Government and Law Enforcement Data Requests
Last updated: November 2026
Onboard protects the data our customers entrust to us. We disclose customer data to a government or law enforcement authority only when we are legally required to, and we tell the customer first whenever the law allows.
Our commitments
Binding legal process only.
We require a valid subpoena, court order, warrant or equivalent legal process. We do not disclose customer data voluntarily.
Customer first.
Our customers control their data, so we ask the requesting authority to seek it from the customer directly.
Customer notice.
We notify the affected customer before disclosing any data, unless the law prohibits it. If notice is prohibited, we notify the customer as soon as the restriction ends.
Review and challenge.
We review every request for legal validity and scope, and we challenge requests that are unlawful or overly broad.
Minimum disclosure.
We disclose only the specific data the request legally requires.
No backdoors.
We do not build backdoors into our systems or give any authority direct access to customer data or encryption keys.
Emergencies
If a verified official reports an imminent risk of death or serious physical injury, we may disclose limited data to address the emergency, with legal process to follow.
International data
EU and UK data protection law
For personal data covered by EU or UK data protection law, this procedure supports the government access commitments in our Data Processing Agreement.
Contact
Questions about this policy, and requests from authorities, can be sent to [email protected].