---
title: "Does the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?"
url: https://insuranceposture.com/questions/third-parties/applicant-cloud-provider-provider-stores-largest-quantity-sensitive-records
category: "Third parties and vendors"
canonical_key: q_ven_006
evidence_state: partial
updated: 2026-08-24
---

# Does the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?

URL: https://insuranceposture.com/questions/third-parties/applicant-cloud-provider-provider-stores-largest-quantity-sensitive-records
Section: Third parties and vendors
Evidence state: Partly verifiable from your tenant

This question is about the carrier's portfolio as much as about yours. They are modelling what happens if one platform has a very bad day.

## What the carrier is actually asking

The carrier is asking whether you use cloud providers and which one holds the largest quantity of sensitive records. It is a concentration question, and it usually extends to the major software-as-a-service platforms rather than only infrastructure providers.

## Why it is underwritten

Cyber carriers hold correlated exposure: a systemic event at a major platform would produce claims across a large part of their book simultaneously. Understanding where each insured's data sits lets them model that aggregation. For you, the answer also determines who your critical dependency actually is.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Which providers hold your data is measurable for the platforms Insurance Posture reads, and attested for the rest.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Azure | Storage accounts and databases holding regulated data, with their regions | Where structured and unstructured sensitive data resides |
| Microsoft 365 | Content discovery across mail, SharePoint, and OneDrive | The collaboration footprint, which frequently holds more sensitive records than anyone expects |
| AWS | Storage and database services holding regulated data | The AWS footprint where present, since multi-cloud estates split this answer |
| Vendor register | Software-as-a-service platforms holding customer or employee data | The customer platform, the human resources platform, and the support tool, which collectively often exceed the infrastructure footprint. Attested |
| Data map | Record counts per platform | An estimate with a stated method, since the question asks about quantity |

**The answer is usually a SaaS platform**

Organisations name their infrastructure provider because the question says cloud provider. The platform holding the most sensitive records is frequently the customer relationship system or the human resources platform. Naming the real one is more useful to the underwriter and more useful to you.

## What a defensible yes requires

- The answer reflects where records actually are rather than where infrastructure runs.
- Software-as-a-service platforms are included in the comparison.
- Record quantities are estimated with a describable method.
- Regions and residency are known for each major holding.
- Concentration is understood, including providers that depend on the same underlying platform.

## How this answer goes wrong

The infrastructure provider is named because it is the recognisable cloud brand, while the largest holding of personal data sits in a customer platform nobody mentioned. The carrier's aggregation model is then wrong, and so is your own understanding of your critical dependency.

## If this answer turns out to be wrong

When the loss originates at a vendor, the application answers about that vendor are the first document the adjuster reads. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Does using a major cloud provider count against us?

Not usually at the individual level. It matters to the carrier portfolio modelling and rarely to your own pricing.

### What if we are multi-cloud?

Say so and give the split. Multi-cloud reduces single-platform dependency and adds complexity, and carriers assess both.

### Should SaaS platforms be included?

Yes. They hold most of the sensitive records in most modern organisations, and excluding them produces an answer that misses the point of the question.

### How precise should record counts be?

An order of magnitude with a method. The carrier wants relative concentration rather than an exact figure.

## Related questions

- [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci)
- [Has any service provider with access to Applicant's network sustained outage longer than 4 hours?](https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer)
- [Is the Applicant compliant with cross-border data transfer laws?](https://insuranceposture.com/questions/data-handling/applicant-compliant-cross-border-data-transfer-laws)
- [How many records of PII / PHI / PCI / biometric does Applicant process?](https://insuranceposture.com/questions/business-profile/records-pii-phi-pci-biometric-applicant-process)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.