Technical Architecture and Infrastructure Manual

Safe offers total flexibility to adapt to the organisation's data security policies, allowing processing to remain wherever it is most efficient.

Safe uses a modular architecture based on containerised microservices, enabling agile deployment both on local servers (On-premises) and in hybrid environments. Unlike heavier infrastructures, our native stack eliminates unnecessary layers of abstraction, maximising hardware performance.

• • CLIENT (Browser): Main user interface. Consumes live video and displays events.

• • VIDEO SOURCES: IP cameras (via RTSP) or webcams that feed the system from outside.

• • ENTRY GATEWAY (API Gateway / Reverse Proxy):

  • · Single entry point for all external traffic (HTTP/HTTPS, WebSockets).

  • · Routes requests to the corresponding internal services.

• • MESSAGE QUEUE:

  • · Intermediate buffer that receives raw detections from the AI.

• • ORCHESTRATOR (Business logic core):

  • · Consumes detections from the Message Queue.

  • · Reads camera and zone configuration from the Database.

  • · Evaluates complex business rules to create events and alarms.

  • · Manages the state (start/stop) of analysis per camera.

  • · Connects to: Database, Object Storage, Event Server (to notify the client) and Email Server.

• • DATABASE (Relational/Document):

  • · Stores structured data: Users, Organisations, Camera/Stream/Zone configuration, Event History, Sessions.

• • OBJECT STORAGE (Files):

  • · Stores unstructured data: Event images, user avatars, generated reports.

Safe is deployed on Linux systems using Docker Compose, which facilitates portability and consistency across environments, and natively on Windows.

To ensure service stability, Safe's development follows a lifecycle (SDLC) with fully isolated runtime environments:

• • Development/Test Environment:

• Where new analytics or features are validated without affecting the live plant.

• • Production Environment:

• Configuration optimised for high availability and maximum hardware performance.

• • Network Isolation:

• on Linux, containers run on a private internal Docker network, exposing only the necessary services (80/443) through Traefik.

• • Access Management:

• Administrative access to the infrastructure is done via secure protocols such as SSH (port 22) with mandatory authentication.

• • Database (PostgreSQL):

• Stores camera configuration, users and historical alert records.

• • Object Storage:

• Acts as a local S3 repository to store video clips and evidence of security violations.

• • Continuity:

• In critical configurations, data replication is recommended to minimise the Recovery Point Objective (RPO) in the event of hardware failure.

For clients with multiple sites or departments, Safe guarantees total logical security where data is never mixed.

• • Unique Tenant ID:

• Each system entity (cameras, alerts, recordings and users) is irrevocably linked to a unique client identifier (Tenant ID).

• • Automatic Tenancy Filter:

• The system automatically applies a filter on every database query or file request; this ensures a user can only view or manage resources that strictly belong to their "tenant".

For delay-free camera viewing, Safe implements a viewer using MediaMTX. This component enables:

• • Ingestion:

• Receiving streams from IP cameras via RTSP or browser webcams.

• • Multi-format Output:

• Dynamic conversion to HLS or WebRTC, enabling smooth playback in any modern browser with low latency

In line with our transparency policy, we detail the third-party services used for auxiliary functions and their security certifications.

Note for Full On-Premise installations: In 100% local deployments, these services are replaced by the client's internal services to guarantee full data sovereignty.

For technical questions about hardware compatibility or custom quotes, contact us at:

• • Technical Support: support@safe.ai

• • Sales: commercial@safe.ai