How Deleting the Footage Makes Facial Analysis Enterprise-Ready

Every organization considering facial analysis meets the same objection: "We cannot upload employee video to a third-party server." The concern is legitimate. Biometric data is among the most sensitive categories under GDPR, PIPEDA, and BIPA.

Cloud-based systems require that upload, which creates data custody, retention, and breach liability that legal and compliance teams rightly reject. That is what has kept facial analysis in research labs.

On the standard read, GRW Project does not upload the video at all. The whole pipeline (video decoding, MediaPipe FaceMesh landmark detection, Action Unit computation, and score generation) runs locally in the user's browser using TensorFlow.js and WebGL acceleration.

On that path the video file stays on the device. No pixels are transmitted to any server, and no frame is written to disk on our side. The only data that reaches GRW is geometric: 468 XYZ coordinates per face per frame, plus the computed scores. Those coordinates are used to compute the scores and are then discarded. The report keeps the numbers. It does not keep the geometry.

We treat those coordinates as sensitive data rather than a safe by-product, because an ordered set of 468 landmarks describes one specific face. They are held for the seconds the maths needs them, and no face template or identifier is built from them.

Four things route the video to a GPU server instead: you turn on room mode, you add a second camera, the probe finds 20 or more faces, or your browser cannot decode the file (some HEVC files and some Safari builds). On those paths the video is uploaded, and it is deleted the moment the analysis reaches a terminal state, and within 60 minutes if the run is abandoned or fails. Only landmark coordinates and the derived scores are kept. The app tells you which path your clip took.

Deleting the footage turns facial analysis from a privacy risk into a manageable one. On the standard path there is no video in transit to intercept and no video store to breach. Coordinates do move over the wire, encrypted in transit and dropped after scoring. On the server paths, a deletion fence and a 60 minute sweep bound the store.

That leaves a different risk profile for legal and compliance teams to review. The Data Processing Agreement is short because there is little processing to describe. The device does the work, on the same models that once needed a cloud GPU.

Rather than collecting data centrally and building security around it, this approach pushes computation to the edge and keeps data movement to the minimum the job needs. So the architecture question matters as much as the feature set: a tool that processes what it can locally, deletes the footage on the paths that do upload, and keeps derived scores is easier to deploy in a regulated environment than one that requires upload and keeps it.