Read the video transcript
Sensitive data now moves between systems, sites and partners. Protecting the network no longer protects the data.
How it fits together: ByteHarbour Edge protects data where it is created, at a camera, a sensor or a file. ByteHarbour holds the protected data and releases it. HarbourGuard decides who may have it, by policy. Consilium is the operator's view of devices, feeds and alerts. Every decision is recorded.
Step 1, protected from the moment it is created. A new camera switches on and asks to join. It is refused until someone approves it.
An operator approves the device. Nothing joins on trust alone.
The operator puts the feed under Perimeter CCTV, an access policy defined once in HarbourGuard. The same policy covers the site's perimeter cameras: one rule for them all.
Footage leaves the camera already encrypted. Anyone intercepting it gets nothing usable.
Step 2, released only to the right people. Two people, one live feed. Left: cleared to SECRET. Right: cleared to CONFIDENTIAL. Perimeter CCTV is CONFIDENTIAL, so both can watch. Each is re-checked every few seconds.
A security manager raises Perimeter CCTV to SECRET, in HarbourGuard, in one place. Saved. Nobody touches either screen.
Within seconds the analyst's feed is cut off. The SECRET-cleared operator keeps watching.
Perimeter CCTV is set back to CONFIDENTIAL. The analyst opens the feed again, and it plays. No new accounts, no reconfiguration.
Step 3, proof built in. Every decision is recorded: who asked, for what, and the outcome, including every re-check. The record is chained: alter any entry and verification shows it.
Three products. Use one, or all three. Each works alongside the systems customers already have. Protect the data. Control the access. Prove it.
Recorded on Espanaro's working software. The camera is a stock video streamed through the live system.
Why streams are harder than documents
A document is protected once and opened occasionally. A live feed is a continuous flow of data that people watch for hours, often at different clearances, while the situation and the policy can change at any moment. Protecting it means encrypting at source without adding unusable latency, deciding access per viewer rather than per network, and acting on policy changes while the stream is playing.
How it works
- Nothing joins on trustA new camera or sensor is held until an operator approves it. Its feed is registered as a protected stream bound to that device's identity.
- Encrypted where it is createdFootage leaves the device already encrypted. Anyone intercepting it on any network gets nothing usable.
- One policy, many feedsA feed is placed under a named access policy, defined once in HarbourGuard, that can cover a whole group of cameras.
- Per-viewer releaseEach viewer is checked against the stream's classification, releasability and need to know before it opens, and re-checked every few seconds while watching.
- Change policy, not screensRaise or lower a policy in one place and access changes within seconds. No new accounts, no reconfiguration.
- Proof built inEvery request, decision and re-check is recorded in a chained, tamper-evident log.
Two clearances, one feed
In the demonstration, an operator cleared to SECRET and an analyst cleared to CONFIDENTIAL watch the same perimeter camera. While the feed is CONFIDENTIAL both can see it. A security manager raises it to SECRET in HarbourGuard; within seconds the analyst's view is cut off while the operator keeps watching. Set it back, and the analyst's feed plays again.
Secure streams from the edge
Where it matters
- Sharing ISR and counter-drone camera feeds with coalition partners at the right releasability
- Perimeter and critical-site CCTV viewed by staff and contractors with different vetting
- Sensor feeds pushed to the tactical edge over constrained or untrusted bearers
- Targeting workflows where a feed's classification can change during an operation
Status
Espanaro has achieved data-centric security Level 3 (DCS-3) for document and live stream sharing, demonstrated at NATO EFDI Accelerator 2.0 in September 2026. This is Espanaro's own assessment against the ACP 240 maturity levels; it has not been independently certified.
Common questions
Can data-centric security protect live video, not just files?
Yes. Espanaro applies DCS Level 3 to live camera and sensor streams. Footage is encrypted at the device, each viewer is checked before the stream opens and re-checked every few seconds, and a policy change takes effect within seconds without touching any screen.
Does encrypting a live stream make it unusable?
No. In the demonstration the protected feed plays normally for authorised viewers, while each viewer is re-checked every few seconds, so access can change within seconds and the video stays usable.
Do we need new hardware?
No. Espanaro's DCS capability is software and is system and hardware agnostic. It runs on-premises, in private cloud, in hybrid environments and at the edge, and connects to existing systems through open interfaces.