Intakes
The eight public addresses every Live Startup answers, from security reports to subpoenas, each with a deadline, an owning Role, and a Process.
An intake is a public address where anyone can reach a Live Startup uninvited. Each one binds an address to a deadline, an owning Role, and the Process that answers.
Why every Startup has them
A Live Startup is a public internet property. Security researchers find flaws, rightsholders send notices, courts serve subpoenas, journalists ask questions, and people who cannot use a Page say so. None of them is a Customer, and several arrive with a legal clock.
Each intake is an address on a Mailbox, with a form on the Site beside it. Every message opens a Thread, and the Thread.created Event starts the deadline. Every Live Startup inherits all eight; none is configured by hand.
The eight intakes
| Intake | Address | First answer within | Owner | Process |
|---|---|---|---|---|
| Security reports | security@, /.well-known/ | 3 days | Security Engineer | Vulnerability disclosure |
| Legal notices | legal@ | 1 day | Legal Lead | Legal notices |
| Takedown notices | copyright@, /legal/ | 1 day | Contracts Manager | Takedowns |
| Whistleblower reports | ethics@ | 7 days | Compliance Officer | Whistleblower reports |
| Press inquiries | press@, /press | 1 business day | Communications Lead | Press inquiries |
| Abuse reports | abuse@, /report | 1 business day | Risk Analyst | Trust and safety |
| Accessibility barrier reports | accessibility@, /accessibility | 5 business days | Designer | Barrier reports |
| Privacy requests | privacy@, /privacy/ | 10 business days | Privacy Officer | Privacy |
Where each deadline comes from
Each deadline is the shorter of the law and the promise the Startup publishes. A subpoena can allow 14 days to object, so a legal notice reaches the owner of record within a day. The EU whistleblower directive requires acknowledgement within seven days.
California requires a privacy request to be confirmed within 10 business days and answered within 45. A safe harbor for hosted material requires prompt removal once a valid takedown notice arrives. An actively exploited flaw also starts a 24-hour regulator clock, which Notify regulator runs.
Intakes answered on time is the share of intake Threads that get a first answer before their deadline. Each Thread shows its deadline in the owning Role's queue from the moment it opens.
Who answers
An Agent seated in the owning Role answers first and says it is an agent, as AI disclosure requires. It answers from the Startup's own records: the press kit, the disclosure policy, the accessibility statement, the subprocessor list.
Some intakes reach a person by law. A legal notice goes to the owner of record, who holds the records it names. The whistleblower line is one that management cannot read, and the reporter is protected from retaliation.
What the Site publishes
Every Live Site serves the pages the intakes rest on:
/.well-known/, naming the security address and a disclosure policy with safe harbor for good-faith research;security.txt - an accessibility statement at
/accessibility, with the barrier-report form; - a press kit at
/press, with facts the Startup's records keep current; - a takedown form at
/legal/, and a privacy request form attakedown /privacy/.request
Going Live checks that each one is served and that each address answers.
Next
- Legal process, Whistleblowing, and Vulnerability handling: the floor rows behind three intakes.
- Acceptable use: what an abuse report is judged against.
- Your data: what a privacy request can see, correct, and export.