Eyes over the incident,
before the first appliance.
When a 999 fire call drops, the drone reaches the scene ahead of the crews and streams thermal overwatch to the incident commander. This is the console they'd command it from — and the governance that lets a Fire & Rescue Service run it lawfully. Software you implement; the drone is any operator's.
Interactive concept demo. Everything here is synthetic — no real incident, no real people, no personal data. It runs entirely in your browser and makes zero external network requests — nothing is collected, transmitted or stored. Run a callout below.
01 UK security & data protection — built in
The blocker to fire drones isn't the tech. It's a data-protection officer being able to sign it off.
Flying a thermal camera over homes is personal-data processing. So governance isn't a policy PDF bolted on afterwards — it's wired into the console, and every decision is written to the tamper-evident ledger above. This is the posture the product is built to; a live deployment finalises it with the force's DPO under a full DPIA.
Public task, life-safety
Imagery that may include people is processed under public task (UK GDPR Art 6(1)(e)) — a statutory fire & rescue function; vital interests (Art 6(1)(d)) is the narrow fallback in an acute life threat. Any casualty/health signal is special-category data handled under Art 9(2)(c) with a DPA 2018 Schedule 1 condition. Purpose is strictly firefighting and scene safety.
No facial recognition. Ever.
Overwatch assesses a scene, never identifies a person. No facial-recognition or biometric-matching model is integrated, and the architecture is designed so it cannot be added without a governance change. Bystanders are minimised, not recognised.
Assessed before it flies
Systematic monitoring of a publicly accessible area requires a Data Protection Impact Assessment (Art 35). A real deployment completes and signs the DPIA with the deploying service before day one.
Overt, incident-linked only
Overt, incident-linked emergency use generally falls outside the RIPA directed-surveillance regime — covertness is assessed case-by-case. The system is designed for overt, incident-triggered use only; and Article 8 necessity and proportionality apply to every flight regardless.
Deleted by default
Footage is auto-deleted after a set retention window unless lawfully held as evidence (fire investigation, coroner, litigation). Subject-access, FOI and disclosure are handled with a full access trail.
Operated to the principles
Run to established surveillance-camera good-practice principles — now consolidated under ICO oversight following the Data (Use and Access) Act 2025 — a clear purpose, proportionate use, published policies, and accountable oversight.
NCSC-aligned, UK-sovereign
Designed to be encrypted in transit and at rest, with UK data residency and UK-held keys, role-based access, and no third-party data sharing or foreign control plane. Aligned to NCSC secure-by-design principles.
Necessary & proportionate
Every deployment is justified against necessity and proportionality (Human Rights Act, Art 8). The named commander's authorisation — and the reason — is recorded before the flight.
The ledger is the proof
Who authorised it, what was recorded, why, for how long, and who accessed it — all hash-chained and tamper-evident. Answerable to the ICO, the public, and the courts. Try the tamper test above.
02 What gets implemented
You create the brain and the trust layer. The drone is anyone's.
Vigil provides (software)
- The commander's operating pictureThermal + EO + incident data as one live decision view, on a tablet in the appliance.
- The tamper-evident audit ledgerEvery authorise, record, flag and access, hash-chained — the DPO's evidence.
- The governance engineLawful-basis, retention, no-facial-recognition and surveillance controls built into the software.
- The post-incident disclosure packSealed record, retention schedule, redaction and disclosure handling.
Off-shelf / partner provides
- The drone & thermal payloadCertified hardware — bought, not built.
- The Drone-in-a-Box dockWeatherproof automated hangar on the station roof.
- The flying & CAA authorisationA licensed BVLOS operator holds the Operational Authorisation.
- CAD integrationThe 999 dispatch trigger, integrated per force.
Day-one reality: the drone launching before the crew leaves is the destination. The first authorised version is human-supervised and pre-positioned, augmenting a service's existing drone unit. The autonomy dial turns up as the safety case matures — the console and the governance are built for both.