Account closed by Security team - seeking guidance on retrieving personal source code through proper channels

Hello DigitalOcean Community,

I’m reaching out for guidance on a difficult situation and would appreciate any advice from staff or community members who have been through something similar.

What happened

On May 4, 2026, I received an email from the Security team stating my account showed “atypical activity” and was locked pending verification. I responded the same day with a detailed description of my workload (personal AI development projects - LLM prototypes, FastAPI services, RAG experiments) and confirmed there was no abuse, mining, scanning, or any prohibited activity.

Over the following days I cooperated fully:

• Submitted a clear photo of my government-issued ID
• Submitted a selfie holding the ID
• Provided additional payment-method clarification when asked
• Explained my project goals and future usage plans

On May 7, the Security team informed me their decision was final - the account would not be unlocked and no further actions could be performed on it. No specific reason was given.

What I’m asking for

I fully accept the account closure. I am not contesting it.

What I urgently need is access to my own personal data stored on the Droplet - several weeks of source code, configuration files, and project files for my AI work. I have no recent backup (a hard lesson learned).

I have offered to:

• Sign a data-retrieval-only agreement
• Accept any technical restrictions (read-only, time-limited window, snapshot export, etc.)
• Forfeit all account credits
• Permanently close the account immediately after retrieval

Support has repeatedly told me that “once an account is locked, no further actions can be performed,” including data retrieval.

What I’ve already tried

1. Multiple replies to the support ticket explaining the data-only request - all denied with the same template response.
2. Filed a formal Data Subject Access Request (DSAR) with the privacy team on May 8, citing the rights described in DigitalOcean’s own Privacy Policy (access and portability of personal data). The request has been acknowledged and is being processed.

My questions for the community

1. Has anyone successfully retrieved their own data after a Security-team account closure? Through which channel?
2. Is the DSAR / privacy-team route the right path for this situation, or are there other official channels I should also pursue?
3. Roughly how long does the privacy team typically take to provide a substantive response?
4. For DO staff who may see this: is there any internal mechanism for separating “account access” (which is denied) from “one-time personal data export” (which is what I actually need)?

I understand the Security team must protect the platform from bad actors, and I respect that. But there should be a humane path for legitimate users to recover their own work, even when the account itself cannot be restored.

Any guidance, similar experiences, or pointers to the right channel would be deeply appreciated.

Thank you for reading.