Background

Lumeo is a flexible video analytics platform that lets you create and deploy a wide range video analytic solutions in minutes, and provides you the flexibility to run analytics on-premise, in your cloud, or on Lumeo's cloud.

In order to do that, some of Lumeo's software runs on servers/edge appliances or VMs deployed in customer networks or customer cloud, and communicates with Lumeo's Cloud services for command and control.

Lumeo AI Gateway

Lumeo AI Gateway is the software that runs on the on-prem equipment, in your cloud or Lumeo Cloud, and is installed using an installation script. If you use Lumeo-Ready Gateways, it comes pre-installed on the Lumeo-ready devices. It is responsible for communicating with Lumeo's Cloud via an API, running analytic pipelines, streaming video, and discovering local cameras and video management systems.

Lumeo AI Gateway is written in a secure programming language called Rust (https://rust-lang.org). It is used by many large companies, like Microsoft, Cloudflare, Dropbox, Google, Yelp, Firefox, and more. The language is designed to be highly performant (on par with C/C++) and prevent any memory overflows, buffer overflows, and the types of programming errors that account for a large majority (around 70%) of security vulnerabilities. https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/

Network Configuration - On-prem / Edge Deployment

In the on-prem / edge deployment mode, Lumeo AI Gateway is deployed within your network, while command-and-control functions are performed via Lumeo Cloud.

This section describes the basic network setup for the Lumeo AI Gateway running locally on customer sites.

Recommended Network Configuration

The recommended simplified network configuration for the Gateway running the Lumeo agent:

• We recommend running Lumeo on a Dual-NIC device. Lumeo-Ready Gateways are all mostly equipped with Dual-NICs as well. With a Dual-NIC device, you can connect one NIC to your camera network, and the other to a network with internet access.
• No restrictions on outbound connections to the Cloud (UDP, TCP)
• Allow 554 (TCP, UDP) inbound connections from your local network / VMS IP Address ranges
• Allow ONVIF (80, 443 TCP & UDP), RTSP (554 TCP & UDP) outbound connections to your local cameras & VMS.
  • If your VMS or Camera is running ONVIF / RTSP service on a different port, you will need to open those up too.

Network Configuration - Viewing Lumeo Live Streams

To view Lumeo live streams from your browser, with a Lumeo Gateway running on-site, your network needs to allow the following outbound communications to the specified domains.

Connections & Ports

The main ports for Lumeo AI Gateway are listed in the table.

• outbound direction indicates that the Lumeo agent makes an outbound connection to the specified Domain on those ports
• inbound direction indicates that the Lumeo software listens on that port for inbound connections on the local network.
• Note that no ports need to be opened in your firewall for inbound connections.

Open Ports - Inbound

Lumeo AI Gateway will listen on port 554 for RTSP connections. This is used by VMS to ingest/record Lumeo output.

Depending on configuration, Lumeo AI Gateway will also create WebRTC stream(s) upon request, on one or more random ports, with random identifiers. This is used to view the video using a browser.

Local Network Connections - Outbound

On the local network, Lumeo AI Gateway will periodically run WS-Discovery process to detect other ONVIF cameras and video management systems on the network. This communication can use the standard ports or vendor specific ports for particular customer integrations.

Lumeo AI Gateway will also (depending on deployment settings) ingest local video streams from cameras or network video recorders. These streams are typically over RTSP.

Additionally, Lumeo AI Gateway may be configured to send alarms and events to locally deployed VMS systems over vendor-specific ports.

External Network Connections - Outbound

Lumeo AI Gateway makes outbound connections to various cloud services for command & control and integrations.

MQTT

Lumeo AI Gateway initiates an SSL socket connection (using MQTT) over port 8883 to mqtt.lumeo.com please note that the ip address is likely to change.

REST API - HTTPS

Lumeo AI Gateway will make https requests to Lumeo's REST API api.lumeo.com over port 443. These communications are also over SSL.

Integrations, Data Storage - HTTPS

Lumeo AI Gateway will make https connections over port 443 to other domains and REST APIs. These connections are for storing/retrieving large data files, Integrations with cloud services (ex. SMS, Email, Elasticsearch, etc.). These communications are also over SSL.

WebRTC

Lumeo AI Gateway will make video streams available upon request over WebRTC to authorized internet clients (user's looking at video output from deployments on Lumeo's web based admin console: https://console.lumeo.com ). As part of WebRTC, Lumeo AI Gateway will make connections to traverse.lumeo.com to attempt STUN and TURN to make a direct peer-to-peer connection to the video stream viewer.

Updates - HTTPS

During installation and automatic updates, Lumeo AI Gateway will also need access to public software repositories over https(tcp port 80 & tcp port 443) and dns (udp port 53).

Network Configuration - Your Cloud Deployment

In the "Your Cloud" deployment mode, Lumeo AI Gateway is deployed within your cloud/VPC, while command-and-control functions are performed via Lumeo Cloud. The Lumeo AI Gateway access cameras/streams from your on-prem network via your VPC, and communicates to Lumeo's cloud and external services via secure outbound connections.

This section describes the basic network setup for the Lumeo AI Gateway running in your cloud.

Recommended Network Configuration

The recommended simplified network configuration for the Gateway running the Lumeo agent:

• We recommend running Lumeo via Kubernetes for easy scale up. See AWS - ECS or GCP - Kubernetes for details. You can also run a single instance using a VM (see AWS - EC2 Instance, GCP - Compute Instance).
• No restrictions on outbound connections to the Internet (UDP, TCP)
• Allow 554 (TCP, UDP) inbound connections from your local network / VMS IP Address ranges if you wish to access RTSP streams from the AI Gateway.
• Allow ONVIF (80, 443 TCP & UDP), RTSP (554 TCP & UDP) connections from your cloud VPC to your local cameras & VMS.
  • If your VMS or Camera is running ONVIF / RTSP service on a different port, you will need to open those up too.

Network Configuration - Viewing Lumeo Live Streams

To view Lumeo live streams from your browser, with a Lumeo Gateway running on-site, your cloud network needs to allow the following outbound communications to the specified domains.

Connections & Ports

The main ports for Lumeo AI Gateway are listed in the table.

• outbound direction indicates that the Lumeo agent makes an outbound connection to the specified Domain on those ports
• inbound direction indicates that the Lumeo software listens on that port for inbound connections on the local network.
• Note that no ports need to be opened in your firewall for inbound connections.

Open Ports - Inbound

Lumeo AI Gateway will listen on port 554 for RTSP connections. This is used by VMS to ingest/record Lumeo output.

Depending on configuration, Lumeo AI Gateway will also create WebRTC stream(s) upon request, on one or more random ports, with random identifiers. This is used to view the video using a browser.

Local Network Connections - Outbound

On the local network, Lumeo AI Gateway will periodically run WS-Discovery process to detect other ONVIF cameras and video management systems on the network. This communication can use the standard ports or vendor specific ports for particular customer integrations.

Lumeo AI Gateway will also (depending on deployment settings) ingest local video streams from cameras or network video recorders. These streams are typically over RTSP.

Additionally, Lumeo AI Gateway may be configured to send alarms and events to locally deployed VMS systems over vendor-specific ports.

External Network Connections - Outbound

Lumeo AI Gateway makes outbound connections to various cloud services for command & control and integrations.

MQTT

Lumeo AI Gateway initiates an SSL socket connection (using MQTT) over port 8883 to mqtt.lumeo.com please note that the ip address is likely to change.

REST API - HTTPS

Lumeo AI Gateway will make https requests to Lumeo's REST API api.lumeo.com over port 443. These communications are also over SSL.

Integrations, Data Storage - HTTPS

Lumeo AI Gateway will make https connections over port 443 to other domains and REST APIs. These connections are for storing/retrieving large data files, Integrations with cloud services (ex. SMS, Email, Elasticsearch, etc.). These communications are also over SSL.

WebRTC

Lumeo AI Gateway will make video streams available upon request over WebRTC to authorized internet clients (user's looking at video output from deployments on Lumeo's web based admin console: https://console.lumeo.com ). As part of WebRTC, Lumeo AI Gateway will make connections to traverse.lumeo.com to attempt STUN and TURN to make a direct peer-to-peer connection to the video stream viewer.

Updates - HTTPS

During installation and automatic updates, Lumeo AI Gateway will also need access to public software repositories over https(tcp port 80 & tcp port 443) and dns (udp port 53).

Network Configuration - Lumeo Cloud Deployment

In the Lumeo Cloud deployment mode, Lumeo AI Gateways are deployed and managed by Lumeo in the Lumeo Cloud.

While Lumeo Cloud Gateways do not open any publicly accessible ports, they do make outbound connections to your Cameras from Lumeo's cloud.

If you need Lumeo Cloud Gateways to process video from cameras within your firewall, you will need to forward the following ports in your firewall to the camera or the VMS:

Privacy and Compliance

Lumeo is undergoing a SOC 2 audit to ensure that we are compliant with the SOC 2 standard. The SOC 2 audit is a comprehensive review of Lumeo's security, availability, processing integrity, confidentiality, and privacy controls. The audit is conducted by a third-party auditor and is based on the SOC 2 standard, which is a set of standards for security and availability of information systems. The audit is expected to be completed by the end of 2025.

Enterprise prospects and customers can request access to the sub-processer list, pen test and other reports from the Lumeo Trust Center at: https://trust.lumeo.com

Data Retention and Access

The following table details the type of user data collected by Lumeo and where it is utilized and persisted.

• Lumeo Cloud refers to Lumeo-managed cloud services and 3rd party subprocessors that may be used to store the data.
• Lumeo AI Gateway refers to Lumeo AI Gateway software running on the device. Any data stored on device is