Law Enforcement Request Policy

1. Our position, in plain English

We do not hand over customer data just because someone official asks for it. We disclose customer data to law enforcement only when we receive valid legal process that compels us to, we read every request as narrowly as the law allows, and we tell the affected customer before we disclose anything unless the law forbids it. We do not sell personal data and we do not give any government bulk or standing access to our systems.

This policy is published by PingStuff (operated by 9950931 Canada Inc., carrying on business as PingStuff.com, 2240 University Ave E., Waterloo, Ontario N2K 0A9, Canada), a service governed by the laws of Ontario, Canada.

2. What we actually hold is limited

PingStuff is a website-monitoring service, and the data we hold reflects that. Before sending a request, agencies should understand what exists and what does not:

• We hold account details (email, optional first name, organization name), the URLs a customer monitors, technical check results about those websites, alert contact details, and message delivery logs. The full inventory and how long each item is kept is published in our Data Retention & Deletion Policy.
• We do not hold passwords (sign-in is passwordless), payment card numbers (Stripe processes payments), or browsing records of anyone visiting a customer’s website. Check results describe the customer’s own site’s technical health, not its visitors.
• Much of our data is short-lived or deliberately coarse. Anonymous check reports are automatically deleted after 7 days, message logs are pruned after 13 months, audit logs after 24 months, and raw check results age out after roughly 14 months. Several logs store only a partial network address (the /24 network for IPv4, the /48 network for IPv6) rather than a full IP. Once data has aged out of both its retention period and our backup rotation — 14 days for backups on our own server, up to 30 days for off-site copies — we no longer hold it and cannot produce it.

3. What we require before disclosing anything

Plain English: a request must be legally binding on us, correctly issued, and properly served. Informal requests — a phone call, an email on letterhead, a badge number — are not enough.

• Canadian agencies must provide valid legal process — a production order, warrant, or subpoena, as applicable under Canadian law — properly issued and served on 9950931 Canada Inc. (carrying on business as PingStuff.com), 2240 University Ave E., Waterloo, Ontario N2K 0A9, Canada.
• Agencies outside Canada must proceed through the mechanisms that exist for cross-border requests — a mutual legal assistance treaty (MLAT) or letters rogatory. We do not respond directly to foreign legal process.
• Every request must identify the requesting agency, the legal authority relied on, and the specific account(s) or record(s) sought.

4. We interpret requests narrowly

When we do receive valid legal process, we produce the narrowest set of records that satisfies it — nothing more. We object to and, where appropriate, challenge requests that are overbroad, vague, improperly issued, or that seek data about customers not named in the process. If a request asks for “everything” about a customer, we push back.

5. We notify the affected customer

Our default is transparency with our own customers. Before disclosing a customer’s data we notify that customer, so they can seek their own legal remedies, unless:

• we are legally prohibited from doing so (for example, by a non-disclosure order), or
• the request is an emergency involving imminent danger of death or serious physical harm, where notice would defeat the purpose of the emergency response.

Where a non-disclosure obligation is time-limited, we intend to notify the customer once it lapses.

6. Emergency requests

We review emergency disclosure requests case-by-case. If we believe in good faith that disclosure is necessary to prevent imminent death or serious physical injury, we may disclose narrowly-scoped data without waiting for formal process. An emergency request should come from an official agency channel and explain, in writing: the nature of the emergency, why it is imminent, exactly what data is sought, and why that data would help. We may seek follow-up legal process after an emergency disclosure.

7. How to submit a request

Send legal process and law-enforcement enquiries to legal@pingstuff.com and, to make sure it reaches us reliably, also submit it via the contact form at pingstuff.com/contact. Requests should be addressed to 9950931 Canada Inc. (carrying on business as PingStuff.com), 2240 University Ave E., Waterloo, Ontario N2K 0A9, Canada. Accepting service by email is a courtesy and does not waive any objection, including to jurisdiction or proper service.

8. Cost recovery and questions

Where the law permits, we may seek reimbursement for the costs of responding to legal process. Customers with questions about this policy can reach us the same way — email legal@pingstuff.com or use the contact form at pingstuff.com/contact.