Security

Our cloud platform is built on Amazon Web Services (AWS), the same infrastructure trusted by leading enterprises and governments worldwide. AWS gives us global scale, but more importantly, it gives our customers built-in resilience and redundancy.

With multi-availability zone architecture, services are automatically backed up across independent data centers. If one zone goes down, your Rock deployment keeps running without interruption. AWS also brings certifications like SOC 2 Type II, ISO 27001, and GDPR compliance, extending enterprise-grade assurance to every Alcatraz cloud deployment.

Performance isn’t just about uptime — it’s about durability. AWS guarantees 11 nines of durability (99.999999999%) for stored data and 99.99% availability, meaning your access control system isn’t just fast, it’s nearly impossible to take offline.

We pair that foundation with real-time monitoring and automated failover, so even under heavy load or unexpected outages, the Rock platform continues to deliver secure, seamless access. In short: the cloud isn’t a weak point — it’s one of our strongest defenses.

At Alcatraz, encryption is the backbone of how we protect your data. From the moment your face is scanned at the Rock, every step in the process is locked down with industry-leading cryptography.

At Rest: Facial Signatures and system data are stored locally on the Rock in AES-256 encrypted form — the same encryption standard used by governments and financial institutions.

In Transit: Any communication between Rocks, the Access Control System (ACS), or the cloud is protected with TLS 1.2+ protocols, preventing interception or tampering as data moves across networks.

By Design, the Rock processes biometrics at the edge, so no raw face images or personally identifiable information (PII) are transmitted. That means attackers have nothing to “sniff” or steal.

We also implement role-based access controls and cryptographic key management to ensure that only authorized administrators — working on behalf of the Solution Owner — can access or manage data. Encryption is not a switch we flip on once and walk away from; it’s continuously monitored, tested, and updated in line with evolving best practices and regulatory guidance.

Not every door and not every person carries the same level of risk. That’s why Rock supports adaptive authentication, a flexible security model that lets organizations dial security up or down based on context.

Granular Access Policies: Solution Owners can decide which users authenticate with a simple facial match, and which require a second factor like a badge or PIN. High-trust employees may pass seamlessly with face-only, while sensitive areas like server rooms or labs can enforce step-up authentication automatically.

Smarter Security, Less Friction: This approach balances usability and risk. Employees aren’t bogged down with unnecessary extra steps where they aren’t needed, but critical zones remain locked down with layered security.

AI-Driven Flexibility: The Rock continuously learns from usage patterns and environmental conditions, enabling organizations to evolve access rules as their needs change. This adaptability ensures strong protection without sacrificing the frictionless experience that facial authentication is meant to deliver.

Built-In Future-Proofing: As regulatory requirements or organizational policies change, administrators can update authentication flows without hardware replacement — ensuring the Rock grows with your security strategy.

The result is a system that delivers personalized access control: the right authentication strength for the right context, every time.With Alcatraz, consent isn’t just assumed — it’s enforced by design. Enrollment into the Rock system is always opt-in, meaning no one can be scanned or matched without explicit approval.

No Silent Enrollment: The Rock cannot capture or create a Facial Signature until the Solution Owner confirms that the individual has consented. This safeguard ensures there is no “background scanning” or automatic enrollment of bystanders.

Solution Owner Confirmation: Consent is tracked and confirmed through the Solution Owner’s own systems — such as onboarding workflows, visitor registration, or digital consent forms. The Rock does not proceed without this explicit “green light.”

Technical Enforcement: The Rock and the ACS are designed so that enrollment cannot begin until consent is registered. This means the device itself enforces the rule, not just policy.Opt-Out Anytime: If a person withdraws consent, their Facial Signature is deleted. From that moment, the Rock will no longer recognize them, and they must use an alternative access method like a badge or PIN.

Global Compliance: This opt-in approach aligns with data protection laws such as BIPA, GDPR, and CCPA/CPRA, which require informed and explicit consent for biometric processing.

By making consent both a policy requirement and a technical safeguard, the Rock guarantees that facial authentication is something you choose — never something that just happens to you.

Security doesn’t end when the door unlocks. One of the most common risks to access control is tailgating—when an unauthorized individual slips in behind someone who has properly authenticated. The Rock addresses this risk directly by making tailgating detection a built-in feature, powered by advanced AI models.

AI-Powered Awareness: The Rock doesn’t just check who is at the door; it analyzes the entry event in real time. If more than one person attempts to follow through on a single authentication, the system generates an alert.

No Extra Sensors Required: Unlike traditional anti-tailgating solutions that rely on additional cameras or sensors, this functionality is embedded in the Rock itself. That means stronger protection without added complexity, infrastructure, or cost.

Real-Time Response: Tailgating attempts are flagged instantly and relayed to the ACS and the Solution Owner’s security team for follow-up. This ensures organizations can act quickly before an incident escalates.

User-Friendly by Design: The Rock is smart enough to differentiate between legitimate, authorized entries and suspicious activity. This means fewer false alarms and smoother entry for those who belong—without sacrificing vigilance.

Every authentication event is about verifying identity and protecting the integrity of the space behind the door. By baking tailgating detection into the device itself, Alcatraz delivers layered protection without added friction.

Security at scale requires more than just strong technology—it requires administrative control, auditability, and flexibility to fit into complex enterprise environments. That’s why the Rock and the Alcatraz platform are built with robust, enterprise-ready management capabilities.

Role-Based Access: Only authorized administrators designated by the Solution Owner can manage enrollment, configure policies, or delete profiles. Roles can be customized to align with the organization’s internal governance model.

Audit Logging: Every key action—such as enrollments, deletions, access events, or administrative changes—is logged with timestamps. These logs help organizations demonstrate compliance during internal reviews or external regulatory audits.

ACS Integration: The Rock works seamlessly with industry-standard ACS, including Lenel, Genetec, and Software House. This allows organizations to manage permissions centrally while still benefiting from biometric authentication at the edge.

Granular Policy Control: Administrators can configure authentication requirements to fit risk levels. For example, high-security areas may require adaptive two-factor authentication (facial authentication plus a badge), while common entry points may allow facial-only.

Privacy Safeguards by Default: Even at the administrative level, personally identifiable information (PII) is not stored within the Alcatraz system. Administrators manage anonymous Facial Signatures tied only to badge IDs, which reduces the risk of privacy exposure.

Enterprise-Scale Deployment: Whether an organization is rolling out ten devices or ten thousand, configuration and updates can be managed centrally across all deployed Rocks, with minimal on-site intervention.

Enterprises get both power and precision—the ability to enforce strict security while customizing policies to match operational needs, all while maintaining auditability and compliance.

Security doesn’t stop at enrollment—it requires strong controls throughout the entire data lifecycle. With the Rock and the Alcatraz platform, we’ve built automation into every stage to ensure biometric data is handled responsibly, from the moment it’s created until the moment it’s deleted.

Enrollment Controls: The Rock will not enroll anyone without confirmed, explicit consent from the Solution Owner. This safeguard ensures that only individuals who have opted in become part of the system.

Automated Retention Schedules: Facial Signatures are only kept as long as they are needed. Solution Owners can configure retention timelines to comply with laws like BIPA, GDPR, or CCPA/CPRA. Once a record exceeds its retention period, it is automatically flagged for deletion.

Event-Driven Deletion: If an individual withdraws consent, leaves the organization, or no longer requires access, the system supports immediate removal of their Facial Signature. This can be triggered manually by administrators or automated through HR/ACS integrations.

Seamless Updates: Firmware and software updates are delivered through secure channels, ensuring every device remains current with the latest security patches without disruption.

Audit-Ready Logs: Every action—enrollment, update, or deletion—is logged with time and administrator details, making it easy to demonstrate compliance and accountability.

Lifecycle automation reduces the risks of human error and ensures that privacy commitments aren’t just policies on paper—they’re enforced by design, every day.

The Rock isn’t just smart software—it’s fortified hardware, purpose-built to withstand physical and digital threats. Because security at the edge is only as strong as the device itself, we’ve engineered the Rock to resist tampering, block unauthorized modifications, and stay resilient over time.

Physical Safeguards: The Rock is designed with tamper-resistant enclosures and built-in sensors. Any attempt to open, alter, or interfere with the hardware can trigger alerts and render the device inoperable until secured by an authorized administrator.

Secure Boot Process: Every Rock device uses a cryptographically signed boot sequence, ensuring that only trusted firmware can run. If someone attempts to load unauthorized code, the system will refuse to start.

Automatic Firmware Updates: Devices regularly receive digitally signed firmware updates to address vulnerabilities and strengthen protections. Updates follow a DTAP (Development, Testing, Acceptance, Production) process before release, minimizing disruption while maximizing security.

Encrypted Storage: Sensitive data—including Facial Signatures and logs—is stored in secure enclaves on the device, using AES-256 encryption, making it inaccessible even if the hardware were physically compromised.

Resilience Against Cloning: Each Rock is uniquely bound to its cryptographic keys, preventing duplication or unauthorized cloning of devices.

Tamper-resistant design ensures the Rock can defend itself in the physical world while secure updates keep it resilient in the digital one. Your system isn’t static, but it grows stronger over time.

Security doesn’t stand still—and neither do we. Threats evolve daily, so our defenses must be adaptive, layered, and relentless. At Alcatraz, security isn’t a one-time feature; it’s a continuous cycle of improvement, testing, and hardening.

Regular Penetration Testing: Independent third-party firms conduct penetration tests against our platform and hardware, simulating real-world attacks to uncover weaknesses before adversaries can exploit them.

Ongoing Vulnerability Scanning: Both cloud services and edge devices are continuously scanned for vulnerabilities, with issues remediated quickly and transparently.

Patch and Update Cadence: Whether deployed in the cloud or on-prem, the Rock receives regular updates that include the latest security patches, ensuring your system never falls behind.Adapting to New Threats: As attack vectors evolve, we enhance our defensive posture—updating encryption methods, authentication protocols, and device safeguards to stay ahead.

Compliance-Driven Improvements: We align our practices with ISO/IEC 27001, 27017, and 27018, and proactively adapt to emerging regulations like GDPR, BIPA, and CPRA. Compliance isn’t a finish line—it’s a foundation we continually build upon.

Security Feedback Loop: Customer feedback, threat intelligence, and industry best practices are integrated into our roadmap, ensuring that every update strengthens both usability and resilience.

The Rock isn’t static. With every iteration, it gets smarter, faster, and harder to attack. Security is never “done”—it’s always evolving, just like the threats we defend against.