Even when a cloud service provider promises not to store request and response content, it typically still retains metadata such as timestamps, account identifiers, request volumes and IP addresses for billing, rate limiting and abuse detection.