Eyes over the incident,
before the first appliance.
When a 999 fire call drops, a drone that reaches the scene ahead of the crews can stream thermal overwatch to the incident commander. This is the console they would watch it from, and the governance designed to help a Fire & Rescue Service answer its data-protection questions. Warden sends no command to the aircraft; the service flies its own drones, as it does today.
Interactive pre-production demo. Everything here is synthetic — no real incident, no real people, no personal data. It runs entirely in your browser and makes zero external network requests — nothing is collected, transmitted or stored. Run a callout below.
01 UK data protection — designed in
The blocker to fire drones isn't the tech. It's a data-protection officer being able to sign it off.
Flying a thermal camera over homes is personal-data processing. So governance isn't a policy PDF bolted on afterwards — it's designed into the console, and every decision is written to the hash-chained ledger above. This is the posture the product is designed to; a real deployment would be finalised by the service's data protection officer, who completes and owns the data protection impact assessment (DPIA).
Proposed: public task, life-safety
Warden proposes that imagery which may include people is processed under public task (Art 6(1)(e) of the UK General Data Protection Regulation, the UK GDPR), a statutory fire & rescue function, with vital interests (Art 6(1)(d)) as the narrow fallback in an acute life threat. Any casualty or health signal would be special-category data; the service's data protection officer decides the Article 9 condition, and Art 9(2)(c) (vital interests) is one candidate. The lawful basis is the fire service's to decide; the purpose is strictly firefighting and scene safety.
No facial recognition.
Overwatch assesses a scene, never identifies a person. No facial-recognition or biometric-matching model is integrated, and the architecture is designed so it cannot be added without a governance change. Bystanders are minimised, not recognised.
Assessed before it flies
Systematic monitoring of a publicly accessible area on a large scale requires a Data Protection Impact Assessment (Art 35(3)(c)); whether a deployment meets that test is the data protection officer's call. Warden provides a starter; the deploying service's data protection officer completes and owns the DPIA before day one.
Overt, incident-linked only
Overt, incident-linked emergency use generally falls outside the directed-surveillance regime of the Regulation of Investigatory Powers Act 2000 (RIPA) — covertness is assessed case-by-case. The system is designed for overt, incident-triggered use only; and Article 8 necessity and proportionality apply to every flight regardless.
Live-only by default
Overwatch is live-only by default — nothing is recorded. When a commander explicitly authorises recording, footage is retention-bound and designed to be deleted automatically unless lawfully held as evidence (fire investigation, coroner, litigation); that scheduled deletion is not yet switched on. Subject-access, Freedom of Information (FOI) and disclosure requests are designed to be handled with a full access trail.
Designed to the principles
Designed to follow established surveillance-camera good-practice principles: a clear purpose, proportionate use, published policies, and accountable oversight.
Hosted in Ireland today, not the UK
Designed to be encrypted in transit and at rest, with role-based access and no third-party data sharing. The backend currently runs in Ireland (eu-west-1), not the UK. No independent security assessment has been done yet.
Necessary & proportionate
Each deployment would be justified against necessity and proportionality (Human Rights Act, Art 8). The named commander's authorisation is recorded before the flight.
The ledger is the record
Who opened the incident, who authorised the flight, each hazard flagged, any purge of imagery and the seal — all hash-chained. A separate access log, protected against edits and deletion, sits outside the chain. In Warden's backend each link is chained with keyless SHA-256 and signed with Ed25519 under a published key, so anyone holding an export can check it against the pinned fingerprint without Warden. Events up to the latest time-stamped anchor (one whose token verifies) also carry an outside RFC 3161 time-stamp, so they cannot be altered undetected after that time-stamp; newer events are not covered until the next anchor, and the verification page lists the other limits. Try the tamper test above: it runs in your browser with a throwaway demo key.
02 What gets implemented
Warden is the governance and the record. The drone stays your service's own.
Warden provides (software)
- The commander's operating pictureThermal + electro-optical (EO) + incident data as one live decision view, on a tablet in the appliance.
- The hash-chained audit ledgerEvery opening, authorisation, hazard flag, purge and seal, chained in order and signed, so a data protection officer can check an export without Warden. External RFC 3161 time-stamping covers events up to the latest anchor; the first was made on 1 November 2026.
- The governance designRole-based access, a recorded human authorisation and a governed purge, built into the software, with no facial recognition. The lawful basis is the service's to decide, not something the software checks, and scheduled deletion is not yet switched on.
- The post-incident recordA sealed record that carries its retention period. Redaction and disclosure handling are not built yet.
Your service & its existing suppliers provide
- The drone & thermal payloadYour service's own aircraft, bought through suppliers it already uses.
- Any dockWhere a service uses one. No dock connection is built yet, and there is no DJI integration.
- The flying & Civil Aviation Authority (CAA) permissionsYour service's own remote pilots and permissions, unchanged.
- Computer-aided dispatch (CAD)Your service's own 999 dispatch system. No connection from Warden to it is built.
Day-one reality: the drone launching before the crew leaves is a long-term direction, not where UK services are today. A first version would sit alongside a service's existing drone unit, with its own pilots flying as they do now. Warden records the decisions either way; how autonomous the flying becomes is the service's and its suppliers' call, not Warden's.