Stick the customer on its own instance of fusion, if running on a vps make sure it is only accessible via customers IP(s), as for recordings, they aren't required to be encrypted or anything special. make sure ur not giving random people superadmin access and remember it is a federal law to...