Law Enforcement Guide
1. Purpose
This guide explains how Voxgrid Inc (“sip.io”) responds to requests for information from law enforcement agencies, courts, regulators and other government authorities (“authorities”). It is intended for authorities and to inform our customers. It does not create rights for any third party and may be updated at any time.
We respect the privacy of our customers and the people they communicate with, and we also support legitimate efforts to investigate crime, protect public safety and stop illegal robocalls and fraud.
2. About our services and customers
sip.io provides cloud communications infrastructure to businesses. Most of our customers are companies, and many are resellers or software developers whose own end users we do not know directly. When a number or call is associated with sip.io, the relevant user is usually a customer of our customer. In many cases the most effective route is to approach the business that uses our Services; we can identify that business in response to valid legal process.
A number that appears to be ours may have been ported away, spoofed by a third party, or used over a BYOC trunk where a different carrier is responsible.
3. What data we may have
Depending on the service, the account’s configuration and our retention periods (see the Privacy Policy), we may hold:
- Subscriber information: account holder name, business name, email, phone, billing address, KYC documents, account creation date, payment records (we do not hold full card numbers).
- Number assignment data: which account a number was assigned to and when, and porting history.
- Call detail records (CDRs): calling and called numbers, date, time, duration and route. CDRs are kept in our primary database for 90 days and archived thereafter for the period required by law.
- Message metadata: sender, recipient, timestamps and delivery status.
- SIP signalling and IP data: IP addresses, user agents and registration events, retained for a limited period.
- Stored content: call recordings, voicemail, transcripts and message content, only if the customer enabled these features and only for the retention period the customer configured (recordings default 30 days; messages default 365 days). Many accounts store no content at all.
Data that has been deleted under our retention schedule is not recoverable.
4. Valid legal process required
We disclose customer data only in response to valid legal process issued under applicable law, or as described in section 5 for emergencies. As a general guide:
- Subscriber information requires a subpoena, court order or equivalent legal process.
- Non-content records such as CDRs, message metadata and IP logs require a court order or equivalent legal process meeting the legal standard for such records in the requesting jurisdiction (in the United States, for example, a court order under 18 U.S.C. § 2703(d) or a search warrant).
- Stored content such as recordings, voicemail or message content requires a search warrant or equivalent process with a judicial authorisation.
Requests must be in writing, on official letterhead, identify the requesting authority and officer, cite the legal authority, specify the data sought with particularity (number, account identifier, and a date range with time zone), and be sent from an official government email domain. We will reject or seek to narrow requests that are overbroad, unclear or not legally valid.
We do not provide information in response to informal or verbal requests, except emergencies.
5. Emergency disclosure requests
Where we believe in good faith that an emergency involving imminent danger of death or serious physical injury to any person requires disclosure without delay, we may disclose information voluntarily to the extent permitted by law (for example under 18 U.S.C. § 2702 in the United States, or equivalent provisions elsewhere).
Emergency requests should be sent to lawenforcement@sip.io with “EMERGENCY” in the subject line and must describe the nature of the emergency, the person at risk, why the information is needed urgently, and the specific information sought. Emergency requests must be signed by an officer and are reviewed on a priority basis. We may ask for follow-up legal process after the emergency.
Emergency calls placed through our network are routed to public safety answering points as described on our Emergency Services page; this section concerns requests for stored data.
6. International requests
We are established in the United States (Voxgrid Inc is a Delaware corporation based in Florida). Requests from authorities outside the United States should generally be made through a mutual legal assistance treaty (MLAT), letters rogatory, or another recognised mechanism for international cooperation, such as the EU e-Evidence framework or a bilateral agreement under the US CLOUD Act where applicable. We may respond directly to a foreign request where US law and the law applicable to the data permit it and the request meets the standards in this guide.
7. Preservation requests
We will honour a written request to preserve specific records pending the issue of legal process, for an initial period of 90 days, which may be extended once on written request, where such preservation is permitted by law. Preservation requests should identify the account or number and the date range. Preserved data is disclosed only on receipt of valid legal process. Because of short retention periods, preservation requests should be sent as early as possible.
8. Customer notice
Our policy is to notify customers of requests for their data before disclosure, so they can seek legal remedies, unless:
- we are prohibited from doing so by law or court order (such as a non-disclosure order);
- notice would create a risk of death or serious physical injury, or the case involves an emergency; or
- the account has been used for fraud, abuse or to harm children, or notice would be futile or counterproductive.
Where notice is delayed by a non-disclosure order, we will notify the customer when the order expires, unless doing so is still prohibited. Where the data relates to a reseller’s sub-account, we normally notify the reseller.
9. Interception and real-time access
sip.io does not provide interception or real-time monitoring of communications except where we are technically able to and are legally required to do so under applicable law, such as the Communications Assistance for Law Enforcement Act (“CALEA”) in the United States or equivalent laws in other jurisdictions, and only on presentation of the required legal authority. CALEA and interception enquiries go to lawenforcement@sip.io. Calls carried over a customer’s BYOC trunk may fall under the interception obligations of the customer’s own carrier.
We do not install backdoors in our Services and we do not voluntarily give authorities direct access to our systems.
10. How to submit a request
Send requests to lawenforcement@sip.io. Formal service of process may also be made to Voxgrid Inc, Attn: Legal, 1646 W Snow Ave, Ste 169, Tampa, FL 33606, USA. This contact is for authorities only. Customers and members of the public should use support@sip.io, and abuse reports should be made through Report Abuse.
Acceptance of a request through these channels does not waive any objection, including to jurisdiction or the validity of process.
11. Robocall traceback
Industry traceback requests (for example from the USTelecom Industry Traceback Group) are handled under our Report Abuse process and are not treated as legal process for subscriber information.
12. Costs
We may seek reimbursement of reasonable costs incurred in responding to requests, where permitted by law.
13. Transparency
We may publish information about the number and types of government requests we receive and how we respond, to the extent permitted by law.