See everything. Identify no one — until the law says you may.
Clearwater watches a space and keeps every person anonymous by default. A camera or drone can monitor an area continuously, yet no one is identifiable — until a lawfully-held key reveals one specific, searched individual. By design, everyone else stays unreadable.
Module of Ithildin Alpine → · redacted detections flow into the same ontology
Runs on Windows · macOS · Linux · Ithildin sensing box (in preparation) · works with RTSP / RTMP / USB webcams / DJI & other drones
Clearwater turns any camera or drone into a privacy-preserving sensor. Faces and bodies are blacked out on your own device before anything is sent anywhere. What you watch is a live picture with the people already made anonymous.
The system can still do the useful work — count people, read occupancy, and detect and classify vehicles — and it can flag a specific person the authorities are lawfully searching for, without ever exposing the public around them.
What it does
- Blacks out faces and bodies on your own device
- Counts people and reads occupancy
- Detects and classifies vehicles
- Flags one lawfully-searched person — on a valid key
What it never exposes
- Redaction runs on-device by design — raw faces are not transmitted
- No public face database is built
- No always-on identification of the crowd
- Face-matching is OFF unless lawfully enabled
Clearwater is plug-and-play and cross-platform. It works with the cameras and drones you already own — in a briefing we set up the edge agent with you, and you are watching a redacted, live feed in four steps, inside the same Ithildin login you use for everything else.
Get the Clearwater edge agent — provided as part of your briefing, for Windows, macOS or Linux; a plug-in Ithildin sensing box is in preparation.
Connect any camera — RTSP, RTMP or a USB webcam — or push a DJI or other drone feed over RTMP.
Paste a one-time claim code — the sensor pairs to your account in a single step.
Watch the live, already-redacted feed — every detection appears inside your Ithildin login.
On your device · redacted-out
Caption · Redaction happens where the video is captured. The cloud only ever sees the redacted view.
This is the difference. Clearwater is built as the privacy-first, lawful alternative to blanket camera surveillance. The public stays anonymous by default, and the power to identify a single person is held back behind a lawful key — never switched on across everyone.
Redaction on your own device — by design, faces and bodies are removed on-device before anything is transmitted.
Every reveal is recorded — a tamper-evident activity record logs each time an identity is revealed, and by whom.
Reveal is key-gated and restricted — identifying one person requires a lawfully-held key, and is restricted by default for everyone else.
Face-matching ships switched OFF — it is only ever enabled for a client with a documented lawful basis.
Designed to Swiss and EU data-protection requirements — nDSG/FADP by architecture; built as the lawful alternative to mass-surveillance camera networks, not another one of them.
The result is awareness you can defend in a legal review: the crowd stays unreadable by design, and each identity reveal is deliberate, recorded and lawfully authorized.
Watch a space, protect the public in it. Clearwater fits anywhere you need continuous awareness but must not surveil the people who pass through — each context tied to a lawful basis and a key-gated reveal.
Public safety
Find one lawfully-wanted person across a monitored area — without surveilling, identifying or recording everyone else.
Site & perimeter security
Continuous awareness of movement and vehicles across a site you control — people stay anonymous by default.
Event & crowd safety
Live counts and crowd-movement state for an event — occupancy and flow without identifying the public.
Critical infrastructure
Presence and vehicle awareness around restricted plant and utilities — privacy-preserving by default, revealable only under lawful authority.
Clearwater is part of the wider Ithildin platform — one login, one shared workspace. Its redacted detections flow into the same ontology as the rest of your Alpine sensors, so camera, drone and site awareness all sit in a single operational picture.
See everything. Expose no one you may not.
We will walk you through the edge agent, connecting your own cameras and drones, the on-device redaction, and exactly how — and under what lawful authority — a single identity can ever be revealed.
Request a Clearwater briefing →