Security
Frames never leave the site. Templates are encrypted under a key sealed to the edge node's own hardware. The SaaS control plane stores scores and session metadata, never embeddings.
The threat model assumes the attacker wins the network.
Design so that the two things worth stealing, raw frames and plaintext templates, do not exist anywhere they could be taken from.
We assume an adversary capable of capturing radio traffic and of inverting machine-learning models if handed raw frames or plaintext vectors. The design response is not to detect that adversary. It is to ensure neither artifact is available away from the edge node in the first place.
Raw video lives in a short in-memory ring buffer and is never written to disk. Keypoints exist for the length of a gait window. Plaintext embeddings exist only between the accelerator and the encryption step, and are then explicitly overwritten rather than left for garbage collection to reach eventually.
What reaches the control plane is a score, a rule identifier, an epoch, and a policy revision. Those are enough to audit a decision and insufficient to reconstruct a person. There is no biometric warehouse to breach because there is no biometric warehouse.
- Template encryption
- Authenticated encryption, per tenant and modality
- Key custody
- Sealed to the edge node's hardware root of trust
- Key escrow
- Split into 3-of-5 shares held by customer custodians
- Baselivery access
- No shares, no ability to unwrap
- At rest
- Full-disk encryption plus per-record encryption
- In transit
- TLS 1.3, mutual authentication on both buses
- Credential bus
- Encrypted secure channel, mandatory
- Model artifacts
- Signature verified before load
What happens to a frame.
The drop order is specified, not incidental. Each stage is discarded before the next frame is allowed to reuse the memory.
Decoded image
Exists in a memory-resident ring buffer. Never written to disk, never sent anywhere. Overwritten as the ring wraps within a few seconds.
Keypoints and detections
Skeleton keypoints live for the length of the gait window, roughly 1.6 seconds, then are dropped along with bounding boxes.
Intermediate activations
Discarded immediately after the embedding is produced. The decoder and the embedder share a sealed memory region that is unmapped once used.
The embedding
Normalised, encrypted with the tenant key, and only then is the plaintext explicitly overwritten in memory.
What remains
An encrypted template in the site-local store, and a score in the control plane. Nothing that can be turned back into a face.
Threats and the control that answers each one.
| Threat | Primary control |
|---|---|
| Credential cloning or replay | Encrypted secure channel mandatory. Legacy cleartext readers refused except under a time-boxed compiled exception |
| Tailgating | Tracked body count compared against credential claims. A mismatch holds |
| Presentation attack with a photo or mask | Passive detection on device, scored into fusion. Face never unlocks alone |
| Look-alikes and siblings | The credential is the index. Biometrics only corroborate the claim it made |
| Walk-away at a desk | Continuous liveness on the endpoint, locking on absence or a foreign face |
| A compromised edge node | Hardware-bound keys, measured boot, signed models, read-only root filesystem |
| An administrator lowering the floor | Dual control required for any drop below the tenant floor. Every compile is audited |
| Revocation races and split brain | Monotonic fencing tokens. The session authority is the last writer, never the edge |
| Special-category data leakage | Raw media dropped at source, templates encrypted per tenant, no central replica |
Privacy is a compile-time gate.
Legal basis before capability
A gait or face template that can identify a person is special-category data under European data protection law, and this design treats every embedding that way even when it only corroborates a claim.
A workspace must record its lawful basis before the compiler will emit any policy pack carrying gait or face weight. There is no configuration path that turns on biometric processing without that record existing first.
Rights that actually resolve
Access returns template metadata and decision history, not the vector itself, because handing over a raw embedding would create the disclosure risk the design exists to prevent.
Erasure destroys the wrapping key for that person's templates, which renders the stored ciphertext permanently unreadable rather than trusting a delete to have reached every replica.
No customer's enrolled templates are used to train or fine-tune any model shipped to another customer. A model upgrade is a re-enrollment event, because there are no stored images to silently re-embed.
Controls an auditor will ask for.
Change
Every policy compile is a change record with named approvers.
Access
Remote shell access is disabled in production. Break-glass uses a short-lived certificate under dual control.
Availability
Sites hold a verified policy snapshot and survive 72 hours of isolation.
Confidentiality
Mutual TLS on every internal bus. No shared secrets committed to source control.
Monitoring
Every denial, hold, and revocation is an immutable event.
Disclosure
Report a suspected vulnerability on the contact form with the security topic, not a public ticket.
Related
Read it properly before you believe it.
We would rather walk a security team through the drop pipeline, the key hierarchy, and the revocation path than send a capability matrix.