Public sector
Data residency, single-tenant on-premise deployment, and a lawful basis recorded before any policy carrying gait or face weight will compile at all.
Compliance here is not a document that describes the system. It is a gate the system will not open without.
The lawful basis is a build dependency.
Most systems record consent alongside the capability. Here the record has to exist before the capability can be produced.
A workspace must record its lawful basis, whether employment obligation, explicit consent, or substantial public interest, before the policy compiler will emit any pack carrying gait or face weight. There is no administrative path that enables biometric processing without that record. The build simply fails.
Dedicated deployment is the same binary and the same schema as the hosted service, running as a single tenant inside your boundary. Encryption keys are sealed to the hardware of each edge node, and the escrow shares are held entirely by your own custodians. Baselivery staff hold none and cannot unwrap a template.
Local rules overlay the global policy. Where a works council or national regulation restricts camera use at a particular site, that site's overlay governs, and a desk camera is refused outright unless the specific basis for it has been recorded.
- Model
- Single tenant, inside your boundary
- Code
- Identical to the hosted service
- Residency
- A property of where you deploy it
- Key sealing
- To each edge node's hardware root of trust
- Key escrow
- 3-of-5 shares, all customer held
- Vendor access
- None. Break-glass is dual control and time limited
- Site overlays
- Per-country camera and processing rules
- Model training
- Customer templates never train shared models
Subject rights, and what actually happens.
Each right maps to a mechanism rather than to a process document.
| Right | Mechanism | Limit |
|---|---|---|
| Access | Export of template metadata and full decision history | The vector itself is not returned, because disclosing it would create the risk this design prevents |
| Erasure | Tombstone, then destruction of the wrapping key for that person's templates | Stored ciphertext becomes permanently unreadable rather than relying on a delete propagating |
| Portability | Metadata export in a structured format | Templates are not portable between model versions and are not exported |
| Objection | A recorded objection forces credential-only where the floor permits it | Where the floor does not permit it, access is denied and the employer is notified. That is a legal decision, not an engineering override |
| Rectification | Re-enrollment creates a new template set | The prior set is tombstoned for a dispute window, then destroyed |
Two questions procurement always asks.
Can the vendor see our data
For biometric templates the answer is architectural rather than contractual. Keys are sealed to your hardware and the escrow shares are held by your custodians, so there is no key path that reaches us.
For operational records in a dedicated deployment, the system runs inside your boundary and we have no standing access. Support access is break-glass, time limited, dual controlled, and logged.
What happens when we leave
The register, tickets, knowledge, and decision history export as structured data. Nothing is held in a proprietary format that requires us to release it.
Biometric templates are destroyed by destroying their wrapping keys, which is verifiable and does not depend on us confirming a deletion ran.
In a dedicated installation your data is in your jurisdiction because the software is running on infrastructure you control, and biometric templates never leave the site that enrolled them regardless of deployment model. That is verifiable by inspection rather than by reading a clause, which is the standard this kind of procurement should hold us to.
Assurance detail.
Special category by default
Every embedding is treated as special-category data, even in one-to-one use.
Control mapping
Change, access, availability, confidentiality, and monitoring hooks map to standard control families.
No shared training
Customer galleries never contribute to a model shipped elsewhere.
Break-glass
Short-lived certificates under dual control, fully logged.
Retention
Templates until offboarding plus thirty days by default, configurable within a hard maximum.
Incident footage
Off unless a hold is authorised by a human.
The same control plane. A different floor.
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.