docs: add SSH session recording compliance guide

[desimone]

Summary

Adds a follow-on guide, "SSH Session Recording for Audit and Compliance," as a companion to the SSH Session Recording reference page. The reference page covers how to turn recording on; this guide covers how to operate it so recordings hold up as audit evidence under SOC 2, PCI DSS, HIPAA, and FedRAMP.

It leads with a shared-responsibility model -- Pomerium produces a tamper-evident record and a correlatable audit trail, and the customer configures storage immutability, encryption, retention, and identity controls -- then walks through WORM/object lock plus retention, encryption at rest, least-privilege storage access, audit-log correlation between Pomerium and cloud-provider logs, integrity verification, playback governance, a control-mapping table across the four frameworks, and the feature's limitations with compensating controls. Each section includes concrete verification guidance. Includes an evidence-flow diagram, screenshots, and a short terminal recording captured from a live end-to-end deployment.

This branch is now rebased onto main; the guide is nested under the Session Recording docs and cross-linked from the main Session Recording page.

Review feedback addressed

• Nested the compliance guide under docs/capabilities/session-recording/ and added it beneath the Session Recording sidebar category.
• Clarified audit-log correlation: Enterprise audit entries with an access_id also carry the matching user_hmac_id.
• Kept S3 per-request encryption scoped to S3 and left bucket-default encryption as the durable recommendation.
• Removed the HEAD/existence-check wording and route-policy evidence row from earlier revisions.
• Softened over-absolute write-once wording and emphasized storage-layer object lock / retention for regulated evidence.

AI disclosure

Drafted with Claude and refined manually. Reviewed across Claude and Codex; adopted corrections include: managed storage roles can include delete and should not be treated as WORM protection; WORM verification must use a delete-capable principal to prove immutability rather than IAM; the S3 user-agent correlation string was softened to match SDK sanitization; encryption now leads with a bucket-default customer-managed key; least-privilege guidance gained custom-role nuance; and the final rebase/comment-addressing pass was reviewed and validated before publishing. The screenshots and terminal recording were captured from a live end-to-end run, and the documented behavior was verified against that deployment.

Validation

• yarn format-check
• yarn cspell "**/*"
• yarn build
• git diff --cached --check

Checklist

• reference any related issues / PRs
• updated docs
• updated UPGRADING.md (n/a)
• updated CHANGELOG.md (n/a)
• disclosed AI usage per AI_POLICY.md

[netlify]

✅ Deploy Preview for pomerium-docs ready!

Name	Link
🔨 Latest commit	e2170ad
🔍 Latest deploy log	https://app.netlify.com/projects/pomerium-docs/deploys/6a3356b37f1c2300086e58fe
😎 Deploy Preview	https://deploy-preview-2226--pomerium-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[CLAassistant]

All committers have signed the CLA.

[desimone]

Thanks @alexandreLamarre — addressed the technical-accuracy comments in 62ea1c3:

• S3-only encryption: scoped the per-request encryption note (ssetype=aws:kms&...) to S3 explicitly.
• Evidence-flow diagram: relabeled the Core/Console edges to "emits ... audit logs" so it no longer reads as logs being routed off Pomerium Core.
• HEAD / user_hmac_id: corrected — on S3, HEAD existence checks carry neither access_id nor the UA HMAC, and Azure/GCS generally don't surface existence checks at all. Also added a note to exclude HEAD checks when auditing for un-annotated reads.
• Route policy evidence row: removed it (and the matching mention in the SOC 2 section) — a recording's existence already implies the route policy was active at capture time, and the policy can change later.

One open item: nesting this under the Session Recording tab depends on #2214 (which introduces that tab) landing first — there's no session-recording tab on main yet. Once #2214 merges I'll move this to capabilities/session-recording/compliance.mdx mirroring the mcp/ structure. Flagging so we don't block the accuracy fixes on it.

[alexandreLamarre]

Besides the two open comments about audit entries & nesting the tab, I think this is ready to go once it is rebased