Most sensitive. Default: stay out of the business system. Match on the device when you can; no raw image in the cloud. If you must keep evidence: short retain, encrypt, a separate store, rights split from HR attendance.
Face at the door does not mean every face and trail must sit forever in the business store. People rarely object to “face to enter.” They object to not knowing where the picture lives, who can export it, and whether it stays after exit. DaXi Technology writes privacy as layers—not “we encrypt.”
Used to recognize, not a photo. Still biometric. If a vendor cloud forces template upload, write ownership, destroy and whether it can stay local.
Who, when, which door, which vehicle. This is the layer tickets and attendance actually need. Retain by role and law; expire into mask or delete.
“Someone exported March access logs.” You audit the act, not copy the trail again. Admin acts must leave a trail.
Usually enough for the business
Late events, visitor overtime, zone-breach alerts, role-bound rights changes.
Late events, visitor overtime, zone-breach alerts, role-bound rights changes.
Do not default into the business store
Gallery photos, live video, high-res trail replay, reversible feature plaintext.
Gallery photos, live video, high-res trail replay, reversible feature plaintext.
Cameras only, faces as decoration: no ticket loop, a pile of sensitive media—highest risk: Cameras without work orders are not software. If access joins HR, exit must kill the gallery in the same act: Access control tied to HR: access dies when employment does. How park access joins the org: How park gates and parking connect to HR.
Notice, least needed, destroyable—must be acceptably testable, not a poster
Before go-live you should answer four lines: what you collect, what it is for, how long you keep it, how an employee appeals. A complaint path must actually change retention—not a poster. Visitors and contractors need an expiring gallery that auto-clears. If a trail is only for security replay, keep it out of MES and payroll. Safety wants missed-check and violation handling records, not necessarily a face: What device records must prove in a safety audit.
On the exit day, gallery, card, plate and visitor-invite rights should close in one transaction. Close in three steps and one is forgotten. If an integrator wants “export the full gallery for test,” write scope and a destroy date. Test data on a personal PC is the hole you never close. A wall that scrolls live face grabs is over-display; visits and off-net screenshots raise risk. Boards can show event counts. Cross-border or multi-park: write which cloud holds templates. A hire at park A should not default-sync everywhere.
If a third-party security cloud insists on raw images, write a short retain and the audit-export scope—or do not mirror it in the business system. DaXi Technology will not default-deliver “all video into a data platform.” The plan names retain per layer, who can see, and how exit and visitors destroy. To assess face access you have, go to Hardware-Software Integration and say whether HR is already joined, and whether the gallery sits on the device or a vendor cloud.