Subpoena Information Request Policy

TierFive considers customer privacy and confidentiality a fundamental responsibility. We do not disclose customer information unless authorized by the customer, required by valid and enforceable legal process, or otherwise permitted by applicable law. Where legally allowed, TierFive may notify the affected customer, provide a reasonable opportunity to seek protective relief, challenge or narrow overbroad requests, limit disclosure to the minimum information legally required, require secure handling, recover reasonable response costs, and require foreign requests to proceed through a legally recognized U.S. process.

Legal Process, Government Requests, and Customer Information Policy

Effective Date: August 4, 2026
Last Updated: August 4, 2026
This Policy explains how TierFive Solutions Group Inc. evaluates and responds to subpoenas, warrants, court orders, governmental demands, preservation requests, emergency requests, civil discovery, and other requests for customer information, records, content, or materials.

1. Purpose and Scope

This Legal Process, Government Requests, and Customer Information Policy (“Policy”) applies to requests directed to TierFive Solutions Group Inc. (“TierFive,” “we,” “us,” or “our”) for information, records, content, testimony, documents, electronically stored information, physical materials, or other evidence associated with TierFive’s websites, customer portals, hosted services, Cirrus File Server, document-conversion services, records-management services, business operations, customers, subscribers, users, personnel, vendors, or other third parties. This Policy is intended as general guidance only. It does not create any contractual right, entitlement to notice, discovery right, third-party beneficiary right, commitment to retain information, agreement to accept service, or obligation to disclose information beyond what applicable law or a controlling written agreement requires. TierFive reserves all objections, defenses, privileges, immunities, confidentiality rights, contractual protections, rights to reimbursement, and other remedies available under applicable law, contract, and equity. Nothing in this Policy waives any objection to jurisdiction, service, validity, scope, relevance, proportionality, burden, privilege, confidentiality, privacy, possession, custody, control, or enforceability.

2. General Principles

TierFive respects lawful legal process and the privacy, confidentiality, security, and contractual rights of its customers and other affected parties. TierFive reviews requests individually and may require legal process appropriate to the requester, jurisdiction, information sought, and circumstances.
TierFive will disclose information only when it determines that disclosure is:
  • Required by valid and enforceable legal process.
  • Authorized by the affected customer or another person with sufficient legal authority.
  • Permitted by applicable law and reasonably necessary to address a qualifying emergency.
  • Reasonably necessary to protect TierFive, its customers, users, personnel, systems, or legal rights.
  • Otherwise permitted or required under applicable law or a controlling written agreement.
TierFive may reject, object to, challenge, seek clarification of, or require narrowing of any request that TierFive considers invalid, improperly served, overbroad, vague, unduly burdensome, disproportionate, technically infeasible, inconsistent with applicable law, directed to the wrong legal entity, or seeking information outside TierFive’s possession, custody, or control.

3. Request Information Directly From the Customer

Parties seeking customer-controlled records should request them directly from the applicable customer whenever practicable. Customers generally are better positioned to identify responsive records, determine ownership and authenticity, assess privilege and confidentiality, apply retention requirements, and respond to disputes concerning their own information. Unless TierFive expressly agrees otherwise in writing, TierFive acts as a service provider, processor, custodian, converter, storage provider, or host for customer-controlled information and is not necessarily the creator, owner, official custodian of record, records officer, records-retention authority, or party responsible for determining the legal status of that information. TierFive may direct a requester to the applicable customer, require evidence that the requester first sought the information from the customer, or object to a request where the customer is available and the information can be obtained from a more convenient, complete, authoritative, or less burdensome source.

4. Categories of Information

The legal process required and TierFive’s ability to respond may differ based on the category of information requested.

4.1 Customer Content

Documents, images, files, folders, communications, messages, uploaded material, shared content, project records, converted images, document metadata, and other content supplied by, created for, stored for, or controlled by a customer or user.

4.2 Subscriber and Account Information

Names, business names, contact information, account identifiers, service types, account dates, subscription status, and similar basic customer or subscriber information.

4.3 Technical and Transactional Information

Internet Protocol addresses, timestamps, login records, access logs, audit events, system-generated metadata, upload or download activity, device information, session information, transaction records, and related technical data.

4.4 TierFive Business Records

Contracts, quotations, statements of work, invoices, payment records, communications with TierFive, project status information, chain-of-custody records, production logs, quality-control records, support records, and other TierFive-created business information.

4.5 Physical Records and Media

Paper files, boxes, microfilm, microfiche, aperture cards, photographs, storage media, source documents, temporary working materials, and other tangible items in TierFive’s custody. A request sufficient for one category may not be sufficient for another. TierFive will not treat process that is legally sufficient only for basic subscriber information as authorizing disclosure of communications, customer content, or other information requiring more specific legal authority.

5. Requirements for Legal Process

Legal process must be valid, properly issued, sufficiently specific, directed to the correct TierFive legal entity, served through an authorized method, and appropriate under applicable law for the type of information requested. A request should include, as applicable:
  • The full name, title, agency, organization, firm, and contact information of the requester.
  • The court, tribunal, agency, jurisdiction, case caption, case number, and issuing authority.
  • A complete and legible copy of the subpoena, warrant, court order, administrative demand, or other legal authority.
  • The specific customer, subscriber, user, account, project, file, location, or other identifier at issue.
  • The exact categories of information sought and the relevant date range.
  • A clear explanation of the relationship between the requested information and the matter under investigation or litigation.
  • The response deadline, return instructions, requested format, and secure delivery method.
  • Any applicable sealing, nondisclosure, delayed-notice, preservation, or confidentiality order.
  • The name and direct contact information of a person authorized to discuss narrowing, scheduling, costs, security, or technical issues.
Requests should use identifiers that TierFive can reasonably associate with an account or project. A person’s name alone may be insufficient. TierFive may require an account number, customer name, project number, email address, domain, specific file or folder identifier, shared link, physical container identifier, or other precise information.

6. Service and Intake of Legal Process

Legal process must be served in accordance with applicable law upon TierFive Solutions Group Inc., its registered agent for service of process, or another person legally authorized to accept service. Courtesy copies, preliminary inquiries, preservation requests, and coordination communications may be sent to: Legal Process Intake
Emailing, mailing, uploading, or otherwise sending a request to the contact information above does not by itself constitute valid service of legal process. TierFive accepts service by email only when an authorized TierFive representative expressly confirms acceptance in writing for the specific matter.
Providing intake assistance, discussing a request, acknowledging receipt, preserving information, or voluntarily accepting a courtesy copy does not waive any objection to service, jurisdiction, validity, scope, burden, confidentiality, privilege, or enforceability.

7. Government and Law-Enforcement Requests

Governmental entities must provide the form of legal process required by applicable federal and state law for the specific category of information sought. Depending on the circumstances, this may require a warrant, court order, grand-jury subpoena, trial subpoena, administrative subpoena authorized by statute, customer consent, or another legally recognized process. TierFive may require governmental requests to:
  • Be issued by a court or authority with jurisdiction.
  • Identify the account, person, service, information type, and time period with appropriate particularity.
  • Establish legal authority sufficient for the requested content or records.
  • Comply with the Stored Communications Act, the California Electronic Communications Privacy Act, and other applicable privacy laws.
  • Include any notice, delayed-notice, nondisclosure, sealing, or minimization requirements.
  • Provide a secure and authenticated method for delivery and verification.
TierFive may contact the issuing agency or its counsel to authenticate, clarify, narrow, modify, schedule, or otherwise address a request. TierFive may seek judicial review or other relief when a demand is defective, overbroad, unusually voluminous, unduly burdensome, conflicts with applicable law, or creates material privacy, security, contractual, or technical concerns.

8. Civil Subpoenas and Private-Party Requests

Civil litigants, attorneys, arbitrators, insurers, investigators, and other private parties must use valid legal process and comply with all applicable jurisdictional, service, notice, privacy, and discovery requirements. TierFive may object to, move to quash, seek a protective order concerning, or require narrowing of a civil request that:
  • Seeks information more appropriately obtained from the customer or another party.
  • Seeks customer content or communications that applicable law does not permit TierFive to disclose through the process presented.
  • Is vague, overbroad, disproportionate, duplicative, cumulative, or unduly burdensome.
  • Seeks privileged, confidential, proprietary, personal, regulated, or security-sensitive information.
  • Requires creation of records, forensic reconstruction, expert analysis, or testimony not otherwise required by law.
  • Seeks information outside TierFive’s possession, custody, or control.
  • Provides insufficient time for review, customer notice, legal consultation, retrieval, or secure production.
Informal requests, attorney letters, discovery demands directed to another party, authorizations signed by persons without sufficient authority, and requests for voluntary cooperation do not necessarily compel TierFive to preserve, search for, or disclose information.

9. Customer Notice

Unless prohibited by law, court order, valid nondisclosure requirement, customer agreement, or exceptional circumstances, TierFive may notify an affected customer or account holder before disclosing customer information. TierFive may provide the customer with a copy or summary of the request and a reasonable opportunity, considering the response deadline and circumstances, to seek a protective order, move to quash, obtain a stay, contact the requester, consent to disclosure, or pursue other appropriate relief. Customer notice is not guaranteed. TierFive may respond without prior notice when notice is legally prohibited, when immediate disclosure is required, when an emergency exists, when notice could create a material security or evidence-preservation risk, when the customer has consented, or when TierFive otherwise determines that notice is inappropriate or impracticable.
A customer’s informal objection does not by itself relieve TierFive of a legal obligation to respond. TierFive may require prompt written evidence that the customer filed a motion to quash, motion for protective order, request for a stay, or other formal challenge. Unless TierFive receives a court order, withdrawal, written extension, or other legally sufficient basis to delay, TierFive may comply by the applicable deadline. Customers are responsible for maintaining accurate and current contact information. TierFive may send notice to the account contact, contractual notice address, legal contact, administrator, or other address TierFive reasonably believes appropriate.

10. Nondisclosure and Delayed Notice

A requester seeking to prohibit or delay customer notice should provide a valid court order or other legally sufficient authority that expressly requires nondisclosure or delayed notice. TierFive may challenge, seek clarification of, or request modification of a nondisclosure requirement that is indefinite, overbroad, unsupported, expired, or inconsistent with applicable law. When a nondisclosure restriction expires or is lifted, TierFive may notify the affected customer unless continued notice is prohibited or TierFive determines that notice is inappropriate under the circumstances.

11. Preservation Requests

A preservation request directs TierFive to preserve specified existing information pending issuance of legal process. A preservation request does not itself authorize disclosure and does not guarantee that responsive information exists, is recoverable, is within TierFive’s possession, custody, or control, or will later be produced. Preservation requests must:
  • Identify the requesting governmental entity or other legally authorized requester.
  • Identify the account, customer, project, records, or material with reasonable specificity.
  • State the legal authority for the request.
  • Identify the relevant time period and categories of information.
  • Provide a direct contact for authentication and follow-up.
  • Be timely renewed or followed by valid legal process where required.
Where 18 U.S.C. § 2703(f) applies, TierFive will preserve records and evidence in its possession for the statutory 90-day period and may extend preservation for an additional 90 days upon a timely renewed request from the governmental entity. TierFive is not required to create new records, reconstruct information already deleted, restore unavailable backups, preserve information outside the request, suspend all ordinary retention practices, or retain information indefinitely. TierFive may preserve a reasonable snapshot or copy rather than maintaining live access or operational systems in an unchanged state.

12. Emergency Disclosure Requests

TierFive may consider an emergency request from an authorized governmental official where TierFive, in good faith, believes that an emergency involving danger of death or serious physical injury requires disclosure without delay and applicable law permits the disclosure. An emergency request should include:
  • The requesting agency, official’s full name, title, badge or identification number, and official contact information.
  • The specific person, account, customer, project, or records involved.
  • A detailed description of the emergency and the imminent danger of death or serious physical injury.
  • An explanation of why disclosure is necessary without delay.
  • The specific information requested and its relationship to the emergency.
  • A certification that the requester is authorized to make the request and that the information provided is accurate.
  • The legal authority supporting the requested disclosure.
An emergency request is not a substitute for legal process where legal process can be obtained without endangering life or causing serious physical injury. TierFive determines in its sole good-faith judgment whether an emergency disclosure is legally permitted and appropriate and may disclose only the information TierFive considers reasonably necessary to address the emergency. TierFive may authenticate the requester through independently obtained agency contact information and may require follow-up legal process or documentation.

13. Foreign Government and Cross-Border Requests

Foreign governmental, regulatory, judicial, and law-enforcement requests must be submitted through a mechanism recognized by applicable United States law. Depending on the circumstances, an appropriate mechanism may include:
  • A mutual legal assistance treaty or other government-to-government process.
  • Letters rogatory or a request under 28 U.S.C. § 1782.
  • Legal process domesticated or issued by a court with appropriate United States jurisdiction.
  • An order issued under a qualifying executive agreement recognized by applicable federal law.
  • Another legally authorized cross-border procedure.
TierFive may require a certified English translation and may reject, object to, challenge, or require domestication of foreign process that is not valid, enforceable, sufficiently specific, or consistent with United States law. TierFive may evaluate conflicts of law, data-location issues, customer residence or nationality, privacy restrictions, contractual obligations, comity, and other relevant considerations and may seek judicial review or modification where appropriate.

14. Physical Records, Media, and Active Projects

Requests involving physical records, source documents, boxes, microfilm, microfiche, aperture cards, photographs, storage media, or other tangible customer property require special handling. TierFive may require:
  • Coordination with and authorization from the affected customer.
  • Specific identification of containers, projects, record series, or materials.
  • A protocol protecting confidentiality, evidentiary integrity, and chain of custody.
  • Secure on-site inspection rather than removal from TierFive’s facility.
  • Use of approved personnel, equipment, couriers, forensic vendors, or secure transportation.
  • Advance payment of reasonable retrieval, staging, supervision, duplication, transportation, and restoration costs.
  • Scheduling that does not unreasonably disrupt active conversion, quality-control, delivery, retention, or destruction workflows.
TierFive may decline to surrender original customer property absent customer authorization, valid legal process specifically requiring surrender, or a court-approved protocol addressing custody, confidentiality, security, and return. TierFive may create and retain an evidentiary record of any inspection, transfer, duplication, or production involving physical materials.

15. Regulated, Confidential, Privileged, and Security-Sensitive Information

Requested information may be subject to additional legal, contractual, professional, or security protections, including protections applicable to:
  • Protected health information and medical records.
  • Student, education, and academic records.
  • Personnel, employment, background-screening, and payroll records.
  • Financial, payment, tax, insurance, and account information.
  • Attorney-client communications, attorney work product, and litigation materials.
  • Government-restricted, law-enforcement, criminal-justice, defense, export-controlled, or security-sensitive information.
  • Trade secrets, confidential business information, proprietary methods, and customer-confidential information.
  • Sealed records, records subject to protective orders, and information restricted by contract or statute.
TierFive may require additional authorization, notice, judicial findings, a qualified protective order, a more specific warrant or court order, customer direction, confidentiality protections, or other safeguards before disclosure. TierFive may withhold or redact information protected by privilege, work-product doctrine, privacy law, confidentiality obligation, trade-secret protection, security requirements, or another applicable protection and may require the requester to obtain appropriate judicial relief.

16. Search, Collection, Review, and Production

TierFive may determine the reasonable method used to identify, preserve, collect, review, export, reproduce, and securely produce responsive information, subject to applicable law and any court order. TierFive may:
  • Limit production to information responsive to valid and enforceable process.
  • Use reasonable search criteria, account identifiers, project identifiers, custodians, systems, and date ranges.
  • Redact unrelated, privileged, confidential, proprietary, personal, regulated, or security-sensitive information.
  • Produce information in a reasonably usable format rather than the exact format requested.
  • Use secure electronic delivery, encrypted media, controlled inspection, or another protective method.
  • Mark information confidential or subject to a protective order.
  • Require a production protocol, confidentiality agreement, protective order, or acknowledgment of handling restrictions.
  • Provide a declaration, certification, or business-records affidavit where appropriate and reasonably available.
  • Use outside counsel, forensic specialists, e-discovery vendors, restoration providers, or other qualified service providers.
TierFive is not required to provide direct access to production systems, customer portals, internal networks, administrative tools, source code, security configurations, credentials, encryption keys, vulnerability information, or other information that could compromise security or expose unrelated customers or systems. Requests for testimony, depositions, declarations, certifications, inspections, or expert assistance may require separate valid process, reasonable scheduling, appropriate witness fees, reimbursement of costs, and coordination with TierFive’s legal counsel.

17. Costs and Reimbursement

To the extent permitted by law, TierFive may seek reimbursement for reasonable costs directly incurred in evaluating, preserving, searching for, collecting, retrieving, restoring, reviewing, redacting, exporting, reproducing, authenticating, securing, transporting, transmitting, or otherwise responding to a request. Recoverable costs may include:
  • Personnel and project-management time.
  • Legal review and outside counsel.
  • Forensic, e-discovery, restoration, vendor, and technical services.
  • Media, copying, scanning, printing, storage, encryption, and secure delivery.
  • Physical retrieval, staging, supervision, transportation, and chain-of-custody services.
  • Business-records certifications, declarations, testimony, depositions, and witness expenses.
  • Necessary disruption of normal operations.
TierFive may require an advance deposit, prepayment, cost agreement, or narrowing of the request before beginning substantial work, except where prohibited by law or inappropriate due to a qualifying emergency. TierFive’s decision not to seek reimbursement in one matter does not waive its right to seek reimbursement in another.

18. Retention, Deletion, Availability, and Technical Limitations

TierFive retains information according to applicable law, customer instructions, written agreements, operational requirements, security practices, litigation holds, and internal retention schedules. This Policy does not create a separate retention obligation or extend any retention period.
TierFive does not guarantee:
  • That a requested customer, account, project, record, file, communication, or identifier exists.
  • That requested information remains available, recoverable, complete, accurate, authentic, or readable.
  • That deleted, overwritten, expired, corrupted, encrypted, or inaccessible information can be restored.
  • That backups exist, are searchable, or can be restored without disproportionate cost or disruption.
  • That TierFive can decrypt information protected by customer-controlled encryption, passwords, keys, or third-party systems.
  • That information can be produced in a requested proprietary, legacy, native, or forensic format.
  • That information held by TierFive is the complete or authoritative version of a customer’s records.
TierFive is not required to create information that does not exist, prepare new analyses, answer interrogatories, reconstruct historical system states, correlate unrelated data, or perform expert or forensic work unless required by law or separately agreed in writing.

19. Customer-Authorized and Voluntary Disclosures

TierFive may disclose information with valid authorization from the affected customer or another person legally empowered to authorize disclosure, provided that the requested disclosure is permitted by applicable law and does not compromise another person’s rights, TierFive’s security, or TierFive’s legal interests. TierFive may require verification of identity, authority, scope, and informed consent. TierFive may reject an authorization that is incomplete, ambiguous, expired, revoked, inconsistent with a governing agreement, or insufficient under applicable law. Nothing in this Policy limits disclosures that TierFive reasonably determines are permitted or required to protect rights or safety, prevent fraud or abuse, investigate security incidents, enforce agreements, comply with law, or address another legally recognized purpose.

20. Challenges, Objections, and Protective Relief

TierFive may, but is not obligated to, contact the requester, object, move to quash or modify process, seek a protective order, request additional time, require cost shifting, pursue appellate review, or seek other relief. Factors TierFive may consider include:
  • Validity, jurisdiction, service, and legal authority.
  • Relevance, proportionality, specificity, and burden.
  • Availability of the information from the customer or another source.
  • Privacy, confidentiality, privilege, security, and contractual obligations.
  • The interests and instructions of the affected customer.
  • Cross-border conflicts of law and comity.
  • Operational, technical, financial, and evidentiary consequences.
  • The urgency and nature of the underlying matter.
TierFive’s decision to comply with, object to, negotiate, narrow, or challenge a request in one matter does not establish a precedent or create an obligation to take the same action in another matter.

21. Security and Delivery

TierFive may require requesters to use secure methods for communications and production. TierFive may refuse to transmit sensitive information through unencrypted email, consumer file-sharing services, unverified links, or other methods TierFive considers insecure.
Requesters are responsible for safeguarding information after receipt and for complying with applicable court orders, privacy laws, use restrictions, confidentiality obligations, and security requirements. TierFive may require confirmation of receipt, recipient authentication, access expiration, encryption, password exchange through a separate channel, secure media handling, or documented chain of custody.

22. Requests Involving TierFive as a Party

If TierFive is a party, potential party, claimant, respondent, target, or subject in litigation, arbitration, investigation, audit, or another proceeding, TierFive may handle the matter through its legal counsel and applicable procedural rules rather than this public Policy. Nothing in this Policy limits TierFive’s ability to assert claims, defenses, counterclaims, privileges, objections, confidentiality protections, or other rights in a matter involving TierFive.

23. Changes to This Policy

TierFive may revise this Policy from time to time. The revised version will be posted on this page with an updated “Last Updated” date. Changes apply prospectively from their stated effective date, except where immediate action is reasonably necessary to comply with law, protect security, address an emergency, preserve information, or protect legal rights.

24. Contact

Questions concerning this Policy, courtesy copies of legal process, preservation requests, emergency requests, and coordination communications may be directed to: Legal Process Intake
The legal-process email address is for intake and coordination only. It does not constitute consent to electronic service, waiver of formal service requirements, or agreement that any request is valid or enforceable.