Where your site videos go
A site-walk video can show people, buildings and security layouts. This page explains what happens to it and how we protect it.
The data flow
| Data | Where it is processed | Sent to the AI provider? | Kept for |
|---|---|---|---|
| Video and audio (may include voices, faces, site and security details) | Our servers. Speech is recognised by a model we run ourselves. | No | Deleted 30 days after the report is issued (default, adjustable per company) |
| Transcript text | Our servers | Yes, to be sorted into report lines, outside South Africa, under contract | With the assessment |
| Stills taken from the video for the report | Our servers | No, unless your company switches on the optional image check | With the report |
| Report PDF and lines | Our servers, then your ERP if connected | No | As your company decides |
In short: video and audio stay on our servers in South Africa. Only the transcript text goes to our AI provider overseas, under contract.
Safeguards
Speech recognition on our own servers
Your audio never goes to an outside transcription service.
Only text goes to the AI
The AI provider sees the transcript, never the video.
Hosted in South Africa
Storage and encrypted backups stay in the same region.
Separate keys for each company
We can destroy one company's data without touching anyone else's.
Automatic deletion
Raw video is deleted 30 days after the report is issued. You can delete a recording, and everything made from it, at any time.
Everything outbound is logged
Every call to the AI provider and every webhook: who, what and how much.
How access is controlled
Roles
Capturers see their own assessments. Reviewers see their company's. Admins run the team, the settings and deletion.
Companies kept apart
Every record and file belongs to one company, and that's checked on every request.
Connector keys
Each can be limited to one company.
No secrets in code
Keys and passwords are kept out of the codebase.
POPIA: who is responsible for what
Under POPIA your company is the responsible party for its site videos, because you decide why and how they're made. We are your operator. We process the videos only on your instructions, under a written agreement that covers security, how we tell you about a breach, and the other providers we use, including the AI provider.
People on site may be filmed or overheard, so let them know. The Android app has a notice step, and the recording guide tells techs to film equipment rather than people. For this website and your user accounts we are the responsible party, and the privacy notice applies.
We built SightWalk with POPIA in mind, but whether you comply depends on how you use it. That's why we don't call the product "POPIA compliant". For the same reason we don't say your data never leaves South Africa: the transcript text does. There's no service-level agreement unless it's written into your contract.
Report a security concern
Use the contact form and choose "Security review" as the topic. Please don't send videos or site photos by email or WhatsApp.
Need answers for your IT or security review?
We'll take your team through the data flow and the data-processing agreement.