Your footage stayson your site. Full stop.
NAO runs entirely on an appliance behind your firewall. Video is processed, redacted, and discarded locally. Only the metadata you choose ever leaves the box. GDPR by architecture, not by policy line.
Where every frame goes — and where it doesn't.
One diagram. Cameras in, alerts and metadata out, video stays put. If you can trace a frame leaving the appliance on this diagram, we owe you dinner.
Compliance isn't a checkbox. It's the architecture.
Every GDPR obligation has a concrete mechanism in the product — not a promise in a policy PDF.
Face redaction in-stream
Faces are blurred on the GPU before any frame touches disk or the network. The unredacted pixel never exists outside RAM.
DSAR & right to erasure
Event-level tombstoning lets you respond to a Data Subject Access Request in under 72 hours — by worker ID, by site, or by time window.
Retention policies
Configurable per stream. Defaults: 30 days for clips, 13 months for event metadata. Auto-purge runs nightly with a signed deletion log.
Lawful basis & DPIA
Template DPIA, Article 35 assessment, and worker-notice copy included. Legitimate-interest balancing test shipped with every deployment.
Outbound-only. Air-gap if you prefer.
The appliance doesn't need a public IP, doesn't open inbound ports, and doesn't phone home with anything more than a license token.
- Inbound portsNone required. Operator access is scoped to your LAN on TCP/443.
- Outbound trafficOptional HTTPS heartbeat to license.feneclabs.com. That’s it. Block it and run offline.
- Air-gap modeOffline license file, no external calls. Updates shipped as signed bundles.
- Access controlRole-based access, SAML SSO, SCIM provisioning, scoped API tokens.
- Audit trailEvery action (view, export, rule change) written to an append-only log with an operator signature.
Encrypted in motion. Encrypted at rest. Bound to the box.
Defense in depth — not a single tunnel doing all the work.
AES-256 at rest
LUKS full-disk encryption on every appliance volume. Keys never leave the TPM.
TLS 1.3 in transit
All LAN traffic — operator, camera control, webhooks — negotiated with modern cipher suites only.
TPM-sealed keys
Disk keys are sealed to measured boot state. Pull a drive, get ciphertext. Tamper the firmware, lose the key.
Signed OS & secure boot
Every image is signed by our release key. Secure boot enforces the chain from UEFI to kernel to userland.
Where we are. Where we're going. Dated.
We publish the status of every framework — not just the ones we've finished.
Third parties try to break it. Every year.
Annual external penetration test by an accredited firm. Signed attestation available under NDA. Responsible disclosure welcomed — and rewarded.
- Report a vulnerabilityEmail security@feneclabs.com. PGP key on request. We respond within one business day.
- Public policyFull scope, safe-harbor language, and bounty guidelines at /security/disclosure.
- AttestationLatest pentest summary letter shared under MNDA. Ask your AE.
Documents your security team will actually ask for.
Everything your InfoSec review wants, without a sales call.
Security overview (PDF)
Architecture, controls, and data flow in one document.
SOC 2 progress letter
Status of the Type II observation window.
Sample DPA
Article 28 processor agreement ready for review.
Subprocessors list
All third parties that touch customer metadata.
Architecture whitepaper
Deep dive on pipeline, inference, and storage.
Talk to our security team.
Architecture review, DPIA walkthrough, pentest letter, or just a blunt Q&A with our CISO. Bring your InfoSec questionnaire.