Law Enforcement Guidelines

Effective date: September 21, 2026 Last updated: October 8, 2026

These guidelines are for law enforcement agencies and other authorities seeking records from Platform Technology Ventures LLC, which operates Cert.Photos. They are informational. They are not a submission to any jurisdiction, not a waiver of any right or objection, and not legal advice.

1. Where to serve legal process

• By email: legal@cert.photos — preferred, and the fastest route.
• By mail: Legal Department, Platform Technology Ventures LLC, One Broadway, 14th Floor, Cambridge, MA 02142, USA.

We are a Delaware limited liability company with its principal office in Massachusetts. We do not accept service of legal process through support@cert.photos, through the in-app support channel, or through social media.

Please include a return email address. We respond by email unless the process specifies otherwise.

2. Emergencies

If you believe there is an emergency involving imminent danger of death or serious physical injury, write to legal@cert.photos with "EMERGENCY DISCLOSURE REQUEST" in the subject line, and state:

• the nature of the emergency and why it is imminent;
• the specific information you need and how it will help;
• the identifiers you already have (account, photo ID, verification URL);
• your agency, your name and rank, and a telephone number we can call back on.

We review emergency requests as they arrive and may disclose information voluntarily where we believe in good faith that an emergency involving imminent danger requires it.

For child sexual exploitation: we file reports with the NCMEC CyberTipline. If your inquiry concerns a CyberTipline report, please reference the report number. See our child safety page.

3. What legal process we require

Requests from U.S. authorities should be supported by process valid under the Stored Communications Act (18 U.S.C. § 2701 *et seq.*):

Requests from outside the United States should come through a mutual legal assistance treaty, a letter rogatory, or another recognised mechanism, unless an emergency applies.

4. What data exists

Cert.Photos holds much less than most photo services. It helps to know what is actually there before drafting process. The authoritative account is our Privacy Policy §2 and §5; in summary:

• Account information — the identifier used to register, and account state. Retained while the account is active and for up to 12 months after closure.
• Photographs and certification records — the image, its C2PA certification record, a cryptographic fingerprint, a capture timestamp, and, only if the user granted location permission, the capture location. Retained while the account is active.
• Verification records — the public /v/<id> page contents for each certified photograph.
• Watermark registry entries (every account level) — an identifier that remains in the registry after account deletion but is dissociated from the user's identity.
• Public ledger entries (every account level) — a cryptographic fingerprint of each certified photograph, recorded in periodic batches. Entries contain no photograph, name, email, account identifier or location. Only the fingerprint is kept long term, in long-term storage; the photograph and its data can be deleted at any time.
• Share-link access logs — coarsened IP address and browser type, held for 90 days.
• Sign-in security counters — held for no more than 24 hours.
• Long-term validation data for certified photographs — fingerprints only, which contain no personal information.
• Abuse reports and moderation records — reports made about content, and what we did about them.
• Device and integrity signals — platform, OS version, and the result of Apple App Attest / Google Play Integrity checks.

Two things we do not have, which are commonly assumed:

• We do not hold a copy of the user's device photo library. Photographs enter Cert.Photos only through our in-app camera. There is no import-from-gallery path on either platform.
• There is no messaging, feed, comment or follow data, because those features do not exist. A shared photo is a dead-end verification link.

5. Preservation requests

Send preservation requests to legal@cert.photos with "PRESERVATION REQUEST" in the subject line. Identify the account or content precisely, by account identifier, photo ID, or verification URL. We will preserve what we hold for 90 days and will extend once on request, pending service of legal process.

6. Identifying the account or content

The most useful identifiers, in order:

1. The verification URL — https://cert.photos/v/<id>.
2. The photo ID — it looks like media_<digits>_<letters>.
3. The account identifier used at registration.

A copy of the photograph on its own may not be enough to identify an account, particularly if it has been re-encoded by another platform.

7. Notice to users

The following is quoted from Privacy Policy §4.5.

We may disclose information when we believe in good faith that disclosure is required by law, legal process, or governmental request; necessary to enforce our terms; or necessary to protect the rights, property, or safety of CertifiedPhotos, our users, or the public. Where permitted, we will notify you of any legal request for your information before responding.

If your process is accompanied by a valid non-disclosure order, or if notice would create a risk to someone's safety, tell us and cite the authority.

8. Cost reimbursement

We may seek reimbursement for the costs of responding, as permitted by 18 U.S.C. § 2706 and other applicable law.

9. Contact

legal@cert.photos — legal process, preservation, emergencies abuse@cert.photos — reporting content (report form) privacy@cert.photos — data subject requests from users

Platform Technology Ventures LLC, One Broadway, 14th Floor, Cambridge, MA 02142, USA.