Legal Requests and Security

EvidentlySo users are often in court cases, so subpoenas and records requests are likely. This page tells users, lawyers and police what we have and how we answer, and how to report a security problem.

Part 1: Subpoenas, court orders and law-enforcement requests

What we don't have

We don't have anyone's text messages, pictures, contacts, snapshots or PDFs. EvidentlySo makes them on the user's own device and saves them to the user's own cloud storage. We can't produce what we never receive. Requests for message content should go to the person who holds the device or cloud account, or to their carrier or cloud provider.

What we may have

Depending on the request, we may hold:

License records: the license key, Stripe's customer reference, paid-through dates, a scrambled phone code, and when the license was activated and last moved to another phone. We don't store the buyer's name or email ourselves, but we can look them up in Stripe.
PDF registry records: a PDF's fingerprint (SHA-256 hash), its Transcript ID and the time the fingerprint reached our registry. These can show that a particular PDF was made with EvidentlySo and when, if you already have the PDF. They can't show what the PDF says.
Support messages someone sent us, while we still keep them.
Updates sign-ups (an email address) held by HubSpot.
Payment records held by Stripe/Link as merchant of record. We see the buyer's email, amount and date, not card numbers. Requests for payment details should go to Stripe.

See our Privacy Policy for how long we keep each of these.

Checking a PDF without asking us

Anyone holding a PDF can check it on our Check a PDF page (EvidentlySo.com/Verify). The page computes the fingerprint in the browser and tells you whether it matches our registry and when it arrived. The PDF itself is never uploaded. Most parties won't need a subpoena for this. [Optional: we can provide a business-records declaration about how the registry works, for a reasonable fee. Attorney to decide.]

How we respond

Valid legal process required. We disclose user records only in response to a valid subpoena, court order or search warrant that applies to us, or with the user's written consent.
Narrow requests. We'll ask that requests be as narrow as possible, and we may object to requests that are overbroad, unclear or not properly served.
We tell users first. Unless the law or a court order forbids it, we'll notify the affected user before we disclose their records, and give them [10] days to object or seek protection from the court. We may skip notice in an emergency or where notice would be futile.
Emergencies. If we believe in good faith that someone faces an imminent risk of death or serious physical injury, we may share the limited records we have with law enforcement without process.
Costs. We may ask the requesting party to cover reasonable costs of finding and producing records, as the law allows.
No content. Because we hold no message content, we'll say so in writing when asked.

Where to send requests

Family Docs, Inc., Attn: Legal Requests, 3440 Youngfield St. #423, Wheat Ridge, CO 80033 · support@evidentlyso.com with "Legal request" in the subject. [Confirm Family Docs' registered agent for service of process; formal service goes to the registered agent.]

Transparency

[Optional: we may publish a yearly count of requests we receive and how we responded.]

Part 2: Security

How we protect what we hold

We keep as little as we can: no message content, no card numbers, no contacts.
Connections between the app, our website and our servers use HTTPS.
Device codes are scrambled (hashed) on the phone before they're sent.
The license key is kept in the phone's secure key store, and the app connects only to your cloud storage, our license service and our registry.
Access to our systems is limited to the people who need it, with [two-factor authentication] on the accounts that hold user data.

What users should do

Your snapshots and PDFs are only as safe as your phone and your cloud storage account. Use a screen lock, keep your phone updated, and turn on two-step verification for your cloud storage account.

Reporting a security problem

If you find a security problem in EvidentlySo or evidentlyso.com, email support@evidentlyso.com with "Security" in the subject [or security@evidentlyso.com]. Please give us a reasonable chance to fix it before telling anyone else, and don't access, change or delete other people's data while testing. We won't take legal action against good-faith research that follows these rules. [Optional: publish /.well-known/security.txt pointing here.]

If something goes wrong

If a security incident affects your personal information, we'll tell you and any regulators as the law requires.