On-Premise Anonymization Software for Regulated Sectors

TL;DR: Gallio PRO blurs faces and license plates in recorded video and images entirely inside your own infrastructure, including air-gapped networks. It is built for security officers, DPOs and IT leadership in defense, healthcare and automotive R&D, where sending raw footage to a cloud processor is not an option. No detection logs are kept, no personal data is stored, and the AI models run offline.

Organizations in highly regulated industries, including defense, healthcare and automotive R&D, work under strict data protection obligations. Sensitive video and image data has to be processed under complete control, without exposing raw content to external servers. Gallio PRO delivers AI-powered on-premise anonymization software built for those conditions: full data sovereignty, data protection by design, and support for the Article 32 requirement on security of processing.

Why Regulated Sectors Require On-Premise Anonymization?

Military, healthcare and automotive testing environments generate large volumes of visual data, from surveillance material and clinical imagery to prototype test footage. Under Article 4(1) of the GDPR, an image from which a person can be identified is personal data, and a readable license plate can be linked to a registered keeper. In regulated environments, moving that material to an external provider introduces risk that is often simply not acceptable.

On-premise anonymization software keeps sensitive recordings inside the organization's own infrastructure. It supports the integrity and confidentiality principle in Article 5(1)(f) and the data minimization principle in Article 5(1)(c), without giving up analytical value. Our glossary entry on data sovereignty covers the underlying concept in more detail.

What Cloud Anonymization Actually Costs a Regulated Buyer?

This is the part that decides most procurement processes, and it is rarely about accuracy.

Uploading raw footage to a cloud anonymization service is itself a disclosure of personal data. The provider becomes a processor, which triggers a written contract under Article 28 with defined instructions, sub-processor controls and audit rights. If any part of that provider's infrastructure or support sits outside the EEA, the transfer falls under Chapter V, and the controller has to identify a transfer mechanism and assess whether the destination country's law undermines it. For a defense unit or a hospital, that assessment is frequently where the project stops.

There is a second, quieter problem. The window during which your organization holds unanonymized material is a risk window, and sending files out to be processed extends it rather than shortening it. Anonymizing at the earliest possible point, on your own hardware, closes that window instead of widening it.

On-premise processing removes the processor relationship for this step entirely. There is no upload, no transfer assessment, no third-party retention question, because the raw file never leaves the building.

Privacy by Design for Sensitive Visual Data

Gallio PRO is built around data protection by design and by default, the obligation set out in Article 25 and reinforced by Recital 78. From ingestion through anonymization to export, every operation happens inside a closed network. Raw, identifiable footage never leaves secure storage.

The software also holds nothing of its own. It keeps no detection logs and stores no personal data, which means there is no secondary database of identifiable material to secure, audit or delete. Your existing records of processing activities under Article 30 remain the single accountability record, under your control rather than a vendor's.

Gallio PRO uses face detection, not facial recognition. It locates a face in order to obscure it. It does not identify who that person is, and it does not build or query any biometric template. In a regulated procurement this is usually the first question asked, because software that performed biometric identification would pull the deployment into an entirely different regulatory category.

Defense and Tactical Environments

Defense organizations handle large quantities of imagery and surveillance material, often under classified conditions where transferring anything to an external environment would breach operational and national security policy. Gallio PRO runs on-premise inside secure networks, so footage showing personnel and civilians can be anonymized before analysis, briefing or external release.

Automatic detection covers faces and license plates. Anything else that has to be obscured, for example an insignia, a document or a screen visible in shot, is handled in the manual editor, which matters in this sector more than in most.

The stakes are not theoretical. Crates for Ukraine, a humanitarian organization operating out of Lviv, uses Gallio PRO to blur faces and license plates in photographs sent back from frontline and newly liberated areas before publishing them on a public transparency map. The subjects include elderly civilians, children and military medics, and the team describes the software as vital to protecting people who could otherwise be targeted. Their author chose to remain anonymous for security reasons. The full account is in the Crates for Ukraine case study.

Sector-specific workflows for tactical imagery are covered separately in our guide to visual data protection for defense and tactical operations.

Medical and Healthcare Environments

Hospitals, clinics and medical device manufacturers increasingly record video for training, diagnostics and procedural review. Video of a patient in a clinical setting reveals data concerning health, which is special category data under Article 9(1) and requires a condition under Article 9(2) on top of an ordinary legal basis. That is a materially higher bar than standard CCTV.

Gallio PRO gives healthcare providers an on-premise anonymization platform that automatically blurs faces in recorded material, with the manual editor available for anything else that identifies a patient, such as a wristband, a chart or a screen. Anonymization is applied to recordings, not to live feeds. That makes footage usable for internal training, dataset preparation and scientific collaboration without the material leaving the hospital network.

Detailed guidance for clinical settings is in our page on medical facilities video anonymization.

Automotive R&D and Testing

Automotive manufacturers and R&D centres collect extensive visual data during vehicle testing and simulation. Cameras inside and outside test vehicles capture drivers, passengers, pedestrians and license plates. Cloud processing is usually ruled out twice over, once for data protection and once for intellectual property, because prototype footage is commercially sensitive in its own right.

Gallio PRO supports on-premise anonymization for automotive research environments, so prototype and test material is anonymized inside the company's own infrastructure. Large datasets are handled in batch rather than file by file.

JP Research India runs the Road Accident Sampling System India (RASSI), a scientific crash investigation programme supported by a consortium of automotive and component manufacturers. No personal information, including victim names and vehicle registration numbers, may be stored in its analytical database. Pradeep Jaswani, Chief Operating Officer, describes anonymization as previously requiring an enormous manual effort, with the diversity of the material defeating every tool the team had tried. With Gallio PRO they de-identify faces and vehicle number plates in a single click by dumping a set of photographs into the tool, and, in his words, all the photos are anonymized on-premise, so they do not need to send sensitive data to third parties. The full account is in the JP Research India case study.

Dataset preparation for driver assistance and autonomous systems is covered separately in our page on anonymization for autonomous vehicles and ADAS datasets.

AI Accuracy Without Cloud Dependence

Unlike cloud anonymization services that rely on third-party servers, Gallio PRO runs its AI locally. All machine learning models execute offline, so there is no data exposure to external environments and no dependency on connectivity. The software detects and blurs faces and license plates in both static images and motion-heavy sequences.

Because nothing needs to reach the internet, Gallio PRO can operate in fully isolated systems. BONES Studio, a motion capture company, selected it on exactly these grounds. Marcin Panek, CTO and Co-Founder, cites fully on-premise data processing, ease of deployment, dependability and reasonable pricing at scale as the reasons it topped their comparison, and notes that it tracks and blurs faces accurately even as performers move dynamically across the stage. The full account is in the BONES Studio case study.

How to Deploy Gallio PRO in a Regulated Environment

1. Confirm the deployment target. Gallio PRO installs on secure servers, virtual machines or air-gapped environments. Decide early which of these your security policy requires, because it shapes the rest of the rollout.
2. Verify the isolation assumption with your security team. The models run offline and the software makes no outbound call to anonymize a file. Have this confirmed on your own network before the deployment is signed off, not after.
3. Wire it into your access model. Gallio PRO works with Active Directory authentication, role-based access control and encrypted storage, so anonymization inherits the permissions you already operate rather than creating a parallel set.
4. Define the detection scope per material type. Faces, license plates or both. Record which sources require manual review for identifiers the automatic detection does not cover.
5. Anonymize as early in the pipeline as possible. The interval during which your organization holds identifiable material is the actual risk. Run Gallio PRO at ingestion rather than at the point of release.
6. Document the step in your Article 30 record. Gallio PRO keeps no detection logs and stores no personal data, so your own register of processing activities is the accountability evidence under Article 5(2).

Irreversibility and When Footage Stops Being Personal Data

Recital 26 of the GDPR states that data protection principles do not apply to information rendered anonymous in such a way that the data subject is no longer identifiable, taking account of all means reasonably likely to be used to identify them. That is a threshold, not a checkbox, and it is assessed on the whole context rather than on the blur alone.

Gallio PRO burns the blur into the export, so the identifiable version cannot be recovered from the anonymized file. What still requires judgement is whether the remaining content, a distinctive uniform, a unique vehicle, a location and timestamp combination, allows identification by other means. That assessment belongs in your DPIA, and it is the reason the manual editor exists alongside automatic detection.

Security and Infrastructure Integration

Gallio PRO fits into existing IT and security architectures, supporting Active Directory authentication, role-based access control and encrypted storage. It deploys on secure servers, virtual machines or air-gapped environments according to policy.

That flexibility is what makes it workable in military research units, hospital IT estates and private automotive R&D networks, where isolation from external networks is both a regulatory and a strategic requirement.

Best Practices for Regulated On-Premise Anonymization

• Keep anonymization on-premise so no raw material is disclosed to a processor and no transfer assessment is triggered.
• Anonymize at ingestion, not at release, to shorten the window in which identifiable material exists.
• Treat automatic detection as covering faces and plates, and define a manual review step for everything else.
• Apply data protection by design across the pipeline, in line with Article 25.
• Keep the accountability record in your own Article 30 register, since the software holds no logs of its own.
• Train personnel on the review step, because the manual editor is where the residual risk is actually managed.

Trusted Privacy Protection for Regulated Industries

Whether the work is defense, healthcare or advanced automotive research, the requirement is the same: full control of the data and no dependency on an outside processor. Gallio PRO delivers anonymization inside your own systems, with no cloud dependency and no transfer risk.

Download Gallio PRO and evaluate it on your own infrastructure, including in an isolated environment, before you commit.

FAQ: On-Premise Anonymization Software for Regulated Environments

What is on-premise anonymization software?

It is software that performs anonymization entirely within an organization's own infrastructure, so the material never leaves internal systems or networks.

Which sectors benefit from on-premise anonymization?

Sectors with strict regulatory or confidentiality requirements, in particular defense, healthcare and automotive R&D, where transferring raw visual data to an external provider is restricted or prohibited.

Does Gallio PRO require internet or cloud access?

No. The models run offline, which makes the software suitable for isolated and air-gapped environments.

Does Gallio PRO anonymize live feeds?

No. Gallio PRO anonymizes recorded video and images. Live camera feeds are not processed.

What does Gallio PRO detect automatically?

Faces and license plates. Anything else that needs to be obscured, for example a document, a screen or an insignia visible in shot, is handled in the manual editor.

How does Gallio PRO support GDPR compliance?

By keeping processing inside your infrastructure in line with Article 32, applying data protection by design under Article 25, and holding no detection logs or personal data of its own, so your Article 30 register remains the accountability record.

Can the system be integrated with existing IT infrastructure?

Yes. Gallio PRO works with Active Directory authentication, role-based access control and encrypted storage, and deploys on servers, virtual machines or air-gapped environments.

Is the anonymization reversible?

No. The blur is burned into the export, so the identifiable version cannot be recovered from the anonymized file.

Bibliography

• Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), Official Journal of the European Union. Available at: eur-lex.europa.eu
• European Data Protection Board (EDPB), Guidelines 3/2019 on Processing of Personal Data through Video Devices, 30 January 2020. Available at: edpb.europa.eu
• European Data Protection Board (EDPB), Recommendations 01/2020 on Measures that Supplement Transfer Tools to Ensure Compliance with the EU Level of Protection of Personal Data, 18 June 2021. Available at: edpb.europa.eu
• Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques, WP216, 10 April 2014. Available at: ec.europa.eu
• CNIL, Practice Guide: Security of Personal Data, 2024 Edition. Available at: cnil.fr
• Information Commissioner's Office (ICO), Guidance on Video Surveillance (Including CCTV). Available at: ico.org.uk