Technology and security
Our AI and data protection
n7kel systems are built so that the client’s data stays with the client, every event can be verified and personal data is processed in accordance with the law. All information is confidential and is not shared with third parties, except where expressly provided for by the agreement and the law. This page covers the main principles; details are in the documentation.
n7kel AI
Recognition is performed by n7kel AI, our own video and speech analytics technology. It recognizes people and actions over time rather than from a single frame, and for any signal it can honestly answer “undetermined”. All recognition runs on the client’s equipment: no foreign cloud AI services, external APIs or subscriptions are used, and no data is transferred abroad. That is why n7kel systems do not depend on foreign neural networks or foreign cloud AI services.
n7kel AI is trained and tested on ordinary 2D images, so the cameras you already have are suitable. 3D cameras are supported too, if they are already on site or the task requires them.
n7kel AI is trained further for the client’s tasks — new actions, objects, uniforms, procedures and scenarios — on annotated examples from the site, at the client’s decision and under a non-disclosure agreement.
A false accusation is worse than a missed event. That is why the main quality indicator is false alarms: it is the first indicator on the dashboard. Every update is tested on fixed data sets and is not released if false alarms have increased.
Principles
How data is protected
Restrictions at the client’s request
Cameras, zones, modules, audio processing, retention periods and access rights are configured at the client’s request. In every case, all information is confidential and is not shared with third parties, except where expressly provided for by the agreement and the law.
Video stays on site
There is no continuous recording: the n7kel on-site unit keeps only the last few seconds in memory for video clips. Only the event, the frame and the clip leave the site, and only if this is provided for. Bystanders’ faces are irreversibly blurred by the on-site unit before saving.
Biometrics are protected
Visitor recognition is off by default. Employee face reference templates exist only with written consent; they are stored encrypted, and photographs are not kept. If consent is withdrawn, the template is deleted.
Signed and chained records
Every event is signed and linked to the previous one. An evidence package can be verified by an independent program without the vendor’s involvement.
Roles and access log
Every view and every download of a frame is logged, including actions by the vendor’s staff. A link to a frame is issued to a specific user for a limited time.
Retention periods
By default: video clips 30 days, frames 90, events 365; all configurable. Deletion is automatic and recorded in the integrity log.
Where the data is located
| Data | Autonomous option | Hybrid option |
|---|---|---|
| Camera video | On site, not transmitted off site | On site, not transmitted off site |
| Events, frames, clips | On the client’s server | On a server in a data center; the location is specified in the contract |
| Face reference templates (employees who have given consent; customers and patients when the module is enabled) | With the client, encrypted | With the client, encrypted |
| POS transactions | On the client’s server | On a server in a data center |
| Speech recordings and transcripts (n7kel Voice) | On the client’s server | On the client’s equipment or in a data center under the contract |
| Vendor access | None; maintenance only at the client’s decision | Processing on the client’s instructions under the contract |
Personal data
Law and ethics of use
- systems are designed for the personal data legislation of the client’s country: Kazakhstan — Law “On Personal Data and Their Protection”, Armenia — Law “On Protection of Personal Data”, other countries on request;
- the client is the personal data controller; all data stays with the client, is confidential and is not shared with third parties; the only exceptions are those expressly provided for by the contract and the law: transfer of match information to the authorized body when the wanted-list check module is enabled, and processing on the client’s instructions in the hybrid option;
- recognition of visitors and customers is off by default; it is enabled only by the client’s decision, as a separate module, and only on a lawful basis;
- the lawful basis is the person’s consent (patient check-in by appointment, bank customers in n7kel Flow) or an agreement with the authorized government bodies (checks against wanted lists); in the event of a match, a notification goes to an authorized member of the client’s staff and, as the agreement provides, to the authority;
- employee face identification only with written, voluntary consent; without consent, all functions except identification work; the “no reference” status never becomes an accusation;
- audio recording and analysis (n7kel Voice) only with employees and customers notified as required by the law of the country;
- any restrictions needed — cameras, zones, modules, retention periods, access rights — are set at the client’s request;
- auxiliary condition assessment (fatigue and stress) is off by default and can be fully disabled in the configuration;
- a violation is a signal for review by a person: no penalty follows automatically, and the employee can see the clip and give an explanation;
- we provide a staff notice template; the final legal assessment is given by the client’s legal counsel.
Product protection
Protection of equipment and updates
- the license is signed and bound to the hardware: it does not work on another machine;
- updates are signed: the signature and checksum are verified before installation, with automatic rollback on failure;
- video analytics equipment accepts no inbound connections from the internet; the autonomous option has no external connections at all;
- each external system gets its own key with separate permissions; revocation takes effect immediately.
More in the documentation
- Security and personal data
A full description of protection measures, roles, retention periods and employee rights.
- Requirements and deployment
Network, cameras, server, hosting options.
- Integrations and API
Integration with any system: access keys, webhooks, POS and 1C, government databases under an agreement.
Questions from security and IT
We will answer your information security and personal data specialists’ questions and provide documentation.