An open campus. A halls building. The same posture.

UK higher education runs the hardest CCTV problem in the country — a public-access footprint with private-residential buildings glued into the middle of it. Embedding-only ReID lets Estates give the Security director cross-camera reach (lab door, library exit, halls lift) without ever naming a student. Athena Swan reads that as protective. PSED reads that as compliant. The DPO reads that as defensible.

§ NAMED PAINS

What the Estates Director tells us first.

01

An open campus is a public space pretending to be private

Russell Group estates are crossed by 60,000 people a day across hundreds of buildings, with halls of residence interleaved with public-access libraries and lecture theatres. The Estates team is asked to provide a private-residential safety posture on an open-campus footprint, with one CCTV control room.
02

Lab-door tail-gating is the security director's recurring nightmare

Postgrad labs, BSL-2 wet-labs, gene-edit facilities — every Russell Group security director on our calls names tail-gating at controlled doors as the single hardest investigation. Today: an hour of footage review, three cameras, and a half-confident answer. With ReID, cross-camera reach surfaces the second-person event the moment it happens.
03

Athena Swan and PSED aren't a bias review — they're a duty

Athena Swan signals an institutional duty of care across gender; PSED extends it across protected characteristics. Both make biometric surveillance over a student population an Equality Impact Assessment minefield. Embedding-only ReID lets Estates document a posture that does not categorise students at all — vector similarity has no protected class.

Pain 01

Public footprint, private buildings, one CCTV control room.

What we see

Cross-camera traces inside the halls of residence and across the library and lecture-theatre cluster, with the public-access campus footprint scoped explicitly per Estates' configuration. The control room sees thumbnail strips when configured rules match.

What we don’t see

Student names — no link to the student records system.
Card-swipe data — that's in the access-control system, not the camera stack.
Faces — embedding-only.
Public visitors outside the configured campus footprint — public-realm cameras at the campus edge are out of scope or scoped down.

What concierge does

Estates configures the rule set with the Security director — typically halls-after-hours, lab-door tail-gate, library-exit-with-unreturned-item.
Control room receives matched-pattern thumbnail strips with the matching rule labelled.
Operator clears, dispatches campus security, or escalates per Estates' policy.
Quarterly Estates + Security review tunes rules and reviews false-positive rate.

Data lifecycle

Raw video sits in a 72-hour ring buffer on the on-prem edge appliance, then auto-overwrites — we never copy frames off the site. Embeddings (the abstract vectors the system actually compares) live for 30 days in the UK-resident database. Event records (a timestamp + a camera ID + a similarity score) live for 90 days for investigation continuity, then auto-purge. None of the three layers contain a face image, a name, or an ID document.

Legal posture

UK GDPR Art 6(1)(f), balanced against the institution's safeguarding duty under Athena Swan and the Public Sector Equality Duty (PSED). Embedding-only ReID processes no Schedule 1 special category — vector similarity has no protected-class signal — so the EIA reads as continuous with the existing CCTV one rather than as new biometric processing. ICO ZA-class registration. DSPT v8 self-assessment shared with the institutional DPO.

Procurement Q&A

What does the EIA need to address?: Standard PSED Equality Impact Assessment scoping: protected characteristics, mitigation, monitoring. Embedding-only ReID materially helps the EIA because the system processes no protected-class signal — there is no race signal, no sex signal, no age signal in body-shape + clothing-colour vectors. We share the EIA template our pilot institutions used.
How does this read against the OfS regulatory framework?: Office for Students focus is student safeguarding + value. The ReID posture supports safeguarding (faster cross-camera reach for incidents in halls + open campus) without creating an OfS-relevant biometric category. We are not in the OfS biometrics-of-students conversation.
What about the Students' Union vote on surveillance?: Same playbook as the residents' association in BTR: SU sabbatical officers + the student DPO read the DPIA addendum + legal opinion before the institutional Senate decision. Three Russell Group institutions we're in conversation with have done this; the SU posture has been 'we like that you're not running facial recognition'.

Pain 02

Postgrad lab door, 03:12, two embeddings through one badge swipe.

What we see

A badge-swipe event at the lab door at 03:12, plus two distinct body-shape embeddings entering through that door in the same 4-second window. A 2-thumbnail strip, the matching access-control event ID, and a configurable escalation.

What we don’t see

Which student or staff member held the badge — that's in the access-control system, joined by the operator manually post-flag.
Faces — embedding-only.
What was done inside the lab — the system observes the door, not the lab interior.
Inferred motive — we surface the pattern; the institutional review handles intent.

What concierge does

Access-control system fires a swipe event; the camera stack flags the second-embedding match.
Control room receives the strip + the access-control event ID within seconds.
Operator escalates per Estates' lab-door policy (typical: PI notified, Estates Security dispatched, badge-holder asked for context).
Post-incident the badge-holder + the second embedding are reviewed by the lab manager; outcome logged.

Data lifecycle

Legal posture

UK GDPR Art 6(1)(f) — legitimate interest in lab biosecurity, balanced against members of the university community in a controlled-access setting where the access-control posture is itself the consent surface. ICO ZA-class registration. PSED EIA continuous with the existing one. DSPT v8 self-assessment shared with the institutional DPO before deployment.

Procurement Q&A

What about BSL-2 / gene-edit lab oversight?: The HSE biosecurity framework treats controlled-access doors as the primary safeguard; ReID strengthens that safeguard by making tail-gates surface in real time rather than after a 90-minute footage review. The institutional Biological Safety Officer is in our deployment conversation from day one.
How fast is the alert?: Seconds — the access-control + camera-stack join runs at the edge appliance. The operator's time-to-decision is the bottleneck, not the system's time-to-flag.
What's the false-positive rate look like on lab doors?: Lab doors are forgiving — two-person entries are operationally rare and pattern-matched well by the embedding. In pilot, the false-positive rate (genuine two-person entry by joint badge-holders, e.g. PhD + supervisor) is order-of-1%, and the operator clears those quickly with the access-control join.

Pain 03

The EIA an Athena Swan submission can rest on.

What we see

Embeddings — body-shape and clothing-colour. Categorically not faces, not biometric templates, not anything an EIA-reviewer would call a protected-class signal.

What we don’t see

Protected characteristics — vector similarity has no race signal, no sex signal, no age signal, no disability signal.
Behavioural inferences — no mood detection, no aggression scoring, no anomaly scoring.
Categorisation of students — the system observes movement, not identity or category.

What concierge does

Estates + DPO + Athena Swan SAT (Self-Assessment Team) chair walk the DPIA addendum + EIA template + legal opinion together before procurement.
EIA submission includes the embeddings-vs-biometric distinction and the categorical non-processing of protected characteristics.
Athena Swan submission cycle treats the deployment as continuous with the existing CCTV one, not as a new biometric workload.
Annual review: false-positive rate monitored across halls vs library vs lab populations to confirm no differential impact emerges (we have not observed one in pilot).

Data lifecycle

Legal posture

UK GDPR Art 6(1)(f). The EIA is the load-bearing instrument — embedding-only ReID processes no Schedule 1 special category, has no protected-class signal in the underlying vector, and treats the deployment as continuous with the institution's existing CCTV processing. ICO ZA-class. DSPT v8 self-assessment shared institutionally.

Procurement Q&A

What does the Athena Swan SAT need from us?: The DPIA addendum, the EIA template, the legal opinion, and a deployment-window false-positive-rate report we generate quarterly. The SAT chair we worked with on the pilot read all of it in an afternoon.
How does this read against the Higher Education Code of Governance?: HE Code emphasises proportionality, transparency and student voice. Embedding-only ReID is proportionate (no biometric escalation), transparent (DPIA addendum + transparency note), and pairs with an explicit SU engagement before deployment.
What about the comparator question — why this and not AFR?: Comparator is in the EIA: facial recognition is Article 9 special category processing under UK GDPR; embedding ReID is not. The Article 9 escalation triggers explicit-consent or substantial-public-interest tests neither of which a UK university can comfortably defend for routine campus CCTV. The middle posture is what we deploy.

§ ICO POSTURE FOR HIGHER EDUCATION

Students are data subjects with a safety expectation.

The defensible reading of UK GDPR Art 6(1)(f) in a halls building is that an 18-year-old paying £9,535 a year has a reasonable expectation of safety and a reasonable expectation of not being surveilled. Embedding-only ReID is the only posture that honours both. There is no face image. There is no name. There is a 14-day-lived vector.

For Russell Group institutions running Athena Swan and the PSED Equality Impact Assessment, the relevant test is categorical: facial recognition processes a protected characteristic (race signal, sex signal, age signal). Vector ReID processes none — by construction, body-shape and clothing-colour embeddings carry no protected-class signal that the system can act on.

Read the rest of the stack.

How it works → See the demo → The UK posture → Pricing →