Method and system for cloud computing service transparency

1. A method, comprising:

storing customer data on a server of a cloud computing service that is located outside of a network security system of the customer;

by the cloud computing service provider, automatically monitoring the customer data to identify one or more access events, wherein each access event originates from a resource of the cloud computing service;

identifying for each access event a resource and a data set, wherein the resource comprises an identifier associated with a human operator or a software application that performed the access event, and the data set includes all customer data that the resource accessed during the access event;

by a processor of the cloud computing service provider, creating a report comprising each access event and information corresponding to the data set for each access event; and

causing the report to be transmitted to the customer.

2. The method of claim 1 , further comprising:

identifying a time stamp for each access event;

including, in the report, for each access event the access event's identified time stamp; and

ensuring that the identified resource for each access event is not identified in the report.

3. The method of claim 1 , further comprising:

identifying a portion of the data set is subject to a reporting restriction;

replacing the identified portion of the data set with a proxy;

including the proxy in the report; and

ensuring that the portion of the data set that is subject to the reporting restriction is not included in the report.

4. The method of claim 1 , further comprising:

periodically generating updated reports; and

causing the updated reports to be transmitted to the customer.

5. The method of claim 1 , wherein creating the report comprises:

determining for each access event a category that corresponds to the access event's data set;

grouping in the report the access events that share a common category.

6. The method of claim 1 , wherein creating the report comprises, for each resource having an identifier that corresponds to a human operator,

assigning an anonymous identifier to the human operator;

determining whether the anonymous identifier corresponds to any other known identifier for the human operator, and if so modifying the anonymous identifier; and

referring in the report to the human operator only by the anonymous identifier.

7. The method of claim 1 , wherein creating the report comprises, for each resource having an identifier that corresponds to a human operator:

determining a job category for the human operator; and

referring in the report to the human operator by the job category and not by any personally identifying information.

8. The method of claim 4 , further comprising:

determining an access reason for each access event; and

including each determined reason in the report.

9. The method of claim 1 , further comprising:

determining the information corresponding to the data set for each access event;

wherein the information corresponding to the data set for each access event comprises an identification of what was accessed, a time stamp, and a unique reference identifier.

10. The method claim 9 , wherein the information corresponding to the access event also comprises one or more of:

an indication of how the data set was accessed,

a location from which the access request originated, or

a job category for a person who initiated the access request.

11. A method, comprising:

storing customer data on a server of a cloud computing service;

by the cloud computing service, identifying a plurality of access events, wherein each access event originates from a requesting resource of the cloud computing service;

identifying for each access event the originating resource, a timestamp, and a data set, wherein the data set identifies a portion of the customer data that the requesting resource accessed during the access event;

by the cloud computing service, creating a report comprising, for each access event, the access event's data set for each access event; and

by the cloud computing service, causing the report to be transmitted to a client.

12. The method of claim 11 , further comprising, before causing the report to be transmitted to the client:

identifying a portion of the report that is subject to a reporting restriction;

replacing the identified portion of the report with a proxy;

including the proxy in the report; and

ensuring that the identified portion is not included in the report.

13. The method of claim 11 , wherein creating the report comprises:

determining a category for each access event that corresponds to the access event's data set;

assigning each access event to the category for which its data set corresponds; and

grouping in the report the access events that share a common category.

14. The method of claim 11 , further comprising:

determining an access reason for each access event; and

including each determined reason in the report.

15. The method of claim 11 , further comprising:

determining the information corresponding to the data set for each access event;

wherein the information corresponding to the data set for each access event comprises:

an identification of what was accessed, a time stamp; and a unique reference identifier, and

one or more of the following:

an indication of how the data set was accessed,

a location from which the access request originated, or

a job category for a person who initiated the access request.

16. The method of claim 11 , wherein the requesting resources comprise one or more of the following: an e-mail application, a social networking applications, a document generation application, an audio or video media sharing application, or an audio or video media editing application.

17. A system, comprising:

a management server;

a storage facility; and

a plurality of resources that are affiliated with the management server;

wherein the management server includes a processor and a memory containing computer-readable programming instructions that, when executed, cause the management server to:

receive customer data from an external client;

store the customer data in the storage facility;

identify an access event, wherein the access event comprises a grant of access to the customer data to a requesting one of the resources;

identify the requesting resource, an access reason, a timestamp, and a data set, wherein the data set identifies a portion of the customer data that the requesting resource accessed during the access event;

create a report comprising the access event's data set, the access reason, and information relating to the requesting resource; and

cause the report to be transmitted to the external client.

18. The system of claim 17 , wherein the requesting resource comprises an e-mail application, a social networking application, a document generation application, an audio or video media sharing application, or an audio or video media editing application.

19. The system of claim 17 , wherein the programming instructions that, when executed, also cause the management server to perform the following before causing the report to be transmitted to the external client:

identify a portion of the report that is subject to a reporting restriction;

replace the identified portion of the report with a proxy;

include the proxy in the report; and

ensure that the identified portion is not included in the report.

20. The system of claim 17 , wherein the programming instructions that, when executed, cause the management server to create the report also comprise instructions to:

for each access event, determine a category that corresponds to the access event's data set; and

in the report, group the access events that share a common category.