How FortiSafe responds to requests from authorities
FortiSafe team ·
An authority only receives data from FortiSafe in response to a legally applicable order or request, and only what exists: at most, the account data and access logs for our systems described in the privacy policy. A history of browsing through the VPN doesn't exist to be disclosed. Before any reply, we check the authenticity, authority, legal basis and scope of the request. Preserving data is not disclosing it, and we notify the customer where the law allows.
What exists and what doesn't
| Data | Exists? | Note |
|---|---|---|
| Account email, devices, subscription and sessions | Yes | Each with the retention period in the privacy policy. |
| Access logs for our systems: date and time, IP, source port and account | Yes, for access from Brazil and Brazil accounts, for 6 months | Required by Brazil's Marco Civil da Internet, art. 15. |
| Sites visited, content, DNS queries, VPN connection IP and times, data volume | No | VPN traffic doesn't pass through our systems, and our infrastructure partner is contractually bound not to log it. There is nothing to disclose. |
How we handle a request
- We log every request we receive, including those we refuse and those that turn out to be fake.
- We verify authenticity through the agency's official channel, never through the contact details in the request. Urgency doesn't skip this check.
- We review the requester's authority, the legal basis and the scope: what was requested, for which account or IP and for which period. Overly broad requests are challenged.
- When there is a legal preservation request, we suspend automatic deletion only for the data covered. Preserving is not disclosing: disclosure requires its own order or request.
- We disclose only what was requested, exists and falls within the order, through the agency's official channel.
- Where the law allows, we notify the customer before disclosure. If there is a gag requirement, we record it and reassess notice once it ends.
- The numbers appear in the transparency report, updated every six months.
What Brazilian law says
- Marco Civil da Internet (Brazil's Internet Civil Framework), art. 10, § 1: whoever keeps logs is only required to disclose them under a court order.
- Art. 10, § 3: administrative authorities with legal competence may request registration data — personal details, parentage and address.
- Art. 15: internet application providers keep application access logs for 6 months, confidentially.
- Art. 13, §§ 2 and 3, and art. 15, § 2: police, administrative authorities or prosecutors may ask, as a precaution, for logs to be kept longer; the request for court authorization to access them must be filed within 60 days.
- Decree 8,771/2016, art. 15-A, added by Decree 12,975/2026: keeping IP logs includes the source port when needed to identify the device.
- Child and Adolescent Statute (ECA), art. 190-F, added by Law 15,487/2026: in flagrante cases or risk to a child's or adolescent's life or physical integrity identified during online patrols, police or prosecutors may request registration data from application providers without a prior court order, informing a judge within 48 hours.
Watch out for fake authority requests
Scammers pose as police or courts to obtain people's data. That's why FortiSafe doesn't reply through the phone number, email or link in a request: we confirm it exists with the agency's official contact.
FortiSafe never asks for your sign-in code. If someone asks for it in the name of an "investigation", it's a scam.
For authorities: how to send a request
- Send it to [email protected] from an official agency address.
- State the agency, the title and name of the requester, and an official contact for verification.
- Give the legal basis and, if any, the case or proceeding number.
- Define the scope: account (email) or IP address, and the period, with time zone.
- For access logs, attach the court order.
- For a preservation request, state which data and which period should be preserved.
Sources
Legislation checked on Brazil's official Planalto website on 13 September 2026.
- Marco Civil da Internet — Law 12,965/2014 (Portuguese) — Arts. 10, 13 and 15: court orders, registration data, 6-month retention and precautionary requests with a 60-day deadline.
- Decree 12,975/2026 (Portuguese) — Art. 15-A added to Decree 8,771: source port.
- Law 15,487/2026 (Portuguese) — ECA art. 190-F: requests without a prior court order during online patrols, with a judge informed within 48 hours.