Finds stolen cars and AMBER-alert vehicles. Destroys everything else on the camera in seconds. Your city holds the keys — we can't read the data.
Conventional plate readers photograph everyone and upload it to a vendor's cloud. Havenlight decides what matters on the camera — before any record exists. Watch:
Each plate is read in volatile memory and checked against signed alert lists stored on the camera: NCIC stolen vehicles, AMBER/Silver alerts, your case-flagged plates.
Almost every vehicle. Erased on the camera in seconds — never transmitted, never stored. Only hourly traffic totals survive.
Re-read for accuracy, encrypted to your keys, delivered in seconds. An officer confirms plate, state, and alert freshness before anyone gets stopped.
Privacy engineering isn't a tax on police work — it's what makes hits trustworthy, stops defensible, and evidence admissible.
Every alert is a verified hit, re-read before it fires. Photo, plate, state, and direction of travel hit the MDT in seconds — no "vehicle of interest" spam.
Hits go to the units covering that zone and your crime center — not every login in three counties.
Detective flags a plate against an RMS-validated case; a different supervisor approves; fleet-wide in minutes. Case closes, flag dies.
Image, confirmation record, cryptographic chain of custody — court-ready. The audit trail that satisfies your council defeats suppression arguments.
CAD push, RMS validation, NCIC sync. Only confirmed, case-bound matches ever enter CAD or RMS. Solar + LTE: no trenching, under an hour per pole.
Departments elsewhere are losing cameras to council votes. Our governance model turns a 5–4 kill into a 7–2 approval — and keeps it funded.
Solar-powered, self-contained, installs on existing poles in under an hour. Everything that matters happens inside the shell — so there's very little to trust.
| Recognition | On-device plate reading and matching — no cloud inference |
| Power | 28 W solar wing, 14-day battery reserve |
| Connectivity | Constant-rate encrypted LTE heartbeat — traffic looks identical with or without a match. Never bulk video |
| Security | Secure element; signed, reproducible firmware; remote attestation |
| Audio | No microphone — nothing to subpoena |
| Encryption | Matches encrypted to agency-held keys; Havenlight can't decrypt |
| Audit | Annual public security audit, full report published |
Enforceable terms with penalties owed to your city — and architecture a vendor can't quietly change.
Non-matches produce no record, ever. Surveillance of the innocent isn't a setting — it's absent.
Everything lives in your cloud tenant or on-prem, encrypted to keys you hold. We can't query it.
All activity lands on a tamper-evident ledger. Aggregates publish to your public portal automatically.
Case-scoped grants between named agencies, expiring in 30 days. No network. Immigration and reproductive-health surveillance rejected at the API.
Public vote to deploy, annual renewal vote, 30-day no-fault termination — standard in every contract.
An alert is a lead, not probable cause. Officers confirm plate, state, and validity before acting.
We fund and draft the laws — warrant rules, retention caps, audits — that bind the whole industry, us included.
| Dimension | Havenlight | Networked ALPR |
|---|---|---|
| Non-matching vehicles | Destroyed in seconds | Stored for weeks, searchable |
| Data custody | Your tenant, your keys | Vendor's cloud, vendor's control |
| Cross-agency search | Bilateral, case-scoped, expiring | De facto national network |
| Query accountability | Purpose codes + case numbers, enforced at the API | Free-text "reason" fields |
| Vendor access | None — cryptographically | Full |
| Retention ceiling | Seconds; 72 h investigative tier; 30-day hard cap | 30 days to years, extendable |
| Community control | Public vote, annual renewal, resident dashboard | Residents learn from the news |
| Business model | Hardware + flat fee; public pricing | The database is the moat |
The public portal shows delayed, aggregated stats — never live case activity. Your oversight board streams the full ledger in real time. And it cuts both ways: the same chain clears your officers when an accusation lands.
Hash-chained, written in the same transaction as the query. No off switch — for anyone. No plate numbers in the chain.
Your oversight board reads the full chain in real time. Suspects can't watch investigations; auditors can.
New camera, new sharing agreement, new setting — public notice first. Nothing arrives by quiet update.
We publish our threat model; no one else in this market does. Tap any scenario for the countermeasure. Misuse caught by an automatic flag is a personnel matter — misuse caught by a journalist ends the program.
Flat and all-inclusive. No per-search fees, no bundle games, never a business model that needs your residents' data.
Volume pricing for 25+ cameras is in our public standard contract. Every agency starts with a 90-day pilot — real cameras, real alerts, council materials included. If a competitor quotes lower, ask to see their data-use terms next to ours.
A privacy company that opposes privacy law is a surveillance company with better branding. We draft and fund rules that bind the whole industry — including us: warrant requirements, retention caps, purpose limits, mandatory audits, a private right of action.
Statutes take years; purchasing rules take a vote. Our model procurement ordinance fits on a page and names no vendor — it just makes the dragnet un-purchasable while keeping real alerting. Residents: hand it to your council.
Get the model ordinanceReal-time verified alerts cover the cases where plate readers genuinely earn their keep. For lawful retrospective work, the optional investigative tier holds encrypted detections for 72 hours — unlocked only with a case number, two-person authorization, and (outside emergencies) a court order. Then the key is destroyed, and no subpoena can bring the data back.
The missing features are the liabilities — the national network and everyone-database are what cities get sued and audited over. A feature you can't lawfully use is a liability with a subscription fee. And match-only hardware is genuinely cheaper to run: no bulk video, no petabytes of innocent traffic.
Structure, not sentiment. The commitments are charter-level and contractually enforceable, with penalties owed to your city. Your data is encrypted to keys we don't hold — a future management team or acquirer has nothing to monetize and no switch to flip.
There's nothing to search. Non-matches don't exist; matches sit encrypted in your tenant under your keys. Sharing is a bilateral, case-scoped grant your agency initiates — and civil immigration enforcement is rejected at the API and barred by contract.
Alerts expire automatically, hits are re-read on-device, and officers must confirm plate, state, and alert validity before acting. Unconfirmed matches self-erase in 24 hours. Misreads feed a public quarterly accuracy report — the error rate is a number, not a rumor.
Ask your council to adopt the model procurement standard — five requirements, one page, no vendor named. Your city keeps real alerting; the dragnet becomes un-purchasable. Email us for the ordinance text and the questions worth asking any camera vendor, ours included.
A live demo, the standard contract, or the model ordinance for your council. We publish everything — that's rather the point.