Government Data Requests

What are government data requests?

Government data requests are demands from police, courts, regulators or intelligence agencies for data a vendor holds about its customers. They usually come as legal orders: a subpoena (an order to hand over records), a court order or a search warrant. Your data can be the target even if you are not the one being investigated.

Vendors describe how they respond in their privacy policy, their DPA and often a separate law enforcement guide. The key promises are about scope, notice and pushing back.

Atlassian's law enforcement guidelines say it reads requests narrowly, objects to overbroad ones, and generally notifies customers 7 to 10 days before handing over data, unless the law forbids it. Its DPA promises to "promptly notify Customer" of valid legal process. HubSpot's data disclosure page tells requesters to go to the owner of the data first, and says it notifies customers of requests for their data unless the law forbids it or there is an emergency.

Why it matters to you

• Notice lets you respond. If you hear about a request first, you can object or hire a lawyer. If the vendor says nothing, your data may be handed over without your knowledge.
• Your customers may ask. EU customers in particular may ask whether US authorities can reach their data through your vendors. See standard contractual clauses.
• Promises differ. Atlassian's DPA has a clause on government requests. HubSpot's DPA has no section on them, so the promise sits on its separate data disclosure page, which can change on its own.

What to check

• Does the vendor promise to notify you before handing over your data, unless the law forbids it?
• Does it promise to read requests narrowly and challenge ones that are overbroad or invalid?
• Does it first point requesters to you, the data owner?
• Does it publish a transparency report?

Transparency Report

A transparency report is a public report in which a vendor counts the government and legal requests it received for customer data, and says how it responded. Reports are often yearly and may break requests down by country and type.

Atlassian's transparency report lists 36 US government requests in 2025, with data produced in 29 of them. It lists 25 international government requests that year, and says it objected to all 25 and disclosed no data. HubSpot's report lists 7 US government requests in 2025, and says that as of March 1, 2026, it had received no National Security Letter or secret surveillance court (FISA) order for customer personal data.

When reading one, look at three things: how many requests ended with data handed over, whether the vendor reports objections, and whether national security requests are shown. Those may appear only as ranges, such as the "0 to 250" accounts in Atlassian's 2025 figures.

How Venpo helps

Venpo watches your vendors' privacy policies, DPAs and trust center pages, and emails you a plain-English alert when language about government requests or customer notice changes.