Providing descriptions of how they comply with these requests is a good start. However, they should be even more specific. A skeptical person could say this st

Providing descriptions of how they comply with these requests is a good start. However, they should be even more specific. A skeptical person could say this still leaves the door open to, say, a custom SFTP server that gives the NSA access to any user data. I don't believe that's the case, but I think they should provide more detailed procedures for exactly how they comply with these requests. e.x. "The following procedure is the only method by which we provide data to law enforcement: 1. When we receive a request for user data from law enforcement, our legal department thoroughly examines the request to ensure it's legitimate, not overly broad, blah, blah, blah. 2. X person performs Y steps to extract the specifically requested data from our data stores, with Z safeguards to assure no additional data is included. 3. The legal department reviews the extracted data to ensure it matches the requested data, and only the requested data. 4. X person sends data to law enforcement agency using Y methods (i.e. uploading data to a SFTP server account) and notifies the agency that the request has been fulfilled."