US security services company: An AI-assisted body-camera operations platform for security patrols

Context

Body cameras produce hours of footage per shift. For a guarding company that footage is only valuable if someone finds the moment that mattered, describes it, grades how serious it was and puts it in a report the client will accept. Done by hand, that does not scale past a handful of sites, and it makes every incident report only as good as an officer's memory at the end of a long night.

The operator wanted the whole chain to run without a person stitching the steps together: camera in the field, footage in the cloud, incident on a screen, report in a client's inbox. Development ran from January to December 2025 across three repositories with 2,561 commits.

What we built

• An ops overview for duty supervisors with live patrol feeds, critical-incident surfacing and GPS positions on a site map
• Incident management with cursor-paginated lists, a six-level severity scale, manual creation from a GPS position or a single frame, and remote capture dispatched to a camera as an AWS IoT job
• AI incident analysis on Vertex AI: severity with confidence, person, vehicle and object detections, scene, weather and lighting, speech segments and key phrases, risk factors, recommended actions and quality assessment
• A media pipeline that combines segments, extracts audio and frames, builds sprite maps, packages archives and generates speech, with idempotency keys on every job
• Reporting with four report types, selectable screenshots and checkpoints, duplicate detection, server-rendered previews and emailed PDFs
• Clients, sites with geocoding and timezone detection, geofenced areas with synthesised entry and exit messages, guards with performance stats and gamification
• Device fleet, SIM and plan management, users and permissions scoped to tenant, client or site, and audit logs for application, authentication, device and email events

Architecture and stack

Splitting the web app from a separate worker service was the most consequential decision. Uploads land in S3, S3 emits events, and one router job classifies each object and fans out to the right specialist job. Each job validates its own payload, carries an idempotency key so a retry never duplicates work, and reports progress to the database, where the dashboard picks it up through live subscriptions. Both applications consume the same schema repository as a submodule, so a field added to the incident model is visible to the dashboard and the workers in the same commit.

How we worked

Tests were concentrated where a silent failure would lose a client's evidence: the worker service carries 1,855 test cases across 111 files covering S3 event parsing, FFmpeg safety, download resilience, disk-space handling and error categorisation, with Playwright configured for end-to-end runs against the web app. CI gates every pull request with type checking, linting on changed files, a dependency audit that fails on critical vulnerabilities, workflow linting and a check that the schema submodule matches what the app expects.

Security lives in the code, not only in policy: all inputs validated with Zod, tenant scoping on data access, no raw SQL for ordinary queries, secrets injected at runtime, security headers and request-size limits at the edge, and log redaction so sensitive fields never reach the logging provider. Deployment, local testing, monitoring, IAM migration and device-migration runbooks were written for the next developer.

Scale and complexity

What this means for your project

If your product turns raw media or documents into records people act on, the same shape works: a thin web app, a worker service for everything slow, one shared schema, and AI reviews stored next to human decisions rather than in place of them. Evaluation, guardrails and traceability are part of the build, not a later phase.

Innovation Insight builds AI features like this from $12k to $60k for a scoped feature, or as a dedicated team for a full platform. Discovery gives you a written scope first.