We do the watching. You do the deciding.

Regional theatres, mid-market music venues, conference centres in the 1,000–5,000 capacity band. The cohort where the head-of-security is one human plus one assistant, the door team already knows the regulars, and a real-time cross-camera trace is the gap between what their job requires and what their bandwidth allows.

§ NAMED PAINS

What the head-of-security tells us first.

01

Two-person security across 12 cameras

Most 1,000–5,000 cap UK venues run a head-of-security plus one. They cover the foyer, the auditorium, the green room corridor, the loading bay and the smoking area. Watching screens isn't the problem — the problem is investigating who entered through which door 90 minutes ago.
02

Door staff already know the regulars

Theatre door teams in regional venues, music-venue door staff in Manchester and Edinburgh — they already pattern-match faces in their heads. The job we automate is the part their heads can't do: cross-camera tracking across a 5,000-seat building in real time.
03

The 'who was that ejected guest' investigation

Pre-show ejection at 19:30. Same person seen at the stage door at 20:45. Today: 75 minutes of footage review across four cameras. With ReID: the system flags the match the moment the second camera sees the same vector.

Pain 01

Head-of-security plus one. Twelve cameras. One person worth of reach.

What we see

Cross-camera traces across the foyer, the auditorium, the green-room corridor, the loading bay and the smoking area. The head-of-security sees a 3-thumbnail strip when a pattern matches, not a 12-feed video wall.

What we don’t see

Ticketed-guest names — the system has no link to the ticketing platform.
Faces — no face image extracted, stored or compared.
Performer or staff routine movement — those embeddings are excluded from cross-camera alerting during their working window.
Anything outside the camera footprint — load-out routes that pass off-site are out of scope.

What concierge does

The head-of-security configures three to five standing rules during onboarding (typical: ejected-guest re-entry, loading-bay after-hours, smoking-area-to-foyer pattern, green-room-corridor unticketed access).
Door staff continue their normal job (visual identification of regulars, ejected guests, refused entries).
When a rule matches, the head-of-security gets the 3-thumbnail strip and decides — confirm with the door team, dispatch the assistant, or escalate to police.
Post-show review: the morning meeting walks through the night's matches and tunes the rules.

Data lifecycle

Raw video sits in a 72-hour ring buffer on the on-prem edge appliance, then auto-overwrites — we never copy frames off the site. Embeddings (the abstract vectors the system actually compares) live for 30 days in the UK-resident database. Event records (a timestamp + a camera ID + a similarity score) live for 90 days for investigation continuity, then auto-purge. None of the three layers contain a face image, a name, or an ID document.

Legal posture

UK GDPR Art 6(1)(f) — legitimate interest in venue safety, balanced against ticketed guests with reasonable safety expectations. Ticketing creates a clean consent layer at point of sale. ICO ZA-class registration; embedding-only ReID treated as continuous with the existing CCTV DPIA. DSPT v8 self-assessment available to the customer's DPO.

Procurement Q&A

Does this conflict with our door team's SIA judgement?: No — it extends it. The door team has the judgement (who's a regular, who's been refused before, who looks wrong). They don't have the reach (where did that person go in a 5,000-seat building). The system adds the reach; the judgement stays where it belongs.
What about ticketed-guest privacy expectations?: The privacy notice at point of sale already names CCTV — the guest consents to a clearly defined surveillance posture at the moment of purchase. Embedding-only ReID sits inside that surface without expanding it into biometric processing. We share the DPIA addendum.
Does this catch fights before they happen?: No — we're not in the behavioural-prediction business. The system catches movement patterns (same person at three cameras, in a sequence that matches a configured rule). The decision to act is the head-of-security's, and the action follows the venue's existing incident-response policy.

Pain 02

The door team knows the regulars. The system knows the cross-camera reach.

What we see

Pattern matches across the building, surfaced to the head-of-security as a thumbnail strip. The door team's visual-identification judgement is untouched and unrecorded.

What we don’t see

Door-staff visual identifications — those are in the staff's heads, not in our database.
Ban lists — we do not maintain a face-recognition ban list; ejected-guest re-entry is matched on the embedding from that night's ejection, in the same 30-day window.
Anything that resembles a watchlist — the only 'list' is configured rules expressed in camera + time + pattern terms.

What concierge does

Pre-show: the head-of-security reviews the configured rules with the door team during briefing.
Show-time: door staff handle door; the system handles cross-camera reach.
Match: head-of-security gets the strip, walks the radio to the door team if confirmation is needed.
Post-show: morning meeting walks the rules; ejected-guest embeddings older than 30 days auto-purge.

Data lifecycle

Legal posture

UK GDPR Art 6(1)(f) — legitimate interest in venue safety, with the ticketing-consent layer at point of sale. Ejected-guest re-entry matching is a defensible specific-incident processing (not a general watchlist) bounded by the 30-day embedding window. ICO ZA-class registration. DSPT v8 self-assessment available.

Procurement Q&A

Are you running facial recognition by another name?: No — we are not. Embedding-only ReID compares body-shape + clothing vectors, which have no protected-class signal the system can act on, and which a person cannot be re-identified from outside the camera stack. We have written legal opinion on this and share it with the DPO before contract.
What about the AFR cases the ICO has acted on?: Facewatch, Serco — both are facial-recognition cases. The ICO's concerns were specific to facial-recognition processing (Article 9 special-category data). Embedding ReID is in a different regulatory category; we share the legal opinion mapping our posture to the ICO's published guidance.
What happens if a banned guest's solicitor calls?: The ejected-guest re-entry rule is bounded by the embedding window (30 days) and the configured incident. After 30 days, the embedding auto-purges and the matching evaporates; the door team's visual recognition of the guest is, as it always has been, not our system.

Pain 03

Ejection at 19:30. Stage-door return at 20:45. We surface the match.

What we see

The embedding from the 19:30 ejection (front-of-house camera) surfacing again at 20:45 on the stage-door camera. A 2-thumbnail strip, two timestamps, one similarity score.

What we don’t see

Who the ejected guest is — no name, no ticket linkage, no face image.
Why they were ejected — that's in the door-team's report, not the camera stack.
Anything before 19:30 or after the trace ends — the embedding scopes to the night and the configured window.

What concierge does

Door team ejects guest at 19:30; head-of-security tags the front-of-house clip with 'ejected, 30-day matching' (one click).
Stage-door camera fires the match at 20:45 — head-of-security gets the thumbnail strip immediately.
Head-of-security walks the strip to the stage-door team; door team confirms identity by sight; police are called if the venue's policy escalates re-entry to a criminal matter.
If the embedding window expires before any further match, the tag auto-purges and the matching stops.

Data lifecycle

Legal posture

UK GDPR Art 6(1)(f), with a specific-incident processing posture for the ejected-guest matching (not a general watchlist). 30-day embedding window for the tagged incident. ICO ZA-class registration. DSPT v8 self-assessment.

Procurement Q&A

How is this different from a watchlist?: Watchlists persist across visits and incidents and tend to grow. Specific-incident matching is bounded by the embedding window (30 days) and the specific event. After the window, the matching evaporates; there is no carried-forward record of the guest in the system.
What if the ejection was a mistake?: The head-of-security can clear the tag in one click; the match queue purges. The door team's report of the original ejection is on the venue's normal complaints process, not ours.
Does this scale to a tour where the same guest gets ejected at three venues?: No — and deliberately. The 30-day window is per-venue, not network-wide. We do not ship cross-venue matching and would not without a separate DPIA + DPA covering the network and the data sharing involved. The locally-bounded posture is the one that survives a DPO review.

§ ICO POSTURE FOR VENUES

Ticketed venues, ticketed expectations.

Ticketing creates a clear consent layer at the point of sale — the moment a venue can say "CCTV is in operation" in a privacy notice the guest opts into. ReID via embeddings sits cleanly inside that consent surface without expanding it into biometric processing.

Where this matters most: SIA-licensed door staff already visually identify regulars and ejected guests. We're not replacing that judgement — we're giving them the cross- camera reach their two-person team doesn't have, in a posture that survives a DPIA.

Read the rest of the stack.

How it works → The UK posture → Pricing →