Security, Privacy and Data Protection Framework (GDPR)

Safe implements cutting-edge technical measures to ensure that video analysis complies with personal data protection regulations (GDPR).

IMPORTANT: a reversible blurring mode can be configured when infringements with potential criminal impact are anticipated. It hides the face during normal use (after recording the image in the database), and if a user with administrator permissions enables it, the faces can be revealed. However, this system must be requested and enabled in advance, since, as the previous steps indicate, the base system destroys them.

The architecture of Safe guarantees full information isolation between different organisations or sites.

• • Unique Tenant ID:

• Every entity (cameras, alerts, users) is irrevocably linked to a unique client identifier.

• • Automated Access Control:

• The system automatically applies tenancy filters on every database query to ensure that users only access the information that belongs to them.

• • Data at Rest:

• All sensitive information stored in our databases and file systems is protected using the advanced encryption standard AES with 256-bit keys.

• • Data in Transit:

• Communications between the user’s browser and the server, as well as between microservices, are protected by Transport Layer Security (TLS) 1.2 or higher, preventing any kind of interception or message forgery.

Safe implements an architecture of authentication and multi-level authorisation that secures both platform access and the integrity of the video streams.

The system uses JSON Web Tokens (JWT) for two critical and distinct purposes, ensuring lightweight sessions and secure transmissions:

• • Session Management:

• Tokens are stored in secure cookies, removing the need for constant database queries to validate the active session.

• • Streaming Security (MediaMTX):

• To access the HLS/WebRTC streams, the system generates short-lived tokens (15 minutes) signed with RS256 algorithms. MediaMTX validates these tokens against an internal JWKS endpoint, ensuring that only authenticated users can view the video in real time.

The system uses JSON Web Tokens (JWT) for two critical and distinct purposes, ensuring lightweight sessions and secure transmissions:

• • High-Strength Hashing:

• Passwords are processed using bcrypt with a cost factor of 12. This standard is strictly applied at registration, login and profile updates, ensuring immunity against rainbow table attacks.

• • Input Sanitisation (Zod):

• All backend interactions (login, registrations, configuration changes) are protected by Zod. validation schemas. This prevents injection attacks and the processing of malformed data before it reaches the business logic or database.

Logical security is based not only on role but also on organisation membership:

• • Filtering by orgId:

• Every API request (event images, cameras, documents) requires a session validation where the system filters data strictly by the user’s organisation ID.

• • File Isolation:

• Paths in object storage are physically partitioned by organisation (e.g. /[orgId]/[eventId].jpg), making it impossible to access other clients’ data.

In addition to access control, Safe Pro applies hardening policies to network traffic and native configurations.

The system automatically injects security headers to protect the end user against common attacks:

• • X-Frame-Options (DENY):

• Prevents Clickjacking.

• • X-Content-Type-Options (nosniff):

• Prevents the browser from interpreting files with incorrect MIME types.

• • Browser XSS Filter:

• Additional layer against cross-site scripting attacks.

• • X-Robots-Tag:

• Instructs search engines not to index any part of the internal application.

To mitigate brute-force or denial-of-service (DoS) attacks, the gateway limits traffic to the application and to the AI’s protected routes:

• • Security Threshold:

• Configured for an average of 100 requests per second, with controlled bursts of up to 50, ensuring server stability during unusual traffic spikes.

Safe restricts cross-origin requests through strict CORS policies on the socket server and inference engine, allowing communication only with the official dashboard origin and prohibiting the use of credentials on unauthorised domains.

Access control is based on roles (RBAC) with granular permissions:

• • User:

• Access to viewing assigned events and cameras.

• • Admin:

• Management of organisation users, camera configuration and event deletion.

• • Super Admin:

• Full access, including diagnostic panels and management of multiple organisations (Safe developers).

• • Secure Development (SDLC):

• Safe is developed following code review phases and security testing in development and test environments that are fully segregated from production.

• • Patch Management:

• We have a strict update policy:

  • · Critical Vulnerabilities:

  • Patches applied within a maximum of 7 days of identification.

  • · High Vulnerabilities:

  • Resolved within a maximum of 30 days.

• • Account Recovery:

• We implement a recovery flow based on cryptographically generated unique tokens with a validity limited to 1 hour.

• • ARCO Rights:

• The system allows the export and deletion of event data to facilitate compliance with data subjects’ rights of access, rectification and erasure.

For technical enquiries about hardware compatibility or custom quotes, contact us at:

• • Technical Support: support@safe.ai

• • Sales: commercial@safe.ai