Skip to content
Skip to main content
First Response & Preservation Operational Explainer

When should a provider or platform specialist be contacted?

Contact the appropriate specialist route when relevant evidence is provider-held, short-lived or likely to be altered by local account action.

Provider systems hold records users cannot see

Security logs, audit events, session IDs, deleted content and retention details may require provider preservation. Urgency increases with takeover, remote deletion, disappearing content, fraud or safeguarding harm.

Preserve account, URL, username, tenant, session, provider identifiers and exact timestamps first. Define the account, period, risk and requested action clearly.

Preservation is not disclosure or disablement

Use the correct organisational, legal or specialist channel; ordinary customer support may not preserve evidence. Do not request resets or disclosure without understanding authority and consequences.

Record contact route, time, request, response, reference, confirmation and stated limits. Provider action complements rather than replaces local preservation.

Key takeaway

Escalate to provider specialists when their systems hold the answer, using exact identifiers and a recorded, legally appropriate request.

Reference: FRP-108First Response & Preservation