Public infrastructure shouldn't run on hardware nobody can account for.

Public buildings are exactly the kind of target that data-sovereignty rules exist for: cameras in government buildings, footage that could end up on servers nobody in the building controls. GDPR treats this as a real legal question. Personal data can move freely inside the EU and EEA, but moving it outside requires an adequacy decision or contractual safeguards under GDPR Chapter V. Scrutiny of specific manufacturers isn't only an American story either. The European Parliament voted in 2021 to remove Hikvision's own cameras from its Brussels premises over security and human rights concerns. Lithuania's National Cyber Security Centre named Dahua and Hikvision specifically in a 2020 technical report, after finding dozens of vulnerabilities and confirming some cameras sent data to servers in Russia. The government followed up in 2022 with a law barring roughly 400 state institutions from installing equipment from "unreliable manufacturers," a category built around Chinese, Russian, and Belarusian suppliers. That's European precedent.

AION only installs UniFi hardware for that reason. UniFi stores footage and access logs on-site by default, on hardware the institution physically controls, and nothing goes to the cloud unless someone there decides it should. We audit existing systems, flag anything that raises the same concerns, and replace it with a single, unified system that a public institution can defend if anyone ever asks what's running its cameras.

Once it's in place, AION manages it as an ongoing service: monitoring, updates, and access control, so the system stays current instead of drifting back into the state it was found in. The hardware is also simply well made, which matters when a system needs to run for a decade without anyone thinking about it.