Transparency report

Effective 2026-04-28 · Reporting period: pre-launch

The abuse policy commits to publishing aggregate stats on abuse reports, action distribution, and lawful orders. This page is where those numbers go. The first full report covers our first 12 months of operation. Until then, the methodology is committed below and the PGP key for sensitive disclosures is published; the numbers section will populate as we operate.

Pre-launch state. ViaductCDN has not yet opened to public signups. There is nothing to report yet. The first annual report will publish 12 months after the first paying customer, or sooner if we receive our first lawful order before then. Whichever comes first.

Operating history

A WHOIS check on viaductcdn.com will show a domain registered in late April 2026. The project behind the domain predates it by months; the two-week-old domain is a fair skepticism marker and the entries below are the verifiable counterweight.

ViaductCDN is operated by Inertial Navigation LLC, a Washington-state limited liability company registered 2015-06-16 (UBI 603 516 505). The LLC has been an active operating entity for over a decade; formation date and registered agent are public record on the Washington Secretary of State’s Corporations and Charities Filing System. ViaductCDN’s engineering was carried out by a related Inertial project (scheducal.com, on the public web since 2023-10-17). The PGP key published below carries its creation date in the self-signature and has been uploaded to keys.openpgp.org, so the key’s age is independently verifiable as well.

Public, dated milestones:

Date	Milestone
1997-09-15	Founder’s personal domain llew.net registered. A 28-year continuous online identity; predates this venture by decades.
2015-06-16	Inertial Navigation LLC formed in Washington state (UBI 603 516 505). The operating entity behind ViaductCDN; not a corporation spun up for this venture.
2023-10-17	scheducal.com registered. A related Inertial project that did the engineering for ViaductCDN; its public web presence has been continuous since registration.
Late 2024	ViaductCDN project work begins under Inertial. Architecture and infrastructure prototyping.
2026-04-25	Per-site Tor v3 hidden-service provisioning shipped. Every customer site gets its own .onion address, customer-owned. A previous shared-front design (using OnionBalance) was retired the same day in favour of this per-site model.
2026-04-28	This transparency page goes live, with methodology committed before any numbers exist. PGP key for sensitive disclosures published.
2026-04-29	First internal end-to-end customer (VIDS on Demand) live on the alpha cluster.
2026-05-09	Newsletter pipeline live (Buttondown, all tracking off, subprocessor disclosed on this page and on /privacy).

If you’re evaluating whether this project is a scam or a rug-pull rather than a real ongoing operation, the load-bearing artefacts are the Washington-state LLC record, the PGP key on keys.openpgp.org, and the threat-model document at /security. A short domain history is not the same thing as a short project history; the two are easy to conflate.

Methodology (committed before any numbers exist)

A transparency report without a methodology is a marketing artifact, not a transparency artifact. We define our terms here so future numbers are interpretable.

What counts as “a report”

A report is any inbound message to abuse@viaductcdn.com or via the form at /abuse that names a specific site_id or .onion address and includes either a description of the alleged violation or a lawful order. Spam and duplicate-of-prior reports are excluded from counts; we publish the de-duplication count as a separate line.

What counts as “acted on”

A report is “acted on” when our triage process produces one of these outcomes:

Dismissed — report doesn’t evidence a policy violation.
Forwarded to operator — for non-urgent matters where the site operator should respond first (DMCA forwards, customer complaints).
Site suspended — clear policy violation, site state set to suspended at the edge.
Account suspended — pattern of violations across multiple sites under one tenant.
Reported to NCMEC — CSAM specifically, per 18 U.S.C. § 2258A.

How we measure time-to-action

Timer starts when the report arrives in our queue (inbound timestamp on abuse@). Timer stops at the first operator action: dismissal, forwarding, suspension. We publish median and 95th-percentile, broken down by category.

What “lawful order” means

Court orders, subpoenas, search warrants, NSLs, and equivalent legal process from any jurisdiction. Counted by category and by jurisdiction. For each we also track:

Whether we complied as-served, complied after pushback (narrowed scope), or fully refused (jurisdiction lacked nexus, request facially overbroad, etc.).
Whether disclosure was permitted (we publish counts even when individual orders are sealed).

Specific orders are not described individually. The counts are enough; itemizing would risk identifying parties involved in sealed proceedings.

Numbers

First reporting cycle has not yet begun. This section will populate on the publication date.

Period	Reports	Lawful orders	Status
2026 (first 12 months)	–	–	Reporting cycle in progress; first publish 12 months post-launch.

Subprocessor list

The third parties we use to operate the platform. Each is named in our privacy policy at /privacy along with what specifically they see. We list them here too because a privacy-positioned product’s subprocessor list belongs in the same place as the rest of the trust artifacts.

Processor	Purpose	Region
Microsoft Azure	Infrastructure (compute, storage, DNS, Key Vault)	USA (East US)
SendGrid (Twilio)	Transactional email delivery	USA
Buttondown	Newsletter delivery (subscriber emails + broadcast content); only populated by opt-in subscribers, never from account data	USA
Stripe	Card payment processing	USA + global
BTCPay (self-hosted)	Cryptocurrency invoice management; runs on our Azure infrastructure	USA (East US)
Let’s Encrypt	TLS certificate issuance for custom domains	USA

Subprocessor changes are announced via in-portal notification before they take effect.

PGP key for sensitive disclosures

Reports that touch on identifying information (CSAM tip-offs, sealed court orders, doxing complaints, security vulnerabilities) can be sent encrypted. The key below is the org key for abuse@viaductcdn.com; the same key handles security@viaductcdn.com for vulnerability disclosures. Private half is held on a hardware token; rotation is annual on the subkey, primary key non-expiring. Verify by fingerprint against keys.openpgp.org.

Fingerprint

DE90 9005 05C1 9240 9DD7 351B 0F44 77CD BE1D 9AE8

Public key block

Cross-references

/abuse — abuse policy and reporting flow
/security — threat model and what we see
/privacy — data we collect, retention, customer rights
/terms — service terms

Questions

Privacy / methodology questions: legal@viaductcdn.com. Abuse reports: abuse@viaductcdn.com. Security disclosures: security@viaductcdn.com.