{"id":1950,"date":"2026-09-18T09:54:33","date_gmt":"2026-09-18T08:54:33","guid":{"rendered":"https:\/\/sooma.com\/?page_id=1950"},"modified":"2026-09-24T17:00:05","modified_gmt":"2026-09-24T16:00:05","slug":"transparency-report","status":"publish","type":"page","link":"https:\/\/sooma.com\/en\/relatorio-de-transparencia\/","title":{"rendered":"Transparency Report"},"content":{"rendered":"

What this document is for<\/h2>\n

The transparency report publicly discloses how many requests for access to client data Sooma has received from authorities, of what type, and how many were refused for not meeting the legal requirements.<\/p>\n

It is an institutional communication piece with three effects:<\/p>\n

    \n
  1. It backs up our message:<\/strong> Sooma states that data is subject exclusively to Portuguese law. The report shows what this means in practice.<\/li>\n
  2. It sets us apart:<\/strong> Few providers in Portugal do this. It is a hard argument to counter in proposals to the public sector and to professions bound by a duty of confidentiality.<\/li>\n
  3. It instils internal discipline:<\/strong>\u00a0It requires a rigorous record of requests to be kept, which is also useful evidence in the ISO\/IEC 27001 certification process.<\/li>\n<\/ol>\n

    Recommended frequency:<\/strong> annual, published in the first quarter of the following year, with all previous reports accessible on the same page.<\/p>\n

    Transparency Report 2026<\/h2>\n

    Sooma operates electronic communications infrastructure in Portugal. In that capacity, it may receive requests from judicial authorities and criminal police bodies concerning client data. We publish annually the number and nature of these requests, as well as their outcome.<\/p>\n

    1. Figures for the year<\/h3>\n

    1.1. Total requests received<\/h4>\n\n\n\n\n\n\n\n\n
    Indicator<\/th>\n2025<\/th>\n2026<\/th>\n<\/tr>\n<\/thead>\n
    Total requests received<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
    Requests from Portuguese authorities<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
    Requests from authorities of other EU Member States<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
    Requests from authorities of third countries<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    1.2. Origin of requests<\/h4>\n\n\n\n\n\n\n\n\n\n
    Requesting entity<\/th>\n2026<\/th>\n<\/tr>\n<\/thead>\n
    Judicial authorities (courts and Public Prosecutor's Office)<\/td>\n0<\/td>\n<\/tr>\n
    Criminal police bodies<\/td>\n0<\/td>\n<\/tr>\n
    Tax and Customs Authority (Autoridade Tribut\u00e1ria e Aduaneira)<\/td>\n0<\/td>\n<\/tr>\n
    Intelligence services<\/td>\n0<\/td>\n<\/tr>\n
    Other administrative bodies<\/td>\n0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    1.3. Type of request<\/h4>\n\n\n\n\n\n\n\n\n\n
    Nature of the request<\/th>\n2026<\/th>\nRemarks<\/th>\n<\/tr>\n<\/thead>\n
    Account holder identification data (basic data)<\/td>\n0<\/td>\nName, address, contact details and contractual details<\/td>\n<\/tr>\n
    Expedited preservation of data<\/td>\n0<\/td>\nTemporary preservation of existing data, at the request of a competent authority<\/td>\n<\/tr>\n
    Seizure of email<\/td>\n0<\/td>\nSubject to judicial authorisation<\/td>\n<\/tr>\n
    Traffic data<\/td>\n0<\/td>\nSubject to judicial authorisation<\/td>\n<\/tr>\n
    Interception of communications<\/td>\n0<\/td>\nSubject to judicial authorisation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    1.4. Outcome<\/h4>\n\n\n\n\n\n\n\n\n
    Outcome<\/th>\n2026<\/th>\n%<\/th>\n<\/tr>\n<\/thead>\n
    Requests fulfilled<\/td>\n0<\/td>\n\u2014<\/td>\n<\/tr>\n
    Requests refused for not meeting the legal requirements<\/td>\n0<\/td>\n\u2014<\/td>\n<\/tr>\n
    Requests corrected by the authority and subsequently fulfilled<\/td>\n0<\/td>\n\u2014<\/td>\n<\/tr>\n
    Requests that could not be answered because the data did not exist<\/td>\n0<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Note on traffic data:<\/strong>\u00a0Sooma retains technical logs for short periods, strictly as necessary for the security and operation of the Service, and does not keep traffic data for criminal investigation purposes. For this reason, some requests concerning traffic data cannot be fulfilled: the data no longer exists.<\/p>\n

    1.5. Accounts affected<\/h4>\n\n\n\n\n\n\n
    Indicator<\/th>\n2026<\/th>\n<\/tr>\n<\/thead>\n
    Number of client accounts targeted by the requests<\/td>\n0<\/td>\n<\/tr>\n
    Percentage of total accounts managed<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    2. How we handle requests<\/h3>\n
      \n
    1. All requests are received through a dedicated channel and recorded internally.<\/li>\n
    2. Each request is analysed individually by the Data Protection Officer and, whenever the nature of the request justifies it, with external legal support.<\/li>\n
    3. In each case, Sooma verifies: the competence of the requesting entity; the existence of a legal basis for the request; the existence of judicial authorisation, where required; proportionality and the delimitation of scope; and the security of the transmission channel.<\/li>\n
    4. Data is only provided when the request is legally valid and formally correct. Where this is not the case, the request is refused, stating the grounds, and the authority may correct and resubmit it.<\/li>\n
    5. No data is provided to authorities of third countries on the basis of direct requests. Such requests must follow the applicable international judicial cooperation mechanisms, with the involvement of the competent Portuguese authorities.<\/li>\n
    6. Sooma has no mechanism whatsoever for permanent, automated or unsupervised access by authorities to its clients' data.<\/li>\n<\/ol>\n

      3. What data can be requested<\/h3>\n\n\n\n\n\n\n\n\n
      Category<\/th>\nWhat it includes<\/th>\nAvailability<\/th>\n<\/tr>\n<\/thead>\n
      Basic data<\/td>\nHolder identification, contact details, contract details<\/td>\nRetained for the duration of the contract and the subsequent legal periods<\/td>\n<\/tr>\n
      Message content<\/td>\nMessages in the mailbox at the time of the request<\/td>\nOnly with judicial authorisation<\/td>\n<\/tr>\n
      Traffic data<\/td>\nIP addresses and connection logs<\/td>\nRetained for short periods; often already deleted<\/td>\n<\/tr>\n
      Interception<\/td>\nMonitoring of communications over a set period<\/td>\nOnly with judicial authorisation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      4. Methodological notes<\/h3>\n