When a 999 fire call drops, a drone lifts from its station and reaches the address ahead of the appliances — streaming live thermal overwatch to the incident commander. Warden is the software built to make that overwatch lawful, accountable, and ready for a DPO to sign off.
See how it works ↓A fire crew rolls to a 999 call knowing an address and little else. The minutes that decide how the fire ends are lived without a picture. Warden turns the call itself into eyes over the scene — so the crew arrives already knowing what it is walking into.
When a fire is reported, the first ninety seconds decide the outcome. Warden turns the dispatch itself into airborne thermal overwatch, so the ground crew arrives already knowing what it is walking into.
The moment a 999 call is categorised, Warden reads the dispatch feed and confirms the pre-cleared BVLOS corridor is clear — a signed check against the operator’s standing Operational Authorisation, not a phone call. The route is live before anyone has moved.
The nearest rooftop Drone-in-a-Box runs its own pre-flight and lifts off autonomously — after a named human authorises it. No appliance is committed just to take a look.
Position, battery, altitude and thermal video stream as high-frequency MQTT into Vigil — the common operating picture the whole response shares.
The incident commander watches sub-500ms encrypted WebRTC thermal video: eyes over the scene before the first appliance arrives, and one picture the whole response can act on.
Architecture & figures illustrate a design concept — not a deployed system or delivered performance.
Warden isn’t a drone — it’s the command-and-accountability layer that sits downstream of one. It never controls the aircraft, so it works with any platform that can hand it two feeds: live thermal video, and telemetry. That’s the whole compatibility test.
Anything on ArduPilot or PX4 speaks MAVLink — exactly what Warden’s telemetry bridge ingests. Pair it with a standard RTSP / SRT video feed and it’s near plug-and-play.
Aircraft with their own SDK or cloud API — or a Drone-in-a-Box — integrate through a thin, per-vendor adapter that maps their video and telemetry onto the same contract.
Video and telemetry flow in; no command flows out. Warden can’t arm, steer or land the aircraft — so integrating it adds nothing to your airworthiness or safety case.
The natural pairing is a UK, public-safety-grade thermal platform on an open or SDK-accessible stack — the same sovereign posture the rest of the system is built to.
In practice, a British BVLOS thermal platform like the Sky Mantis 2 already carries two video streams plus telemetry and C2 over one encrypted mesh link — Warden taps the thermal feed and the telemetry, with no change to the aircraft.
Illustrative, from published specifications — not a partnership with, or endorsement from, any named operator; any actual integration would be confirmed with the operator.
Thermal overwatch, the incident data, a human-in-command authorise gate and the live tamper-evident record — the view an incident commander would run it from. This is a glimpse; the full working prototype is one click away.
A camera in the sky is only welcome if it stays inside the law. So we wrote the line down as something the system runs on every tasking — four gates: a lawful basis, a human in command, a proportionate and targeted purpose, and a record you can answer for. One failure is a hard refusal.
An illustrative decision procedure for a design concept — example requests, not real taskings.
Flying a thermal camera over homes is personal-data processing. So governance isn’t a policy PDF bolted on afterwards — it’s wired into the software, and every decision is written to the tamper-evident record. This is the posture the product is built to; a live deployment finalises it with the service’s DPO under a full DPIA.
Imagery that may include people is processed under public task (UK GDPR Art 6(1)(e)) — a statutory fire & rescue function; vital interests (Art 6(1)(d)) is the narrow fallback in an acute life threat. Any casualty or health signal is special-category data handled under Art 9(2)(c) with a DPA 2018 Schedule 1 condition.
Overwatch assesses a scene, never identifies a person. No facial-recognition or biometric-matching model is integrated, and the architecture is designed so it cannot be added without a governance change. Bystanders are minimised, not recognised.
Systematic monitoring of a publicly accessible area requires a Data Protection Impact Assessment (Art 35). A real deployment completes and signs the DPIA with the deploying service before day one.
Overt, incident-linked emergency use generally falls outside the RIPA directed-surveillance regime — covertness is assessed case-by-case. The system is designed for overt, incident-triggered use only, and Article 8 necessity and proportionality apply to every flight regardless.
Footage is auto-deleted after a set retention window unless lawfully held as evidence (fire investigation, coroner, litigation). Subject-access, FOI and disclosure are handled with a full access trail.
Designed to be encrypted in transit and at rest, with UK data residency and UK-held keys, role-based access, and no third-party data sharing or foreign control plane. Aligned to NCSC secure-by-design principles.
The whole system on one picture — what the drone sends in, what the commander controls, and how every decision becomes a signed, tamper-evident record. The flow a data-protection officer and a partner engineer both need to see.
Warden sits downstream of the ground station and physically cannot send flight commands. Adding it introduces no airworthiness or liability surface to the operator’s aircraft.
By default the thermal feed is live-only — no imagery is stored. Any opt-in recording is retention-bound, and its deletion is itself written to the record as a signed event.
Every action is signed into an append-only HMAC hash chain. Edits, deletes and un-seals are rejected at the database, and anyone can recompute the chain to prove it was never altered.
Diagram illustrates a design concept — not a deployed system.
Every flight leaves a trail: who authorised it, what was recorded, why, for how long, and who accessed it. Each entry is hash-chained to the one before it, every launch waits for a named human, and any attempt to quietly edit the past breaks the chain in front of you.
A synthetic incident record for a design concept — the hashes are real (SHA-256); the flight, people and data are illustrative.
A camera over the public earns its place by what it refuses to do. These are hard limits, wired into the software — not promises in a policy document.
No facial-recognition or biometric-matching model is integrated. Overwatch assesses a scene, never identifies a person — and it can’t be switched on without a governance change.
Overt, incident-linked use only. Covert directed surveillance belongs to RIPA and a separate authorisation regime; that is not what this is built for.
Imagery is auto-deleted after a set retention window unless lawfully held as evidence. Storage limitation, by design — not indefinite retention.
Imagery is the service’s, held under UK data residency with UK-held keys. No third-party data sharing, no foreign control plane.
A named commander authorises every flight. Software recommends; a person decides, and the decision — with its reason — is written to the record.
These commitments describe a design concept, not undertakings by an operating company.
For fire & rescue innovation leads, drone-unit officers, and anyone working to reach the scene better: try the console, then let’s talk.
Human, in command, always.