Why we don't action US DMCA notices, and what we do action instead.
The US Digital Millennium Copyright Act (DMCA, 17 U.S.C. § 512) is United States law. We are incorporated in the Federation of Saint Kitts and Nevis, and our infrastructure is hosted in Iceland, the Netherlands, Romania, and Switzerland. None of these jurisdictions give DMCA notices legal force.
We therefore do not act on DMCA notices. We log each notice received against our warrant canary for transparency, reply politely to the sender, and otherwise take no action against the customer's content.
This is not a loophole. It is a deliberate positioning decision taken in full awareness of the trade-offs, shaped by the specific legal regimes of the countries we operate in.
US Congress cannot legislate for courts in Saint Kitts, Iceland, the Netherlands, Romania, or Switzerland. A DMCA take-down notice is an instrument under US civil procedure that only carries meaning for service providers subject to US jurisdiction. We are not subject to US jurisdiction.
Even in the United States, the DMCA safe-harbour provisions are an optional protection for providers who choose to participate — not a mandatory take-down regime. A provider outside the US gains nothing by complying and forfeits the customer trust that underpins our business model by doing so.
Around 600 – 900 DMCA notices reach us monthly. All are handled this way. Statistics are published in the semi-annual Transparency Report.
We act on genuine judicial process under the law of the relevant operating jurisdiction. Specifically:
Upon receipt of a valid order, we:
You don't need to file a counter-notice — we haven't taken anything down. If the sender subsequently obtains a court order in one of our operating jurisdictions, we will contact you and help you prepare a response within the court's procedure.
We do not maintain a "repeat infringer" register based on DMCA notices. Customers accumulating large volumes of spurious notices are not penalised.
Every Monday we publish a PGP-signed statement at /canary confirming:
If the canary goes stale for more than 14 days without a corresponding infrastructure incident, assume something significant has changed and act accordingly.