Casebound

Case-scoped forensic face search · built for Canadian law

Face search that ends when the case does.

Police search camera footage for one person, in one authorized case — and only with each camera owner's approval. When the case closes, the footage and face data are deleted. No always-on surveillance. No citywide face database.

Launch the demo How a case works
I'm with a police serviceGet footage in minutes, with a court-ready record → I own a cameraYour rules: approve or deny, everyone else blurred →
Halftone reproduction of a synthetic composite face — the sought person exhibit
EXHIBIT A · sought person
source: case reference photo
Halftone close-up of an eye from CCTV footage
CASE WINDOW
JUL 02 18:00 → JUL 04 06:00
OWNER CONSENT
GRANTED PURGE ON CLOSE
POLICY ENFORCED
Your video stays on your network· Owner approval creates access· Every action logged· Deleted when the case closes· Charter s. 8 · FOIP · PIPA
01The problem

The footage is overwritten before anyone reaches the door.

After an incident, officers canvass door to door and ask each owner to find the clip, download it, and hand it over — a USB stick, an email, a text. Days of it. Meanwhile most home cameras overwrite their storage in about 24 hours. The evidence is routinely gone before the canvass gets there — for the police and for the family.

Today · the manual canvassdays
  1. Officer knocks — owner is at work, on vacation, or asleep
  2. Owner hunts through an app for the right clip
  3. Owner exports, compresses, emails — or hands over a USB
  4. Repeat, one door at a time, across the whole street
against
The camera · retention loop≈24 h

Then it records over everything. Whatever was not collected no longer exists.

Casebound deletes the download-and-send step. One request reaches every registered camera at once; the owner approves from their phone; the footage is in the case in minutes, not days — while it still exists.

02For police & forensics

Evidence at canvass speed: minutes, not days.

A forensic tool with the paperwork built in — the legal authority is recorded before the first frame is processed, and every step lands in the audit log on its own.

a

Every camera on one map. One request reaches them all.

Registered doorbells, driveways, storefronts, transit and city cameras — plotted on the live street map. Pick the cameras around the incident and send one access request for the exact footage window you need. No door-to-door. No absent owners — the request goes to the owner online, wherever they are, and their approval from a phone takes minutes.

REQUEST → OWNER'S PHONEONE CASEONE WINDOW

b

See where the suspect moved — the path builds on the map.

Each sighting drops a pin; Casebound connects the movement along the actual roads, in time order, so the route someone took across the city reads at a glance — which way they came, where they went, which camera to request next.

Real street map with an amber route connecting four numbered camera sightings across downtown Calgary, in time order
Real case map · four confirmed sightings, connected along the roads
c

Find one face — a missing person, a named suspect.

Enroll a reference photo when you open the case; search runs only inside that case's footage and returns ranked leads with similarity scores — never automated identifications. Every search and every viewed lead lands in the case record.

A MATCH IS A LEADA PERSON REVIEWS ITEVERY SEARCH LOGGED

d

The audit trail writes itself.

Open, request, consent, search, view, export, close, purge — every action is recorded with who did it and when. The same trail that stands up in court is the one that shows the public exactly how a case was handled.

DISCOVERABLEDEFENSIBLEEXPORTABLE

03For camera owners

Your camera. Your rules. No USB sticks, no strangers at your door.

Registering your doorbell or storefront camera just puts its location on the map — nothing else. Footage moves only when you approve a specific case, for a specific time window. Here's exactly what protects you:

the one person police may look for

Every face is blurred — except the one person police are allowed to look for.

Police never see your camera outside the window you approve. Inside it, they see only the one person from that case — and anyone that person meets or hands something to, so an accomplice can't hide behind the blur. Every other face — your family, your customers, your neighbours — is blurred automatically. No photo of a suspect on file? Then every face stays blurred.

You decide every time. And saying no is always fine.

Approve or deny every request — ask the detective questions first, in writing. A no ends the request, and nothing else happens. Your portal shows a live list per camera: which case has access, to what window, and when it ends. When the case closes, access and data end with it.

And it works for you, too: when something happens on your street, police can reach the cameras around your home in minutes — while the footage still exists, instead of days later when it's already been recorded over.

Helping counts — and it earns you real thank-yous.

Close a case you helped with and you earn points, with more when your camera produced the lead. Redeem them for rewards from a catalogue set with your city and police service. The Calgary pilot design:

  • 50 Community recognition certificate
  • 90 Coffee with a neighbourhood officer
  • 150 Police station tour
  • 250 K9 unit meet & greet
  • 400 Patrol car ride-along
  • 1000 VIP spot in the Stampede Parade

The hinge between the two sides: only the owner's approval creates the grant that authorizes access. Police cannot self-grant a third party's camera — that rule is enforced in code, not in a policy binder.

04How a case works

Five steps. Every one authorized, audited, and reversible — except the audit.

The case is the unit of authorization. Step through the lifecycle — the receipt on the right grows at every step, and it is the only thing left at the end.

Steps advance on their own — click any step to jump. The scene is illustrative; the mechanics are the shipped ones: fail-closed gate, per-case index, owner-created grants, purge on close.

05The lesson

Scan-everyone tools lost in Canadian courts. Casebound searches for one person, with permission — then deletes.

In 2021, Canada's federal and provincial privacy commissioners found Clearview AI's model unlawful: scrape everyone, keep everything, search anyone. The RCMP's use of it was found unlawful too. Any face-search tool built for Canadian policing starts from that finding — not from what the technology can do. Casebound is designed to break every factor of it.

Whole-population scrape → No scraping. Footage enters per case only.
No consent, no authority → Owner consent or recorded legal authority, per case.
Standing general-purpose index → Per-case index. No cross-case or global search exists.
Searchable against anyone → Search runs only inside one authorized case.
Indefinite retention → Purge on case close or expiry.

“A face embedding is a biometric identifier. Removing the name column does not change that.”

— the design decision that rejected the always-on citywide index
06Compliance posture

Controls that map to the law — with honest status.

Each technical control lines up with the requirement it supports under Charter s. 8, Alberta FOIP and PIPA, PIPEDA, and the 2022 joint guidance on police use of facial recognition. The code enforces what code can enforce. The rest is named, not hand-waved.

Lawful basis per collection Every case carries an authorization reference — warrant, production order, consent, or exigency. Nothing runs without an open case. Enforced in code
Purpose limitation Search is scoped to one case. No cross-case or global query exists in the codebase. Enforced in code
Data minimization Fail-closed gate — processing only for granted cameras, inside both the case and grant time windows. Bystander faces blurred by default. Enforced in code
Owner consent (PIPA) Access-request flow — only the owner's approval creates the grant that authorizes access. Enforced in code
Retention limits Purge on close or expiry deletes the case's embeddings, watchlist, and sightings. Enforced in code
Accountability Append-only audit of every open, grant, enrol, search, match, close, and purge — with actor and time. Enforced in code
Human in the loop Matches surface as leads for review, never as identifications. A mandatory review procedure is established with your service during rollout. Deployment step
Access control Every action is actor-stamped with police / owner role separation. Production deployments integrate your identity provider and access policy. Deployment step
Accuracy & demographic bias Threshold calibration and demographic-bias certification on representative footage are completed — and published — before any live use. Pre-launch gate
PIA + OIPC engagement A Privacy Impact Assessment and engagement with the Alberta OIPC precede any deployment. The architecture is built to make both straightforward. Pre-launch gate
Charter s. 8 Alberta FOIP Alberta PIPA PIPEDA Criminal Code s. 487.014 OPC joint FR guidance, 2022

This is not legal advice. Compliance is conferred by the legal basis for each collection plus the governance around each use — not by software alone. The architecture's job is to make the lawful path the only path the code can take.

07Proof

A validated core. Honest limits.

No inflated claims. The recognition core is real and measured — and its limits are documented, because your privacy officer will ask.

0-D
On-device face embeddings

A real pretrained stack — detection, 68-point landmarks, deep recognition — running where the footage lives. Video never leaves your network.

0/6
Same-face matches under moderate CCTV degradation

At roughly 400 px face resolution, 6 of 6 matched. At harsh quality — 250 px with heavy JPEG — 3 of 6. That overlap is exactly why matches are leads for human review, never identifications.

0
Biometric records after a case closes

Purge on close is enforced by the index itself — not by an operator remembering to delete.

0%
Of case actions in the audit log

Open, grant, enrol, search, match, close, purge — every one actor-stamped and append-only. Discoverable, defensible, exportable.

The deployment path

Every rollout runs through the same gates, together with your service — none of them are optional:

  1. Review by Canadian privacy counsel
  2. Privacy Impact Assessment; engagement with the Alberta OIPC
  3. A documented FR use policy with a per-use necessity & proportionality test
  4. Model accuracy and demographic-bias certification on representative footage
  5. Integration with your identity provider and access policy
  6. A mandatory human-review procedure
  7. A transparency and oversight mechanism your public can see

Police use of facial recognition remains legally unsettled in Canada. Casebound treats that as a design input — not a footnote.

08Inside the product

The real screens — not renderings.

Captured straight from the working product with a demonstration case: a missing 16-year-old, four cameras their owners approved, and the route her sightings traced across downtown.

09Pricing

Camera owners never pay. Agencies fund the system.

The consent side of this system — the residents and businesses who share footage — is never charged and never will be. The investigating side pays, and every paid plan includes its hosting: the server the system runs on is inside the price, not a separate bill.

Camera owners
Freealways
  • Register cameras — location only, never a feed
  • Approve or deny every request, with a question thread
  • Signed approvals, per-camera access ledger, kill switches
  • Share-footage and go-live links; points and real perks

Goodwill is not a revenue line.

Investigative team
Per seatmonthly · negotiated per pilot
  • Everything shipped: cases, canvass & map area-select, live looks, footage review with enforced redaction
  • Tamper-evident audit with published anchors
  • Purge on close — enforced by the index, not by policy
  • Hosting included — runs on managed infrastructure we operate; the server bill is inside the price

Minimum 5 seats. Month to month.

Agency
Annualper service · negotiated
  • A dedicated, isolated instance on its own server — your data never shares infrastructure with anyone
  • Unlimited seats and cases for one service
  • Deployment-path support: PIA and Alberta OIPC engagement alongside your service
  • Infrastructure included — the dedicated server, secure tunnel and storage are part of the plan

For a police service or municipal pilot.

There is no public rate card — pricing is negotiated with each pilot agency, and every paid plan includes its hosting. Every plan still runs the full deployment path above (counsel review, PIA, bias certification, human-review procedure); no tier skips a gate. The public demo stays free.

Talk to us about a pilot Read the compliance posture first

See a case run end-to-end.

Sign in as a detective or as a camera owner. Open a case, request a camera, approve it from the other side, run a scoped search, close the case — and watch the purge land in the audit receipt.

Launch the interactive demo Review the compliance posture