Legal

Security and compliance

What we do to keep client data safe, which standards we work to, and — stated plainly — which certificates we do and do not hold.

Standards we work to

"Practices aligned" means we have taken the control areas of the standard and applied the ones that fit a company of our size and activity. It does not mean an accredited body has audited us, and it is not a substitute for certification. We review these practices internally rather than on a fixed audit cycle.

How client data is handled

When you send us imagery to blur, annotate or process, this is what happens to it.

Transfer and storage

Data is transferred over encrypted channels and stored in EU-region object storage. Credentials for that storage are scoped to the specific task and are rotated. Original client material is kept separate from our own capture archive.

Access

Access to client material is limited to the people working on that job. Processing runs on our own hardware in Lithuania rather than on rented general-purpose cloud GPUs, which keeps the number of parties touching the data small. Where a job requires capacity we do not have in-house, we tell the client before any data moves.

Return and deletion

At the end of a job we return the deliverable and delete the working copies on the schedule agreed in the contract. If you need written confirmation of deletion, ask for it and we will issue it.

Sub-processors

We do not add a sub-processor to a client job without telling the client first. The current list is in the data processing terms.

Anonymisation as a security control

Our blurring pipeline is the control that does most of the work in reducing risk: faces and plates are destroyed in the output before anything leaves our hands. The technical detail, and an honest statement of the limits of what blurring achieves, is on the blurring service page and in section 2 of the privacy policy.

We flag one thing here because it matters for a security assessment: while we retain an original unblurred capture, that material is pseudonymised rather than anonymised and is protected by access control, not by irreversibility.

EU AI Act

We build and run computer-vision models, so the AI Act applies to us and we would rather state our position than leave you to guess it.

• We do not do biometric identification. Our face model finds that a face is present so it can be destroyed. It does not match faces to identities, it does not build face templates, and we hold no biometric database. We do not perform real-time remote biometric identification in public spaces.
• We do not do emotion recognition or biometric categorisation.
• What our models actually classify is road signs, road surface defects and street furniture — infrastructure, not people.
• Risk classification. On our own assessment the detection and anonymisation systems we operate are not prohibited practices and are not high-risk systems under Annex III. This is our own assessment and we will revise it as guidance develops.
• Human oversight. Model output is automatic and is labelled as such in deliverables. Where a figure in a report comes from a model rather than a measurement, the report says so — our survey reports mark automatic values "automatic, not verified".

Incidents

If we suffer a personal data breach we will notify the supervisory authority within 72 hours where Article 33 GDPR requires it, and affected clients without undue delay. If you are a client, your contract names the contact we will use. To report something to us, including a suspected vulnerability in this site or our services, write to [email protected]. We will not pursue anyone who reports a genuine vulnerability to us in good faith.

What to ask us for

If you are assessing us as a supplier, these are reasonable things to request, and we will provide them: our legitimate interests balancing assessment for street capture; our retention schedule; the sub-processor list; a written deletion confirmation; and a description of the blurring pipeline and its measured limits. If you need something we cannot provide, we will say so rather than improvise.