Data Protection
Your footage does not travel
The architecture rule is simple: compute goes to the footage; only model weights and metrics travel.
Processing runs inside your cloud or VPC, in your jurisdiction. Your footage never leaves your country or your cloud account. There is no central data lake of operator footage, because the system is built so one cannot exist: each Operator's raw footage and co-owned model weights live in an isolated, operator-walled store, and nothing identifying crosses that wall.
What we bring to the compliance conversation
We arrive with the artifacts, not just assurances:
A data-processing agreement per Operator, the impact-assessment dossier and cross-border dossier prepared for filing within the statutory window from processing start, and training-purpose disclosure language for your end-site notices.
An Article 28 processor agreement, DPIA support, a documented legitimate-interest analysis for the processing, and EU-resident processing. Our attribute scope is designed to stay outside biometric-identification categories.
Explicit, scoped, revocable training consent as a written clause, never an assumption; consent and notice flow-down to end sites; footage retention limits; and deletion on contract end.
Our training-data lineage gate applies to compliance the same way it applies to licensing: if we cannot show where a model's training data came from and under what consent, the platform refuses to deploy it.
What we never build
We state this proactively, because in this industry the burden of proof is on the vendor:
- ✕No face recognition. Ever, in any vertical, for any Operator.
- ✕No biometric identification. We do not build or train on face embeddings, gait, or body-geometry signatures.
- ✕No person re-identification. We do not build it, market it, or accept contracts to add it. Our attribute vertical detects worn and carried attributes only, such as clothing color and bags, for operational search and statistics. It describes what someone is wearing or carrying in a frame; it is not designed to establish who they are or to follow an individual across cameras.
If a request would turn an attribute model into an identification system, we decline the request. This line is a design constraint, not a policy we hope to keep.