Security and data
A vision platform sees people. That sets the bar.
VisaRoxy is deployed on sites where staff, contractors, drivers and sometimes the public are in frame. This page states what the platform processes, where it runs, what it stores, and what we do not claim.
Position
Four commitments the architecture enforces.
Each one is a property of how the platform is built rather than a policy statement. That distinction is the point.
Inference runs in the environment you nominate. Video does not have to leave your network.
The platform stores event records and short event clips, not continuous recordings of every stream.
Privacy zones are removed from the frame before the model sees it, not blurred on the way out.
VisaRoxy holds no compliance certification and claims none. Posture is agreed per deployment.
Data categories
What the platform actually handles.
Six categories, with different sensitivity and different retention behaviour. Keeping them separate is what allows an analyst to work with counts without being granted access to video.
- Video frames
- Decoded from camera streams for analysis. Frames are processed in memory and are not written to disk as a continuous record. This is the category that most often contains identifiable people, which is why it is the one the deployment model is designed around.
- Event records
- Structured metadata describing what was observed: event name, zone, severity, duration, timestamp, camera, agent. Contains no image data and no identity. This is the category that most downstream systems consume.
- Event clips
- A short window of video around a confirmed event, written only when an agent's action set asks for one. Held for the site's clip retention window and then removed. Clips are access-controlled separately from event metadata.
- Configuration
- Zones, rules, thresholds, schedules, escalation paths and agent definitions. Site-confidential rather than personal, and versioned so a change can be traced to the person who made it.
- Identity and access
- Operator accounts, role assignments and session records. Where single sign-on is configured, authentication happens against your directory and VisaRoxy holds the role mapping rather than the credential.
- Audit log
- Rule changes, configuration edits, clip exports, access grants and administrative actions, each attributed to a named user with a timestamp. This is the record that answers "who changed this, and when".
Data flow
Where the video goes, in three deployment models.
The single most useful question a security reviewer can ask about a vision platform is where the frames are processed. VisaRoxy answers it per site, and the answer is a deployment choice rather than a setting.
- Edge applianceFrames are decoded and analysed on hardware inside the site network. Video never traverses the WAN. Events and clips stay local unless a destination is configured outside the site.
- Your private cloudFrames travel from the site to a tenancy your organisation controls. Your existing cloud security controls, network policy and logging apply to the runtime.
- Managed tenancyFrames travel to a tenancy operated by VisaRoxy for your deployment. The smallest operational lift, and the model that needs the most scrutiny from your security team.
Whichever model is chosen, outbound event delivery is explicit: events are sent only to endpoints you nominate and approve, and every delivery attempt is recorded against the event.
- Camera Stream published on the site LAN Never leaves the network
- Runtime Decode, exclude, detect, track, evaluate On the edge appliance
- Store Event records and short clips Local storage, site retention window
- Outbound Event metadata to approved endpoints 4 destinations on the allow-list
- Updates Signed application updates Applied by site engineering
Illustrative interface with sample data.
Access and retention
Who can see what, and for how long.
Both are configuration rather than fixed behaviour, because a site's obligations differ. The defaults are restrictive and the site widens them deliberately.
| Control | How it works | Why it matters |
|---|---|---|
| Role-based access | Roles determine whether a user can view events, view clips, edit rules, or administer the deployment. | A supervisor can tune a threshold without being able to export video. |
| Single sign-on | Federation against the site's directory, so access follows joiners, movers and leavers. | Removes the second place where stale accounts accumulate. |
| Clip access separate from metadata | Event counts and durations are readable without the clip permission. | Analysts and BI tools work on numbers without a video grant. |
| Retention windows | Configured per site and per camera group, for event records and for clips independently. | Specific periods are agreed with the customer rather than fixed by the product. |
| Deletion | Events, clips and records can be removed on request, and retention windows expire automatically. | Supports a subject request or an internal instruction to erase. |
| Audit log | Rule changes, exports, access grants and administrative actions are attributed to a named user with a timestamp. | Answers who changed a rule or exported a clip, and when. |
Put your security team in the room early.
The deployment topology and retention model are easier to agree before a pilot than after one. Bring the people who will have to sign it off.