Privacy by architecture
Not a privacy policy. A system that has nowhere to send your video.
Ividiyo records, analyses, indexes and serves your cameras entirely on hardware you own. There is no cloud storage tier, because there is no cloud storage.
Most camera systems sold today upload your footage and then tell you how carefully they look after it. That can be true and still leave you exposed to things you do not control: a change of ownership, a change of terms, a breach at the provider, a subpoena served on them rather than on you, or simply a price rise on storage you can no longer move.
A local system removes the question rather than answering it. Video is written to your disks. The AI inference runs on your GPU. The search index is in your database. Nobody else holds a copy, because the software has no mechanism to make one.
That is a design decision with real costs — you own the hardware, the backups and the uptime — and for anyone handling footage of staff, residents, patients or children, it is usually the decision that makes the rest of the compliance conversation straightforward.
Six concrete mechanisms, not a value statement.
Recording, detection, plate recognition, appearance search and synopsis all run on site. There is no cloud storage tier to opt out of and no telemetry carrying video or images off the premises.
Watching from a phone on mobile data establishes an encrypted session between your server and your device. Where the network allows, it is a direct peer-to-peer connection; where it does not, a relay forwards bytes it cannot read.
Export a clip for an insurer, a contractor or a public request with faces and number plates redacted, so you can hand over the incident without handing over everyone who happened to walk past.
Role-based access down the location tree: a site manager sees their site, a regional manager sees their region, a contractor sees one gate. Permissions fail closed, so a misconfigured account shows nothing rather than everything.
Every action is recorded server-side — including the reads that matter, like who watched live, who scrubbed back through playback and who exported a clip. The entries are hash-chained, so a removed or edited row breaks the chain and the system will say where.
Retention is per camera, enforced by a task that deletes rather than by a policy document. Footage nobody chose to keep stops existing on schedule, which is the part most data-protection regimes actually ask about.
Neither regulation forbids CCTV. Both ask you to be able to answer a short list of questions: what are you recording, why, who can see it, how long do you keep it, and what happens when someone asks about footage of themselves.
A local system makes most of those answerable from one place. The footage is in a location you can point at. Retention is a number per camera that is actually enforced. Access is a list of roles you can print. And when a subject-access request arrives, anonymised export lets you give someone the clip they appear in without exposing the other people in frame — which is usually the obstacle that makes those requests painful to answer.
The audit log carries the other half. If the question is ever whether someone used the system to watch a person rather than a place, a log that records live views and playback — not just configuration changes — is the only thing that can answer it.
None of this is legal advice, and a system cannot make you compliant on its own. It can make compliance something you demonstrate rather than assert.
A privacy page that claims no outbound connections at all would be lying.
On disks in your own server: local SSDs for recent footage, with optional NAS or archive pools behind them for longer retention. The path is one you choose at installation. No copy is made anywhere else.
No. We have no access to your system. There is no vendor back door, no support account that exists by default, and no cloud console holding your streams. If you want us to help with a problem, you grant access deliberately and can withdraw it afterwards — and the audit log records what was done while it was granted.
No. Object detection, plate recognition, face recognition and appearance search all run on a GPU or AI accelerator in your own machine. No frame is sent anywhere for analysis, which is also why the features keep working when the internet does not.
Faces and number plates are detected and blurred in an exported clip, so a recording can be shared with an insurer, a contractor or a third party without exposing uninvolved people. The original recording is untouched — the redaction applies to the export.
Every action that changes something, and the reads that matter for privacy: live views, playback, clip exports, snapshots, PTZ, face and plate searches, and reads of the audit log itself. Each entry carries the user, time, IP address and outcome, and the entries are hash-chained so that a deleted or altered row can be detected.
The Free tier runs up to 10 cameras with live view, recording, playback and clip export — no licence key, no time limit, no card. Point it at the cameras you already own and see what it does before anything changes.
Need something to send on? Download the product brochure (PDF) — it carries this comparison and the pricing.