Law enforcement guidelines

Status: DRAFT — FOR LEGAL REVIEW
Version: 0.2
Date: 2026-10-18
Owner: Head of Legal / Compliance Officer (to be appointed)
Jurisdiction: Canada (operating company); EU users served under the DSA and GDPR; market neutral
Applicable law: Criminal Code of Canada (production orders, preservation demands and orders, interception authorizations), Canadian mutual legal assistance legislation, Personal Information Protection and Electronic Documents Act (PIPEDA); for EU users, GDPR (Regulation (EU) 2016/679), Digital Services Act (Regulation (EU) 2022/2065) Arts. 9, 10 and 13, e-Evidence Regulation (Regulation (EU) 2023/1543); Council of Europe Convention on Cybercrime (Budapest Convention, ETS No. 185), applicable MLATs
Reviewed by counsel: [pending]

This is Aurora's public-facing guidance for law-enforcement agencies and government authorities requesting data from [Registered company name]. It is a draft prepared for review by qualified Canadian and EU counsel. It is not legal advice. It does not create any rights, obligations, or expectations beyond those required by applicable law and Aurora's contracts with its users.

1. About Aurora

[Registered company name] ("Aurora") is a company incorporated in [Province], Canada, with its registered office at [Registered address]. Aurora operates the Platform at auroramembers.com — a premium adult companion advertising platform serving providers and members anywhere their use is legal, including users in the European Union. Providers publish their own profiles, which are their advertisements; Aurora charges for the advertising service and handles no payments between users.

• Legal name: [Registered company name]
• Registered office: [Registered address], [Province], Canada
• Business number: [Business number]
• Data Protection Officer: [email protected]
• EU legal representative under DSA Art. 13: [to be appointed]

For its EU users, Aurora is an intermediary service provider within the meaning of Art. 3(g) of the Digital Services Act, specifically a hosting service for user-generated content, and as such is subject to the DSA's due-diligence obligations (Chapters III and IV).

2. Governing Law and Jurisdiction

Aurora is subject to Canadian law. Legal process directed to Aurora must be valid under Canadian law and served in accordance with Canadian procedural rules. This means:

• Canadian authorities may serve Aurora directly with the instruments provided by the Criminal Code of Canada — for example production orders, preservation demands and preservation orders, search warrants, and interception authorizations issued by a justice or judge — and by other applicable federal or provincial law.
• EU member-state authorities may use the instruments provided by EU law, addressed to Aurora's EU legal representative under DSA Art. 13 ([to be appointed]):
  • Orders under DSA Arts. 9 and 10 (orders to act against illegal content and orders to provide information), which Aurora processes through the contact point in Section 3.
  • European Production Order / European Preservation Order under Regulation (EU) 2023/1543 (the e-Evidence Regulation), once fully applicable and to the extent it can be addressed to Aurora through its EU legal representative.
  • Otherwise, mutual legal assistance with Canada.
• Other non-Canadian authorities must proceed through the applicable mutual legal assistance treaty (MLAT), letter rogatory, or the Budapest Convention, typically via Canada's central authority for mutual legal assistance. Aurora does not respond to direct requests from foreign authorities that are not transmitted through an MLAT or equivalent lawful channel, except in the narrow circumstances of an emergency disclosure (Section 6).

Other than its EU legal representative under DSA Art. 13, Aurora has no designated representative outside Canada and does not consent to jurisdiction in other countries for the purpose of compelled disclosure.

3. Contact Point

All formal law-enforcement requests must be submitted in writing to:

• Email: [email protected] (stub — to be provisioned before launch)
• Postal: [Registered company name], Attn. Legal / Law Enforcement Response Team, [Registered address], [Province], Canada

Business hours: Monday–Friday, 09:00–17:00 local time at Aurora's registered office in [Province], Canada. Requests received outside business hours are logged on receipt and actioned on the next business day, unless they are marked as an emergency disclosure request (Section 6).

Emergency line (imminent harm only): Detailed in Section 6. Do not use this line for routine requests; misuse will delay legitimate responses.

Secure transmission. Aurora accepts encrypted email (PGP — key fingerprint at auroramembers.com/.well-known/pgp) and physical delivery. Do not send sensitive legal process over plain email; if you must, follow up with a signed hard copy.

Requests should include: (a) the requesting authority's name and address, (b) the name and contact of the officer in charge, (c) a case reference, (d) the legal basis for the request, (e) the data sought (with sufficient precision for Aurora to identify the relevant account or content), and (f) any legally required supporting documentation.

4. Legal Process Required, by Data Type

Aurora applies a graduated standard: the more sensitive the data, the stronger the legal process Aurora requires, consistent with Art. 6(1)(c) GDPR (legal obligation), Art. 6(1)(f) (legitimate interest), PIPEDA, and the Criminal Code of Canada. Aurora rejects overbroad, vague, or unlawfully issued requests.

4.1 End-to-End Encrypted Messages — What Aurora Cannot Provide

Aurora's direct-messaging system is end-to-end encrypted. Message ciphertext is stored on Aurora servers; the private keys reside on users' devices. Aurora does not have, and cannot produce, the plaintext of E2EE messages, even under lawful compulsion. Aurora will not:

• Decrypt or assist in decryption of E2EE content.
• Build, deploy, or maintain a "lawful access" backdoor in its cryptographic protocol.
• Weaken or remove E2EE for identified accounts (client-side or server-side).
• Push signed client software updates targeted at specific users to enable interception.

This position is grounded in GDPR Art. 32 (security of processing) and Art. 25 (data protection by design), in Aurora's contractual commitments to users, in the protection against unreasonable search and seizure under the Canadian Charter of Rights and Freedoms, and, for EU users, in Art. 7 CFREU and Art. 8 ECHR. Aurora will meet its obligations by preserving and producing:

• Account and subscriber data.
• Message metadata (sender, recipient, timestamp, delivery status) — on the appropriate legal process.
• Message attachments that were scanned server-side for CSAM before being encrypted client-to-client: for those, Aurora retains only the perceptual hash and the CSAM flag if any; the original bytes are not retained.

Requests for E2EE message plaintext will be answered with a formal written statement confirming inability to comply.

4.2 What Aurora Does Not Hold

Aurora deliberately minimizes data under GDPR Art. 5(1)(c). The following data is not retained and will not be producible:

• Raw KYC documents (ID scans) — deleted after verification; only the verification outcome is kept. Raw documents exist for 1 month at the processor (Didit Identity Spain S.L., Barcelona) pursuant to the DPA; requests for those must be directed to Didit under Spanish / EU law.
• Plaintext of E2EE messages (Section 4.1).
• Payment card data — Aurora does not accept cards and holds no card data. Plans are paid in Bitcoin to Aurora's own payment server; Aurora holds the invoice, amount and payment reference for its own plans only. Aurora holds no data about payments between users, because none pass through Aurora.
• Fine-grained geolocation — Aurora stores only coarse geocoordinates.

5. Preservation Requests

Aurora honors preservation demands and orders under the Criminal Code of Canada, and preservation requests under Art. 29 Budapest Convention, Art. 10 of the e-Evidence Regulation, or equivalent lawful authority. Preservation:

• Runs for up to 90 days from receipt, and may be renewed once for an additional 90 days upon written request.
• Does not constitute disclosure. Aurora will not release preserved data except pursuant to valid legal process meeting the standards in Section 4.
• Requires sufficient specificity to identify the data (account handle, email, URL, or time range). Aurora will not preserve entire user segments or time windows in response to vague requests.

6. Emergency Disclosure Requests

In situations of imminent danger of death or serious physical injury, Aurora may voluntarily disclose minimum necessary subscriber or content data in the absence of formal legal process, consistent with the PIPEDA provisions permitting disclosure without consent in an emergency that threatens the life, health or security of an individual and, for EU users, Art. 6(1)(d) GDPR (vital interests) and, where relevant, Art. 23 GDPR derogations. Aurora applies this exception narrowly.

6.1 Standard

Aurora will voluntarily disclose only if it has a good-faith belief, based on the content of the request, that:

1. There is an imminent risk of death or serious physical injury to an identifiable person;
2. The data requested is reasonably necessary to prevent or mitigate that harm; and
3. Waiting for formal legal process would defeat the purpose of the request.

6.2 Procedure

• Emergency requests must be submitted on official letterhead of the requesting agency, signed by an officer who can be verified, and sent to the emergency contact at [email protected] with subject line prefix [EMERGENCY].
• Aurora's on-call Legal Lead reviews the request. Where possible, Aurora will verify the request with the issuing agency via an independent channel.
• Aurora minimises disclosure to the smallest data set reasonably required to address the emergency.
• Aurora logs every emergency disclosure: time, requesting agency, officer, basis, data disclosed, reviewer.
• Follow-up formal legal process is expected within 5 business days; if none arrives, Aurora will notify the agency that future disclosures will require formal process.

7. Aurora's Internal Legal Review Process

Every law-enforcement request — whether routine, preservation, or emergency — is routed to Aurora's Legal Response Team and reviewed by qualified counsel before any data is disclosed. The review covers:

• Authority and jurisdiction of the issuing body.
• Validity of the legal instrument under Canadian law (or EU law, for instruments addressed to Aurora's EU legal representative).
• Scope — is the request narrowly tailored to the articulated purpose?
• Proportionality — is the data proportionate to the offence under investigation (Canadian Charter of Rights and Freedoms; for EU users, Art. 8 ECHR, Art. 8 CFREU, Art. 5 and 6 GDPR)?
• Gag order — is Aurora legally prohibited from notifying the user? (Section 8).
• Data availability — does Aurora actually hold the data sought?
• Production format — specifying a secure format and verification.

Aurora pushes back on overbroad, vague, unlawful, or extraterritorially-grounded requests, and where necessary challenges them before the competent Canadian court.

8. User Notification

Consistent with DSA Art. 9(5) and Aurora's transparency commitments:

• Default: Aurora notifies affected users of law-enforcement requests seeking their data, so that they can seek legal advice or challenge the request where possible.
• Exceptions: Aurora delays or withholds notification where legally required to do so — for example, where a Canadian court issues a non-disclosure order, where there is a court-ordered gag, or where notification would materially obstruct an active criminal investigation into conduct that poses a serious threat to life or safety.
• When the gag lifts: Aurora notifies the user as soon as legally permitted.

Notification includes a redacted copy of the request where possible, and informs the user of their right to legal representation.

9. Transparency Reporting

Under DSA Art. 15 and Art. 24, Aurora publishes a quarterly transparency report disclosing, in aggregate:

• The number of orders received from Canadian authorities and from EU Member State authorities (DSA Art. 15(1)(a) for the latter), by category of alleged illegality, jurisdiction, type of order, and response time.
• The number of information orders received from Canadian and EU Member State authorities.
• Voluntary emergency disclosures.
• Data preservation requests.
• The number of requests rejected, partially complied with, or challenged.
• Aggregate statistics on user notification.

Aurora publishes transparency reports at auroramembers.com/transparency and archives them for at least five years. The template for the report is documented in transparency-report-template.md.

10. Specific Response Times and Formats

• Acknowledgement of receipt: within 2 business days.
• Preservation request — actioned within 1 business day of acceptance.
• Routine disclosure request — target within 15 business days of a validly issued and lawfully served request, consistent with the period set in any accompanying order (and in any case within the time frame set by Art. 9 of the e-Evidence Regulation where applicable).
• Emergency disclosure — reviewed and responded to within hours, 24/7.
• Rejections and objections — issued in writing with legal reasoning.

Aurora produces data in a secure structured format (JSON or CSV, hash-manifested, delivered via encrypted transfer). Aurora does not provide direct access to production systems, databases, or consoles.

11. What Aurora Will Not Do

Aurora will not, under any circumstances:

• Provide bulk or dragnet disclosures of data about unidentified or loosely specified groups of users.
• Implement a back door in end-to-end encryption, or otherwise weaken cryptographic protections.
• Conduct pre-emptive or ongoing monitoring of user communications beyond the Platform's regular, disclosed moderation and CSAM-scanning.
• Target specific users for covert client-side software updates.
• Honour requests from foreign authorities that bypass MLAT / EPO / EIO channels, except for qualifying emergency disclosures.
• Act on informal requests (phone calls, in-person visits) without documented follow-up legal process.
• Retaliate against users or employees who exercise their legal rights in connection with a law-enforcement request.

12. Questions

For questions about these Guidelines, contact:

Aurora Legal / Compliance
[email protected] (stub)
[Registered company name], [Registered address], [Province], Canada

For data-protection questions, contact the DPO at [email protected].

DRAFT — FOR LEGAL REVIEW. These guidelines must be reviewed and approved by qualified Canadian and EU counsel with expertise in criminal procedure, PIPEDA, GDPR, and cross-border e-evidence instruments before publication. Placeholder contact details must be populated post-incorporation.