited logging is necessary to provide a specific customer-requested service. We consider data governance when designing and selecting systems and do not create, collect, or retain more data than we need. When we offer services that require us to temporarily collect data, such as monitoring services, we keep that data for a limited time before it is automatically deleted. As a result, Fastly is highly unlikely to have data responsive to requests seeking transactional data about our customers’ end-users’ interactions with our customers.
We believe that our customers, not Fastly, should respond to all-third party requests related to their use of our services (including information about our customers’ users). The contracts that we enter into for our internet intermediary and edge cloud services require our customers to address all third-party requests we receive regarding data they transmit or cause to be transmitted through our services, including any request we receive from law enforcement authorities and government agencies. The relevant customer is required to resolve the issue directly with the individual or entity that makes the request. If the customer fails to do that, we reserve the right to suspend their access to our services. We believe that this process should apply even when governments are making the request.
For purposes of these guidelines, a “customer” is a Fastly subscriber except for those on a “free trial” account, as described here. Free trial accounts are not supposed to use Fastly to transmit production traffic.
|If sending your request by:||Send it to:|
|Email (must be used for law enforcement requests unless otherwise required by law)||firstname.lastname@example.org|
|Physical (only where required)||Please alert email@example.com if you wish to make delivery by mail or in person and we will provide an appropriate and accessible location or mailing address.|
All law enforcement requests must:
To enable us to verify that a request is from an official law enforcement agency, requests must include at least the following information:
Requests from law enforcement outside of the United States must be issued pursuant to applicable laws and through official channels. A Mutual Legal Assistance Treaty request, a request from a country meeting the obligations under the CLOUD Act, or letters rogatory may be required.
Law enforcement seeking information from Fastly are, in most cases, able to obtain the information they seek directly from Fastly’s customers without compromising investigations or causing risk to individuals. We may provide law enforcement with contact information of our customers as appropriate. Specifically, our contracts require our customers to provide Fastly with a contact address for handling all third-party requests related to their content or use of the services. We are permitted to share that designated contact with any third party, including law enforcement.
Our Terms of Service regarding compelled disclosure require Fastly to notify our customers prior to any disclosure of their confidential information unless explicitly prohibited by law.
Fastly requires nondisclosure orders to include a specified time period (e.g., 90 days) during which we are prohibited from notifying the customer. Where appropriate, we will challenge nondisclosure orders in court. Fastly will provide notice to customers upon the expiration of a valid nondisclosure order.
Fastly will not release customer information or content unless properly served with a valid and binding legal demand that compels Fastly to produce the requested information.
Fastly objects to overbroad or otherwise inappropriate demands as a matter of course.
Where compelled by law, in response to valid and binding subpoenas, Fastly will disclose customer information, which may include a customer’s name, address, email address, account creation date, and billing information.
Any customer content, including personal data, that our customers submit or cause to be submitted to our services will not be disclosed in response to a subpoena.
Fastly will not produce customer content unless we are served with a valid search warrant issued under procedures set forth in the Federal Rules of Criminal Procedure and the United States Constitution or equivalent procedures upon a showing of probable cause that compels Fastly to produce such information.
Fastly will preserve customer information (which may include a customer’s name, address, email address, account creation date, and billing information) pursuant to a valid request for preservation not to exceed 90 days. Preservation requests, in accordance with applicable law, should include the following information:
Fastly will not disclose any preserved information without law enforcement otherwise meeting the requirements for disclosure set forth in these guidelines.
While Fastly does not commit to producing records under any set of circumstances or within a particular timeline and may request additional information to verify the nature of the emergency request and/or the identity of the person making the emergency request, any emergency request must:
In addition to applicable law, our acceptable use policy (which is incorporated into our terms of service) prohibits the use of Fastly’s services for the purposes of exploiting or attempting to exploit minors in any way. If a law enforcement request relates to child safety, please put “CHILD SAFETY” in the subject line of the request.
Fastly reports any apparent instance of child exploitation detected on our services to the National Center for Missing and Exploited Children, including content identified within a law enforcement request.
Consistent with applicable law, Fastly may seek reimbursement for costs to comply with requests from law enforcement. Fastly does not seek reimbursement for compliance associated with emergency disclosure requests or child safety matters.