Who sees what, who did what, and how you prove it afterward

A permission isn’t one big switch. IRIS splits 315 permissions across 66 modules, granted or withdrawn one at a time: you decide who sees which camera, who exports video and who can do nothing but watch. Eight profiles come ready made — administrator, operator, auditor, supervisor, technician and a few more — and anyone who needs a different one duplicates it and trims it, without limit. Above the permission sits the scope: which site, which camera, which case, with an expiry date and a warning a week before it runs out. And one rule is printed on the screen itself: if a group denies something, that denial always wins, even when the profile grants it. That’s what lets you hand out a broad profile and trim it for one team without inventing a new one.

The audit log only accepts additions: once written, it isn’t touched. That isn’t a promise made by the software, it’s a rule of the data store itself, which refuses any attempt to change or delete an entry by hand, no matter who tries. Each entry keeps 27 details — who, what, on what, from which address, how it looked before and how it looked after — and is tied to the previous one by a fingerprint. In a working installation that adds up to 489 distinct actions on record: sign-ins and sign-outs, permission changes, a recording opened, a camera moved, exports, configuration changes. One button walks the whole chain and answers whether it’s intact, or at which entry and on which date it broke. The log is also sealed period by period, so that two years from now today’s state can still be checked.

Personal data is handled by type, not in one lump. Each table carries its own term with the legal basis written beside it, and a nightly pass applies them on its own and leaves a trace of what it deleted; before arming it you can run a dry run, which deletes nothing and shows what would go. The seven requests a person can file — access, rectification, erasure and the rest — each have their screen, their deadline and their warning as that deadline nears, and any user files their own from their profile. A data breach opens with its 72-hour clock in plain view, and the dashboard flags the ones that have run past it. Private areas of a camera are black for everyone, and revealing them takes a written reason, a second person to approve it and a limited window. Biometric data has its own term, separate from video, and the screen states in writing that extending it increases legal exposure, instead of letting it stretch with nobody saying a word.

Compliance is kept as a list, not as a speech. There are the 79 controls of the Spanish national security framework at its high level and the 93 controls of annex A of ISO 27001, each with its status, its evidence, the date of the last review and who carried it out; the two frameworks are cross-referenced, so a single statement of applicability answers both audits. There’s also a register of the artificial intelligence systems in use and a line where a person reviews the machine’s decisions and confirms, overrides or escalates them. And it’s worth saying what this isn’t: IRIS is designed to help you meet those frameworks, but it isn’t certified or approved under any of them. It’s the organization running the system that gets certified, with its own processes and premises; what the product supplies is the evidence to get there. The one third-party approval we do hold is for people counting, granted by the Centro Español de Metrología, Spain’s national metrology institute. The approval is Spanish. It doesn’t stand in for a U.S. certification, and we don’t present it as one.

The breakdown that costs money is the one you discover the day you need the video. So there’s a panel that sorts every camera — connecting, no image, turned off on purpose, not measured, not being watched — and says how long it’s been like that, how many outages it has had in the last 24 hours and the last seven days, and how long the worst one lasted. Services and servers work the same way: when something fails you don’t get a red icon, you get the reason written out, and that reason tells apart it isn’t running, it has gone hours without refreshing, it answers but produces nothing, and it was turned off on purpose. There’s also a diagnostic that hunts the silent faults, the ones that never raise an error: two services fighting over the same port, a database change never applied, a watchdog that has stopped. And one decision says a lot about the product: when something hasn’t been measured, the screen doesn’t paint it green. No faults found isn’t the same as couldn’t be checked, and here the two are told apart.

All the configuration lives inside the system and is handled from the browser: 1,524 values across 44 services — cameras, storage, network, retention, languages and time zones — with not one file to edit and no server to log into. Every change records who made it and when, and every setting is documented inside the platform itself: what it governs, in which unit, what its default is and what happens if you set it to zero, which doesn’t always mean unlimited. The certificate inventory is cut from the same cloth: it lists them all, warns about the ones about to expire and raises two warnings on its own that almost nobody prints in a brochure: that the system is being served with the factory certificate, the same one in every installation, and that some of the machine’s addresses appear in no certificate at all. Renewing one asks for the administrator’s password again, because having a session open isn’t enough to replace a certificate, and a copy of what was there is kept before anything is touched. Small details, and exactly the ones you miss six months in.