Who is the cloud provider?¶

The cloud provider is the organisation supplying the relevant remote service. It operates or arranges the systems that store data, run software, authenticate users or record activity for its customers.

Identify the service, not just the brand¶

A familiar brand may supply several separate products, each with different accounts and records. A business application may also rely on another company’s infrastructure without exposing that relationship to users.

The provider relevant to the enquiry is the one performing the function that generated or holds the evidence. Dave may see his employer's logo on a file-sharing screen even though a separate platform authenticates him and stores the files.

For example:

• the storage provider may hold a file and sharing history;
• the identity provider may hold sign-in and authentication events;
• the application provider may hold user actions and content;
• the infrastructure provider may hold customer and server records.

The visible company may be an intermediary¶

Resellers, managed-service providers and workplace administrators can sit between the user and the underlying platform. Payment may go to one organisation while another operates the technical service.

Review account screens, invoices, terms, domain information and technical identifiers. Provider support or published law-enforcement guidance may clarify which legal entity controls the relevant records.

Provider does not mean user¶

An IP address or server name identifying a cloud provider normally shows that its infrastructure was involved. It does not identify the customer or person responsible for the activity.

The next step is to identify the tenant, subscription, account or resource using that service at the relevant time. Precise account identifiers, timestamps and event references help the provider locate those records.

Record the relevant period¶

Services can migrate, companies can change names and customers can switch suppliers. Establish which provider performed the function when the event occurred, not merely who supplies the service today.

Keep the provider, customer, account holder and actual user as separate fields in the investigation. Who the customer or account holder is addresses the next link.