Data and technology sovereignty

Sovereignty is the question of who decides: who owns the video, who can reach it, where it is processed, and how long it is kept. It also asks whether any of those answers depend on a vendor staying in business, or staying friendly. IREX answers those questions architecturally, which is why the answers do not change with a contract renewal.

Four guarantees

Guarantee	What it means in operation	Why it holds
Complete customer ownership and control of data	IREX neither owns nor accesses customer video, events, logs, alarms, watchlists, or floor plans. Every byte stays with the customer, under the customer's access controls and retention policy.	Architectural. The platform is user-hosted on the customer's private cloud or on-premises hardware, and no IREX-side data plane for customer media exists.
On-premises and private-network deployment available in every case	On-premises, private-cloud, and fully air-gapped deployments are all supported. Hosting by IREX is an option a customer may choose, never a condition of using the platform.	The IREX Private Cloud installs on bare metal, virtual machines, private or public cloud, hybrid, and air-gapped networks. Runtime has no internet dependency.
An auditable technology stack	The infrastructure a sovereign customer depends on can be inspected rather than trusted. IREX-authored components can additionally be placed under source-code review or escrow.	The infrastructure layer is entirely open-source, with no third-party proprietary code. Review and escrow of IREX components are available under a licensing or development agreement.
Every user action auditable	Every high-risk AI action, including each face search, watchlist match, and export, is bound to a mandatory Case ID and written to a non-erasable, tamper-evident log. An oversight body can reconstruct who did what, when, and on what legal grounds.	Case ID is a platform-level mandate, not a configuration option. The log is append-only and exported daily; supervisors and ethics committees have read access by design.

The trust boundary

Video, events, and the audit log stay inside one boundary the customer defines. Nothing crosses it except by the customer's decision, and an air-gapped deployment removes the crossing entirely.

What IREX does not hold

The clearest statement of data sovereignty is a list of what the vendor cannot produce if asked. For a user-hosted deployment, IREX holds none of the following:

Live or recorded video from customer cameras.
Events, detections, matches, or their snapshots.
Watchlists, or the person and vehicle databases behind them.
Maps, floor plans, and camera positions.
The audit log, including Case ID records.
User accounts, roles, and permission structures.

Because IREX has no copy, the customer's retention policy is the only retention policy, and a legal request served on IREX cannot produce customer video.

Deployment sovereignty

Decision	Who makes it
Where the platform runs: on-premises, private cloud, hybrid, or air-gapped	The customer. All four are supported. See Deploy instance.
Which jurisdiction the data sits in	The customer. Deployments are served from an in-region instance where a data-protection regime requires it.
Retention period for the video archive	The customer, per camera. When the period expires the data is physically erased from the media. See Manage cameras.
Who may see which camera, recording, or module	The customer's administrators, through role-based access control. See Manage users and user groups.
Whether IREX monitors the deployment	The customer, through the support tier. IREX NOC monitoring applies to IREX-hosted deployments and to user-hosted deployments under a premium support agreement, not by default.
Which external systems the platform connects to	The customer. See External connections and the API guide.

Technology sovereignty

Data sovereignty without technology sovereignty is temporary. A deployment that cannot be operated, inspected, or extended without the vendor is dependent whatever the contract says about data ownership. Three properties address that:

An open-source infrastructure layer. Kubernetes, Ceph, Cassandra, Apache Ignite, Kafka, PostgreSQL, Elasticsearch, Apache Spark, and Cilium, with no third-party proprietary code. The stack can be inspected, and the skills to operate it are available on the open market. See Platform architecture.
Hardware independence. The platform installs on bare metal without a hypervisor license and without a specific hardware vendor. Analytics run on CPU through the Synet framework or on NVIDIA GPUs, so existing server inventory can be used. See System requirements.
No runtime dependency on IREX. An air-gapped deployment operates with no connection to IREX at all. Updates are applied from local media. See Update instance.

For customers whose procurement rules require it, IREX source-code review or escrow is available under a licensing or development agreement. Contact the IREX representative for the region.

Multi-tenancy without shared exposure

A national or regional deployment usually serves several organizations at once: a police force, a transport authority, a municipal traffic department. The carrier-grade multi-tenant architecture gives each of them its own hierarchy of users, cameras, watchlists, and events inside one deployment, so infrastructure is shared while data is not. Sovereignty applies at the level of each tenant, not only at the level of the installation.

See Manage users and user groups and Manage general properties.