OmertaCall PGP key
Scope and applicability
These guidelines cover requests concerning OmertaCall services from criminal authorities, courts, local police, telecom regulators and other competent bodies worldwide. Civil litigants must provide a valid court order binding on the relevant OmertaCall entity. They cannot use the emergency channel to obtain discovery. Civil requests normally require advance notice to the affected client and an opportunity to challenge, unless applicable law or a binding order requires otherwise.
This policy reflects industry practice and our reading of applicable law. Binding legal obligations take precedence over the default handling and retention periods below. We assess each request on its facts; a listed instrument is not an automatic entitlement to all records.
OmertaCall LLC is established in Nevis. OmertaCall (Dublin, Ireland) is its Irish branch, registered as the designated establishment for EU electronic-evidence orders. The Dublin establishment can access data held by the Nevis company to answer those orders. Address the entity and establishment relevant to your instrument; our hub identifies the Nevis addressee.
Registered office (Nevis)
OmertaCall LLC, Hunkins Waterfront Plaza, Suite 556, Main Street, Charlestown, Nevis.
EU establishment (Dublin, Ireland)
OmertaCall (Irish branch of OmertaCall LLC), Office Suites Club, 20 Harcourt St, Saint Kevin's, Dublin 2, D02 H364, Ireland.
Accepted legal process
We respond to valid, binding process where the issuing jurisdiction has authority over the relevant OmertaCall entity and the requested disclosure is lawful. Foreign process may require mutual assistance, recognition or a local order. Send the original instrument and explain the asserted jurisdiction.
| Requesting jurisdiction or route | Handling |
|---|---|
| St Kitts and Nevis | Serve a valid domestic court order, warrant or other binding instrument on OmertaCall LLC (Nevis). |
| Mutual legal assistance and letters rogatory | Route foreign criminal assistance through the Attorney General of St Kitts and Nevis as Central Authority. We respond to the resulting valid local process. This is the default route where foreign process is not directly enforceable. |
| EU electronic evidence and Ireland | Serve European Production Order Certificates (EPOC) and European Preservation Order Certificates (EPOC-PR) on OmertaCall (Dublin, Ireland), our designated establishment. Relevant Irish domestic orders go to that establishment. EU mutual assistance or a European Investigation Order to Ireland may provide another route where applicable. |
| United Kingdom | We assess communications-data authorisations and other process under the Investigatory Powers Act (IPA) served on us, including the issuing authority's powers and any applicable safeguards. Other requests may require mutual assistance through St Kitts and Nevis. |
| United States | We respond to US process, including process invoking the CLOUD Act, where it is enforceable against us. Otherwise use the US–St Kitts and Nevis mutual legal assistance route. |
| Australia, Canada and other countries | Submit process with the basis for its enforceability. Where direct service is insufficient, use the applicable mutual assistance or letters rogatory route through St Kitts and Nevis. |
| Budapest Convention cooperation | Competent authorities may use applicable cooperation and expedited preservation mechanisms, including their designated contact networks. The Convention does not itself grant unrestricted access to our records; production still requires the applicable lawful process. |
| Civil proceedings and regulatory enquiries | Civil disclosure requires a binding court order. Regulators must identify their statutory powers and jurisdiction. We may require recognition, local process or a narrower request. |
Submission and requester verification
The law-enforcement portal is the preferred submission route and is a separate system. Its verified external URL has not yet been published on this site. Until then, submit standard process or preservation requests to [email protected], and emergency requests to [email protected]. There is no emergency phone line.
Send one matter per submission, with the signed instrument and cover sheet as PDF. Use English, or provide the original and an English translation, subject to any binding language rules. Identify the relevant OmertaCall entity or Dublin establishment. A submitted email or portal receipt is not acceptance of service or confirmation that the request is legally sufficient.
Use an official agency address. Include your full name, role, agency, official contact details and a means to verify your authority independently. We may check an agency directory, official domain, signature, seal or issuing court, and seek further credentials. Possession of a PGP key alone does not establish official status.
Every law-enforcement request must include the requester's PGP public key, fingerprint and official credentials, including resubmissions and extensions. Responses and disclosures to law enforcement are sent only by PGP-encrypted email to a verified recipient. Unencrypted or unverifiable requests receive only an encrypted request for a verifiable key and official credentials if a usable key was supplied; without one we cannot send a reply. No substantive data is disclosed before verification and legal review. Do not send sensitive case material in plaintext while our public encryption key is awaiting publication; first supply your public key and official credentials so secure submission can be arranged.
Required cover-sheet fields
Include all of the following so we can identify the records and assess the process:
- Issuing authority, requesting officer, official role and independently verifiable agency contact details.
- Legal basis, jurisdiction, relevant OmertaCall entity, signature or seal, and the complete order or authorisation.
- Case reference, nature of the investigation, and why the request is necessary and proportionate.
- Precise targets: telephone numbers in E.164 international format, account IDs, sender IDs or WhatsApp numbers, as relevant. Explain their connection to the case.
- Start and end dates and times in UTC, with any original timezone explained.
- Specific data categories requested, rather than an unrestricted request for all information.
- Due date, applicable statutory deadline and reason for urgency.
- Any non-disclosure order, its legal basis, scope and expiry; explain any other lawful reason to delay notice.
- Your PGP public key and fingerprint, and the official email address to receive encrypted responses.
Data inventory and retention
The periods below are our default schedule, not a promise that a particular record exists. Service configuration, client deletion, applicable numbering rules and valid legal holds affect availability. We do not create missing historic records or retain content solely for law-enforcement purposes. Where applicable law requires a different period, we follow that requirement and limit retention to the relevant records.
| Category | What may be available | Default retention |
|---|---|---|
| Subscriber and account data | Account identity, contact information and numbers assigned | Account life plus 12 months |
| Number assignment history | Our assignment and reassignment records linking a number to our client | Account life plus 12 months; this is not a full carrier portability history |
| KYC and identity checks | Verification documents, business registration and number-use declarations we collected | Five years after the relationship ends, subject to applicable numbering and identity rules |
| Voice call detail records (CDRs) | Calling and called numbers, UTC time, duration, route and upstream carrier where recorded | 12 months from the call |
| SMS, WhatsApp and RCS delivery metadata | Sender, recipient, time and delivery status on our side of the service | 12 months from the event; other platforms hold their own records |
| Message content | SMS bodies or chat text only where our service actually stores them | Client-controlled; deleted on client deletion or within 30 days after account closure, subject to a valid hold |
| Call recordings | Only calls recorded using a feature enabled by the client | As configured by the client; deleted within 30 days of account closure, with backups rolling off within 35 days of deletion |
| Transcripts, AI-agent transcripts and summaries | Only where the client enabled the relevant recording or transcript feature and the output is retained | Same client-controlled schedule as recordings, including backup roll-off |
| IP, login and API access logs | Source IP and access events recorded by our systems | 12 months |
| Billing and payment records | Invoices and payment records; card references are tokenised only | Six years after the end of the financial year |
| Law-enforcement request log | Request, legal basis, review and disclosure record | Six years |
| Preserved records | Existing identified records subject to a valid hold | Until the hold expires, ends or is withdrawn, in accordance with applicable law |
For numbers resold from partner carriers, we can return only information we hold or control: our subscriber or reseller client's account details, our assignment records, and our own records of calls and messages passing through our platform. We may not know the reseller's end user. On valid process we can identify the upstream carrier holding the number range, so the authority can seek further records directly from it under its jurisdiction's process.
We do not hold users' handset or cell-site location, other carriers' records, far-end providers' records, their network CDRs or a complete number-portability history. Our own number ranges also do not give us access to another operator's records. We cannot produce content that was never stored or has already been deleted.
Preservation
A preservation request identifies existing data to hold while formal production process is obtained. It does not authorise disclosure, restore deleted data or initiate future surveillance. Provide the same verification, targets, UTC interval, case reference and PGP key required for production requests, and identify the legal basis and intended follow-up process.
For a verified request where permitted by law, our ordinary initial hold is 90 days. Ask for an extension before expiry, explaining the continuing basis and expected production process; one further 90-day period may be available where applicable law permits. We confirm the actual scope and expiry by encrypted email. A request to extend is not itself confirmation of an extension.
EU EPOC-PR preservation follows its own timetable: 60 days, extendable once by 30 days where applicable, with continued preservation where a valid follow-up production process requires it. Other mandatory periods take precedence. If no valid extension or follow-up process arrives by expiry, the hold ends and normal deletion resumes. A lawful continuing hold overrides routine deletion only for the identified records.
Client notification
We notify affected clients by default before disclosure, with an opportunity to raise an objection where lawful and practicable. For civil proceedings, advance notice is normally required. We may withhold or delay notice when applicable law or a binding non-disclosure order forbids it, where notice poses a risk to life or serious physical safety, or where it would harm an investigation and withholding it has a lawful basis.
Authorities seeking delayed notice must explain the specific grounds and duration rather than requesting secrecy without an end date. We review restrictions and provide delayed notice once the restriction or relevant risk ends, unless another lawful restriction remains. We do not promise secrecy merely because a requester asks for it.
Review and pushback
We check authenticity, jurisdiction, enforceability, necessity, proportionality and scope before disclosing records. We reject or seek correction of unsigned, unverifiable, overbroad or out-of-jurisdiction requests, and may require a narrower time range, specified data categories, local process or mutual assistance. We may challenge process in accordance with applicable law. Send corrections under the original case reference with your public key again.
Response handling and timelines
We prioritise verified emergencies involving an imminent risk of death or serious physical injury, and assess voluntary disclosure case by case under applicable law. Explain how the requested information would avert the threat and why waiting for ordinary process would be unsafe. Follow up with formal process. PGP and official verification remain mandatory in emergencies.
Where EU electronic-evidence rules apply, production is ordinarily due within 10 days of receipt of the EPOC, or within eight hours for an emergency EPOC, subject to the applicable rules for defects, objections and extensions. We handle preservation promptly under the relevant legal timetable.
For other standard requests we work to the binding deadline and communicate any defect or expected delay by encrypted email. There is no universal response-time commitment for standard or bulk requests. Large datasets and archive retrieval can take longer; contact us early to discuss scope. We do not use a bulk-request queue to displace a statutory deadline.
Disclosures are limited to responsive records we hold or control and may lawfully provide. We describe material availability limits and transmit responses only by PGP-encrypted email to the verified authority. Receipt of a request does not confirm that a target is a client. Live interception or prospective collection requires a separate assessment under the applicable local legal framework; an ordinary production or preservation request does not enable it.
Costs and further contact
Routine requests are handled without charge. Where applicable law permits, bulk production or archive retrieval may incur reasonable recovery costs. We discuss the scope and expected cost before chargeable work; payment does not create a lawful basis for disclosure or remove statutory obligations.
Use [email protected] for legal-process questions and [email protected] for emergency disclosure. Public scam, fraud and abuse reports belong at [email protected]. See the law-enforcement hub for the channel table and current key-publication status.