Who sees what, who did what, and how you prove it afterwards

A permission is not one big switch. IRIS splits 315 permissions across 66 modules, granted or withdrawn one at a time: you decide who sees which camera, who exports video and who can do nothing but watch. Eight profiles come ready made — administrator, operator, auditor, supervisor, technician and a few more — and anyone who needs a different one duplicates it and trims it, without limit. Above the permission sits the scope: which site, which camera, which case, with an expiry date and a warning a week before it runs out. And one rule is printed on the screen itself: if a group denies something, that denial always wins, even when the profile grants it. That is what lets you hand out a broad profile and trim it for one team without inventing a new one.

The audit log only accepts additions: once written, it is not touched. That is not a promise made by the software, it is a rule of the data store itself, which refuses any attempt to change or delete an entry by hand, no matter who tries. Each entry keeps 27 details — who, what, on what, from which address, how it looked before and how it looked after — and is tied to the previous one by a fingerprint. In a working installation that adds up to 489 distinct actions on record: sign-ins and sign-outs, permission changes, a recording opened, a camera moved, exports, configuration changes. One button walks the whole chain and answers whether it is intact, or at which entry and on which date it broke. The log is also sealed period by period, so that two years from now today's state can still be checked.

Personal data is handled by type, not in one lump. Each table carries its own term with the legal basis written beside it, and a nightly pass applies them on its own and leaves a trace of what it deleted; before arming it you can run a dry run, which deletes nothing and shows what would go. The seven requests a person can file — access, rectification, erasure and the rest — each have their screen, their deadline and their warning as that deadline nears, and any user files their own from their profile. A data breach opens with its 72-hour clock in plain view, and the dashboard flags the ones that have run past it. Private areas of a camera are black for everyone, and revealing them takes a written reason, a second person to approve it and a limited window. Biometric data has its own term, separate from video, and the screen states in writing that extending it increases legal exposure, instead of letting it stretch with nobody saying a word.

Compliance is kept as a list, not as a speech. There are the 79 controls of the Spanish national security framework at its high level and the 93 controls of annex A of ISO 27001, each with its status, its evidence, the date of the last review and who carried it out; the two frameworks are cross-referenced, so a single statement of applicability answers both audits. There is also a register of the artificial intelligence systems in use and a queue where a person reviews the machine's decisions and confirms, overrides or escalates them. And it is worth saying what this is not: IRIS is designed to help you meet those frameworks, but it is not certified or approved under any of them. It is the organisation running the system that gets certified, with its own processes and premises; what the product supplies is the evidence to get there. The one third-party approval we do hold is for people counting, granted by the Spanish Centre for Metrology.

The breakdown that costs money is the one you discover on the day you need the video. So there is a panel that sorts every camera — connecting, no image, switched off on purpose, not measured, not being watched — and says how long it has been like that, how many outages it has had in the last 24 hours and the last seven days, and how long the worst one lasted. Services and servers work the same way: when something fails you do not get a red icon, you get the reason written out, and that reason tells apart it is not running, it has gone hours without refreshing, it answers but produces nothing, and it was switched off on purpose. There is also a diagnostic that hunts the silent faults, the ones that never raise an error: two services fighting over the same port, a database change never applied, a watchdog that has stopped. And one decision says a lot about the product: when something has not been measured, the screen does not paint it green. No faults found is not the same as could not be checked, and here the two are told apart.

All the configuration lives inside the system and is handled from the browser: 1,524 values across 44 services — cameras, storage, network, retention, languages and time zones — with not one file to edit and no server to log into. Every change records who made it and when, and every setting is documented inside the platform itself: what it governs, in which unit, what its default is and what happens if you set it to zero, which does not always mean unlimited. The certificate inventory is cut from the same cloth: it lists them all, warns about the ones about to expire and raises two warnings on its own that almost nobody prints in a brochure: that the system is being served with the factory certificate, the same one in every installation, and that some of the machine's addresses appear in no certificate at all. Renewing one asks for the administrator's password again, because having a session open is not enough to replace a certificate, and a copy of what was there is kept before anything is touched. Small details, and exactly the ones you miss six months in.