Who we are

Security controls fail when they are inconvenient

Almost every breach of physical security we are called in to review started the same way: a control that made someone's job harder, so it was quietly defeated. A propped door. A shared card. A leaver whose access nobody removed.

We engineer against that. Authentication fast enough that nobody props the door, credentials that expire on their own, and an audit trail detailed enough to answer a regulator without a fortnight of log archaeology.

• Hardware and software built by one team, so they actually fit
• Open standards — OSDP, ONVIF, SCIM — never a locked estate
• Privacy engineering treated as a product requirement, not a policy PDF

How we handle biometric data

• Templates are irreversible. No enrolment images are retained.
• AES-256 at rest, TLS 1.3 in transit, keys rotated on schedule.
• You choose where templates live: device, controller, credential or tenancy.
• Consent capture, retention limits and per-user deletion are product features.
• A DPIA template and data-processing agreement ship with every project.

Reporting a vulnerability

We operate a coordinated disclosure policy. Report a suspected vulnerability to our security team and you will get a human acknowledgement within one business day and a remediation timeline within five.

security@xipheredge.com

Certifications pack