PhotoRobot Logging & Monitoring Standard

This document defines the PhotoRobot Logging & Monitoring Standard. It details how PhotoRobot collects, stores, and analyzes logs and metrics to ensure security, performance, and operational visibility. The standard supports compliance with PhotoRobot’s contractual obligations under the DPA and SLA.

‍

‍

Objectives

• Detect anomalies and security events
• Provide detailed forensic capability
• Support business continuity and incident response
• Ensure full traceability across systems

‍

‍

Logging Sources

• Application logs
• Access logs
• Authentication/authorization logs
• API logs
• Infrastructure logs (GCP)

‍

‍

Logging Platform

• GCP Cloud Logging (centralized)
• Logs stored in the EU region
• Protected from unauthorized access
• Retention aligned with business and regulatory needs

‍

‍

Monitoring Platform

• Google Cloud Monitoring
• Dashboards for key metrics
• Alerts for security and uptime signals
• Threshold-based triggers

‍

‍

Log Retention

• Retention period defined per log type
• Sensitive logs restricted to minimum required duration
• Automatic lifecycle policies applied

‍

‍

Alerting

• Security alerts issued for:
  
  • anomalous login attempts
  • unusual processing patterns
  • infrastructure issues
• Notifications sent to engineering team

‍

‍

Access Control to Logs

• Logs accessible only to authorized personnel
• All access to logs is itself logged
• Least-privilege enforced

‍

‍

Forensic Use

• Logs support incident investigations
• Combined with other telemetry for context
• Strict tamper protection via GCP-managed controls