Abstract
UC Riverside has no shared place to compute on non-CUI research data at UC Protection Level 3 or 4, such as HIPAA data under agreements and FERPA records. Our plan puts a hardened VM per study in a Google Cloud project with no internet route, campus sign-on, steward-approved export and audit logs held by the campus security office. Nothing has been built. I checked the plan and its offline Terraform claim by claim against 19 peer offerings, HIPAA, FERPA, UC policy, Google's documentation, upstream source code and selected literature. Of 35 open items in the resulting register, 14 close by a decision or a document rather than by code.
Cite this note
Charles E. Forsyth III. 2026. Sensitive Data, Shared Cloud: Reviewing a Plan for a P3-P4 Research Environment on Google Cloud. Zenodo. https://doi.org/10.5281/zenodo.23890329
Companion book: Charles E. Forsyth III. 2026. Sensitive Data, Shared Cloud: Planning a P3-P4 Secure Research Environment for HIPAA and FERPA Data on Google Cloud. Zenodo. https://doi.org/10.5281/zenodo.23890331
Four lessons
- The defects that matter most are inherited defaults. Perimeter API names, edition-gated application options, storage soft delete and live package mirrors. Two single-shot AI review panels that saw only the repository found none of them; AI agents given the same code plus the vendor and upstream pages did.
- Isolation lives in the administrator plane. In a shared cloud project, separation between studies is decided by who can act as the deployer, not by the researcher's path. From Google's documentation, per-study customer-managed keys don't change that, because one service agent holds every key.
- A folder perimeter makes project-per-study cheap. With the perimeter on a folder, a new study project joins it with no edit to the perimeter.
- FERPA needs its own intake question. On my reading, FERPA's studies exception does not cover research a faculty member starts unless the institution commissions or adopts the study, so intake has to record which route applies; the campus FERPA officer decides.
The two documents
The paper (23 pages) gives the method, the findings in ten areas, an inherited-default checklist other campuses can reuse, a table of how each defect was found, and the decisions only campus leadership can make. The companion book (208 pages) carries the full evidence: the rules, peer practice and related frameworks, the planned architecture, data in and out, software supply, the researcher's day, logging, the operating model, cost, GPUs and AI, a 15-test fake-data pilot and the 35-item register. Both are public editions: campus systems, offices and roles appear by function, and design weaknesses are described by kind.
Author note
The plan, the design decisions and the conclusions are mine and my team's. I used AI writing agents to draft chapters from my brief and AI reviewer panels to check the drafts against primary sources; I am responsible for every claim. The views and readings here are my own and do not represent the University of California, Riverside or the University of California. The campus security office, systems team and leadership have not reviewed or approved these documents, and nothing in them is UC policy or a commitment by UCR.