What should be preserved before contacting a provider?¶

Before contacting a provider, preserve the stable identifiers, exact time context and local evidence needed to identify the relevant account, object, session or event. A broad description or display name may point to the wrong customer or produce an incomplete search.

Preserve locally first because containment, deletion and account changes can alter what remains visible.

Capture identifiers in context¶

Depending on the service, useful values may include:

• account, tenant, subscription and user IDs;
• email addresses and usernames;
• message, object, file, session and transaction IDs;
• domains, full URLs and provider case references;
• IP addresses, ports and protocols; and
• exact timestamps with time zone and source.

Retain the local log, export, page context or screenshot showing where each value came from. Stable machine identifiers are usually more useful than shortened links or display names, but visual context can help map a user-facing value to the provider's internal terminology.

Identify the right service¶

One provider may operate consumer, enterprise, reseller and regional systems with different records and retention. Establish the relevant product and, where possible, the entity holding its data. An email address or domain alone may exist in several of those environments.

Short retention can make preservation urgent, but urgency does not remove the need for a precise identifier and time range. Record any uncertainty so the later request does not silently broaden or misidentify the event.