Home / Technology
Technology
The reference design.
For IT and technology directors who want to know what is actually in the closet. This is the standard design. Every site is adjusted to what you already run.
The parts of a typical install.
The brain: a Mac mini
Runs Pioneer: the dashboard, alerts, cases, search and detection. Quiet, low power, built for a network closet.
Detection and event clips
Pioneer finds people and vehicles on your camera feeds and keeps an event clip for every alert, on equipment you own. No per-camera subscription.
Door events
Door and badge events from your existing access system are brought in next to camera footage. Exterior and life-safety doors stay on their listed hardware.
Firewall and zones
A dedicated firewall (OPNsense on a small appliance) separates four zones: students and guests, staff, cameras and doors, and management.
DNS filtering
At install, we can set up local DNS filtering so malicious and inappropriate destinations are blocked across zones, without a cloud DNS service.
Keyed remote access
At install, we set up keyed remote access on a few named devices. Removing a device's key removes its access. Staff use the dashboard on site.
Intrusion monitoring
Where we install a dedicated firewall, we can turn on intrusion monitoring at setup so it watches traffic for attack patterns.
System health
Grafana dashboards show uptime and operational signals so facilities and IT see the same picture.
Encrypted backups
Configuration and critical data are backed up with encryption, kept off the single closet.
Hardening
Raising the bar on the weak points.
Staying local removes the biggest exposure: a vendor-cloud login that opens a live view of your building. These steps cover the paths that remain.
- Remote keys on a few named devices, never the whole IT team
- Default-deny between staff devices and camera storage
- Disk encryption on the Mac mini
- A locked closet, unused switch ports shut, guest Wi-Fi never on the camera zone
- Encrypted backups kept off the closet
Honest ceiling
What stays risky.
Insider risk and "a person with a key" never go to zero. The aim is to make those paths clearly harder than a flat network with a shared cloud password. We do not claim more than that.
A second phase, when the district is ready, can add 802.1X on staff ports, stricter device policies, short-lived remote keys and single sign-on with multi-factor for web interfaces.
Later phase
Lockdown and fire-panel integration.
These need district policy and your fire authority's approval, so they are not part of the first install. When added, lockdown and fire stay distinct signals, exits stay open from the inside, and a fire alarm never becomes a free front door. Pioneer does not replace your listed fire alarm system.
See it on a setup like yours
Book a short demo, or send us what you run today and we will map it. No pressure and no pitch deck.