Transparency Report

Updated April 7th, 2021.

From time to time, ImprovMX may receive requests for assistance from law enforcement authorities. As a strict general rule, ImprovMX only complies with legally binding orders.

Upon receiving a judicial order, ImprovMX is obliged to provide any user information readily available that would help identify a user that is subject to a criminal investigation. In addition to the items listed in our privacy policy, in extreme criminal cases, ImprovMX may also be obligated to monitor the IP addresses which are being used to access the ImprovMX accounts which are engaged in criminal activities.

In the event that we have questions about the legality of an order, ImprovMX will always request further clarification from French authorities. If doubts persist and the order appears not to be compliant with legal requirements, ImprovMX will contest it to the extent permitted by law.

ImprovMX may also sometimes act upon other types of requests. If presented with overwhelming evidence that the account in question is being used for illegal purposes against our Terms and Conditions, the offending account will be suspended immediately. Legality is assessed on French law, and illegal purposes include activities such as phishing, ransomware, or identity theft. No data is handed to third parties during this process unless a qualifying data order is also received.

Legal requests transparency

This is a list of request we received and their state.

• On December 12th, 2019, we received a request from someone assisting a government entity in an incident response investigation. They asked us about what logs we were storing that could help them in their search.
  The information requested were not stored by ImprovMX and as such, no further actions were taken by both parties.
  
• On April 7th, 2021, we received a request from the National Crime Agency of the United Kingdom. The NCA is currently leading an investigation into a group of individuals who are running an online platform that enables their customers to socially engineer accountholders. After carefully reviewing the request, we took steps to formally identify the authenticity of the law enforcement agent within the NCA. After this was established, we’ve decided to share information with the NCA and collaborate with their investigation, based on the ground that the usage was against our Terms of Service and more broadly definitely illegal. We’ve shared that customer domain and alias set-up including redirection emails, and 3 screenshots of logged activity (encrypted).