Security

Security is built into the architecture of Recs Studio, not bolted on. Every customer runs in a dedicated cloud project with full infrastructure isolation, least-privilege access controls, encrypted data flows, and customer-managed network access.

Infrastructure Isolation

Recs Studio deploys each customer into a separate cloud project. There is no shared compute, shared storage, or shared database between customers. Each customer's environment is fully isolated, with its own application, data warehouse, object storage, and ML pipelines.

This model gives customers complete control over their project access, audit logs, and data residency while allowing Recs Studio to manage the platform software layer.

Network Security

• Static egress IP: Each customer project is configured with a reserved static external IP. All outbound connections from Recs Studio to customer data sources originate from this predictable IP, which customers can whitelist in their database firewalls.
• No inbound access to customer databases: Recs Studio does not require any inbound firewall rules or deployed agents inside the customer environment.
• HTTPS everywhere: All public endpoints and inter-service communication use TLS.

Identity and Access Management

• Least-privilege access: Each service runs under its own dedicated identity with only the permissions required for its function.
• Customer-controlled access: Customers own their cloud project and can audit every permission granted to Recs Studio.
• Secure authentication: Platform access is protected by session authentication with CSRF protection for all state-changing requests.

Credential and Secret Management

Database passwords, API keys, and cloud storage credentials are stored in a managed secret store, never in the application database or configuration files. The platform retrieves secrets at runtime using restricted service identities.

Encryption

• In transit: All data is encrypted with TLS 1.2+ when moving between users, services, databases, and cloud APIs.
• At rest: Cloud infrastructure automatically encrypts data in the database, data warehouse, object storage, and secret store using managed encryption keys.

Data Residency and Processing

Customer projects are provisioned in the cloud region that matches the customer's legal, regulatory, and latency requirements. Recs Studio does not copy customer data outside the customer's own project.

Logging and Monitoring

• Cloud logging captures application, audit, and infrastructure logs per customer project.
• Cloud monitoring tracks endpoint latency, error rates, and training job health.
• Every ETL run and training run is tracked with status, metrics, and error classification in the platform UI.

Compliance and Data Protection

Recs Studio leverages the compliance posture (SOC, ISO 27001, GDPR) of the underlying cloud services. For customers subject to GDPR or similar regulations, a Data Processing Addendum (DPA) incorporating the EU Standard Contractual Clauses (SCCs) is available on request.

To request a DPA or security questionnaire, email support@recs.studio.

Security Inquiries

For security questions, vulnerability reports, or compliance documentation, contact us at support@recs.studio.