Your footage stayson your site. Full stop.
The Fenec Labs appliance runs entirely behind your firewall. Video is processed, redacted, and discarded locally. Only the metadata you choose ever leaves the box.
Where every frame goes — and where it does not.
Cameras in, alerts and metadata out, video stays put.
Compliance is not a checkbox. It is the architecture.
Every GDPR obligation has a concrete product mechanism rather than just a policy promise.
Face redaction in-stream
Faces can be blurred on the GPU before any frame touches disk or the network.
DSAR and erasure support
Event-level deletion workflows help respond to data-subject requests.
Retention policies
Configurable per stream with default clip and metadata retention windows.
Lawful basis and DPIA
Deployment package includes review material for DPIA and worker notices.
Outbound-only. Air-gap if you prefer.
The appliance does not need a public IP, does not open inbound ports, and can run offline with signed update bundles.
- Inbound portsNone required. Operator access is scoped to your LAN on TCP/443.
- Outbound trafficOptional HTTPS heartbeat to license.feneclabs.com. Block it and run offline.
- Air-gap modeOffline license file, no external calls, signed update bundles.
- Access controlRole-based access, SAML SSO, SCIM provisioning, scoped API tokens.
- Audit trailActions are written to an append-only log with operator identity.
Encrypted in motion. Encrypted at rest. Bound to the box.
Defense in depth, not one tunnel carrying all trust.
AES-256 at rest
LUKS full-disk encryption on appliance volumes. Keys never leave the TPM.
TLS 1.3 in transit
Operator, control, and webhook traffic use modern cipher suites.
TPM-sealed keys
Disk keys are sealed to measured boot state.
Signed OS and secure boot
Release images are signed and verified from boot to userland.
Where we are. Where we are going. Dated.
We publish framework status plainly rather than implying finished certifications.
Security review is planned before commercial pilots.
No external penetration test has been completed yet. Responsible disclosure is welcomed while the product is prepared for pilots.
- Report a vulnerabilityEmail security@feneclabs.com. PGP key on request. We respond within one business day.
- Public policyFull scope and safe-harbor language will live at /security/disclosure.
- AttestationPending first external penetration test.
Security materials without invented attestations.
Preparation documents are useful, but they are not a substitute for counsel review, audits, or issued certifications.
Talk to our security team.
Architecture review, DPIA walkthrough, or a direct Q&A about how the appliance behaves on your network.