Security Whitepaper

Last updated — 12 October 2026. This Linox Ltd document reflects the current Darkfield deployment model. The Data Processing Agreement governs our processing on a customer's behalf.

1 · Introduction

Linox Ltd builds Darkfield, an AI vision platform that runs perception on the cameras an organisation already operates. By its nature, Darkfield handles some of the most sensitive data a business holds: live video of its sites, its people, and its operations. Security and privacy are therefore not features added after the fact — they are the starting point of the architecture.

This whitepaper describes the controls Linox operates across infrastructure, data handling, access management, model oversight, and incident response. It is written for the security, IT, and data-protection teams evaluating Darkfield.

Darkfield deployments are scoped to your requirements. This document describes our current security and privacy practices. Available features, supported integrations and the deployment model are confirmed in your proposal.

2 · Security & Privacy at a Glance

Across every model, data is encrypted in transit and at rest. Managed hosting uses UK infrastructure; customer-owned locations and any outbound connections are agreed in the deployment plan, subject to the data-transfer provisions of the DPA. In-memory anonymisation, which removes identifying detail from each frame before any clip is persisted, is available for customers who require it.

3 · Infrastructure Security

Darkfield is engineered to expose the smallest possible surface to your network and to ours.

• Customer-owned infrastructure: Darkfield can run perception on the appliance supplied for your premises or on your private-cloud compute. The gateway reaches only the cameras you nominate — the rest of your network remains unreachable to Darkfield.
• Network segmentation and isolation: Production environments are segmented to contain and protect different parts of the infrastructure. For managed-cloud customers, inference runs in a dedicated, network-isolated instance rather than a shared multi-tenant pool.
• UK-hosted managed cloud: Managed-cloud ingest and the management plane run on UK-based infrastructure. Customer-owned deployment locations and any external system connections are specified in the deployment plan.
• Zero-trust corporate access: Corporate endpoints operate under a zero-trust model in which every access request is verified before it is granted.
• Endpoint and email security: Endpoint detection and response (EDR) tooling and email threat protection are deployed across the corporate fleet to block malicious content before it reaches our teams.
• Authentication to production: Access to production systems, datastores, and networks requires unique credentials or authorised SSH keys, a valid multi-factor authentication (MFA) method, and an approved encrypted connection.
• Monitoring and audit logging: Infrastructure and access events are logged centrally and continuously monitored so that suspicious activity can be reviewed and acted upon.

4 · Data Encryption

Data is protected at every stage of its lifecycle.

• Encryption in transit: All data moving between your site, your devices, and Linox is encrypted using TLS 1.2 or higher. This includes RTSP streams from managed-cloud customers.
• Encryption at rest: Stored data — including configured recordings and archives, events, detections, short evidence clips, and configuration — is encrypted using AES-256.
• Air-gapped integrity: Model-weight updates delivered to air-gapped deployments are cryptographically signed and validated before they are activated.

5 · Data Privacy & Minimisation

This is the heart of operating AI vision responsibly.

• Inference location: In customer-owned deployments, inference runs on-premises or in your private cloud, with data flows and any outbound integrations agreed in the deployment plan. In managed-cloud deployments, raw video is streamed to your dedicated, network-isolated instance in the UK — not a shared pool — and is processed under Linox's management.
• In-memory anonymisation (on request): For customers who require it, anonymisation can be applied to each frame in RAM before any clip is persisted. Event clips and recording archives are configured according to the customer's purpose and instructions; continuous recording is available where specified in the deployment.
• Supporting data-protection obligations: Darkfield provides controls to support UK GDPR obligations. Lawful deployment depends on the purpose, configuration and controller instructions. In most deployments you act as the data controller and Linox acts as your processor, governed by the Data Processing Agreement (DPA).
• Data residency: Core managed hosting uses a dedicated UK instance. Customer-owned locations are agreed in the deployment plan. For either hosting model, any external processing or integration follows the documented scope, the transfer safeguards in section 11 of the DPA and the subprocessor roster in Annex 3.
• Retention and disposal: Events and short evidence clips use a configurable 30-day default. Recording and archive storage can support years of retention, but capacity does not determine how long personal data should be kept. The controller sets and reviews retention for the documented purpose, retaining data only for as long as necessary. Continuous recording and its retention are agreed per deployment. Search covers retained footage and observations. Data is securely disposed of at the end of its retention period and when a customer leaves the service.
• Zero-retention option: For sensitive deployments, a zero-retention mode processes events without persisting evidence clips.
• Identifiable individuals: Where a deployment may involve identifiable individuals — for example faces, or number plates checked against DVLA — in-memory anonymisation is available on request, and Linox supports customers in completing Data Protection Impact Assessments (DPIAs) and minimising what is captured.

6 · Access Control

Access to customer data and to the platform is granted on a least-privilege basis.

• Single sign-on and MFA: Support for SSO, with MFA enforced for administrative access.
• Role-based access control: Granular roles (administrator, user, and service accounts) ensure people and systems can only reach the data and functions their role requires.
• Customer-managed access: Customers manage their own users, the cameras each user can see, and how alerts are routed.
• Provisioning and de-provisioning: Access requires a documented request and approval before it is granted, and is promptly revoked on role change or departure.
• Audit logging and export: A comprehensive audit trail of user access and administrative actions is maintained and can be exported for integration into your own SIEM.

7 · Model Safety, Accuracy & Oversight

Because Darkfield decides what is worth a person's attention, the model itself is held to account.

• Self-QA: The system samples its own output on a rolling window and scores it against the data table agreed with you at onboarding.
• Automatic retraining: When precision drops below the agreed tolerance, a retrain is triggered automatically — per camera, on the actual scene — and the new weights are validated before they go live.
• Human oversight: Every change is recorded in an audit log. You can pause or override the system at any time.
• Scoped detection: Open-vocabulary detection is limited to what you define, and the Vision AI layer only flags events that match the agreed description. This reduces false positives and avoids unnecessary surveillance.

8 · Secure Development & Change Management

Changes to the platform are controlled, reviewed, and traceable.

• Development lifecycle: A formal software development lifecycle (SDLC) governs the development, acquisition, implementation, change, and maintenance of the platform.
• Change management: Changes to software and infrastructure are authorised, documented, tested, peer-reviewed, and approved before they reach production. Relevant changes are communicated to affected internal and external users.
• Vulnerability management: Defined procedures cover the identification, triage, and remediation of vulnerabilities within agreed service levels.
• Dependency security: Third-party dependencies are monitored for known vulnerabilities.

9 · Security Validation

Linox validates its controls through regular internal testing and review.

• Penetration testing: Penetration tests are conducted at least annually. Findings are addressed through a prioritised remediation plan.
• Control self-assessments: Linox performs control self-assessments at least annually to confirm that controls are in place and operating effectively, with corrective actions tracked to closure.
• Vulnerability and system monitoring: Continuous monitoring and a defined vulnerability-management process keep the platform under ongoing review.
• UK regulatory compliance: Linox operates under the UK GDPR and the Data Protection Act 2018 and designs deployments to support customers' obligations under the Surveillance Camera Code of Practice.

10 · Incident Response

Linox maintains a documented Incident Response Plan designed for rapid detection, containment, investigation, and resolution.

• Plan and ownership: A formal Incident Response Plan assigns clear ownership and defines escalation paths to leadership.
• Detection and alerting: Centralised log ingestion, analysis, and monitoring (SIEM) with automated alerting.
• Scope: The plan covers both traditional security events (such as unauthorised access or system disruption) and AI/product-safety events (model behaviour or output outside expected guardrails).
• Prioritisation and SLAs: Incidents are assigned a severity based on their impact to confidentiality, integrity, and availability, with critical incidents requiring rapid acknowledgement.
• Breach notification: As a processor, Linox notifies the affected controller without undue delay after becoming aware of a personal data breach and assists with its response. The controller must report a notifiable breach to the ICO without undue delay and within 72 hours of becoming aware of it, and inform affected individuals where required. Where Linox is the controller, we meet those obligations ourselves.
• Testing: The plan is tested through tabletop and technical exercises to ensure operational effectiveness.

11 · Reliability, Disaster Recovery & Business Continuity

Darkfield is designed to keep working through disruption.

• Disaster recovery: A Disaster Recovery Plan outlines a phased approach — assessment, recovery of temporary operations, and reconstitution to normal service.
• Business continuity: A Business Continuity Plan is maintained and tested at least annually.
• Redundancy: Cloud storage, databases, and load balancers are replicated to support high availability.
• Backups: Encrypted daily backups are retained for a defined period, integrity-checked, and tested.
• Edge resilience: Edge deployments can run perception locally while their local compute, camera connections and power remain available. Configured Darkfield solar/4G units support up to one week of local recording and buffering during loss of external connectivity, with adequate local storage and power. The one-week allowance covers recording and buffering; it does not guarantee offline AI or spoken actions. Local analysis and rules depend on a functioning camera-to-compute path, power and the agreed configuration. Remote alerts, live access, two-way talk and managed-cloud analysis need connectivity. Buffered data synchronises when the connection returns. Third-party cameras have their own limits.

12 · Organisational & Personnel Security

Security depends on people as much as systems.

• Background checks: Performed on new employees where lawful.
• Code of conduct: Acknowledged by employees at hire; violations are subject to a disciplinary policy.
• Security training: Staff receive security awareness training.
• Device management: Endpoint and mobile devices are centrally managed through a mobile device management (MDM) system.
• Password policy: Enforced across in-scope systems.
• Roles and accountability: Roles and responsibilities are documented, and performance is reviewed.

13 · Security Controls Reference

The following controls are implemented and operated across the Darkfield platform and Linox's operations as of June 2026.

Infrastructure security

Organisational security

Product security

Internal security procedures

Data and privacy

14 · Contact

Linox is committed to providing a secure and privacy-respecting platform for every customer. We continuously monitor and improve our security practices as the platform grows.

For questions about this document, to request a Data Processing Agreement, or to discuss specific requirements such as DPIAs or air-gapped deployment, please contact our security team:

hello@linox.co.uk

// © 2026 linox ltd · united kingdom