Comment by scosman

1 doesn't hold: you validate ownership and access by customer. OSS is the customer not PBS. OSS owns that process for PBS, not IM. It might not be technically possible (encryption, mixed data, sharing, ACLs). It might expose private data of non PBS OSS customers. It might violate the contract they have with their clients like OSS.

2 it doesn't say either way. From owning systems like this, I'd assume there's some degree of "we have no idea what's in this bucket and can't just hand it over to random person asking for it".

Context: I owned a photo backup startup. 8.6 billion photos. Some might be yours, most are not. If you went to AWS and asked for a copy of the bucket, they rightfully wouldn't have complied.