Reporting illegal content
If you believe something hosted on a customer's forge is illegal, tell us. Anyone may — you do not need an account, a lawyer, or a relationship with us.
Send your report to support@forgejo.dc-analytic.com, with "notice" in the subject line.
What a report needs
Four things. A report with all four is one we are obliged to act on:
- Why it is illegal — an explanation with enough substance to assess. Which law, and how it applies. "This is illegal" on its own is not something anybody can act on.
- Exactly where it is — the URL, or enough detail to find it precisely. "Their whole forge" is not a location.
- Your name and email address, so we can acknowledge the report and tell you what we decided. You may leave these out only where the report concerns child sexual abuse material or the other offences where the law permits anonymity.
- A statement that you believe in good faith that the information in your report is accurate and complete.
If something is missing we will ask for it rather than silently discard the report.
What happens next
- We acknowledge it, with a reference, normally within one business day.
- We assess it. Our job is to judge whether the illegality is apparent to a diligent operator without a detailed legal examination. It is not our job to decide a contested legal question between you and a customer, and we will say so when that is where we have landed.
- Usually, we forward it to the customer with a deadline to remove the content or answer it. They know their content and their rights in it better than we do, and the first move is theirs.
- Where the content is manifestly illegal, or the customer does not answer, we suspend the instance. Where somebody is in danger, or the report concerns child sexual abuse material, we suspend immediately and report to law enforcement.
- We tell you what we decided, and we tell the customer, with the reasons and how to contest it.
What we can and cannot do
This is worth being plain about, because it decides what a report can achieve.
Every customer runs their own separate instance of the software, and nothing in this product signs us in to one. We cannot delete a file, a repository or a comment. Our options are to ask the customer, or to stop their entire instance — which takes down everything else they host, most of which will have nothing to do with your report.
That is why the customer gets the first move, and why the bar for us acting ourselves is deliberately high. It is not reluctance; it is proportionality with a very blunt instrument.
Bad-faith reports
We reject reports that are not really about illegality: a competitor complaining about a project, a demand to remove criticism, a claim with no legal basis in it. You get a short answer saying so. Repeatedly submitting manifestly unfounded notices will get you ignored.
Copyright complaints from the United States
Send them to the same address, and include what a notice under 17 U.S.C. §512(c)(3) requires: identification of the work, identification of the material and where it is, your contact details, a statement of good-faith belief that the use is not authorised, and a statement under penalty of perjury that your information is accurate and that you are authorised to act.
Two things to be straight about. We have not registered a designated agent with the United States Copyright Office, so we do not claim the §512 safe harbour, and you should not assume it. And your complaint will be handled through the process above, which is the one that binds us — a European hosting provider's obligations do not switch off because a notice is written in an American format.
A customer whose content we restrict on a copyright complaint may send a counter-notice. We will forward it to you, and unless you tell us you have filed suit, we will restore the instance after ten to fourteen business days.
Orders from authorities
An order from a judicial or administrative authority is not a report and does not belong on this page. Send it to the address in the Impressum, which is our single point of contact for authorities. We act on orders within the time they specify and inform the affected customer unless the order forbids it.
Something else
Spam, phishing, scanning or other abuse coming from a customer's instance goes to the same address and is handled under the acceptable use terms rather than under this process. A vulnerability in the platform itself belongs on the security page.