What we have been asked for, and what we could give

Measure	Count
Legal demands received	0
Accounts named across all demands	0
Accounts for which any metadata was produced	0
Accounts for which message content was produced	0
Preservation orders in force	0

Nothing has been received because nothing is deployed and there are no customers. This page exists now rather than later so that the machinery producing it is built and tested before the first demand arrives, rather than assembled in a hurry afterwards.

We do not decline to hand over message content. We cannot. What this service holds is ciphertext and wrapped keys, and it can read neither. A demand for the contents of an account's messages can be complied with completely and fully, and what it yields is material nobody involved can turn into words.

That is why this figure is printed exactly and never banded. If it is ever anything other than zero, a range would be the wrong way to tell you.

The limits of that claim are on the delivery page and are not buried: encryption in a browser protects you against a server that stores your messages, and not against one that serves you modified JavaScript. We say so because it is true, not because anybody asked.

A large messenger reporting "1,284 requests" reveals nothing about anybody. A small one reporting "one preservation order, United Kingdom, this half" has — combined with a date on the warrant canary and a support thread — come close to naming an account. So counts above zero are published in bands: 1–9, 10–49, 50–99, and so on upward.

Zero is reported exactly, because "we received none" is the most useful sentence this document contains, and banding it away would be absurd.

A demand can arrive with a legal prohibition on saying that it arrived. Such a demand cannot be included in any figure on this page without breaking that prohibition — so it is not, and we would rather tell you that the exclusion exists than fold it silently into a zero. A total that quietly absorbed a gagged demand would be a lie told with arithmetic.

The warrant canary is the instrument that covers exactly this case. It works by ceasing to be updated, and that page explains — carefully, because most canary pages get this wrong — what its absence would and would not prove.

No jurisdiction is a safe one, and this page does not call any of them that. What follows is where each part of hosted Haven sits and what can lawfully reach it, stated so that you can weigh it rather than take a slogan on trust.

What any of these could obtain is the same list whatever the jurisdiction: the metadata the privacy page enumerates from the live schema. The message content is ciphertext nobody here can open, which is the row above that reads zero.

• Figures are generated by scripts/transparency-report.js from the demand register. The generator takes only a period; it accepts no number from its caller.
• A separate register records preservation orders and what they suspend. The two are cross-checked: a preservation order with no hold placed means data the order covered may have been destroyed on schedule, and a hold with no order on file is indistinguishable, from outside, from an operator deciding to keep somebody's messages. Either disagreement is published rather than resolved quietly.
• The register names how many accounts a demand covered and never which. A register holding identities would make this report a re-identification risk instead of a disclosure.
• Reports cover closed half-years, so a published figure does not change under the reader.