# Intakes

URL: /systems/trust-and-governance/intakes · Id: `page:systems/trust-and-governance/intakes`

> The eight public addresses every Live Startup answers, from security reports to subpoenas, each with a deadline, an owning Role, and a Process.

An intake is a public address where anyone can reach a Live [Startup](/business/nouns/startup) uninvited. Each one binds an address to a deadline, an owning [Role](/business/nouns/role), and the [Process](/business/nouns/process) that answers.

## Why every Startup has them
A Live Startup is a public internet property. Security researchers find flaws, rightsholders send notices, courts serve subpoenas, journalists ask questions, and people who cannot use a [Page](/business/nouns/page) say so. None of them is a [Customer](/business/nouns/customer), and several arrive with a legal clock.

Each intake is an address on a [Mailbox](/business/nouns/mailbox), with a form on the [Site](/business/nouns/site) beside it. Every message opens a [Thread](/business/nouns/thread), and the `Thread.created` [Event](/business/nouns/event) starts the deadline. Every Live Startup inherits all eight; none is configured by hand.

## The eight intakes
| Intake | Address | First answer within | Owner | Process |
| --- | --- | --- | --- | --- |
| Security reports | `security@`, `/.well-known/security.txt` | 3 days | [Security Engineer](/agents/engineering/security-engineer) | [Vulnerability disclosure](/workflows/processes/vulnerability-disclosure) |
| Legal notices | `legal@` | 1 day | [Legal Lead](/agents/legal/legal-lead) | [Legal notices](/workflows/processes/legal-notices) |
| Takedown notices | `copyright@`, `/legal/takedown` | 1 day | [Contracts Manager](/agents/legal/contracts-manager) | [Takedowns](/workflows/processes/takedowns) |
| Whistleblower reports | `ethics@` | 7 days | [Compliance Officer](/agents/legal/compliance-officer) | [Whistleblower reports](/workflows/processes/whistleblower-reports) |
| Press inquiries | `press@`, `/press` | 1 business day | [Communications Lead](/agents/marketing/communications-lead) | [Press inquiries](/workflows/processes/press-inquiries) |
| Abuse reports | `abuse@`, `/report` | 1 business day | [Risk Analyst](/agents/operations/risk-analyst) | [Trust and safety](/workflows/processes/trust-and-safety) |
| Accessibility barrier reports | `accessibility@`, `/accessibility` | 5 business days | [Designer](/agents/product/designer) | [Barrier reports](/workflows/processes/barrier-reports) |
| Privacy requests | `privacy@`, `/privacy/request` | 10 business days | [Privacy Officer](/agents/legal/privacy-officer) | [Privacy](/workflows/processes/privacy) |

## Where each deadline comes from
Each deadline is the shorter of the law and the promise the Startup publishes. A subpoena can allow 14 days to object, so a legal notice reaches the owner of record within a day. The EU whistleblower directive requires acknowledgement within seven days.

California requires a privacy request to be confirmed within 10 business days and answered within 45. A safe harbor for hosted material requires prompt removal once a valid takedown notice arrives. An actively exploited flaw also starts a 24-hour regulator clock, which [Notify regulator](/workflows/processes/notify-regulator) runs.

[Intakes answered on time](/agents/legal#intakes-on-time) is the share of intake Threads that get a first answer before their deadline. Each Thread shows its deadline in the owning Role's queue from the moment it opens.

## Who answers
An [Agent](/business/nouns/agent) seated in the owning Role answers first and says it is an agent, as [AI disclosure](/systems/legal-and-corporate/floor/ai-disclosure) requires. It answers from the Startup's own records: the press kit, the disclosure policy, the accessibility statement, the subprocessor list.

Some intakes reach a person by law. A legal notice goes to the owner of record, who holds the records it names. The whistleblower line is one that management cannot read, and the reporter is protected from retaliation.

## What the Site publishes
Every Live Site serves the pages the intakes rest on:

- `/.well-known/security.txt`, naming the security address and a disclosure policy with safe harbor for good-faith research;
- an accessibility statement at `/accessibility`, with the barrier-report form;
- a press kit at `/press`, with facts the Startup's records keep current;
- a takedown form at `/legal/takedown`, and a privacy request form at `/privacy/request`.

Going [Live](/business/lifecycle/states/live) checks that each one is served and that each address answers.

## Next
- [Legal process](/systems/legal-and-corporate/floor/legal-process), [Whistleblowing](/systems/legal-and-corporate/floor/whistleblowing), and [Vulnerability handling](/systems/legal-and-corporate/floor/vulnerability-handling): the floor rows behind three intakes.
- [Acceptable use](/systems/trust-and-governance/acceptable-use): what an abuse report is judged against.
- [Your data](/systems/trust-and-governance/your-data): what a privacy request can see, correct, and export.