Every privacy commitment falls into one of two categories, and the difference matters more than the wording.
A policy control says we will not do X. It depends on the current leadership continuing to mean it, on every employee understanding it, and on the company surviving the commercial moment when doing X would solve a problem. It is a promise.
An architectural control means the system cannot do X. It survives a change of leadership, an acquisition, a bad quarter and a persuasive customer, because changing it requires building something that does not exist.
Where in the pipeline decides everything
De-identification is usually described as though it were a single act. In practice, where it happens determines what it is worth.
Obscure faces and plates after footage is indexed and stored, and you have a filter on the output. The identifying material exists in the system. It can be accessed by anyone with sufficient privilege, produced under an order, exposed in a breach, or re-enabled by a future decision. The protection is a policy dressed as a technical measure.
Obscure them before indexing — ideally on the device, before anything leaves the vehicle — and the identifying material was never in the searchable record. There is nothing to access, produce, breach or re-enable. The protection is structural.
The question to ask any company in this category is not “do you de-identify.” It is “at which stage, and is the original recoverable.”
Ours runs on the device, before anything is uploaded. A multi-task neural network detects faces, pedestrians, licence plates and dashboards on the camera itself, and obscures them there. The identifying material does not travel to us and is not stored by us in the operational record.v
That is a materially different promise from the one the rest of this category makes. Every other major vehicle-camera platform we can find applies redaction in the cloud — at the point video is served to a customer, or when a clip is downloaded — which means the unredacted master exists on their systems by design. One states plainly that blurring is not retroactive, which tells you the stored original is untouched. Ours is a pipeline position, and a pipeline position is checkable.
The honesty problem
No detection system catches everything, and a privacy page claiming otherwise is describing a marketing position rather than an engineering one.
Extreme angles, low light, partial occlusion and motion blur all reduce detection rates. We set thresholds to over-obscure — accepting that we will blur things that were never faces, because that error is cheap and the other one is not. Miss rates are sampled and reviewed each release.
There is also a limit no detector addresses. Context can identify a person with no face and no plate in frame: an unusual vehicle, a specific address, a specific time. The control for that is not better detection. It is the absence of a person-level index, the absence of journey reconstruction across events, and reduced location precision in aggregate outputs — three architectural decisions, not three promises.
What this costs
Edge processing is more expensive than cloud processing. Destructive obscuring means you cannot go back and recover something you later wish you had. Over-obscuring degrades some material we would have found useful. Refusing a person-level index closes product directions that customers ask for.
All of that is the price, and it is worth naming because the alternative — keeping the capability and governing its use carefully — is genuinely cheaper and genuinely more flexible. It is also the approach that has failed repeatedly in this category, always for the same reason: the capability outlived the care.
The test we would apply to anyone
If a company’s privacy protection could be reversed by a single executive decision, an acquisition, or a sufficiently large customer, it is a policy. That is not worthless — policies constrain behaviour and create liability. But it should be read as an intention rather than a guarantee, and described that way.
Ask where in the pipeline it happens, whether the original is recoverable, and what would have to be built to undo it. The answers tell you which kind of commitment you are looking at.