Notice & Action

Anyone can tell us about content they believe is illegal. You don't need an account, and it costs nothing.

Child sexual abuse material (CSAM)

• Never send the material. Don't download, screenshot, copy, forward or attach it. Possessing or sharing it is a crime in most countries, even when you mean to report it. Send us only the link or location.
• You may stay anonymous. Name and email address are not required for notices about child sexual abuse offences (Article 16(2)(c) DSA). An email always shows the address it was sent from, so for a fully anonymous report, use a hotline.
• Hotlines. You can also, or instead, report it to your national hotline, which you can find through INHOPE (s’ouvre dans un nouvel onglet), or to NCMEC's CyberTipline (s’ouvre dans un nouvel onglet). Hotlines work with law enforcement and with service providers like us.
• What we do. CSAM notices go to the top of our queue, and access to the reported content is disabled automatically while a person handles the case. When we confirm CSAM, we close the account responsible, report it to NCMEC's CyberTipline as US law requires (18 U.S.C. § 2258A), preserve the report and the material for one year under a legal hold, and inform the competent authorities where someone's life or safety is at risk.

Copyright and other intellectual property

You can report intellectual property infringement through this page like any other illegal content. Our Copyright Policy explains the details rights holders should include, counter-notices, and our repeat-infringer policy.

To let us act quickly and fairly, a notice should contain the four elements listed in Article 16(2) DSA. The report form asks for all of them.

1. A substantiated explanation. Why you believe the content is illegal: what it is, and which rule it breaks. Naming the law or provision, and the country concerned, helps. “I don't like it” is not enough.
2. The exact electronic location. The exact link (URL) of the Exito Transfer link, Exito Vault share link or file request, or, for mail, the sender address and message headers. See the table below.
3. Your name and email address. So we can confirm receipt and tell you our decision. Not required for notices about the offences in Articles 3 to 7 of Directive 2011/93/EU (child sexual abuse and exploitation).
4. A good-faith statement. Confirming that you believe in good faith that the information and allegations in your notice are accurate and complete.

How to point us to the content

When a notice gives us actual knowledge

A notice with these elements gives us actual knowledge or awareness of the specific content concerned (Article 16(3) DSA) when it allows a diligent provider to identify the illegality without a detailed legal examination. From that moment, we act expeditiously to remove or disable access to the content if it is illegal (Article 6 DSA). Incomplete notices are still reviewed, but we may need to ask you for more information before we can act.

1. 1
   We confirm receipt
   Without undue delay, by automatic reply where possible, with a case reference. Please quote it in any follow-up.
2. 2
   We triage
   Our automated enforcement system sorts notices by urgency and type. Child sexual abuse material, terrorist content and threats to life or safety go straight to the top of the queue. In urgent cases, such as reports of CSAM or malware, access to the reported content is restricted automatically while the notice is assessed.
3. 3
   We assess it
   We assess the content and its context in a timely, diligent, non-arbitrary and objective manner. Clear-cut cases, such as a file our malware scanner confirms as malicious, may be decided by automated means. Anything that needs judgment, such as whether content is illegal, is decided by a trained member of our staff, and hard legal questions may go to legal advisers.
4. 4
   We decide
   We choose the least restrictive measure that is effective and proportionate (see below), or decide that no action is needed.
5. 5
   We tell you
   We tell you our decision without undue delay, with our reasons and how to challenge it through an appeal, out-of-court dispute settlement or the courts.
6. 6
   We inform the affected user
   If we restrict content or an account, the affected user receives a statement of reasons and can appeal too.

Possible outcomes

• Disable a link. We deactivate the Exito Transfer link, Exito Vault share link or file request concerned.
• Remove content. We delete the files or content concerned.
• Restrict the account. For example, we limit or pause sending, turn off sharing or Exito Transfer, or ask the user to verify their account.
• Suspend or close the account. For serious or repeated violations, under our Terms.
• No action. When the content is neither illegal nor against our rules, or the notice doesn't give us enough to go on. We always tell you why.

In choosing, we weigh the gravity of the content, whether it was a one-off, and the rights and legitimate interests of everyone involved, including freedom of expression and information.

Use of automated tools

We use automated means to sort notices by category and urgency, to spot duplicates, to give reviewers signals such as malware scan results, and to apply interim, reversible restrictions while a notice is assessed. Some clear-cut decisions may be taken by automated means; decisions that need judgment are taken by a person, and every appeal is decided by a person. As Article 16(6) DSA requires, our decision notification states whether automated means were used in processing your notice.

Target response times

The DSA imposes no general obligation to monitor content (Article 8), and we don't read your mail or files. To keep the Service safe and our mail deliverable for everyone, we rely on targeted, largely automated measures:

• Spam and malware filtering. Mail is filtered for spam on our own infrastructure, and mail and Exito Transfer uploads may be scanned for malware. Filters may query public DNS blocklists with the sending server's IP address or domain.
• Sending limits. Every account has a daily sending limit that starts lower for new accounts and grows with account age and trust.
• Automated enforcement. Our automated enforcement system watches spam complaints, bounces, blocklist listings, malware results, signs of account takeover and reports. When signals cross set thresholds, it can limit or suspend sending, suspend an account, block a transfer and quarantine its files, suspend a custom domain or block an IP address. These measures are designed to be temporary and reversible, and complex cases are escalated to our staff.
• Sign-up protection. Rate limits per IP address, checks on recovery addresses (no disposable addresses) and a Cloudflare Turnstile bot check.

We may also investigate on our own initiative, for example after a report from a recipient, a blocklist operator or a security researcher. Whenever an automated or own-initiative measure restricts content or an account, the user receives a statement of reasons that says so, and can ask for review by a person through an appeal.

If we restrict a user's content or account because it is illegal or breaks our Terms or AUP, we send that user a clear and specific statement of reasons (Article 17 DSA), at the latest when the restriction takes effect.

This covers removing or disabling access to content or links, suspending or ending all or part of the Service (for example, sending, sharing or Exito Transfer), and suspending or closing an account. We send it to the email address associated with the account.

What it includes

• What we did. The restriction, its scope and, if it is temporary, how long it lasts.
• Facts and circumstances. What we found, whether we acted on a notice or on our own initiative and, only where strictly necessary, the identity of the notifier.
• Automated means. Whether we used automated means to detect the content or to take the decision.
• Legal ground. For illegal content: the law we relied on, and why the content is illegal under it.
• Contractual ground. For violations of our Terms or AUP: the provision we relied on, and why the content breaks it.
• Redress. How to appeal, use out-of-court dispute settlement or go to court.

When we may not send one

• When we have no electronic contact details for the user (Article 17(2) DSA).
• For deceptive high-volume commercial content, such as spam campaigns (Article 17(2) DSA).
• For orders from authorities under Article 9 DSA, which follow their own rules (Article 17(5); see Orders from authorities).
• When the issuing authority of a terrorist-content removal order decides that there must be no disclosure (Article 11(3) of Regulation (EU) 2021/784), or another competent authority lawfully requires confidentiality. We inform the user as soon as, and to the extent that, we are allowed to.

In cases involving child sexual abuse material that we report to NCMEC, the statement is limited to the measure, the rule concerned and the redress available, so that a criminal investigation is not compromised.

If you disagree with a decision, ask us to review it. Appeals are free, electronic and handled by people.

Who can appeal

The notifier (including against a decision not to act on a notice) and the affected user.

Which decisions

Decisions to remove or disable access to content, to restrict or suspend all or part of the Service, to suspend or close an account, or not to act on a notice.

Deadline

Within six months after you were informed of the decision.

How

Use the appeal page at exitomail.com/appeal, or email abuse@exitomail.com with your case reference, why you think the decision is wrong, and any evidence that supports your view.

Cost

Free of charge.

We handle appeals in a timely, non-discriminatory, diligent and non-arbitrary manner. Your appeal is reviewed by appropriately qualified staff, where possible someone who was not involved in the original decision, and never solely by automated means. If your appeal shows that our decision was wrong, we reverse it without undue delay, for example by restoring the content or the account. We send you a reasoned decision and tell you about out-of-court dispute settlement and your other options.

Article 21 DSA gives users of online platforms the right to turn to an out-of-court dispute settlement body certified by a Digital Services Coordinator. The European Commission publishes the list of certified bodies (s’ouvre dans un nouvel onglet). Because we are not an online platform, that right does not formally apply to our Service, and a certified body may decline a dispute about it.

• If a certified body agrees to handle your dispute with us, we will engage with it in good faith. We may decline when a dispute about the same content and the same grounds has already been resolved.
• The body cannot impose a binding settlement on either side.
• Your right to go to court is unaffected. You can also lodge a complaint about our compliance with the DSA with the Digital Services Coordinator of the Member State where you live or are established (Article 53 DSA).

Trusted flaggers are organizations with particular expertise in detecting certain types of illegal content, awarded that status by the Digital Services Coordinator of their Member State (Article 22 DSA). Their notices, within their designated area of expertise, are handled with priority and decided without undue delay.

• Use the same channels as everyone else: the report form (choose “Trusted flagger” under “I am reporting as”) or abuse@exitomail.com.
• Identify yourself as a trusted flagger, and name your organization, the Digital Services Coordinator that designated you and your area of expertise.
• We may check your status against the Commission's public list of trusted flaggers (s’ouvre dans un nouvel onglet).

Article 22 DSA applies to online platforms. We give trusted flaggers priority voluntarily, on all our hosting services.

Judicial and administrative authorities of EU Member States may order us to act against specific illegal content (Article 9 DSA) or to provide information about specific users (Article 10 DSA).

How to send an order

Send orders to our point of contact for authorities, legal@exitomail.com, in English. English is also an official language of Ireland, where our legal representative is established, as Article 11(3) requires. An order should meet the conditions of Article 9(2) or 10(2) DSA: it should identify the issuing authority and its legal basis, state its reasons, identify the content (exact URLs) or the users concerned, explain the available redress and, for orders to act, state their territorial scope. We verify that each order is authentic, and we may ask for clarification when an order is incomplete or unclear.

What we do

• We inform the issuing authority, or another authority it specifies, of the effect given to the order without undue delay, saying whether and when we acted.
• We inform the affected user of the order and the effect we gave it, at the latest when we act or at the time set by the authority, with a statement of reasons, the territorial scope of the order and the redress available (Articles 9(5) and 10(5) DSA).
• Informal requests that are not orders are not enough on their own: we disclose user data only when a valid legal basis requires or permits it. See our Privacy Policy.

Removal orders for terrorist content

Competent authorities can issue removal orders under Regulation (EU) 2021/784 (s’ouvre dans un nouvel onglet) on addressing the dissemination of terrorist content online. Send them to legal@exitomail.com with “TCO removal order” in the subject. This address is our contact point under Article 15 of that Regulation, and it accepts English. We remove the content or disable access to it in all Member States as soon as possible and in any event within one hour of receiving the order, as Article 3(3) requires, preserve it for six months (Article 6), and inform the user concerned in line with Article 11, unless the authority decides otherwise. Our legal representative for that Regulation (Article 17) is being designated.

Member State authorities, the European Commission and the European Board for Digital Services (Article 11 DSA)

legal@exitomail.com. Languages: English. English is also an official language of Ireland, where our legal representative is established, as Article 11(3) requires.

Users and anyone using the Service (Article 12 DSA)

support@exitomail.com for questions, abuse@exitomail.com for notices and appeals, and the appeal page at exitomail.com/appeal. You can always reach a person: you are never limited to automated tools.

Legal representative in the EU (Article 13 DSA)

Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: digitalrequest@datarep.com (put “ExitoMail” in the subject). Online form: datarep.com/data-request (s’ouvre dans un nouvel onglet). Phone: +353 1 919 8899.

Legal representative for terrorist content removal orders (Article 17 of Regulation (EU) 2021/784)

Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: terroristcontentrequest@datarep.com (put “ExitoMail” in the subject). Online form: datarep.com/data-request (s’ouvre dans un nouvel onglet).

Contact point for removal orders (Regulation (EU) 2021/784)

legal@exitomail.com

Mail delivery and blocklist issues

postmaster@exitomail.com

Provider

EXITO Media LLC, a Wyoming limited liability company (Wyoming Secretary of State, filing ID 2022-001141268), with its business address at 111 NE 1st St, 8th Floor, #88287, Miami, FL 33132, United States.

When we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the law-enforcement or judicial authorities of the Member State or States concerned and give them all relevant information we have (Article 18 DSA).

If we cannot identify the Member State concerned with reasonable certainty, we inform the law enforcement authorities of the Member State where our legal representative is established (Ireland), or Europol, or both (Article 18(2) DSA). Where the threat concerns people outside the EU, we may also inform the competent authorities there, including in the United States. We share only what is necessary for that purpose.

We intend to publish a transparency report at least once a year, on this page, starting after our first full year of operation. It will cover:

• orders received from Member State authorities, by type of illegal content and issuing Member State, and how quickly we gave effect to them;
• notices received, by type of alleged illegal content, including those from trusted flaggers, the action we took, whether on legal or contractual grounds, how many were processed using automated means, and how long we took;
• own-initiative moderation, including the automated tools we use and the measures taken;
• appeals received, their grounds and outcomes, how long we took, and how many decisions we reversed.

Separately, for any calendar year in which we take action against terrorist content or are required to under Regulation (EU) 2021/784, we publish the transparency report that its Article 7(2) requires, before 1 March of the following year. That duty has no exemption for small companies.

Notices and appeals only work when people use them in good faith. Following the model of Article 23 DSA, which we apply voluntarily, we act against two kinds of misuse, under the policy set out here in advance.

Users who frequently provide manifestly illegal content

We suspend, for a reasonable period and after a prior warning, the accounts, or the relevant features, of users who frequently provide manifestly illegal content. Content is “manifestly illegal” when it is evident to a layperson, without any substantive analysis, that it is illegal.

People who frequently submit manifestly unfounded notices or appeals

We suspend, for a reasonable period and after a prior warning, the processing of notices and appeals from individuals or organizations that frequently submit notices or appeals that are manifestly unfounded.

How we decide

We assess each case individually, in a timely, diligent and objective manner, considering:

• the absolute number of items of manifestly illegal content, or of manifestly unfounded notices or appeals, in a given time frame;
• their proportion relative to the total number of items, notices or appeals in that time frame;
• the gravity of the misuse, including the nature of the content, and its consequences;
• where it can be identified, the intention behind it.

For example: a user whose Exito Transfer links are repeatedly confirmed to host phishing pages, or someone who sends dozens of templated notices against a competitor's lawful files. A first suspension usually lasts 30 days; repeated misuse leads to longer suspensions. Every suspension comes with a statement of reasons and can be appealed.

• Why we use it. To process your notice, communicate with you, handle any appeal and meet our legal obligations under the DSA (Article 6(1)(c) GDPR), and to keep the Service safe (Article 6(1)(f) GDPR).
• Who sees it. We don't reveal your identity to the affected user unless strictly necessary, for example when a rights holder must be identified in a copyright case. We never reveal the identity of someone reporting child sexual abuse material. We share notices with authorities only where the law requires it, such as under Article 18 DSA or an order.
• How long we keep it. 12 months after the case is closed, or longer while needed for a legal claim or a legal hold.
• Your rights. See our Privacy Policy, or write to privacy@exitomail.com.

Fill in the form below. It prepares a complete notice, with every element listed in What a notice must contain, as an email to abuse@exitomail.com that you send from your own email app. Nothing is sent or stored by this page. Prefer to write it yourself? Email us directly with the same information.

To report illegal content, use the form at https://exitomail.com/fr/legal/notice-and-action#report or email abuse@exitomail.com with the information listed in “What a notice must contain”.