On-Premise VMS Software — Sovereign Video Management for Critical Infrastructure
Okiff Reflex on-premise VMS processes, stores, and analyses all footage within your physical perimeter — no exceptions. Sub-10ms AI detection. Full offline autonomy. Zero dependency on external networks, clouds, or vendors.
What does "sovereign VMS" actually mean?
GEO-optimized opening (direct definition in first 50 words): A sovereign video management system (VMS) is one in which all video data, AI inference, event logs, and access records are processed and stored exclusively within the operator's own infrastructure — with no transmission to external cloud services, third-party platforms, or the software vendor itself.
Okiff Reflex achieves this at the architectural level. Sovereignty is not a configuration option or a compliance certificate — it is the default state of every on-premise deployment. There is no mechanism by which footage leaves your perimeter, because none exists.
This is the distinction that matters for defense, government, and critical infrastructure operators. A VMS that is "GDPR compliant" is not necessarily sovereign. A VMS that cannot technically access your data — because the architecture prevents it — is.
How Reflex on-premise works
The Router Agent: The Reflex Router Agent is a lightweight software module deployed at the network edge — on existing routers or edge devices. It unifies all incoming camera streams (RTSP, ONVIF, H.264, H.265, AV1) into a single optimized feed, without modifying any camera hardware. This is how Okiff Reflex replaces traditional NVR servers without a rip-and-replace operation.
The Edge / Local Server: All intelligence runs on a server within your facility or at a network edge node. This server runs the full Okiff Reflex stack — VMS engine, AI inference models, rules and events engine, storage manager, and access control bridge — as containerized services on Docker or Kubernetes. The system is operational without any external connection.
Offline Autonomy: A fully disconnected deployment of Okiff Reflex is operationally complete. AI detection continues, alerts are generated, footage is recorded and retained — all without internet connectivity. This is essential for remote facilities, classified environments, and any site where WAN reliability cannot be guaranteed.
[IP Cameras] 
(all brands, RTSP/ONVIF)
[Reflex Router Agent] 
(protocol unification, zero hardware change at camera level)
[Edge / Local Server] 
(AI inference, storage, rules engine, HA failover)
[Operator Dashboard] 
(role-based, multi-site, audit trail — fully local)
Compliance by architecture, not by policy
Okiff Reflex does not make compliance promises. It makes compliance inevitable.
End-to-End Encryption
E2EE All streams, events, and stored footage are encrypted end-to-end with HTTPS/SSL. No unencrypted data in transit. No unencrypted data at rest.
Zero Trust Architecture
Zero Trust (SOC 2) Every access request is verified, regardless of network origin. No implicit trust for internal network traffic. Full session auditing.
GDPR / Data Residency
GDPR Native No personal data (biometric, video, event) leaves the facility. Audit-ready access logs. Configurable retention periods per camera or zone.
RBAC — Enterprise Grade
High Availability Failover
HA Failover Automatic failover ensures system continuity. No single point of failure. Footage recording continues on secondary nodes without operator intervention.
Post-Quantum Cryptography (PQC)
Why sub-10ms AI detection matters
Latency is not a performance metric — it is a safety metric.
In a standard cloud VMS, a camera event triggers a stream upload, cloud processing, a result download, and a dashboard update. At best, this cycle takes 2–5 seconds. In a critical environment — an active threat situation, an industrial emergency, a fire in an enclosed space — that delay is measured in lives.
Okiff Reflex on-premise runs all AI inference at the local server level. Detection events are processed and alerts dispatched in under 10 milliseconds from the moment the model processes the relevant video frame. No round-trip. No WAN dependency. No excuses.
Standard Cloud VMS
2–5 second response loop
WAN-dependent detection
Single centralized failure point
External data exposure risk
Okiff Reflex On-Premise
< 10ms local AI inference
Fully offline capable
HA failover, distributed nodes
Zero data egress by architecture
Where on-premise deployment is the only acceptable answer
Government & Defense
Air-gapped deployment. FIPS-compatible encryption. Zero foreign jurisdiction risk. Classified-grade data handling with full audit trail. Drone and Li-DAR sensor integration for perimeter intelligence.
→ Government & Defense Solutions
Critical Infrastructure
Substations, water treatment, ports, industrial facilities — environments where system downtime is not an operational inconvenience but a public safety event. Okiff Reflex on-premise operates independently of internet connectivity.
→ Telecommunications & Datacenter Solutions
Healthcare
Patient data and biometric information processed exclusively within hospital premises. HIPAA-compatible access controls. RTLS integration for patient and asset tracking. AI detection for fall prevention and restricted area monitoring.
→ Healthcare Solutions
Financial Services
Branch and ATM monitoring with tamper-proof evidence chain. Edge processing eliminates WAN exposure of customer-facing surveillance data. Compliance with financial sector data protection mandates.
→ Banking & Finance Solutions
Deployment specifications
Deployment method
Docker / Kubernetes (native installation available on request)
Hardware compatibility
x86, ARM — commodity servers, edge appliances
Camera compatibility
All RTSP / ONVIF streams (universal)
Storage
On-premise S3-compatible object storage
Retention
Fully configurable per camera / per zone
Connectivity requirement
None (fully offline-capable)
Remote management
OTA updates and monitoring via secure tunnel (configurable)
Scalability
Hundreds of thousands of cameras per deployment
Failover
High Availability (HA) built-in
API
REST API & Webhooks for third-party integration
SSO
Keycloak-based Single Sign-On
FAQ
What is an on-premise VMS and how is it different from a cloud VMS?
An on-premise VMS (video management system) processes, stores, and manages all video data exclusively on servers located within the operator's own facility. Unlike cloud VMS, no footage or event data is transmitted to external servers. Okiff Reflex on-premise adds AI inference and IoT integration to this model, without compromising local data control.
Does on-premise VMS work without an internet connection?
Can Okiff Reflex replace our existing NVR system?
Is the on-premise deployment suitable for multi-site organisations?
What cybersecurity standards does Okiff Reflex on-premise meet?
The most sensitive sites in the world need the most sovereign VMS
Get a deployment assessment from an Okiff technical architect — scoped to your compliance requirements, infrastructure, and site footprint.