Sovereign · Cyber-hardened · Rust-native
A camera network produces intelligence only as trustworthy as its evidence chain, and only as safe as the infrastructure beneath it. Vaidome delivers the analytics and the sovereign, cyber-hardened platform they run on — engineered as one system.
All data resident in-country. Fully offline and air-gap capable. No external cloud dependency.
Security engineered into every layer, not added afterwards. This is our core discipline.
No interpreted languages in production. A smaller, auditable attack surface end to end.
Encryption built to withstand the quantum era, today — through our Nizam post-quantum cryptography work.
The problem
Adding cameras does not add visibility. Organisations keep hitting the same four limits.
Dozens of live streams, one pair of eyes. Attention drops within minutes — and that is exactly when the critical moment goes by.
Proving an incident means hours of scrubbing through recordings. The footage is found, but not in time.
Regulation and operational security do not allow footage to reach an external cloud. Most analytics products ask for exactly that.
Every new requirement becomes a new project, a new wait and a new invoice. The organisation cannot retrain or change its own detection models.
Technical architecture
Six stages, engineered as one system. Each stage hands the next an auditable record.
ONVIF / RTSP
Multi-camera ingest from the cameras you already have. No camera replacement required.
Zero-copy ingest
Frame scheduling and back-pressure control. No interpreted languages, and predictable resource use.
H200 GPU · MIG
Mission-trained models running on partitioned GPUs.
ClickHouse
Events and metadata held queryable at scale.
Batin engine
Rules, data-loss prevention and real-time alarm generation.
RBAC dashboard · APIs
Role-based operator screens and APIs into external systems.
Every clip and every detection is written to Hafiz with a SHA-256 hash chain — tamper-evident and court-defensible.
Three differentiators
These are not marketing headlines. They are design decisions taken at the very start of the architecture, and they cannot be undone.
No cloud, no external APIs, no phoning home for a licence. Installation runs without internet, and the system works at full function on an air-gapped network. Data stays in-country.
Every alarm frame is written to disk and sealed with SHA-256. All operations are recorded in a hash-chained, immutable audit log, and the chain is verified with a single action.
Models are developed in-house and trained on data from your own site, then re-trained on site as conditions change. The whole cycle, from labelling to promotion, runs on your server without a line of code.
Layered view
Data flows upward. Security and sovereignty span every layer.
Operator UI · RBAC dashboards and secure APIs
Rules, data-loss prevention and real-time alarms
ClickHouse analytics · Hafiz immutable evidence store
H200 · MIG · mission-trained models
Rust agent · decode, scheduling, back-pressure
IP cameras · ONVIF / RTSP · existing VMS
PRODUCT = proprietary Vaidome product · Vaidome = built in-house · Green = production-ready
spans every layer
AI functions
All models are developed in-house and trained on site- and mission-specific data, then re-trained on site as conditions change. Inference runs on our Rust runtime — auditable, with no interpreted-language dependencies.
Multi-lane plate capture and watch-listing.
Identity matching with lawful-use controls.
Occupancy, flow and gathering analytics.
Line-cross, zone breach and motion anomaly.
Classify, count and track objects and vehicles.
Abnormal movement and dwell detection.
Left-luggage and unattended-item alerts.
Detect specified clothing or markings.
Detection on its own is not enough. Rules decide which detection becomes an alarm, and your operator team builds the rules.
Zone breach, line crossing, entry and exit, and headcount.
Blackout, blur, scene change and frozen image — derived from the frame already being processed, at no extra compute cost.
Multi-step scenarios such as "if the subject passes this door and stops in this zone within 30 seconds".
Rules run only during the hours you set, and maintenance windows can be defined.
Model lifecycle
Off-the-shelf models are general purpose. High accuracy on site comes from training on the organisation's own footage — which is exactly what Studio is for.
Collect examples by drawing boxes on your own recordings.
Create a versioned, reproducible training set.
Start training on GPU and follow progress and metrics.
Run it in shadow mode, read the quality scorecard, then promote it through an audited gate.
We do not claim accuracy; we measure it. It is computed with a standard COCO evaluation on a frozen test set and reported class by class.
A real measurement example. Your own result depends on your data and your class definitions.
Sub-threshold detections and operator false-alarm flags feed the labelling queue for the next version of the model. The system adapts to your site as it is used.
Evidence and compliance
A security system that cannot defend the record it produces is only a monitoring system. The evidence chain was built for this requirement from the start.
Every record carries the digest of the one before it. Changing a single line breaks the entire chain, and verification shows it immediately.
Audit chain verification
2,550,994records32s
The alarm frame and the event clip are written to disk and hashed with SHA-256. Any later change is detectable.
Report, frame, clip and manifest leave the organisation as a single package. The recipient checks it with an offline verifier.
While the retention policy runs, records under investigation are locked against deletion.
PostgreSQL row-level security isolates data fail-closed: a role without permission cannot query the data at all.
Who changed what, and when — all written to the chain and verified with a single action.
Restore from backup is proven by regular restore drills, and synchronisation is supported on air-gapped networks.
Cybersecurity — our core discipline
Security is not a layer dressed over video analytics afterwards; it is the platform itself.
CRYSTALS-Dilithium and SPHINCS+ through our Nizam work — resistant to harvest-now-decrypt-later attacks.
The Hafiz SHA-256 hash-chain makes every log and every clip tamper-evident and court-defensible.
Fine-grained roles, least-privilege enforcement and multi-factor access across the platform.
Data is encrypted in transit and at rest across every layer of the platform.
IPsec IKEv2 tunnels, segmented VLANs, air-gap and closed-network operation.
Pure-Rust production runtime — no interpreted languages, and a minimal attack surface.
The platform beneath the analytics
Video analytics is only the visible part. Beneath it sit four proprietary products, each hardened and engineered in its own right — Hafiz already in production, the others production-ready.
Secure storage and fast data
Network and environment monitoring
Monitoring and data-loss prevention
Post-quantum cryptography
Screen tour
The product interface is available in Turkish and English. Every screen is designed so the operator can take the next step in a single click.
Layouts from 1×1 to 4×4, camera-to-tile assignment, named walls and tour mode.
Screen 1 / 15
Performance and scalability
Representative operating figures on the specified hardware, confirmed against the agreed SLA at acceptance.
Approximately 300 concurrent 1080p streams per GPU node, scaling near-linearly. The chart projects that figure linearly. Evidence retention extends to petabyte scale.
Alarm noise suppression
44.1 events/min1 alarm/min
Events are grouped into episodes, so operators see one alarm instead of a stream of near-duplicates.
30-day report time
2.94s26 ms
A summary layer makes reports open instantly.
GPU telemetry cost
10s~30 ms
About 0.3% of a single CPU core — measuring the system does not slow it down.
Measured efficiency
Integration
Interoperability is delivered through published, open standards. We integrate with the platforms shown via those standards — rather than as a certified reseller.
ONVIF · RTSP — integrates with Milestone, Genetec and other VMS platforms.
S3-compatible API (90+ endpoints) — Hafiz or any S3 target.
REST and gRPC APIs — export models and events to third-party applications.
syslog and CEF feeds — alerts flow into your existing security operations.
GeoJSON and map-service APIs — plot cameras and detections on maps.
Webhook + HMAC, SMTP email, MQTT (QoS 1), SNMP (TRAP/INFORM).
Prometheus metrics, a ready-made Grafana dashboard and GPU telemetry.
Failed notifications are queued and retried with exponential backoff. Critical external actions can be gated on operator approval.
Deployment and implementation method
Engagement begins only on acceptance of our proposal; implementation follows the phased path below.
Site survey, camera and network assessment, requirement mapping.
Limited-camera pilot proving detection and performance on your own data.
Model training and on-site calibration to your environment.
Phased, secured deployment across the network.
Integration, acceptance testing and go-live.
Operator and administrator enablement.
SLA-backed maintenance, updates and model re-training.
The installation package is carried on USB and its SHA-256 verification runs fail-closed. Nothing beyond Docker is installed on the customer server, and no step requires internet.
Air-gap boundary
IP cameras
ONVIF / RTSP
Organisation server
Analysis · recording · dashboard
Operator workstations
Organisation network
Use cases
What changes between sectors is not custom code but a model trained on the organisation's own data. The events below are typical examples.
Incidents are seen as they occur and defended afterwards with sealed evidence.
Credibility and innovation
Where named references cannot be shared, our credibility rests on published work and independent recognition.
Our post-quantum cryptography work was accepted for presentation at a NATO seminar — external validation of the science behind Nizam.
A public release of 40,000+ lines of Rust: 90+ S3 endpoints, blockchain-style hash-chain audit, PQC capabilities and air-gap sync.
A dedicated post-quantum cryptography effort hardening the platform against harvest-now-decrypt-later threats.
H200 GPU clusters (MIG-partitioned) · Kubernetes / KubeFlow ML pipelines · high-throughput columnar analytics and secure object storage · encrypted site-to-site networking.
Named references are shared under NDA at the short-list stage, with each client's written consent — and we can arrange direct reference calls. For sensitive, security-critical deployments, deployment counts and locations are treated as confidential.
Technical summary
A ready reference for specification documents and tender files.
| Specification | Value |
|---|---|
| Deployment | On-premises, fully offline / air-gap capable |
| Data residency | All data in-country; no external cloud dependency |
| Hardware | NVIDIA GPU (H200 · MIG partitioning) or CPU-only profile |
| Camera protocol | ONVIF · RTSP; works alongside an existing VMS |
| Runtime | Pure-Rust production runtime; no interpreted languages |
| Data layer | ClickHouse analytics · PostgreSQL (RLS) · Hafiz S3-compatible object store |
| Integration | REST · gRPC · S3 (90+ endpoints) · Webhook + HMAC · SMTP · syslog RFC 5424 / CEF · MQTT (QoS 1) · SNMP · GeoJSON |
| Observability | Prometheus metrics · ready-made Grafana dashboard · GPU telemetry |
| Cryptography | End-to-end encryption in transit and at rest · CRYSTALS-Dilithium · SPHINCS+ · EdDSA-signed JWT |
| Access control | Role-based access control (RBAC) · multi-factor authentication (MFA) · row-level isolation |
| Evidence | SHA-256 hash-chain · signed evidence package · offline verifier · legal hold |
| Interface language | Turkish and English operator interface; PWA for mobile |
| Installation | Single box, docker compose, air-gap package on USB; SHA-256 fail-closed verification |
| Licensing | Per module · per camera count · per classes per camera |
Extended capabilities
These capabilities are part of the platform and are enabled according to deployment scope.
Event description and free-text recording search via a local vision-language model.
Person re-identification across cameras and a unified journey timeline.
Active-passive redundancy with automatic failover.
Doors, turnstiles and field sensors feed directly into event chains.
Moving cameras are driven from the operator console.
Frequently asked questions
Direct answers. If we are not certain about something, we say so.
Yes. The installation package is carried on USB, verification is local, and the system runs at full function on an air-gapped network. It does not call out for licence checks, download models or send telemetry.
Yes. It works with IP cameras that provide ONVIF and RTSP, and it sits alongside existing VMS installations such as Milestone and Genetec. No camera replacement is required.
It does not have to. It works with your existing VMS through open standards and adds the layer that the VMS cannot see — analysis, rules, alarms and evidence. If you prefer, recording and monitoring can also be consolidated with us.
No. It also runs on a CPU-only profile, with camera density and model complexity planned accordingly. The GPU profile reaches approximately 300 concurrent 1080p streams per node.
Scale grows near-linearly with the number of GPU nodes. Approximately 300 concurrent 1080p streams per node is a representative figure; the exact number is set by frame rate, resolution and the number of active models, and we calculate it together during discovery.
On your own server. Analytics data sits in ClickHouse, configuration and permissions in PostgreSQL, and evidence in the Hafiz S3-compatible object store. None of it leaves the boundary of your organisation.
We do not claim accuracy; we measure it. mAP, precision and recall are computed with a standard COCO evaluation on a frozen test set and reported as a per-class scorecard. That scorecard becomes part of the acceptance file.
Off-the-shelf models are general purpose: lighting, camera angle, clothing and scene layout are specific to your site. High accuracy comes from training on the organisation's own footage; Studio exists for exactly this, and it is a design decision rather than a weakness.
In three layers: events are grouped into episodes (in one measured case, 44.1 events per minute reduced to a single alarm), rules and chains add context, and operator false-alarm flags feed the labelling queue for the next version of the model.
Frames and clips are sealed with SHA-256, all operations are written to a hash-chained immutable audit log, and the chain can be verified. An incident is exported as a signed package that the recipient checks with an offline verifier. Final admissibility of the evidence rests with the relevant court.
These functions come with lawful-use controls: role-based access, multi-factor authentication, a retention policy, and every query written to the immutable audit log. Which functions are enabled, and to what scope, depends on the organisation's legal assessment and local regulation.
We work through seven stages: discovery, proof of concept, training, rollout, commissioning, team enablement and support. The duration becomes clear during discovery, based on camera count, site conditions and the scope of model training.
Next step
We propose a scoped, scenario-based demonstration of the computer-vision and closed-network capabilities most relevant to your priorities, followed by a security and architecture deep-dive.