Guide
SaaS Platforms As Undiscovered Repositories
17 pages · 25 min read
This guide, 'SaaS Platforms as Undiscovered Repositories', is for UK lawyers, in-house counsel, and investigators.
- Cloud evidence
- Custodians and data mapping
§ Guide
SaaS Platforms As Undiscovered Repositories
This guide, 'SaaS Platforms as Undiscovered Repositories', is for UK lawyers, in-house counsel, and investigators.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 25 min read · Published 2026-08-31
This guide, 'SaaS Platforms as Undiscovered Repositories', is for UK lawyers, in-house counsel, and investigators. It addresses the problem that business records increasingly live inside SaaS applications, which traditional email and drives disclosure exercises will not find. The guide covers finding these platforms by mapping the SaaS estate, preserving each platform against its own retention, and collecting its structured records and audit trails. It details what each kind of platform holds, including CRM, project, HR, support, finance, and messaging applications. Key topics include preservation and collection methods, disclosure obligations, proportionality, and the power of the audit trail. It also provides worked examples, common mistakes, technical limitations, and questions to ask.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is ICO guide to the UK GDPR, which you should read alongside this guide. See every guide's author and source.
§ Full text of SaaS Platforms As Undiscovered Repositories
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
SaaS Platforms As Undiscovered Repositories
SA AS DISCOVERY · A GUIDE FOR UK LAWYERS SaaS Platforms as Undiscovered Repositories Finding, Preserving and Collecting the Business Records That Live Inside Applications COMPUTER FORENSICS LAB
§ Common questions
Frequently asked questions
- A key witness says they have almost no relevant documents. Is that the end of it?
- Often it is the beginning: the question "what documents do you have?" misses the applications where modern work is recorded (§2). Ask what platforms they work in all day (§3): the CRM, the project tool, the messaging app: and the record is usually there in quantity (Example 1's 400 interactions), with a change history and audit trail the witness never thought about.
- How do we even find out what SaaS platforms a business uses?
- By triangulation (§3): the identity provider or SSO lists sanctioned applications, end point exam in at i on finds installed and browser-used ones, network and CASB logs catch the rest, and expense and card records reveal the department a l and shadow subscriptions IT never sees (Example 2). No single source is complete; together they map the estate the asset register does not.
- Can data in a CRM or project tool really be collected for disclosure?
- Yes, as structured data (§5-§6): through the platform's export or its API, preserving the records, their change histories, comment threads and audit trails, and rendering them into review in a form that keeps the structure and context (§6's format problem). Flattening them to screenshots loses the very history and links that make them valuable; proper collection keeps them.
- What makes the audit trail so useful?
- It is the platform's own neutral record of who did what and when: created, viewed, edited, exported, deleted (§5,
- The other side wants "all our HR system data". Do we have to extract everything?
- No: proportionality applies to SaaS as to anything (§6-§7), and the sensible answer is targeted API collection: the relevant individuals' records, the relevant period, the change history and audit trail: agreed through the DRD (Example 3). Wholesale extraction is usually disproportionate, buries the relevant material, and mishandles special-category data; targeted collection produces the decisive records without it.
- What if a record was changed or deleted in the app?
- The platform usually remembers: change histories record who altered which field and when (guide 109's backdating logic for structured data, Example 1's softened note), and soft-deleted records sit in the platform's recycle store with the deletion logged in the audit trail (guide 106). What was removed from the app, by whom and whether it is recoverable, is established per platform, and the integration reflections (§8) may hold the pre- change copy besides. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Guide
Android Backups Local Google And Manufacturer Cloud
19 pages · 26 min read
- Mobile and messaging evidence
- Cloud evidence
Guide
The Google Account Androids Cloud Estate
18 pages · 26 min read
- Mobile and messaging evidence
- Cloud evidence
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.