IRIS+

GDPR overview

GDPR compliance is stated explicitly and in concrete terms. Irisity claims privacy by design and by default, positions the customer as controller and itself as processor, and points complainants to the Swedish authority IMY. The product carries the mechanisms: black, dynamic and background masking, plus full anonymisation on sensitive sites where detected people are white-masked or replaced by low-resolution versions. Contact runs through privacy@irisity.com; a data protection officer exists but is not named, reachable via Customer Success. Two caveats. Irisity claims no certification of its own: ISO/IEC 27001 appears once, only as a standard the architecture supports. And no Data Processing Agreement is published or offered anywhere on the site.

Who owns the data?

Ownership depends on which data you mean. For the video handled inside IRIS+, the customer is the data controller and Irisity acts only as a processor, working on the customer's documented instructions; the customer decides what is recorded, what is masked and how long it is kept. Irisity becomes the controller for the separate business layer: website usage, contact details and the commercial relationship. The vendor also keeps sample video from customer installations for its own research, stating that it never links that footage to names or identifiers and never returns it to the original customer, property owners or authorities beyond what the law requires.

Reuse rights

Customers keep operational freedom over their own footage: they configure detection, masking and retention, export metadata and clips as CSV or MP4, and can disconnect the analytics at any time with no lock-in. What matters more is what the vendor does. Irisity states plainly that it stores example video from security installations to build training datasets for its machine-learning models, alongside troubleshooting and benchmarking. Footage may also be sent temporarily to third-party annotators, under the European Commission's standard contractual clauses when those sit outside the EU. Trial data may additionally be used to improve the product and for sales and marketing purposes unless the customer explicitly agrees otherwise in writing, which is the only documented route to exclusion. There is no self-service opt-out toggle.

Data retention & training

Hosting summary

Where data sits depends on the deployment chosen. On-premise customers keep full control of their own storage and network, and no third party is involved. For cloud deployments, video and metadata are protected using encryption services from Google Cloud Platform, including hardware-backed key storage, but Irisity names no region or country for that cloud. Separately, the personal contact and business-relationship data that Irisity processes as controller sits with Microsoft, in cloud services located within the EU; Microsoft may move it to third countries only in the event of a serious IT security incident, and only to protect it. Because Irisity operates globally, it reserves the right to transfer personal data outside the EU and EEA under EU-approved mechanisms. Video sent temporarily to third-party annotators outside the EU travels under the European Commission's standard contractual clauses. Research footage is held on approved, encrypted, firewalled equipment with access limited to research staff. Jurisdiction is Swedish: the terms are governed by Swedish law and the supervisory authority is IMY.