What account records might a provider hold?¶

id: "AI-029" title: "What account records might a provider hold?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"

What account records might a provider hold?¶

Script¶

An online provider may hold much more than the name on the account.

But what exists depends on the service, its systems, retention periods and the type of account.

Start with registration information.

That may include the name supplied, email address, telephone number, creation time, billing details and the IP address or device used when the account was opened.

Then consider access records.

The provider may hold login times, IP addresses, device identifiers, browser or application details, session records, authentication methods and security alerts.

There may also be account-control records.

Password changes.

Recovery requests.

Changes to email addresses or telephone numbers.

Multi-factor authentication settings.

Trusted devices.

Session revocations.

For some services, content and transaction records may be available.

Messages.

Uploads.

Downloads.

Payments.

Orders.

Contacts.

Searches.

Location information.

Administrative actions.

Do not assume the provider holds all of this.

Some services record detailed histories.

Others keep only limited information.

Some records may exist for a short period.

Some content may be encrypted or unavailable to the provider.

Deleted material may no longer exist, or it may remain in backups that are not routinely accessible.

The wording of the request matters.

Asking for “all account information” may produce an incomplete response because it is vague or does not match the provider's record categories.

Identify the investigative question first.

Are you trying to establish who registered the account?

Who accessed it?

Whether it was compromised?

Which device carried out a transaction?

Then request the records most likely to answer that question.

Preservation may also be urgent where records are short-lived.

Use lawful authority, local process and provider guidance.

A provider's records can be valuable, but they are not self-explanatory.

Always establish what each field means, how the record was generated and what it can and cannot prove.