This page is the written form of CounterClock's storage locations and data flow. It is kept in step with the certification questionnaire and the privacy policy; if they ever disagree, treat this page as the one to correct.
Where data is stored
| What | Where | How long |
|---|---|---|
| Ring OAuth tokens, sites, cameras, invited members | DynamoDB, AWS us-east-1 (encrypted at rest, point-in-time recovery) | until unlink or deletion |
| Camera snapshots | Amazon S3, AWS us-east-1 (encrypted at rest) | 7 days, by lifecycle rule |
| Raw motion events, service episodes | DynamoDB, AWS us-east-1 | 90 days, by record expiry |
| 15-minute aggregated statistics | DynamoDB, AWS us-east-1 | 400 days |
| Alerts | DynamoDB, AWS us-east-1 | 30 days |
| Connected TV screens (hashed access keys), TV pairing records, abuse-limit counters (hashed network address) | DynamoDB, AWS us-east-1 | until disconnected, unlinked or deleted, or 90 days unused; pairing records expire after 70 minutes, counters within 65 minutes; expired records are deleted by record expiry, normally within a few days |
| Frames during counting | memory only, on the relay and on the counting machine | not written to disk |
How data flows
Ring Partner API (motion event)
|
v
AWS Lambda, us-east-1 -- verifies the webhook HMAC over the raw body
| rejects on mismatch, de-duplicates, returns 200
v
occupancy engine -- opens/closes anonymous episodes
|
| periodically, while a site is open, requests one snapshot
v
Ring Partner API (snapshot) ---> Amazon S3 (7 days)
|
v
relay, Contabo GmbH, Karlsruhe, Germany
| terminates TLS, so it can see the frame: it is a SUB-PROCESSOR
| forwards over a private tunnel
v
counting machine, Dubai, UAE -- Qwen3.5-9B (self-hosted, open weights)
| returns ONE integer: people in frame
|
| if that machine is unreachable:
+--> Amazon Bedrock, US -- Claude Haiku 4.5, same single integer
|
| if the frame cannot be read at all:
+--> reported as UNVERIFIABLE. Never as zero.
v
DynamoDB -- counts and durations only. No image, no descriptor, no identity.
v
operator dashboard (passwordless sign-in; one-time code by email via
Amazon SES, AWS us-east-1; Resend as automatic backup)
What crosses a border
The snapshot leaves AWS in the United States, reaches the relay in Germany, and is analysed on a machine in the United Arab Emirates. That is a transfer outside the United States and we disclose it rather than imply it. Nothing is stored at either hop: the frame exists in memory for the detection and is discarded.
What never happens
- No face is detected, described, embedded or matched.
- No person is followed from one frame to another, or from one camera to another.
- No per-employee figure is produced — the product cannot tell staff from customers.
- No model is trained or fine-tuned on Ring customer data, self-hosted or managed.