Those companies have huge legal departments writing iron-clad contracts and stocking a lot of very sharp knives for any such eventuality. Smaller companies make for much easier targets.

> even if your notes are kept private, it'll still come out in discovery

Those notes might have been lost by then - that is, if their existence at any given time is even known. It is perfectly reasonable for people working quickly after an outage, to not actually write down every step or observation they make.

> What are the risks here?

Not prison, but you might be forced to pay a bunch if someone manages to get a ruling against you for negligence or the likes.

Doesn't mean it never happens.

Sure plenty of uber larges Incs are "in the cloud" but with mission critical (read: high value worth sueing over) applications and data? That's a pretty small universe.