How We Handle Law Enforcement Requests

Unlike many other privacy-focused companies that talk tough for marketing reasons but respond to lawful requests just like any other company, we want to be fully transparent: black.com is a corporation operating under local laws and regulations and complies with lawful requests from authorities. Otherwise, our project would soon be no more.

This doesn’t mean we aren't critical or don't publicly raise our concerns about the ever-decreasing possibility of communicating and using the Internet privately. But rules and laws are made in parliaments, and for black.com, there are only two choices: either we follow the laws of a particular market or, if they go against our principles, we leave that market altogether.

Requests We've Received So Far

We've received three requests for user data so far. One came from the UK and asked us to cooperate voluntarily, which we don't do. One came from Germany and didn't follow formal standards. The last one came from Austrian authorities, acting on a request for legal assistance from a third country outside the EU.

Last updated: October 2026. We'll update this section as new requests arrive.

Who Can Request Data from black.com?

black.com GmbH is based in Vienna, so every request that can oblige us runs through Austrian law. Our email servers and database are hosted in the Equinix ZH5 datacenter in Zurich, Switzerland. Swiss authorities could act on those servers under Swiss law. They would find the same data we list below, but no keys to read your emails.

Authorities in Austria

In practice: account data, like your phone number, can be requested by investigating authorities, a public prosecutor or a court. Finding out which account used an IP address, or freezing data for up to 12 months so it isn't deleted, takes a public prosecutor. Seeing who you write to, or intercepting future emails, also needs a judge's approval, and only for offenses punishable by more than a year. Seizing stored data has needed a judge's approval since January 1, 2025.

When an authority asks for account data, such as your phone number, we have to hand it over right away (§ 138 Abs 2 StPO). For anything more, we need a written order from the prosecutor, plus a judge's approval where the law requires one. The only shortcut is an emergency: if someone's life or health is in acute danger, the authorities can ask us directly for account data and the IP address behind specific messages (§ 53 Abs 3a SPG).

The prosecutor has to tell you afterward that your data was requested, except for account data. They can wait, though, as long as telling you would put the investigation at risk (§ 138 Abs 5 StPO). A prosecutor can also require us to keep a request confidential (§ 138 Abs 3 StPO).

Austria has no general data retention. Its Constitutional Court struck it down in 2014, and no new law has replaced it. What remains is the case-by-case preservation of up to 12 months described above.

Authorities in Other EU Countries

Since August 18, 2026, prosecutors and judges anywhere in the EU can send their requests directly to us, under the EU's e-Evidence Regulation.

We normally have 10 days to respond, and 8 hours in a life-threatening emergency.

Authorities Outside the EU

Authorities from outside the EU can't oblige us to hand over anything directly. They have to ask Austria for legal assistance, under a treaty such as the one between Austria and the US. Austrian authorities then decide whether to carry out the request. If they do, they send it to us under Austrian law.

How We Check Every Request

1. We check that it's genuine and comes through an official channel.
2. We check the legal basis and the scope.
3. We hand over only what the request names, and only what we hold.
4. We tell you. Like Google, we let you know when someone requests your data, unless the law forbids it.
5. We count it in Figure 1 above.

Requests We Don't Answer

We don't hand over any data in response to these requests:

• Requests that skip legal assistance. An authority abroad may have a legal basis at home, but outside the EU, that basis only reaches us through Austria. The UK request we mentioned above was one of these.
• "Voluntary cooperation." We never hand over data as a favor. Only a request with a legal basis can oblige us.
• Informal requests. A phone call, an email from an unofficial address, a visit without paperwork. We ask for an official request and leave it there.
• Requests from companies or private individuals. We only answer authorities, through official channels. Support is a different matter: if you contact us about your own account, we'll of course help you.
• Requests from states that aren't internationally recognized, or from states under comprehensive sanctions.

A request that asks for more than the law allows gets narrowed to what the law allows.

What Data Can black.com Share with Authorities?

We can only hand over what we hold, and we only hold what we need to run your account. Here's all of it:

Two rows need context:

• Your phone number. We ask for it at sign-up mainly to keep spam accounts out and to limit the free plan to one account per number.
• Your IP address. We log it for sign-ins and account changes, not for every request your app makes, and you can see your own access log in your account. It never appears in the emails you send: our email server writes "from black.com" into the routing header instead.

When you delete an email, it leaves our database right away (from the trash, after 30 days), and its attachments follow within about a day. Our database backups are encrypted and locked for 14 days, so nobody can change them, us included. Your emails inside them stay end-to-end encrypted, so a backup holds nothing more readable than our live database does.

If you delete your account, we wait 14 days in case you change your mind. Then everything in the table is deleted, apart from logs and backups that expire on their own and a record of each web payment: date, plan, country, amount and Stripe's transaction ID. Austrian tax law requires us to keep it for seven years.

Data Held by the Services We Use

Like almost every internet company, we rely on a few outside services. Each of them holds some data of its own and answers to the law where it's based:

Cloudflare protects our servers against attacks. It sits between your app and our servers and decrypts the connection on the way through, so it sees what our servers see. What it can't read is end-to-end encrypted email between black.com users. If you'd like to see what Cloudflare is asked for, and what it hands over, it publishes a transparency report twice a year.

What We Can't Share, Even If Asked

We can't hand over certain things even when a request names them, because we never hold them in readable form:

• The subject, message and attachments of every email in your mailbox
• Your private keys, the passkey secret they come from and your 24-word recovery phrase

All of it is encrypted with keys that only exist on your personal devices. We only ever receive your public keys. How black.com encrypts your email explains how this works exactly.

So if a request asks for the contents of a user's emails, we can hand over exactly what we store: ciphertext, plus the sender, recipient, date and size of each email. Without the keys on that user's devices, the content stays unreadable, to us and to whoever receives it.

EU law agrees. The e-Evidence Regulation covers data "regardless of whether they are encrypted or not," but its preamble adds that it "should not lay down any obligation for service providers to decrypt data." As of today, no Austrian or EU law requires a provider to break end-to-end encryption.

When You Email Someone on Gmail: The Special Case of SMTP

There is one exception, and it's built into how email works.

Between black.com users, an email is encrypted on the sender's device and only decrypted on the recipient's. Email to and from other providers, like Gmail, travels over SMTP, the protocol every email server speaks, and SMTP has no idea what a key is. So for a short moment, our servers handle that email in readable form: an email from Gmail until we encrypt it with your key, and an email you send to Gmail from the moment you hit send until it leaves for Gmail's server. If an email has even one recipient outside black.com, CC included, the whole email takes that route.

That moment normally lasts only a few seconds. Our encryption article walks through every step.

It's also the one place where an authority could, in theory, ask us to copy content. Austrian law allows the interception of future messages, with a judge's approval, for offenses punishable by more than a year, and providers have to help (§ 135 Abs 3 and § 138 StPO). Say that happened for Alice, a black.com user:

1. Emails from Charlie, who uses Gmail, reach our servers readable, so we could be required to copy them before we encrypt them.
2. Alice's emails to Charlie are readable to our servers the moment she hits send. Same answer.
3. Alice's emails with Bob, who also uses black.com, are never readable on our servers. A copy would be ciphertext, plus who wrote to whom, and when.
4. Everything already in Alice's mailbox stays encrypted. An interception only reaches forward, never back.

This isn't hypothetical for the industry. In 2020, a German court required Tutanota, now Tuta, to hand over one account's future unencrypted emails. In 2021, Germany's Federal Court of Justice confirmed that email providers can be required to do this. As Tuta pointed out at the time, the order only reached newly sent unencrypted emails, not what was already stored.

This has never happened to us. It would mean building a system whose only purpose is copying a user's communications, which our infrastructure doesn't have today, and the request would have to clear the legal hurdles above. If we ever received one, we would challenge it in court and be as open about it as the law allows.

Could We Be Forced to Change Our Software?

On the web, technically yes. In our apps, it would be much harder.

Our web app downloads its encryption code from our servers every time you open it. A server that delivers code could, in theory, be made to deliver different code to one person. Our iOS and Android apps don't work that way. They come from Apple's and Google's app stores, and everyone gets the exact same version. To change the app for one person, we'd have to ship a new version to everyone.

That's one reason we built native apps with privacy and security in mind, and most of our users read their email there. We recommend them, and we think they're the nicest way to use black.com. Open-source code raises the bar again, because anyone can compare what's published with what runs. We're open-sourcing our code in 2026.

Public keys are the second place to watch. Today, your app trusts the public key our server hands it for each contact. A server that handed out a key of its own could quietly read along, an invisible extra recipient that cryptographers call a "ghost participant." That's exactly what end-to-end encryption is meant to rule out.

You can already check this yourself. On any end-to-end encrypted email from another black.com user, open the email's menu and choose Encryption, in the apps or on the web. You'll see the key fingerprints of everyone on the email. Compare them with your contact on a call or in person: if they match, nobody swapped a key in between.

From the first quarter of 2027, our apps will also pin keys, so your app remembers each contact's key and warns you if it ever changes. The longer-term answer is verifiable key directories (Matthew Green explains why they matter), which WhatsApp started rolling out in 2023.

As far as we know, no Austrian authority has ever required a provider to change its code or hand out a fake key.

Where We Draw the Line

We're European, and we love Europe. But we won't cross certain lines. If a law ever required us to introduce backdoors into our product or hand over your keys, it would defeat the reason black.com exists. In that case, we would stop operating in that specific jurisdiction and remove our services there. Signal's president, Meredith Whittaker, took the same position in 2023: if the choice came down to building a backdoor or leaving, Signal would leave.

This wouldn't be the first time a company walks away from a market. In 2025, as Mark Gurman first reported, Apple stopped offering its end-to-end encryption for iCloud to new users in the UK, reportedly after the UK government demanded access to encrypted data. Apple said it has "never built a backdoor or master key to any of our products or services and we never will."

FAQ

Does black.com Share User Data with the Government?

Only when the law requires it. We answer lawful requests from authorities that reach us through an official channel, and we hand over only the data a request names. Informal requests and "voluntary cooperation" get nothing. So far, we've received three requests.

Can black.com Read or Decrypt My Emails?

No. Your emails are encrypted with keys that only exist on your devices, and we never receive them. The one exception is email to and from other providers, which our servers handle in readable form for a short moment, because SMTP requires it.

Does black.com Log IP Addresses?

Yes, for sign-ins and account changes, and we keep that history for one year. We don't log every request your app makes, and your IP address never appears in the emails you send. Cloudflare, which sits in front of our servers, sees your IP address with every request and keeps its own logs.

Is black.com Anonymous?

No. black.com is built for privacy, not anonymity. Every account needs a phone number at sign-up, and paid plans are linked to a payment through Stripe, Apple or Google. If you need to stay anonymous toward your email provider, a service that requires a phone number, ours included, is the wrong tool.

Will black.com Tell Me If Someone Requests My Data?

Yes, unless the law forbids it. Like Google, we let you know when someone requests your data. A prosecutor in Austria, or an authority in another EU country, can require us to keep a request confidential.

Can black.com Refuse a Request?

Yes, if it has no legal basis or doesn't come through an official channel. A lawful request is binding, though: refusing one can cost us fines of up to €10,000 (§ 93 StPO).

Does the US CLOUD Act Apply to black.com?

No. The CLOUD Act reaches companies under US jurisdiction, and black.com is an Austrian company. US authorities have to ask Austria for legal assistance. The US services we use, like Cloudflare and Stripe, do answer to US law for the data they hold.

Is Austria a Good Country for Private Email?

Yes, though no country makes a provider untouchable. Austria has had no general data retention since its Constitutional Court struck it down in 2014, and the same court struck down a law allowing state surveillance software in 2019. In July 2025, parliament passed a new one that lets the state security service use spyware for the gravest threats only, and the Constitutional Court is reviewing it.

Where Are black.com's Servers?

In the Equinix ZH5 datacenter in Zurich, Switzerland. The company is based in Vienna, so every request that can oblige us runs through Austrian law.

What Happens to My Data When I Delete It?

An email you delete from the trash leaves our database right away, and the trash empties itself after 30 days. Attachments follow within about a day, and our encrypted backups expire after 14 days. After that, there's nothing left to hand over.

Further Reading

We're working on two follow-up articles that go deeper:

• Chat Control, FISA and beyond: a 2026 overview. The laws and proposals that could change private communication, in the EU and elsewhere.
• Law enforcement requests to Google: a global barometer. What Google's transparency report shows about which countries ask most, how often Google hands over data, and how that has changed since 2009.

If you spot a mistake or a gap, tell us on X at @blackcom. We'll update this article as the law changes.