Alerts & Incidents

This is the operational core of Pariah: what happens when a face matches, how your team responds, and how you turn an alert into a record you can act on and defend.

How an alert is raised

When the NVR client matches a face against an active profile on-site, it reports a detection to the platform. The platform turns that detection into a real-time alert and pushes it to the people who need it — in the web dashboard and on the mobile app at the same time.

Two kinds of alert exist:

• Match alerts — a recognised person of interest has been detected at a camera. These carry the matched profile, the site and camera, a snapshot, and a confidence score.
• Camera alerts — an operational signal about a camera or device itself (for example, a camera going offline). These keep you aware that coverage is intact, separate from any recognition.

Continuous matching happens entirely on-site; the platform only ever receives the resulting events. See NVR & Cameras.

Who gets alerted

Alerts follow your estate structure and team assignments:

• Staff are assigned to one or more sites, and receive alerts for the sites they cover. See Getting Started for the estate model and Roles & Permissions for who can change assignments.
• Each person controls how they're notified under Profile → Notifications — in-app and mobile push. To receive push on a phone, sign in to the mobile app on that device at least once so it can register for notifications.

If alerts aren't arriving on a phone, check Troubleshooting.

Reviewing a match

A match is a probability, not a fact. Before anyone acts, a trained person reviews the alert:

1. Look at the snapshot against the profile's enrolled images.
2. Check the confidence and the profile's notes and ban status.
3. Apply judgement. Lower-quality cameras and busier scenes produce more false positives; your match sensitivity setting trades reach against precision.

Never take a decision that has a legal or otherwise significant effect on a person based on a match alone. Human review is both good practice and a compliance requirement.

Acknowledging alerts

Acknowledging records that a human has seen and handled an alert. You can acknowledge alerts one at a time, or use Ack All to clear a backlog at the end of a busy period. Acknowledgement is part of your audit trail — it shows alerts were reviewed, not ignored.

Incidents

An incident is the durable record of something that happened — an attempted entry by a barred person, a confrontation, a theft. Where an alert is a momentary signal, an incident is the case file you keep.

Creating one. Raise an incident from an alert or detection to carry its context across automatically, or create one standalone from the dashboard or mobile app. Incidents created on the floor sync to the dashboard for follow-up.

Linking detections. Attach the relevant detections so the incident holds the evidence of who was seen, where, and when — including multiple sightings across cameras or sites.

Evidence. Attach photos, notes, and files to build the record. Keep it factual and proportionate; an incident about a person is personal data and is subject to the same data-subject rights as anything else.

Status and follow-up. Work an incident through its lifecycle and add notes as things develop, so anyone picking it up later has the full picture.

Legal hold

Incidents are decision-grade records, so by default they are kept indefinitely rather than aged out by retention. When an incident may be needed for a dispute, investigation, or legal proceeding, place it on legal hold — held material is exempt from retention deletion until you release the hold. Use it deliberately: a hold pauses your normal storage-limitation housekeeping for that record.

The response workflow, end to end

1. Match on-site → alert to assigned staff (web + mobile).
2. Review the snapshot and profile — confirm before acting.
3. Acknowledge to record that it was handled.
4. Escalate to an incident if something happened, linking detections and evidence.
5. Legal hold if the record may be needed later.
6. Follow up and close from the dashboard.

This chain — local match, human review, acknowledged alert, evidenced incident — is also what demonstrates a lawful, proportionate, human-in-the-loop process if you are ever asked to account for a decision.