Law Enforcement Guidelines
Last Updated on February 25, 2026These guidelines are intended for those seeking information about a DigitalOcean account, or looking to take action against a resource hosted on our network.
Requesting DigitalOcean User Information
Safeguarding our users’ data is vital to the trust our users place in our service to keep their data secure. For the most part, DigitalOcean’s ability to disclose user information is governed by the Electronic Communications Privacy Act, 18 U.S.C. §2701, et seq. (“ECPA”). ECPA mandates that DigitalOcean disclose certain user information to law enforcement only in response to specific types of legal process, including subpoenas, court orders, and search warrants.
To request information for a site hosted on DigitalOcean, the site’s IP address and a date range must be specifically included in the request. We can’t process overly broad or vague requests. If your inquiry alerts us to a violation of our policies or Terms of Service, we will handle it via our usual abuse procedures which may include contacting the user regarding their misconduct or suspending the site entirely.
What Information Is Available?
Our Privacy Policy describes the information that we collect in more detail. In general, we have:
-
The email address currently assigned to the account.
-
The IP address from which a site was created.
-
The date and time at which a site was created.
-
First name, last name, and phone number (if a user elects to provide this information).
-
The PayPal or Stripe transaction information for purchases (this does not include credit card or bank account information, but may include country code or postal code).
-
Physical address (if a user elects to provide this information).
-
The contents of the Droplet itself (if the Droplet has not been deleted by the user).
We cannot guarantee that we will have any given set of information for any particular user.
The length of time data is retained varies based on the type of information and actions of the user. Generally, Droplet contents are purged immediately upon deletion by the customer. Additionally, customers can control the format of their content (e.g. plain text, masked, or encrypted) and can delete or destroy server content whenever they choose. DigitalOcean accounts can contain various information, which is unverified and is provided at the user’s discretion.
Before revealing information to anyone who is not the account owner, we require a valid subpoena, warrant, or court order that specifically requests it, unless we have a good faith belief that there is an emergency involving death or serious physical injury. See below for more details.
What Information Is Unavailable?
Here are some examples of data which we are unable to provide:
-
Connection Logs.
-
Credit Card information.
-
Local and long distance telephone connection records.
-
Records of session times and durations.
-
MAC addresses.
-
Telephone or instrument numbers.
Requests from Government Agencies/Law Enforcement
-
Except in emergencies (see more below), DigitalOcean turns over protected user information only upon receipt of a valid subpoena, ECPA US court order, or search warrant. Additionally, we will notify affected users about any requests for their account information, unless prohibited from doing so by law or court order (see more below).
-
Upon receipt of a valid subpoena, if these pieces of information are available, we can provide user registration information such as the first and last names, phone number, email address, the date/time stamped IP address from which a site was created, the physical address, and the PayPal / Stripe transaction information.