How the security model is built.
This reference gives IT, security, and procurement teams a row-level view of the planned architecture and the controls already implemented. Each control has a stable reference and a current status.
Four requests: the page, two fonts, one icon. The only script is a few hundred bytes that remembers whether you chose dark, and it fetches nothing. Check both in your own network tab.
Quote a row by its reference. C-04 means the same row next year as it does today. If a control changes, the reference stays and the row says what changed. A clause you pasted into a contract can't quietly come to mean something else.
Process observations at the roadside.
The pylon processes sensor input near the road and creates structured observations. Any retained imagery is governed separately by defined purpose, access, and retention terms.
| E-01 | What is up there | The production sensor, power, and communication configuration will be set after field validation and site review. |
| E-02 | What the computer does | It processes sensor input near the road and creates structured observations. Any retained imagery follows separate purpose, access, and retention terms. |
| E-03 | What leaves the pole | Structured observations, coverage, health, and time references may leave the unit. Any transfer of imagery follows separately defined terms. |
| E-04 | The rolling buffer | If a site uses a rolling imagery buffer, its purpose, access, transfer, and retention window are set in the site terms. The public site does not state one universal duration. |
| E-05 | When the power dies | A power loss stops observation. Coverage records mark the affected period so it is not treated as observed traffic. |
Each data type follows a named retention clock. Contract terms set the duration and the event that ends access or storage.
| Ref | The clock | What it holds | What ends it |
|---|---|---|---|
| T-01 | The buffer on the pole | The raw recording, on one unit | It writes over itself. Nothing extends it and nothing shortens it. |
| T-02 | A live session | Nothing. It is a view, not a store. | Closing the incident, or the ceiling, whichever comes first. |
| T-03 | Your history window | Counts, and the numbers worked out from them | Your plan. The window moves forward with the calendar. |
| T-04 | The public log | Who asked, what for, and what we handed over | Nothing. It is the record. Taking a line out of it would defeat the point of having it. |
Four questions, asked in one place.
Every screen and every action runs the same four questions, and they are never the same word. A row a customer can't have is drawn from the same table as a row they can. So a support view and a customer portal can't disagree about their own account.
| I-01 | Does this kind of customer have it at all | The product type sets which functions can appear. A function outside that product is not shown. |
| I-02 | Did this organization buy it | The organization contract sets which purchased functions are available to its seats. |
| I-03 | Was this seat given it | The owner decides. Roles add up, and one person can hold several. An auditor seat can't also be an owner seat on the same organization. |
| I-04 | And if not, which one failed | A refusal names whether the product, organization contract, seat role, legal rule, or measurement state caused it. |
A prototype is built and validation comes next. Some controls are implemented in the current software; others require a running service, an outside test, or an audit. Each row states which applies.
| Ref | The control | Where we are | What it actually means |
|---|---|---|---|
| C-01 | One customer can't read another | In place | Every row carries its organization, and each query is narrowed to the signed-in seat's organization before it runs. Cross-organization lookup is not part of the customer interface. |
| C-02 | Access is a seat, not a person | In place | Roles and flags sit on the seat. The four questions in section 3 run in one place, on every screen and every action. A support view can't show a screen the customer doesn't have. |
| C-03 | An auditor can't audit themselves | In place | The auditor role cannot be combined with the owner role for the same organization. The application enforces that separation of duties. |
| C-04 | Two people to release anything | In place | A release under legal process needs two Forge Core approvals and appears in the public log. One person cannot approve both steps. |
| C-05 | A reason travels with the session | In place | A live session opens against an incident and carries a purpose that limits what the session can reach. |
| C-06 | Access expires on its own | In place | A session ends when the incident closes or reaches the ceiling in T-02. |
| C-07 | Encrypted in transit and at rest | In place | The build requires encrypted transport and encrypted storage volumes. Field validation and production review will verify the deployed configuration. |
| C-08 | No secret reaches a browser | In place | The gate on the investor pages runs on the server and its password lives in AWS Secrets Manager. A gate written in browser script ships the password to the visitor along with the thing it was hiding. |
| C-09 | A second factor on every staff account | True, not written | True today on the cloud accounts and the code host. There is no signed policy saying it must stay true, and that document is the thing an auditor asks for rather than the fact. |
| C-10 | A written incident plan | Not yet | Section 7 is the planned response sequence. The plan has not been approved or rehearsed, so this control remains not yet in place. |
| C-11 | An outside test | Not yet | No independent penetration test has been completed. This register is a company control statement rather than an external audit. |
| C-12 | A SOC 2 report | Not yet | A SOC 2 report requires operating evidence over time. The compliance page lists the work that comes before this step. |
| S-01 | Who "we" is | Two people. Andrew answers for every word on this site, and a reply to any address here reaches him. |
| S-02 | What we see without asking | The estate: which units are up, which are down, which corner has nothing on it. Not a customer's answers, and not their questions. |
| S-03 | Helping a customer with a screen | The support view uses the same access table as the customer portal, so it cannot show a function the customer account does not have. |
| S-04 | Reading a customer's own data | Staff must record a reason first, and the access appears in the customer's log. |
| S-05 | Handing anything outside | Two approvals are required and the decision is published. See C-04. The same release process applies to every outside request. |
These rules define product and access behavior. Changes require the same review and release process as other controlled product changes.
X-01
Temporary track correspondence
A temporary object number can connect observations while the system maintains a continuous view. Road Sentinel does not read plates or recognize faces, and its structured record has no name or identity index. Separate imagery may still show a person or vehicle and follows its own terms.
X-02
No sharing between agencies
Each customer sees its own authorized incidents and records. The customer interface does not include a cross-organization lookup.
X-03
Access runs out on its own
Live access starts with an incident and ends when the incident closes or after four hours. That access ceiling is separate from data retention. Each session carries its purpose and is logged.
X-04
The reason limits what the session can be used for
The recorded incident purpose limits which functions and records the session can reach.
X-05
The usage log is open to anyone
The public log reports request purpose, outcome, and any refusal. It does not publish customer data or imagery.
| R-01 | The first hour | Post a dated public notice stating what is known and what is still being checked. |
| R-02 | The same day | Contain the affected function, including taking it offline when needed. |
| R-03 | Three working days | Notify affected customers and required authorities based on the incident and applicable law. |
| R-04 | Two weeks | Publish what happened, what we got wrong, and what changed because of it. It goes in the public log with everything else. |
| R-05 | The honest part | This sequence has not been rehearsed. C-10 remains "not yet" until the plan is approved and tested. |
Evidence status
No outside audit or penetration test has been completed. Section 4 identifies implemented controls and planned controls. Ask for written evidence for any row that matters to a contract.