Security and data

Detection runs on-site, at the edge

Foreman installs as a 60-second Windows .exe on a machine inside your premises. It reads the low-bandwidth sub-stream from your existing DVR or NVR and runs Foreman's own AI models — trained in-house — to spot people, vehicles, fire and smoke, locally on-site.

Your continuous video stream never leaves your premises. There is no cloud upload of your live feed, no constant streaming to our servers, and no copy of your footage held off-site. The processing happens where the cameras are.

• Detection runs on your own hardware, inside your network
• Reads the DVR sub-stream — low bandwidth, no impact on recording
• Continuous video is never transmitted off the premises

What leaves your premises, and what does not

When the on-site model detects a possible event, Foreman sends a short clip around that moment to Foreman's cloud, where a larger model double-checks it before it alerts you. This verification is what cuts false alarms — and it is the only thing that causes media to leave the premises.

What leaves: short event clips, still photos, and detection metadata, only when an event is detected. What never leaves: your continuous live stream, your archived recordings, and anything from periods when nothing was detected.

• Leaves the premises: short event clips, event photos, detection metadata
• Never leaves: continuous video, archived footage, non-event periods
• Sent only at the moment of a detection, never on a schedule

Where event media is stored, and for how long

Event clips and photos are stored in India, encrypted in transit and at rest. They are automatically deleted after 30 days. You do not have to request deletion — the retention cap applies by default.

We do not sell your footage, and we do not use your footage to train Foreman's models. Your camera data is processed only to detect events and notify you.

• Stored in India, encrypted in transit and at rest
• Auto-deleted after 30 days — retention is capped by default
• Never sold, never used to train our models

Your DVR stays the system of record

Foreman is not your recorder. Your existing DVR or NVR keeps recording exactly as it does today and remains the system of record for your footage. Foreman sits alongside it as a detection and alerting layer.

If you removed Foreman tomorrow, your recording setup would be unchanged. The device you already rely on to hold your footage is the device that keeps holding it.

• Your DVR/NVR keeps recording and stays the system of record
• Foreman adds detection and alerts — it does not replace your recorder
• Removing Foreman leaves your existing recording untouched

Network: outbound HTTPS only, no router changes

Foreman talks to the cloud over outbound HTTPS only. There is no port-forwarding, no inbound connections, and no changes to your router or firewall. Your cameras are never exposed to the public internet by Foreman.

Because the connection is outbound-only, your IT team can verify exactly what Foreman reaches, and nothing on your network becomes externally reachable as a result of installing it.

• Outbound HTTPS only — no inbound ports opened
• No port-forwarding, no router or firewall changes
• Your cameras are not exposed to the public internet

Built to align with the DPDP Act 2023

India's Digital Personal Data Protection Act 2023 sets out principles for handling personal data: clear notice and purpose, using data only for that purpose, limiting how long it is kept, keeping it secure, and respecting the rights of the people the data is about. Foreman is built to align with those principles. We hold no third-party certification, and we do not claim one.

In the language of the Act, your factory is the data fiduciary for footage of your premises, employees and visitors — you decide why the cameras run and you give the notices the law requires. Foreman acts as a data processor, handling that footage only on your instructions and only to deliver the service.

In practice: purpose limitation (event detection and alerting, nothing else), storage limitation (30-day auto-delete on event media), and support for data-principal rights. Requests about footage of individuals are handled through you as the fiduciary; requests about your own account data come to us directly.

• Notice and purpose: footage is processed only to detect events and alert you
• Purpose and storage limitation: no secondary use, 30-day retention cap
• Data-principal rights supported via privacy@foremanintelligence.com
• Aligned with DPDP principles — not certified; we hold no third-party certifications

Access controls, in plain terms

Access to event media is scoped to your account. Inside Foreman, access to internal systems follows least-privilege: only the people who need it to operate and support the service can reach it.

Data is encrypted in transit and at rest, and Foreman relies on a small number of trusted sub-processors — for example cloud hosting, storage, and messaging — to run the service. A current list is available on request.

• Event media is scoped to your account
• Internal access follows least-privilege
• Encrypted in transit and at rest
• Sub-processor list available on request