Privacy-first vehicle recognition

The license plate camera without the database.

Finds stolen cars and AMBER-alert vehicles. Destroys everything else on the camera in seconds. Your city holds the keys — we can't read the data.

See it work
0 byteskept on non-matching vehicles
< 10 secto destruction on-device
100%of queries audit-logged
30 daysabsolute retention ceiling
How it works

Match on the pole. Forget by default.

Conventional plate readers photograph everyone and upload it to a vendor's cloud. Havenlight decides what matters on the camera — before any record exists. Watch:

MATCH-ONLY PIPELINE · SIMULATIONLIVE
STEWARD S1
VEHICLES SEEN 0 ERASED ON-DEVICE 0 VERIFIED ALERTS 0 RECORDS KEPT ON INNOCENT DRIVERS 0 — always
STEP 1

Read on the device

Each plate is read in volatile memory and checked against signed alert lists stored on the camera: NCIC stolen vehicles, AMBER/Silver alerts, your case-flagged plates.

FRAMES OFF-DEVICE: NONE
STEP 2A

No match → destroyed

Almost every vehicle. Erased on the camera in seconds — never transmitted, never stored. Only hourly traffic totals survive.

RETAINED: 0 BYTES
STEP 2B

Match → verified alert

Re-read for accuracy, encrypted to your keys, delivered in seconds. An officer confirms plate, state, and alert freshness before anyone gets stopped.

HUMAN CONFIRMATION: REQUIRED
The obvious question

But is it as effective?

Yes. Every plate reader — ours or anyone's — only sees vehicles that pass its cameras, and the catches happen live, the instant a flagged car crosses one. Recording everyone doesn't add eyes; it only adds storage. Watch the same traffic go through both systems:

MATCH-ONLY · HAVENLIGHTLIVE
NO ARCHIVE EXISTS
KEPT TONIGHT: the match · records of innocent drivers: 0
RECORD-EVERYTHING · INDUSTRY DEFAULT
KEPT TONIGHT: every plate, every trip · searchable for weeks

The catches happen live

Stolen cars, AMBER alerts, flagged suspect vehicles — they're caught the moment they pass any camera, in real time. That instant is where this technology earns its keep, and both architectures share it equally.

Chokepoints beat blankets

A city has a handful of arterial routes, and a moving vehicle can't avoid them. Coverage is set by placement and density — and with no bulk video to haul, the same budget buys a tighter net of cameras.

A plate surfaces later? Flag it forward

When a witness or doorbell camera produces a suspect plate, flag it — every camera hunts that vehicle from then on, tied to the case. No archive of everyone required.

The archive of everyone isn't where the catches come from.
It's only where the risk lives.

For law enforcement

Fewer alerts. Better alerts. Cases that hold.

Privacy engineering isn't a tax on police work — it's what makes hits trustworthy, stops defensible, and evidence admissible.

ALERTING

Alerts that deserve the lights

Every alert is a verified hit, re-read before it fires. Photo, plate, state, and direction of travel hit the MDT in seconds — no "vehicle of interest" spam.

ROUTING

Beat-scoped, not broadcast

Hits go to the units covering that zone and your crime center — not every login in three counties.

BOLO

Case plates flagged from the field

Detective flags a plate against an RMS-validated case; a different supervisor approves; fleet-wide in minutes. Case closes, flag dies.

EVIDENCE

Packages that survive motions

Image, confirmation record, cryptographic chain of custody — court-ready. The audit trail that satisfies your council defeats suppression arguments.

INTEGRATION

Fits the stack you have

CAD push, RMS validation, NCIC sync. Only confirmed, case-bound matches ever enter CAD or RMS. Solar + LTE: no trenching, under an hour per pole.

SURVIVAL

A program that doesn't get cancelled

Departments elsewhere are losing cameras to council votes. Our governance model turns a 5–4 kill into a 7–2 approval — and keeps it funded.

Detailed rendering of the Havenlight Steward S1 camera unit and mounting pole, with a blue band and privacy-by-design detail card.
Hardware

Steward S1

Solar-powered, self-contained, installs on existing poles in under an hour. Everything that matters happens inside the shell — so there's very little to trust.

RecognitionOn-device plate reading and matching — no cloud inference
Power28 W solar wing, 14-day battery reserve
ConnectivityConstant-rate encrypted LTE heartbeat — traffic looks identical with or without a match. Never bulk video
SecuritySecure element; signed, reproducible firmware; remote attestation. Watchlists stored on-device as keyed hashes — a stolen camera reveals nothing, not even who was being looked for
AudioNo microphone — nothing to subpoena
EncryptionMatches encrypted to agency-held keys; Havenlight can't decrypt
AuditAnnual public security audit, full report published

The Steward will never

  • Run facial recognition
  • Stream or store video of traffic
  • Index vehicles, decals, or bumper stickers
  • Join a national search network
  • Touch data brokers — either direction
The seven commitments

In every contract. Built into the physics.

Enforceable terms with penalties owed to your city — and architecture a vendor can't quietly change.

Match, don't record

Non-matches produce no record, ever. Surveillance of the innocent isn't a setting — it's absent.

Your data, your keys

Everything lives in your cloud tenant or on-prem, encrypted to keys you hold. We can't query it.

Every query leaves a mark

All activity lands on a tamper-evident ledger. Aggregates publish to your public portal automatically.

Sharing is bilateral

Case-scoped grants between named agencies, expiring in 30 days. No network. Immigration and reproductive-health surveillance rejected at the API.

Communities consent

Public vote to deploy, annual renewal vote, 30-day no-fault termination — standard in every contract.

Humans verify first

An alert is a lead, not probable cause. Officers confirm plate, state, and validity before acting.

We lobby against ourselves

We fund and draft the laws — warrant rules, retention caps, audits — that bind the whole industry, us included.

Side by side

Havenlight vs. the dragnet

DimensionHavenlightNetworked ALPR
Non-matching vehiclesDestroyed in secondsStored for weeks, searchable
Data custodyYour tenant, your keysVendor's cloud, vendor's control
Cross-agency searchBilateral, case-scoped, expiringDe facto national network
Query accountabilityPurpose codes + case numbers, enforced at the APIFree-text "reason" fields
Vendor accessNone — cryptographicallyFull
Retention ceilingSeconds; 72 h investigative tier; 30-day hard cap30 days to years, extendable
Community controlPublic vote, annual renewal, resident dashboardResidents learn from the news
Business modelHardware + flat fee; public pricingThe database is the moat
Open source

Every line of code is public.

Trust claims are cheap; repositories aren't. Everything that touches your data is open source — and reproducible builds with remote attestation prove the code running on the pole is the code anyone can read.

steward-firmwareGPL-3.0

The on-device pipeline: read, match, erase. Reproducibly built; attestation verifies the running image byte-for-byte.

haven-coreAGPL-3.0

The agency backend: alerting, policy engine, evidence packaging. Deploys in your tenant, not ours.

haven-ledgerAGPL-3.0

The tamper-evident audit chain and the public transparency portal it generates.

haven-verifyApache-2.0

Independent audit tooling — verify attestation and ledger integrity without trusting us.

AUDIT

Read what runs on the pole

Your auditor — or any resident — can inspect the exact code, and attestation proves it's what's deployed. No "trust us" step anywhere.

SECURITY

Many eyes, funded

Open code means researchers find problems before adversaries do. Our vulnerability-disclosure program pays for what they find.

NO LOCK-IN

Forkable, even from us

If Havenlight ever disappears — or disappoints — your city isn't stranded. The full stack can be run, audited, and maintained without us.

Repositories publish with the first production release, alongside the annual public security audit.

Transparency portal

Your residents see what your officers do.

The public portal shows delayed, aggregated stats — never live case activity. Your oversight board streams the full ledger in real time. And it cuts both ways: the same chain clears your officers when an accusation lands.

OVERSIGHT LEDGER · SIMULATED FEEDAPPENDING

Tamper-evident

Hash-chained, written in the same transaction as the query. No off switch — for anyone. No plate numbers in the chain.

Independently verifiable

Your oversight board reads the full chain in real time. Suspects can't watch investigations; auditors can.

Notice before change

New camera, new sharing agreement, new setting — public notice first. Nothing arrives by quiet update.

Threat model

Engineered against abuse — including by its users.

We publish our threat model; no one else in this market does. Tap any scenario for the countermeasure. Misuse caught by an automatic flag is a personnel matter — misuse caught by a journalist ends the program.

Watchlist bloat"Just flag everyone"
Countered: custom entries need a case number, a supervisor, and a ≤90-day expiry. List size publishes to the portal — bloat is visible immediately.
Insider misuseAn officer tracking an ex
Countered: identity-bound queries, two-person auth, warrant-gated location histories, and anomaly patterns auto-flagged to oversight.
Device theft & hackingStolen cameras, breached feeds
Countered: no footage inside, credentials revoke on tamper, zero inbound network endpoints. The thief gets a solar panel.
Radio eavesdroppingTransmissions leak the matches
Countered: constant-rate encrypted heartbeat — traffic is byte-identical whether the street is empty or a hit just fired.
Small-count inferenceA count of one is one car
Countered: only hourly aggregates with small counts suppressed leave the device. No per-vehicle timestamps exist.
Investigation tip-offA live public ledger warns suspects
Countered: public tier is delayed and aggregated; the real-time chain goes only to your oversight board, under confidentiality.
Stale & false hitsYesterday's stolen car, today's wrongful stop
Countered: alerts expire automatically, every hit is re-read, and unconfirmed matches self-erase in 24 hours. Error rates publish quarterly.
Legal pressure on usThe vendor as weakest link
Countered: subpoena us and get ciphertext we can't decrypt. Every legal demand we receive is published annually.
Downstream copiesRetention dies at the export door
Countered: only confirmed, case-bound matches export to CAD/RMS, carrying binding retention terms. Unconfirmed alerts never leave.
Screen leakageA screenshot is still a record
Countered: alert views are per-officer, watermarked, and logged. A leaked screen identifies its leaker.
Pricing

Public pricing. Because of course it is.

Flat and all-inclusive. No per-search fees, no bundle games, never a business model that needs your residents' data.

Municipal & Agency
$2,400
per camera per year — hardware included
  • Steward S1, install kit, solar power
  • Match-only alerting, verified lists
  • Your cloud tenant or on-prem
  • Transparency portal + audit ledger
  • Court-ready evidence packages
  • Support, connectivity, attestation
Campus & Transit
$2,400
per camera per year
  • Everything in Municipal
  • Governance templates & DPAs
  • Geofenced alert scopes
  • Dispatch integration
Neighborhood & HOA
$1,200
per camera per year
  • Alerts to your own security contact
  • No police data feed
  • Stolen-vehicle & AMBER lists only — residents can't add plates
  • Same zero-retention pipeline

Volume pricing for 25+ cameras is in our public standard contract. Every agency starts with a 90-day pilot — real cameras, real alerts, council materials included. If a competitor quotes lower, ask to see their data-use terms next to ours.

Policy

We're trying to make our promises mandatory.

A privacy company that opposes privacy law is a surveillance company with better branding. We draft and fund rules that bind the whole industry — including us: warrant requirements, retention caps, purpose limits, mandatory audits, a private right of action.

The fastest lever: one council meeting

Statutes take years; purchasing rules take a vote. Our model procurement ordinance fits on a page and names no vendor — it just makes the dragnet un-purchasable while keeping real alerting. Residents: hand it to your council.

MODEL ALPR PROCUREMENT STANDARD

  1. Match on-device; retain nothing on non-matches
  2. Jurisdiction-owned storage, independently auditable
  3. Annual public security audits, published in full
  4. Machine-enforced purpose limits + public reporting
  5. No vendor access, no monetization, no network conditions
Questions cities actually ask

FAQ

Without a database, how do you solve crimes after the fact?

Real-time alerts handle most of it. For look-backs, an optional 72-hour tier exists — it takes a case number, two approvals, and usually a court order. After 72 hours the key is destroyed and the data is gone for good.

Why pay dragnet prices for fewer "features"?

The missing features are the ones cities get sued over. And with no bulk video to store, match-only is cheaper to run.

What stops Havenlight from becoming the thing it replaced?

Your data is encrypted with keys we don't have — there's nothing for a future owner to monetize. And the commitments are contract terms your city can enforce with penalties.

Can federal agencies search our cameras?

No. Non-matches no longer exist, and matches live in your tenant under your keys. Nothing is shared unless your agency shares it, case by case.

What about wrong-plate stops?

The camera re-reads every hit, then a human confirms it before any stop. Unconfirmed matches erase themselves in 24 hours, and error rates are published quarterly.

We're residents, not a police department. What can we do?

Ask your council to adopt our one-page procurement standard. It keeps real alerting and makes the dragnet un-purchasable. Message us for the text.

Get started

Safety your city attorney can defend.

A live demo, the standard contract, or the model ordinance for your council. We publish everything — that's rather the point.