Version v1 · effective 1 September 2026
The commitments
These are properties of the machine, not values we hold. Each one is written so you can check whether we kept it. This page is versioned, so a future revision gets a new URL and this one stays where it is.
- 01Inference in the dock
- The threat detection model executes on Luna Dock hardware on your property. Video is never uploaded to be processed. There is no server-side inference path to enable later.
- 02Local first storage
- Footage is stored on the dock. Cloud backup is opt in and off by default. Turning it off never disables local recording, playback or detection.
- 03Encrypted by default
- End to end encryption is active from first boot. It is not a setting, not a paid tier, and not something you have to go and find.
- 04We hold no keys
- We cannot decrypt your footage. We therefore cannot produce it under subpoena, warrant, national security letter or commercial pressure. Legal process is served on you, the owner of the data.
- 05No law enforcement portal
- No portal, no bulk request tool, no agency dashboard, no voluntary sharing programme. It is absent from the product and from the roadmap.
- 06Geofenced to your parcel
- The aircraft is constrained to your property boundary in firmware. It is not a configurable limit, so it cannot be widened by us, by you, or by anyone who compromises either of us.
- 07Transit framing
- While the aircraft is moving, the camera points down and inward. Neighbouring property is not captured, rather than captured and then discarded.
- 08No data or analytics sales
- We do not sell customer data, and that includes aggregated, anonymised and de-identified derivatives, which is the loophole this industry normally uses.
- 09Local footage is never paywalled
- Local storage, playback and detection work forever, offline, with no subscription. A subscription buys monitoring and response. It never buys access to your own recordings.
Charter lock
These commitments will be written into the corporate charter at incorporation, so that an acquirer cannot void them.
Stated plainly for what it is: today this is a promise, and this company's whole argument is that promises are worth less than architecture. It is a dated public commitment with a named trigger, which is stronger than silence and weaker than the real thing. It becomes architecture when the entity exists.