HALLKEEPv1.0 · self-hosted
Technical architecture

Local, single-tenant, and built for the edge.

One appliance per site reads your existing cameras, runs detection on the LAN, and never ships footage to a third party by default.

Request a demoSee deployment

Capture layer

Pulls frames from existing cameras and NVRs over RTSP, HLS, or HTTP snapshot. Per-camera intervals. Credentials encrypted at rest.

RTSP · HLS · snapshot

Motion gate

Frame-diff, polygon-scoped per zone. Cuts inference cost and false positives before a model ever runs. Ignore masks drop screens, fans, and timestamp overlays.

frame-diff · polygon

Inference

Configurable detection models, sized to your events. Runs on the appliance — CPU, GPU, or Apple-silicon — never off-box.

on-appliance · CPU/GPU

SLA engine

Five-state lifecycle: DETECTED → CONFIRMED → WARNING → BREACH → resolved. Per-event thresholds drive promotion and escalation.

30s loop · per-event

Routing

Push, webhook, and messaging fan-out, shift-, floor-, and role-aware. Cross-zone cooldowns suppress repeats. Every send audit-logged with redacted secrets.

webhook · audit-logged

Storage

Events and snapshots persist on the appliance on a rolling retention window. The same store backs replay, evidence, and search.

on-appliance · rolling

Observability & integration

Live inspector and health checks per camera and stage. Export support bundles for diagnostics. Read and push through APIs and webhooks.

inspector · APIs

One five-stage pipeline, frame to escalation.

No black box. Every stage is observable, replayable from the snapshot store, and tunable per camera.

01 · CaptureRTSP, HLS, or HTTP snapshotPer-camera intervals, encrypted credentials, optional continuous sub-stream with motion-triggered HD bursts.existing cameras · LAN
02 · Motion gateFrame diff, polygon-scopedCuts inference cost and false positives. Per-zone thresholds. Ignore masks for screens, fans, and timestamp overlays.optional · per camera
03 · InferenceConfigurable detection modelsBring the detection models that fit your events. CPU, GPU, or Apple-silicon — your appliance, your call.object · scene
04 · SLA engineFive-state lifecycleConsecutive frames promote DETECTED to CONFIRMED. Time pushes through WARNING and BREACH. Operator action resolves.30s loop · per-event
05 · RoutingPush, webhook, messagingShift-, floor-, and role-aware. Cross-zone cooldowns. Fan-out per rule. Every send audit-logged with redacted secrets.multi-route

Deployment specs

  • Form factorOn-site appliance, one per site — commonly a Mac mini-class device.
  • CamerasRTSP, HLS, or HTTP snapshot from existing IP cameras and NVRs.
  • NetworkPrivate LAN or mesh VPN. No public IP required.
  • ProcessingLocal inference at the edge. Zone-scoped and cost-aware.
  • StorageEvents and snapshots on the appliance, on a rolling retention window.
  • OutboundAlerts and an optional license heartbeat. No camera footage by default.

Walk the architecture with us.

Bring your camera setup, network constraints, and the events you care about. We'll review the deployment end to end and map each stage to your site.

Request a demoTalk to an integrator