Technical Architecture and Infrastructure Manual

Safe offers full flexibility to adapt to the organisation’s data security policies, allowing processing to be kept wherever it is most efficient.

Safe uses a modular architecture based on containerised microservices, allowing agile deployment both on local servers (On-premises) and in hybrid environments. Unlike heavier infrastructures, our native stack removes unnecessary layers of abstraction, maximising hardware performance.

• • CLIENT (Browser): Main user interface. Consumes live video and displays events.

• • VIDEO SOURCES: IP cameras (via RTSP) or webcams that feed the system from outside.

• • ENTRY POINT (API Gateway / Reverse Proxy):

  • · Single entry point for all external traffic (HTTP/HTTPS, WebSockets).

  • · Responsible for routing requests to the corresponding internal services.

• • MESSAGE QUEUE:

  • · Intermediate buffer that receives the raw detections from the AI.

• • ORCHESTRATOR (Business brain):

  • · Consumes detections from the Message Queue.

  • · Reads camera and zone configuration from the Database.

  • · Evaluates complex business rules to create events and alarms.

  • · Manages the state (start/stop) of the analysis per camera.

  • · Connects to: Database, Object Storage, Event Server (to notify the client) and Email Server.

• • DATABASE (Relational/Document):

  • · Stores structured data: Users, Organisations, Camera/Stream/Zone configuration, Event history, Sessions.

• • OBJECT STORAGE (Files):

  • · Stores unstructured data: Event images, user avatars, generated reports.

Safe is deployed on Linux systems with Docker Compose, which ensures portability and consistency across environments, and natively on Windows.

To guarantee service stability, Safe development follows a lifecycle (SDLC) with fully isolated runtime environments:

• • Development/Test Environment:

• Where new analytics or features are validated without affecting the live plant.

• • Production Environment:

• Configuration optimised for high availability and maximum hardware performance.

• • Network Isolation:

• on Linux, containers run on a private internal Docker network, exposing only the necessary services (80/443) through Traefik.

• • Access Management:

• Administrative access to the infrastructure is carried out through secure protocols such as SSH (puerto 22) with mandatory authentication.

• • Database (PostgreSQL):

• Stores camera configuration, users and historical alert records.

• • Object Storage:

• Acts as a local S3 repository to store video fragments and evidence of safety breaches.

• • Continuity:

• In critical setups, data replication is recommended to minimise the Recovery Point (RPO) in the event of hardware failure.

For clients with multiple sites or departments, Safe guarantees full logical security where data is never mixed.

• • Unique Tenant ID:

• Every system entity (cameras, alerts, recordings and users) is irrevocably linked to a unique client identifier (Tenant ID).

• • Automatic Tenancy Filter:

• The system automatically applies a filter on every database query or file request; this ensures that a user can only view or manage the resources that strictly belong to their own tenant.

For zero-delay camera viewing, Safe implements a viewer using MediaMTX. This component allows:

• • Ingestion:

• Receiving IP camera streams via RTSP or browser webcams.

• • Multi-format Output:

• Dynamic conversion to HLS or WebRTC, enabling smooth viewing in any modern browser with low latency

In line with our transparency policy, we detail the third-party services used for auxiliary functions and their security certifications.

Note for Full On-Premise installations: In 100% local deployments, these services are replaced by the client’s internal services to guarantee full data sovereignty.

For technical inquiries about hardware compatibility or custom quotes, please contact:

• • Technical Support: support@safe.ai

• • Sales: commercial@safe.ai