Security and data

Our software installs in 60 seconds on a computer inside your premises. It reads the low-bandwidth sub-stream from your existing DVR or NVR and runs our own AI models, trained in-house, to spot people, vehicles, fire and smoke right there.

Your recordings stay on your premises. We do not stream your cameras to our servers around the clock, and we hold no copy of your recordings. The processing happens where the cameras are.

• Detection runs on your own hardware, inside your network
• Reads the DVR sub-stream, low bandwidth, no impact on recording
• Your recordings stay on your premises

When the on-site model spots a possible event, we send photos and a short clip of that moment to our cloud service and the AI providers we use to check events. A second, larger model checks it there before you are alerted. That check is what cuts false alarms.

We also send a small preview photo of each camera every few minutes, so the app can show that every camera is working. When you open a live view, that camera streams to you for as long as you watch. On the first night after setup, we read a few stills from your past recordings to build your history report. Your recordings themselves stay on site.

• Sent: event photos and clips, detection details, a small preview photo of each camera every few minutes, and live views you open
• Sent once, on the first night after setup: a few stills from past recordings for your history report
• Stays on site: your recordings and your continuous video

Event photos and clips are encrypted in transit and at rest, and deleted automatically after 30 days. You do not have to ask for this. Our cloud and AI providers may process data outside India, including in the United States.

We do not sell your footage and we do not train our models on it. We process your camera data only to run the service for you: detecting events, alerting you and showing your cameras in the app.

• Encrypted in transit and at rest
• Deleted automatically after 30 days
• May be processed outside India, including in the United States
• Never sold, never used to train our models

Foreman is not your recorder. Your existing DVR or NVR keeps recording exactly as it does today and remains the system of record for your footage. Foreman sits alongside it as a detection and alerting layer.

If you removed Foreman tomorrow, your recording setup would be unchanged. The device you already rely on to hold your footage is the device that keeps holding it.

• Your DVR/NVR keeps recording and stays the system of record
• Foreman adds detection and alerts, it does not replace your recorder
• Removing Foreman leaves your existing recording untouched

Foreman talks to the cloud over outbound HTTPS only. There is no port-forwarding, no inbound connections, and no changes to your router or firewall. Your cameras are never exposed to the public internet by Foreman.

Because the connection is outbound-only, your IT team can verify exactly what Foreman reaches, and nothing on your network becomes externally reachable as a result of installing it.

• Outbound HTTPS only, no inbound ports opened
• No port-forwarding, no router or firewall changes
• Your cameras are not exposed to the public internet

India's Digital Personal Data Protection Act 2023 sets out principles for handling personal data: clear notice and purpose, using data only for that purpose, limiting how long it is kept, keeping it secure, and respecting the rights of the people the data is about. We follow those principles in how we handle your footage and your account.

In the language of the Act, your business is the data fiduciary for footage of your premises, employees and visitors: you decide why the cameras run and you give the notices the law requires. We act as your data processor, handling that footage only on your instructions and only to deliver the service.

In practice: purpose limitation (running the service for you, nothing else), storage limitation (event media deleted after 30 days), and support for data-principal rights. Requests about footage of individuals are handled through you as the fiduciary; requests about your own account data come to us directly.

• Notice and purpose: footage is used only to run the service for you
• Purpose and storage limitation: no secondary use, 30-day retention on event media
• Data-principal rights supported via privacy@foremanintelligence.com

Access to event media is scoped to your account. Inside Foreman, access to internal systems follows least-privilege: only the people who need it to operate and support the service can reach it.

Data is encrypted in transit and at rest, and we rely on a small number of trusted sub-processors, for cloud hosting, storage, messaging and AI processing, to run the service. A current list is available on request.

• Event media is scoped to your account
• Internal access follows least-privilege
• Encrypted in transit and at rest
• Sub-processor list available on request