At some point in an Oracle Java audit, the cooperative tone gives way to a formal instrument: the LMS data request letter. Oracle's License Management Services function uses it to specify, in writing, the data it wants from you. This letter is the engine of the audit, because the figures you return in response become the inputs to the claim. Understanding what the letter can and cannot demand, and answering it with precision, is among the highest leverage moves in the entire defense.
This article is part of the Java Audit Survival Guide, the buyer side pillar on defending an Oracle Java audit.
What the letter typically asks for
An LMS data request letter usually asks for a defined set of items: a total employee count, often phrased to capture the broadest possible population; deployment data showing where Java is installed; download and update history; and supporting records across a multi year period. In 2026, with LMS audits intensified, the requests reach back across a three year lookback and press hard on contractor and temporary worker inclusion, because the metric counts every full time and part time employee, every contractor, and every temporary worker, regardless of who uses Java.
The letter is written to be broad. Breadth serves Oracle, because the wider the data, the larger the population that can be argued and the higher the claim. Your job is not to fill in every box as asked, but to answer what your contract genuinely obliges, scoped and verified.
What your contract actually obliges
The letter's authority comes entirely from the audit clause in your agreement, not from the letter itself. That clause defines what Oracle may request, from which entity, and under what notice. In practice it usually entitles Oracle to reasonable, relevant information about licensed use, not to an unfiltered export of your entire global organisation. The gap between what the letter asks for and what the contract obliges is your room to operate. The way LMS assembles a claim from these inputs is detailed in how Oracle LMS builds a Java audit claim.
How to answer without inflating the claim
Answer the letter as a precise legal and commercial document, because that is what it is. The principles:
- Provide only what the contract obliges, scoped to the contracting entity named in the agreement, not the global group.
- Verify every figure before it leaves your organisation, especially the population count, which drives the entire claim.
- Separate Oracle Java SE from any free OpenJDK distribution at the source, so the data cannot be read as if every runtime is chargeable.
- Respond in writing through a single owner, on a reasonable timeline that allows verification.
- Bound the period to what the contract supports, with dated records of removals, migrations, and divestments across the lookback.
Deciding what to hold back is as important as deciding what to send, a judgement covered in the data Oracle requests in a Java audit and what to withhold.
| Letter requests | Contract usually obliges | Buyer side answer |
|---|---|---|
| Total employees, broadly defined | Relevant population for the contracting entity | Verified count scoped to that entity, in writing |
| All Java deployment data | Information on licensed Oracle Java SE use | Inventory separating Oracle Java SE from free distributions |
| Records across several years | Period defined by the audit clause | Dated history bounded to the supported window |
| All contractors and temporary staff | Population as the agreement defines it | Verified figure, with disputable inclusions challenged |
Indicative worked example. A manufacturer received an LMS letter asking for group wide headcount and a full deployment export across three years. It answered with a verified population scoped to the single contracting entity, an inventory that isolated Oracle Java SE from the free distribution on most servers, and a dated record showing two business units had migrated. The data that anchored the claim was a fraction of what the letter requested. Figures are indicative.
Timing and tone
The letter often arrives with a deadline that feels pressing. A reasonable, written request for the time needed to produce verified data is entirely legitimate and rarely refused. Rushing produces errors, and errors in a population figure favour Oracle. Calm precision favours you. Treat the letter as the formal record it is, and let your written, verified response stand as the definitive account, not a hurried first draft.
The bottom line
The LMS data request letter turns an audit into a measured claim, and the figures you return are the claim's foundation. Read it against your contract, answer only what the agreement obliges, scope to the contracting entity, separate Oracle Java SE from free distributions, and verify every number before it leaves your hands. A disciplined answer to the letter is a smaller claim at the end.
Next step. Book a Strategy Call and we will read your LMS letter against your contract and draft the scoped, verified response before you reply. Submit the form and ask to Book a Strategy Call. We work on a Fixed Fee from $18,000 or a Gainshare share of verified savings or avoided exposure, with zero retainer and no risk to you.