Every event arrives with its video
An alarm, a forced door, a pressed panic button or an AI detection arrives as a single event: the site, the exact time, the clip from just before and after, and who handled it.
Integrated security with AI
Know that every camera at every site is recording today, and be able to prove what happened yesterday
The cameras, access control and alarms from all your sites come together on one platform, installed on your own server. The AI analyses the video inside each site and alerts you to what you defined as important; every event is kept with its video, its exact time and who handled it. It reuses the cameras already installed.
For credit unions, building societies and banks; for condominiums and gated communities; and for the security companies that serve them. It starts with an assessment of one site: two weeks, and a report that is yours even if you go no further with me.
Jump to your case: financial sector · condominiums and gated communities · security companies
What happens today at a site with cameras
None of these problems is fixed by buying more cameras. They all come from the same place: devices that do not talk to each other and a system nobody watches.
The camera that stopped recording a month ago
A full disk, a loose cable, a camera someone turned while cleaning. Nobody notices until the day of the incident, which is the only day it mattered.
Three months configured, three weeks stored
The recorder is set to keep three months, but the disk filled up early or the cameras recorded at a higher resolution than planned, and only three weeks are actually there. It comes to light when someone asks for old footage.
The alarm in one system, the video in another
When the vault sensor or the electric fence goes off, someone has to work out which camera covers that spot and then find that moment in its footage. In an emergency, those are the minutes that get lost.
The log in a notebook
Who opened the branch, who entered the vault, who visited the condominium: it is handwritten, when it exists at all. Reconstructing an incident means matching the notebook against the video, minute by minute.
Nobody knows who watched the video
Anyone with the recorder password can watch, copy or delete footage. Often that password is still the factory default, or the same on every device, and the device is exposed to the internet.
Evidence that gets disputed
The footage exists, but the recorder's clock is off, nobody knows who exported it and the file went through three USB sticks. In a criminal case, that evidence carries less weight.
This is solved with architecture: every device talking to the others, a system that watches itself, and every action leaving a trace.
One platform for everything that protects a site
Cameras, doors, sensors, alarms and logs in one place, on the same clock, with permissions per person.
Every camera's health, watched
If a camera loses its image, is covered or turned, or stops recording, the platform logs it and raises an alert. The operating record the regulations require keeps itself up to date.
Retention, measured
How many days each recorder really holds, compared with what the regulation or the house rules require, and a warning before it falls short.
Logs that write themselves
Branch opening and closing, vault entries, visitors at the gatehouse, guard patrols: who, at what time and with the video of that moment.
Who watched and who exported each video
Permissions per site and per person. Every playback and every export is logged, and exported footage carries its cryptographic fingerprint (SHA-256), which the platform stores separately, so it cannot be altered without it showing.
Connected to whoever responds
Events reach the monitoring centre, in-house or contracted, with the event clip, attached or as a link depending on what its software accepts, so the person responding sees what the camera saw.
Credit unions, building societies and banks: the new physical and electronic security rules
In Ecuador, credit unions and building societies (mutual housing lenders) answer to SEPS, the regulator of the cooperative and mutual financial sector. On 5 June 2026 it issued a new physical and electronic security regulation (Res. SEPS-IGT-IGS-IGJ-INR-INSESF-INSEPS-INGINT-2026-0085) that replaces the 2018 one. Tiers 1, 2 and 3, building societies, central credit unions and the sector's state finance corporation have eighteen months to comply, until December 2027; tiers 4 and 5 have twenty-four, until June 2028. Until then, supervision follows the 2018 regulation (Res. SEPS-IGT-IR-IGJ-2018-021). This is what the new one requires, and what the platform records to show it is met.
Record around the clock, and know it is really recording
The regulation requires high-resolution cameras recording 24 hours a day, 7 days a week, a system that is evaluated continuously and an up-to-date record of its operating status. The platform watches each camera and keeps that record itself: if one stops recording or loses its image, it is logged and someone gets the alert.
Art. 9.1 a) · tiers 1, 2 and 3, building societies and central credit unions
Every restricted area, with no blind spots
The regulation requires cameras at entrances, teller counters, ATMs, inside the vault and in every restricted area, with no point left uncovered, and at least two at each ATM. Each branch has its coverage map, with the camera watching each point and its status: a point without a camera, or with a camera down, shows up before an inspection finds it.
Arts. 9.1 b), 7.1 e) and 10 j) · tiers 4 and 5 and the state finance corporation through art. 9.2
Three months of footage, measured
What counts is what is stored, not what is configured. The platform measures the days each recorder really holds and warns you before it drops below the minimum.
Arts. 9.1 c) and 9.2 · all tiers
Opening and closing, on video
The regulation requires two locks on the door, an employee and the guard present when the branch opens and closes, and procedures for opening and closing the vault, including the case of someone left inside. The log writes itself: who opened, who closed, at what time and with the video of that moment. And if someone is left inside the vault after closing, the camera inside, with after-hours person detection, raises the alert.
Arts. 4.1 e) and 7.1 f)
Logged access, one door at a time
Every entry to the teller area, the vault, the ATM room and the equipment room is authenticated and logged, with the video of that moment; third parties only with prior authorisation. Anti-passback stops anyone moving from one sensitive area to another without leaving the first, and a door left ajar is a time-stamped event.
Art. 4.1 h) and first general provision
The panic button reaches the security officer, at once
Panic buttons are connected to the security company's monitoring centre and to the institution's own, and every incident is reported in real time to the security officer. On the platform it arrives with the video from the camera covering that spot.
Art. 4.1 j)
Alarms over two paths, with the scene recorded
Every alarm signal reaches the monitoring centre over two communication paths at once, with the clip from the camera covering that point, and is recorded together with the scene, ready to hand over free of charge to the competent authorities that request it.
Art. 8.1 a) and c)
ATMs: two cameras and real-time anti-skimming alerts
Each ATM with its overhead camera and its front camera, and the alarms from the devices that detect fake card readers, where the ATM or its monitoring system exposes them, on the same platform as the video. The AI adds its own alerts for loitering in front of the ATM and for covered cameras.
Art. 10 c), i) and j)
The security officer's report, without building it by hand
The regulation creates the physical and electronic security officer, with monthly compliance reports, and requires documented maintenance at least every six months. For each branch, the platform keeps every requirement with its status and its evidence: which camera covers each point, how many days are stored, what failed during the month and when it was fixed.
Art. 12 d) and fifth general provision
Operational risk and the risk rating
Attacks, external fraud, criminal acts and cyberattacks are external operational risk events. Each one is kept with date, branch and evidence for the institution's operational risk event database, and operational risk is one of the risks the rating agency analyses in its annual report and in every quarterly review.
Res. SEPS-IGT-IGS-INSESF-INR-INGINT-INSEPS-IGJ-0116, arts. 7 no. 4 and 15 · Res. SEPS-IGT-IGS-INR-INSEPS-INGINT-2023-0344, art. 22 no. 3 n)
Banks answer to a different regulator, the Superintendency of Banks. The Monetary and Financial Policy and Regulation Board set continuous 24-hour recording for the whole financial system, with the integrity, availability and confidentiality of the footage (Res. JPRFM-2026-002-F, art. 8), and the Superintendency of Banks also requires an operating record, three months of footage and synchronised clocks on every recorder (Res. SB-2026-1691, art. 42). The platform is the same; what changes is the map of controls, built from the regulation that applies to each institution.
Condominiums, gated communities and residential complexes
In a condominium, security is everyone's responsibility, but it is run by a property manager with little time to spare. What matters most is not the camera but the gatehouse, which usually runs on a notebook, a phone and the guard's memory.
Visitors announced from a phone
The resident registers a visitor, who receives a QR code that expires. The guard sees the invitation on screen and lets the visitor in without calling the resident, and the entry and exit times are kept with an image from the gatehouse camera instead of a signature nobody can read.
Plates that open, plates that wait
A plate-reading camera at the vehicle gate: residents' number plates open the gate, announced visitors' plates are logged and unknown plates wait for the guard to decide.
The perimeter, at night
The electric fence and perimeter sensors are tied to the nearest camera. If someone lingers by the wall or walks the car parks in the small hours, the guard gets the alert with the video while the person is still there, not the next morning.
Patrols you can verify
Checkpoints along the guard's route: every round is time-stamped, and management can see whether it happened, when and how long it took, without having to take anyone's word for it.
Every parcel accounted for
Every parcel that reaches the gatehouse is logged with a photo, the resident is notified, and the system records who collected it and when.
Management, with data
Reports for the board and the owners' meeting: incidents, visits by time of day, patrols completed and cameras with faults. And if the condominium keeps its accounts in Odoo, residents and fees come from the same system.
What the law requires in a condominium. A condominium's cameras record residents, visitors and children. In Ecuador, the data protection authority (SPDP) requires a written balancing assessment before anyone records on the basis of legitimate interest (Res. SPDP-SPD-2025-0041-R, art. 5); legitimate interest does not cover recording audio, areas that intrude on privacy, such as toilets, changing rooms, nursing rooms or dining rooms, are not recorded and, where children are involved, the assessment has to justify it expressly in their best interest, with reinforced safeguards (arts. 15 and 16.4). The project is designed with that in mind from the start: no audio, no cameras facing homes, visible notices at the entrances, and visitor logs that keep only what is needed, for a fixed period.
For security companies and integrators
If your company installs, maintains or guards sites, this does not take your client away: it gives you more to sell them and a reason to come back.
The client stays yours
You bring the equipment, the installation, the on-site maintenance and the relationship. I bring the architecture, the platform, the AI and the integration, remotely. I do not contact your client without you, during the project or after it.
What you sell on top
The IP cameras at critical points, the AI device at each site, the separate network and the backup power: whatever the assessment says is missing, with the reason in writing, which is what a risk department or a board asks for before approving a purchase.
Your maintenance, visible
The platform shows which camera stopped recording, which one was turned and which recorder is running out of days. Your technician arrives knowing what to fix, and your client sees in the monthly report what was fixed and when.
How invoicing works
Each of us invoices the client for our own part, or you invoice everything and I invoice you, if you prefer to arrive with a single proposal. It is agreed with you, in writing, before the first visit.
If your company provides guarding, you are already where this gets decided: the SEPS regulation requires guards from private security companies, under a current contract, at tier 1, 2 and 3 credit unions, building societies and central credit unions (art. 4.1 f)). What you need to sell them more is not another camera, but the ability to show the risk department that what is installed records and covers what the regulation requires.
How it starts: one site first
In stages, starting with a single site. Each stage stands on its own and delivers something useful even if you stop there.
1 · Assessment of one site
One whole site, branch or condominium: which cameras record and which do not, how many days each recorder really keeps against the minimum that applies to it, which required points have no camera, and which devices still have their factory password or are exposed to the internet. Two weeks.
2 · Pilot at that site
The platform, the AI inside the site and the logs running, with every alert counted, true and false, before scaling up. The AI goes live only once its assessment is up to date. It is accepted with the covered-camera test.
3 · Roll-out in waves
Site by site, applying the lessons of the pilot and without switching off anything that works today. Each wave is accepted with the same test.
4 · Ongoing operation
Every day, the health of each camera and the days stored on each recorder; every month, scheduled updates, AI tuning with the month's false alerts and a report for management, the security officer or the board. Adding sites or new functions is a separate project, with its own scope and price.
What the assessment asks of you. One hour from whoever is responsible for security, to pin down what worries you and which regulation applies; read-only access to the recorders, or the data your technician exports if your policy does not allow remote access; half a day from your technician or your security company at the site, with a checklist I prepare; and one hour to go through the results together.
What it leaves you. A written report that is yours even if you go no further with me: the state of that site, the staged plan for all of them, based on the inventory you send me for the rest, and the pilot proposal, with its scope, its price and its acceptance test. At a credit union it serves the security officer, the risk committee and the next inspection; at a condominium, the board and the owners' meeting; and with it any security company can quote for what is missing. If what you have can be fixed with adjustments, I will tell you so and I will not sell you the platform.
What I see of your security stays with you. An assessment puts in writing exactly what would help anyone who wanted to rob you: which point has no camera, which recorder keeps fewer days and which device still has its factory password. That is why I sign your non-disclosure agreement before receiving any data, or a one-page one with these rules: I work with a read-only user that you create and delete, the report goes only to whoever you designate and, if we do not go on to the pilot, I delete my working copies thirty days after delivering it. Your institution's or condominium's name never appears in anything I publish.
The assessment has a fixed price, and each stage has its scope and price in writing before it starts. You can stop after any stage.
The guarantee: the covered-camera test
You have one doubt, and you are right to have it: that on the day it matters, the system will not alert. This is how it is answered, at your site and with you watching.
The pilot's acceptance test. A camera is covered, another is unplugged, an alarm is triggered and the link between the site and your server is cut. Each one has to arrive as an event, with its time and its video, on the screen of whoever responds, and whatever happened while the link was down has to upload by itself, with its original time, when the link comes back. If it does not pass that test, I do not charge for my part of the pilot.
False alerts, with a number agreed beforehand. Before starting, we set how many false alerts a day your operator can handle without starting to ignore them, and at the end of the pilot every alert is counted, not a hand-picked sample. Any detection above that number I keep tuning at no cost until it comes down, or it is switched off: an alert the operator learns to ignore is worse than having none.
For it to apply: the test is done at your site, with your cameras and with whoever actually handles the events, not in a demo. That condition works in your favour, because in a demo everything works.
What is delivered, what is not, and who answers for it
In security, whatever was not written down comes to light on the day of the incident. These are my limits.
The physical side belongs to your security company
I do not sell or install cameras, cabling, recorders or sensors. Your security company does that, or one I recommend, based on what the assessment says is missing and why.
Events are handled by whoever responds today
Your guard and your monitoring centre, in-house or contracted. The platform brings them each event with its video; it is not a monitoring or response service, and it replaces neither.
I answer for the platform
That it receives, alerts and stores. Support hours and response times are written into the operation proposal, before it is signed. And if your server stops, each site keeps recording and detecting, just as when the link goes down.
Everything stays in your name
The server, the passwords, the documentation and the licences, if any tool has them. Your IT department, or the provider you choose, can run the platform without depending on me.
The regulation and the law remain yours
I do not certify compliance or give legal advice. I leave you the technical information your balancing assessment, your risk unit or your lawyer needs, and the record to show what was done.
One pilot at a time
Each pilot is software running at a real site, and only one runs at a time. If the slot is taken, I tell you the date of the next one before you invest time in this.
AI video analytics, inside each site
Video is analysed on a small device installed at the site itself. The events and clips that matter leave it; the rest of the video stays recorded at the site and is only viewed with permission.
Weapon detection
It detects a visible weapon and alerts an operator, who checks it before escalating. Human verification is part of the design: no detection is perfect, and a false weapon alarm must never reach the police unchecked.
People where nobody should be
In the vault, at the teller counters, in technical rooms or in closed common areas, outside the hours set for each.
Loitering
Someone who stays in front of the ATM, at the entrance or by the perimeter longer than normal.
Camera tampering
Covered, turned, out of focus or blank: each one is an event, not a gap discovered later.
Abandoned objects
A bag left unattended in the lobby, a corridor or by the gatehouse. In busy areas, such as the customer area, this detection raises more false alarms, and the pilot measures where it works.
Foot traffic
How many people per hour and per site, counted at the edge without keeping images or identities, to decide how many counters to open or where to place the guard. Since this is a purpose other than security, it goes into the balancing assessment before it is switched on.
What it does not do, on purpose. It does not recognise faces and does not record audio. Ecuador's data protection law treats biometric data as sensitive (LOPDP, art. 4), and the data protection authority does not accept legitimate interest as a basis for processing sensitive data or for recording audio in video surveillance (Res. SPDP-SPD-2025-0041-R, arts. 15 and 16). The analytics work with objects and behaviour, not identities; the only reading that identifies is plate reading at a condominium's vehicle gate, and it goes into that condominium's balancing assessment.
Why inside the site. It needs far less bandwidth, keeps detecting and recording if the link drops, and footage of people does not travel further than it must.
Before switching it on. Where the legal basis is legitimate interest, adding analytics to cameras that already record changes the risks of the processing, so the existing balancing assessment is no longer valid (Res. SPDP-SPD-2025-0041-R, art. 18). And systematic, large-scale monitoring of a publicly accessible area, such as a branch network, also requires an impact assessment (LOPDP, art. 42). The AI goes live only once those assessments are up to date.
The architecture, on top of what is already installed
For your IT department and your security company, who are the ones who will review the design. Three zones, each with a single job: the site captures and analyses, the network carries everything without exposing it, and your server decides and stores.
At each site · branch or condominium
Analogue camerasthe ones already installed, through a hybrid recorderRTSP · ONVIF
IP cameras at critical pointsteller counters, vault, ATMs, gatehouse, vehicle gate
Access control, sensors and alarmsdoors, fence, panic button, readersOSDP · SIA DC-09
Artificial intelligence nodeanalyses the video inside the site; the events and clips leave it
Security network
dedicated, no internet egress, encrypted linkOn your server
Security platform
- events with their video
- camera health and retention
- logs, visitors and patrols
- permissions and audit
- fingerprint of every export
Monitoring centrein-house or contracted; receives each event with its video
Analogue cameras are not thrown away. A hybrid recorder puts their image on the network and the platform receives it as one more stream, at whatever resolution that camera has. The cameras at critical points are replaced first, where the analytics need more resolution; the rest are replaced at the end of their useful life, not before. It is the same method as the architecture map, applied to security.
The details you do not see, and that make the difference
A security system can be attacked too, and the evidence it produces can be disputed. These decisions are made in the design, not afterwards.
A network just for security
Cameras, recorders and readers sit on a separate network with no internet egress, the manufacturer's cloud services switched off and an encrypted link to head office or management. Cameras and recorders exposed to the internet are a well-known target for cyberattacks, and for credit unions the 2026 regulation already requires it: a separate network, protected recorders and servers, every device hardened and patches kept current (fourth general provision).
One password per device, and current firmware
No device keeps its factory password or shares another's. There is an inventory with the version of every recorder and camera, and updates are applied on a schedule, not when someone remembers.
The exact time
Every device syncs its clock to the same time server on the security network, which is synchronised with Ecuador's official time from INOCAR, the navy's oceanographic institute. A video with a clock ten minutes off is a video that gets disputed, and an alarm that does not match its scene proves nothing.
Open standards, not lock-in
ONVIF for camera video and events (Profile T, with the older Profile S only on equipment already installed, and Profile M for analytics metadata), OSDP with Secure Channel enabled for access control readers instead of Wiegand, which travels unencrypted, and encrypted SIA DC-09 for IP alarm reporting to the monitoring centre. With open standards, switching camera brands does not mean switching systems.
What to demand from anyone selling you this
Five questions separate a serious security platform from a recorder by another name. The answers should come straight away.
Where does the footage live, and in whose name?
If the answer is the vendor's cloud, your recordings depend on a contract. Ask for the platform to be installed on your server or in your data centre, and for that to be in writing.
How will I know a camera has stopped recording?
If the answer is that the technician checks it at the next maintenance visit, you will find out on the day of the incident. Demand automatic alerts and an operating record.
How many false alarms does the detection produce?
A brochure percentage does not answer that. The serious answer is a pilot at one of your sites, with true and false alerts counted before you buy for every site.
Does it recognise faces or record audio?
If they say yes, ask on what legal basis. Recognising faces means processing biometric data, the kind that uniquely identifies a person, which Ecuador's data protection law treats as sensitive (LOPDP, art. 4); the data protection authority accepts legitimate interest neither for sensitive data nor for recording audio in video surveillance (Res. SPDP-SPD-2025-0041-R, arts. 15 and 16). If the system ships with audio on, it has to be switched off.
Do all the cameras need replacing?
Almost never. Ask to see what can be kept through hybrid recorders, which critical points do need a new camera, and why.
Frequently asked
Does it work with our Hikvision cameras?
Yes. The platform takes video from recorders and cameras over RTSP and over ONVIF, which current Hikvision devices ship with switched off and which is enabled in their settings, just as with any other brand that supports them. The assessment confirms, model by model, what can be reused.
Does it help meet the new SEPS security regulation?
It covers the electronic side the regulation asks to monitor and record: 24-hour recording with an operating record, coverage without blind spots, three months of footage measured, alarms linked to their scene, logged access, the separate security network and the security officer's report. The physical side, such as armour, vaults and guards, stays with the institution and its security company.
What happens if the site's internet goes down?
The site keeps recording and the node keeps detecting. Events wait at the site and upload when the connection is back, with their original timestamps.
Do we need a server?
Yes: the platform runs on your own server or in your data centre. The assessment determines its size, based on how many sites and cameras there are and how many days of footage must be kept. In a condominium, one machine in the management office may be enough.
Does it work for a small condominium?
Yes. You can start with the gatehouse: visitors, plates and parcels, with the cameras already there. The rest can be added later.
How much does it cost?
The assessment has a fixed price, stated in the proposal before it starts. The pilot and the roll-out are quoted from what the assessment finds: how many sites, how many cameras, how many days must be kept and what equipment is missing; your security company quotes the equipment. I do not publish a figure that has not come from your sites.
How long does it take?
The assessment of one site, two weeks. The rest depends on how many sites there are and on the state of the network, which is why it comes out of the assessment: the staged plan, with its dates, in writing.
Does this comply with data protection law?
It is designed to: no facial recognition, no audio, set retention periods, permissions and a record of who sees what. The institution or the condominium is the controller, because it decides what is recorded and why; whoever runs the platform on its behalf is a processor, with a contract and obligations of its own (LOPDP, arts. 34 and 47). The project hands over the technical information its balancing assessment and, where required, its impact assessment need.
14 /
Tell me about your sites
Tell me how many sites you have, how many cameras and which brand, and what worries you today. If you are a security company, tell me the same about a client's site. Within one business day I reply with the assessment proposal: scope, timing and price in writing, free and with no commitment.
contacto@andresbrinez.comSix years building systems for companies in three countries: Colombia, Ecuador and Australia