What is cloud-provider retention?¶
Cloud-provider retention is the period and process by which a provider keeps customer data, logs, backups and deleted material.
Different data types may be retained for different lengths of time.
What this means in practice¶
Account records, login logs, file history, deleted items, backups, billing records and security alerts may each follow separate schedules.
Retention may also depend on the customer’s plan, region, organisation settings, legal obligations and whether the account remains active.
Investigators should identify the exact record required and ask about its specific retention, not simply whether the provider “keeps data”.
The customer organisation may also retain copies or exports independently of the provider.
What this may show¶
Some records may disappear quickly. Others may remain for years. A provider may preserve data in backup after it disappears from the user interface.
Where records may be volatile, preservation action should be considered early and through the appropriate lawful process.
What this does not show on its own¶
The dangerous assumption is that one retention period applies to everything held by the provider.
Use careful language. A provider’s ability to retain data does not mean the data is still available, complete or retrievable in the required form.
What to do next¶
Check whether the retention period is fixed, configurable or affected by account deletion, subscription level, legal hold or customer policy.
Do not assume that published general guidance describes the specific account or historical period under investigation. Provider products and policies change.
Key takeaway
Cloud retention varies by data type, product and configuration, so identify the exact record and act early rather than relying on a general provider retention statement.