OCR Vendor Subpoena: Who Can Demand Your Uploaded Files?

An OCR vendor subpoena is possible, because a subpoena can be served on anyone who holds documents, and a vendor holds the copies you uploaded. What protects them is a federal statute that restricts what some online providers may disclose, the privilege rules, your contract with the vendor, and how little you leave in the account.

This post walks through the federal statutory text and the federal civil rule on subpoenas. State law, case law and the facts of your vendor relationship all change the analysis. Read it as a map of the questions, not as legal advice on any demand in front of you.

Can a third party subpoena an OCR vendor for a law firm's documents?

Yes, a third party can serve a subpoena on an OCR vendor. Whether the vendor may lawfully hand over the contents of your uploads in response is a separate question, and for some providers federal law says no. A subpoena for account records, as opposed to document contents, meets fewer obstacles.

Under Federal Rule of Civil Procedure 45, paragraph (a)(1)(A)(iii), a subpoena may command a person to "produce designated documents, electronically stored information, or tangible things in that person's possession, custody, or control". The rule does not exempt companies that hold files for someone else. State courts have their own subpoena rules, and criminal and administrative process work differently again.

Three kinds of requester matter to a law firm.

One practical point belongs here. A requester who cannot get documents from the vendor may still ask the firm or the client for them directly, on the argument that files in a vendor account are within the account holder's control. Whether that argument succeeds is a question for the court hearing it. Leaving files with a vendor does not move them out of reach of ordinary discovery.

What does the Stored Communications Act let a vendor disclose?

The Stored Communications Act bars certain providers from knowingly divulging the contents of what customers store with them, subject to listed exceptions. A civil subpoena from a private party is not on the list of exceptions for contents. Account records are treated differently: the statute lets a covered provider give those to anyone who is not a governmental entity.

Which providers the statute covers

18 U.S.C. 2702, subsection (a)(2), applies to "a person or entity providing remote computing service to the public". The definition is in 18 U.S.C. 2711, paragraph (2): "the provision to the public of computer storage or processing services by means of an electronic communications system".

An online OCR service takes files over the internet and processes them, so the definition is the obvious place to start. Whether a given vendor falls inside it is a legal conclusion that depends on the service and on case law this post does not survey. Do not assume it either way.

The condition that depends on the vendor's own terms

Section 2702(a)(2) protects contents carried or maintained on the service on behalf of a customer and, under subparagraph (B), "solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing".

Read that against a vendor's terms of service. If the terms let the vendor use uploads for something beyond storing and processing them for you, such as improving its own products, the wording of subparagraph (B) gives a requester an argument that the protection does not apply. That is one more reason to read what a vendor's terms authorize its staff and systems to do with your files; the post on whether OCR vendor employees can see your documents covers that reading.

The exceptions for contents

Section 2702(b) lists nine situations in which a covered provider "may divulge the contents of a communication". They include disclosure:

• "to an addressee or intended recipient of such communication";
• "as otherwise authorized in section 2517, 2511(2)(a), or 2703 of this title", the last of which is the government process section;
• "with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service";
• "as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service";
• to a governmental entity where the provider believes in good faith "that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay".

None of the nine mentions a subpoena issued in private civil litigation. The consent exception is the one to notice, because the subscriber is your firm. A vendor that receives a civil demand for contents can point to the statute and tell the requester to seek the files, or consent, from the account holder.

Records that are not contents

Section 2702(c) covers "a record or other information pertaining to a subscriber to or customer of such service", with the contents of communications carved out. Paragraph (6) allows disclosure of those records "to any person other than a governmental entity". So the statute does not stop a covered vendor from telling a private litigant that your firm has an account, when it was opened, or how it is paid for. Your contract might.

Government warrants and nondisclosure orders served on a vendor

A governmental entity can compel a covered provider to disclose stored contents under 18 U.S.C. 2703, in some cases with a warrant and no notice to the customer. Under section 2705(b) a court can also order the provider not to tell anyone. A firm may learn of such a demand late or never.

18 U.S.C. 2703, subsection (b)(1), sets out two routes to contents held by a remote computing service:

• Paragraph (A): "without required notice to the subscriber or customer, if the governmental entity obtains a warrant".
• Paragraph (B): "with prior notice from the governmental entity to the subscriber or customer" if it uses an administrative, grand jury or trial subpoena or obtains a court order under subsection (d), "except that delayed notice may be given pursuant to section 2705 of this title."

That is the text of the statute. Court decisions and agency policy affect how these routes are used, so treat the text as the start of your research.

Account records follow subsection (c). Paragraph (2) lists what a provider "shall disclose" on an administrative, grand jury or trial subpoena: name, address, session times and durations, length and types of service, subscriber number or identity "including any temporarily assigned network address", and the "means and source of payment for such service". Paragraph (3) adds that a governmental entity receiving records under the subsection "is not required to provide notice to a subscriber or customer."

Orders that keep the vendor silent

18 U.S.C. 2705, subsection (b), lets a governmental entity apply for an order commanding the provider "for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order." The court enters the order if it finds reason to believe notice will result in one of five harms, among them "destruction of or tampering with evidence" and "otherwise seriously jeopardizing an investigation or unduly delaying a trial."

Subsection (a) covers delayed notice by the government itself, in periods "not to exceed ninety days", with extensions.

Preservation requests

Section 2703(f) says a provider, "upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process." The records are kept for 90 days, extended for another 90 on a renewed request. A preservation request can therefore freeze material in a vendor's systems before any warrant exists.

What follows for a firm: a contract clause promising notice of legal process helps with civil demands and with government demands that carry no secrecy order. It cannot override an order under section 2705(b). The only control that works in every case is the amount of client material sitting in the account when the demand arrives.

Does privilege survive when the demand goes to the vendor instead of the firm?

Serving the vendor does not by itself strip privilege from a document, but it changes who is positioned to object. The vendor received the subpoena and has no reason to know which pages are privileged. The firm and the client know, and they have to learn of the demand in time to act.

In a federal civil case, Rule 45 gives three footholds.

1. Notice to the parties. Rule 45(a)(4) says that when a subpoena commands production of documents before trial, "then before it is served on the person to whom it is directed, a notice and a copy of the subpoena must be served on each party." If your client is a party to that case, the notice is how you find out. If your client is a stranger to the case, this rule does not reach you.
2. A motion to quash. Rule 45(d)(3)(A)(iii) says the court "must quash or modify a subpoena that" "requires disclosure of privileged or other protected matter, if no exception or waiver applies". Rule 45(d)(3)(B) speaks of protecting "a person subject to or affected by a subpoena", which is wider than the person served. Who has standing to move in your court is a point to research.
3. The withholding procedure. Rule 45(e)(2)(A) requires "a person withholding subpoenaed information under a claim that it is privileged" to "expressly make the claim" and describe what is withheld. That paragraph is addressed to the person responding, which is the vendor.

Attorney-client privilege is commonly described as belonging to the client and asserted by the lawyer on the client's behalf. Confirm how your jurisdiction puts it. On that understanding a vendor cannot be relied on to assert it. The vendor may not know the privilege exists.

A worked example

Okafor and Reyes LLP represents Tidewater Marine in a contract dispute. A paralegal uploads forty pages of scanned email between Tidewater's general counsel and its operations manager to an online OCR service, exports the text and leaves the files in the account. The opposing party, Harlan Supply, serves a Rule 45 subpoena on the OCR vendor for "all documents uploaded by or on behalf of Tidewater Marine or its counsel."

Under Rule 45(a)(4), Harlan must serve notice and a copy on Tidewater before serving the vendor. The firm now has work to do, quickly:

• write to the vendor, identify the account, state that the contents include privileged material and that the firm does not consent to disclosure;
• point the vendor to 18 U.S.C. 2702 and ask for its position in writing;
• move to quash or modify under Rule 45(d)(3) in the court for the district where compliance is required;
• place a hold on the uploaded files, because a demand has been made for them. The post on how a litigation hold changes what you may delete explains how a pending demand changes what the firm may delete.

Had the firm deleted the uploads the day the export was saved, months before any demand, the forty pages would not have been sitting in the account when the subpoena arrived. What a vendor can still hold after a deletion is a separate question to put to the vendor.

A thinner account gives a later subpoena less to name. Keep attorney-client privilege and the work-product doctrine in view when you decide what may remain with the vendor overnight. Electronically stored information left in the account is the set the demand will describe. Write the deletion date in the matter log so you can show what was already gone.

Legal process notice clauses to look for in an OCR vendor's terms

A legal process clause says what the vendor will do when someone demands your files. Look for four promises: prompt notice to you unless the law forbids it, disclosure of no more than the demand requires, redirection of the requester to you, and room for you to object before anything is produced.

The ethics guidance treats this as a term to check. ABA Formal Opinion 512, drawing on earlier cloud computing opinions, says lawyers should ensure "that the lawyer will be notified in the event of a breach or service of process regarding production of client information".

For an example of how a provider words such a commitment, the AWS data privacy FAQ says: "If a governmental body sends AWS a demand for your customer content, we will attempt to redirect the governmental body to request that data directly from you." It continues that, if compelled to disclose, AWS "will give you reasonable notice of the demand to allow you to seek a protective order or other appropriate remedy unless AWS is legally prohibited from doing so." That is a cloud infrastructure company, not an OCR vendor, and it is quoted only to show the elements. Read your own vendor's wording.

Reading the clause

Search the terms, the privacy policy and any data processing agreement for "subpoena", "legal process", "law enforcement", "court order" and "compelled". The clause can sit in any of the three. The post on OCR vendor data processing agreement clauses covers the rest of that contract.

If the published terms say nothing, ask in writing. Schema Law's Enterprise plan lists "Security questionnaire and contract review", which is the place to raise a legal process clause with it; the pricing page shows what each plan includes. The site's public pages state no legal process term, so ask.

What a vendor can still hand over after the firm deletes an upload

After a deletion, a vendor may still hold three things: account records, logs showing that an upload happened, and any copies that remain in backups until they expire. Deleting removes the document from what can be produced going forward. It does not erase the fact that the firm used the service.

Account records. The list in 18 U.S.C. 2703(c)(2) shows what the statute itself treats as subscriber records: name, address, session times, length of service, network address and payment source. None of that depends on a document still being stored.

Logs and metadata. A vendor's systems may record file names, page counts and timestamps apart from the files. A file name such as "Tidewater GC email re termination.pdf" tells a reader something. Ask your vendor what it logs, and consider neutral file names for uploads.

Backups. Deletion from an account and deletion from backups can be two events. As an illustration from a different kind of service, OpenAI's page on chat and file retention policies in ChatGPT, as archived in September 2026, says that after a Library file is deleted in an Enterprise workspace, "OpenAI's internal backups may retain it for up to 30 additional days, unless OpenAI must retain it longer for security or legal obligations." Your OCR vendor's figure, if it publishes one, is the one that counts.

Preserved copies. A preservation request under section 2703(f) or a vendor's own legal hold can keep material that you believe you deleted.

About Schema Law, the site says this and no more: every plan includes "Delete any document, at any time", and the security commitments on the homepage say that when you delete a document, "The original file and everything parsed from it are removed." Questions about logs and backup windows are ones to put to the vendor in writing.

A deletion habit that limits exposure

1. Export what you need and save it in the firm's document system.
2. Check the export against the source pages.
3. Delete the upload from the vendor account, unless a hold applies.
4. Note the deletion date in the matter file.

Once the export is in the firm's system, it is a firm record like any other. Whether it must go to the client at the end of the matter is covered in the post on whether OCR text is part of the client file.