SecuraCV is a calm, local-first witness layer for homes, studios, labs, and small sites. It helps you understand what happened without turning your cameras and sensors into an identity archive.
Clips stay on your hardware. Events become privacy-preserving claims. The durable record is a signed, hash-chained log you can verify offline.
| Principle | What it means in practice |
|---|---|
| Local by default | No subscription, remote indexing, or telemetry. Your cameras, your logs, your disk. |
| Minimal by design | The kernel accepts semantic events such as motion in zone A, not face embeddings, plates, demographics, or person re-identification. |
| Verifiable after the fact | Events are Ed25519-signed and hash-chained, so edits show up during verification. |
| Comfortable to live with | Home Assistant integration, a verified timeline, gentle Canary devices, and display surfaces designed to be readable instead of alarming. |
| Honest about limits | Specs, threat model, docs linting, and supply-chain provenance are part of the product, not fine print. |
Start with the short essay: Witnessing is not watching. For the precise rules, read the privacy invariants.
| If you are... | Start here | Outcome |
|---|---|---|
| Running Home Assistant with cameras | Home Assistant setup → Frigate integration | Frigate keeps recording; SecuraCV adds verified witness events and chain health. |
| Running Docker beside an existing Frigate | Docker quickstart | One sidecar container wraps the witness API, bridge, and doctor checks. |
| Building hardware | Getting started with Canaries → hardware guides | Small independent witnesses for radar, camera-module presence, WiFi sensing, and displays. |
| Evaluating trust and safety | Why exports work this way → threat model | A clear view of what is enforced, what is audited, and what remains out of scope. |
| Developing | Operator guide → documentation map | Specs, commands, testing expectations, and day-2 operations in one map. |
Prefer to explore first? The SecuraCV Lab turns the same paths into an interactive guide with browser demos and one-tap commands.
Requires Home Assistant 2024.4.1 or newer.
- In Home Assistant, install the official Mosquitto broker add-on.
- Add these repositories in Settings → Add-ons → Add-on Store → ⋮ → Repositories:
https://github.com/blakeblackshear/frigate-hass-addonshttps://github.com/kmay89/securaCV
- Install Frigate and Privacy Witness Kernel.
- Open the Privacy Witness Kernel Web UI and follow the setup wizard.
- Point Frigate at your cameras. The wizard writes a starter config template to
/config/frigate.yml; copy it into Frigate's config, replace the placeholder RTSP URLs, then start Frigate.
After setup, SecuraCV publishes witness sensors, chain-integrity status, daily digest state, and a Verify Now action into Home Assistant. Frigate keeps handling clips and retention; SecuraCV adds the privacy boundary and verifiable event log.
The happiest path today is Home Assistant + Frigate + Mosquitto on a Raspberry Pi 4 or x86 host with RTSP cameras.
Use the compose quickstart, doctor check, bundled-broker option, and API-token setup in Frigate integration.
On a supported Linux host, the repository installer is curl -fsSL https://raw.githubusercontent.com/kmay89/securaCV/main/scripts/install.sh | bash.
# Ubuntu/Debian prerequisites
sudo apt-get install build-essential libseccomp-dev pkg-config
# Run a local demo, then verify the generated witness log
cargo run --bin demo
cargo run --bin log_verify -- --db demo_witness.dbReal camera ingest, break-glass exports, service operation, and day-2 commands live in the Operator Guide.
Camera / sensor
↓
Frigate, RTSP, file, V4L2, ESP32, or sensor adapter
↓
Privacy Witness Kernel
↓
Event contract + metadata minimization
↓
Ed25519-signed hash-chain log + optional sealed vault envelope
↓
Home Assistant, CLI verification, or export workflow
SecuraCV separates private media from verifiable claims:
- Cameras and sensors observe locally.
- Detection output is reduced to an allowed event vocabulary.
- Precise timestamps are coarsened, zones stay local, and identity selectors are forbidden.
- Each accepted event is appended to a signed hash chain.
- Verification proves whether the chain still matches what was written.
- Raw media access, when enabled, goes through the break-glass vault flow instead of casual browsing.
The important promise is not that tampering is impossible. It is that tampering becomes visible.
- Verified Home Assistant timeline. A Lovelace card shows events under chain status and displays the verified badge only after signature verification succeeds. See Verified Timeline.
- Frigate bridge with CI coverage. The Frigate → MQTT → sealed-log path is exercised by automated tests and a live-broker CI smoke path. See Frigate integration.
- Real ingest paths. File, RTSP, V4L2, ESP32 HTTP, and sensor-adapter paths are documented; the ffmpeg RTSP path has an end-to-end CI roundtrip. See v1 roadmap.
- Detection backends. The default motion path is dependency-light; Tract/ONNX is feature-gated for local object detection experiments. See inference backends.
- Canary hardware family. Vision, WAP, Sense, Display, and OTA projects share a growing firmware platform under
firmware/. - Canary Cards. Radar and witness state can render as standardized, privacy-classed cards across Lab, display, and Home Assistant surfaces. See Canary Cards.
- SecuraCV Lab. Browser demos model real firmware behavior, display surfaces, onboarding, power/bench behavior, and the MR60BHA2 radar placement pipeline. Try the Lab.
- USB onboarding design. Experimental USB-OTG builds provide a read-only drive with
START-HERE.html, consented one-tap help launch, and recovery/unseal flows. It is off in stock profiles. See USB onboarding. - Supply-chain transparency. Published firmware artifacts and browser-flasher factory images carry SLSA provenance attestations recorded in Rekor, complementing checksums and device-side OTA verification. See supply-chain transparency.
Canaries are small, local witnesses that corroborate the kernel instead of trusting one central box.
| Device | What it does | Where |
|---|---|---|
| Canary Vision | Presence from a Grove Vision AI module; no pixels leave the device. | firmware/projects/canary-vision/ |
| Canary WAP | WiFi-sensing presence, mesh experiments, beacon/chirp work, local dashboard. | firmware/projects/canary-wap/ |
| Canary Sense | MR60BHA2 60 GHz mmWave radar witness for presence, coarse occupancy, range bands, and wellbeing builds. | firmware/projects/canary-sense/ |
| Canary Display | Watch and wall display surfaces with calm status, QR onboarding concepts, Lab parity, and living-canary health cues. | firmware/projects/canary-display/ |
| Canary OTA | Standalone signed-update engine work: manifest fetch, SHA-256 verify, A/B rollback building blocks. | firmware/projects/canary-ota/ |
Build plans, BOMs, enclosure notes, and bench procedures are collected in hardware docs. Firmware capability status is tracked in firmware features.
SecuraCV should feel useful, not stressful. It is intentionally conservative about its claims:
- The invariants define what the kernel must not collect or expose.
- The event contract defines which claims are allowed.
- The threat model separates enforceable security boundaries from audited trust boundaries.
- The root paradox explains what host compromise can and cannot preserve.
- The Beacon and Chirp specs keep life-safety advisories distinct from emergency-broadcast impersonation and forbid PII on the wire.
A few bright lines keep the system calm:
- No face recognition, plate OCR, demographic estimates, or bulk identity search.
- No cloud dependency for verification.
- No life-safety shortcut that auto-originates Beacon alerts from sensors alone.
- No claim that outruns the implementation: if a feature is marked design, RFC, pending bench validation, or post-v1, treat it as exactly that.
The project values honest edges more than glossy overclaiming.
The best entry point is the documentation map. It is checked in CI so new docs cannot become unreachable.
High-signal references:
- Home Assistant setup
- Frigate integration
- Operator guide
- Security docs
- Supply-chain transparency
- v1 roadmap
- Changelog
SecuraCV is a v1 release candidate.
Current audited docs status:
- The root README now points at current setup paths, hardware families, Lab surfaces, and supply-chain verification.
- The docs map is CI-enforced, so Markdown under
docs/must remain reachable. - The core Frigate/MQTT/witness-log path is verified end-to-end in CI.
- The RTSP ffmpeg path has a real roundtrip test.
- The v1 tag is still held for on-device hardware validation across the kernel/bridge path and representative ESP32 firmware.
Track the exact gate in v1 roadmap and recent work in CHANGELOG.
SecuraCV is independent, open source, and Apache-2.0 licensed. Helpful contributions include:
- testing a real Home Assistant or Docker install,
- bench-validating Canary hardware,
- improving docs and examples,
- reviewing privacy/security boundaries,
- building small, calm, local-first user experiences.
Read CONTRIBUTING, the security policy, and the repo engineering guide in AGENTS.md before opening a PR.
The software is Apache-2.0 (LICENSE) — free to run, anywhere, at any scale, forever. Two short, plain-language companions cover the rest:
- LICENSING.md — who pays, who doesn't, and why. Free for schools, universities, nonprofits, groups, businesses, and governments to self-host at any scale; the short list of things that cost money (bought hardware, court-grade attestation, support SLAs) each has a free path; and the survival promises (no phone-home, no kill switch, standalone verifier) that make it safe to standardize on.
- TRADEMARK.md — using the name, logo, and mascot: a free "Works with SecuraCV" badge for anyone, primary marks by public grant.
- TERMS.md — a plain-language template for paid-services terms (advisory-only, liability capped at fees, not a safety device). A scaffold for your attorney to finish — not legal advice, and it covers services only, never the Apache-2.0 software.
SecuraCV — calm local proof, without the surveillance archive.