Background

Lumeo is a flexible video analytics platform that lets you create and deploy a wide range video analytic solutions in minutes, and provides you the flexibility to run analytics on-premise, in your cloud, or on Lumeo's cloud.

In order to do that, some of Lumeo's software runs on servers/edge appliances or VMs deployed in customer networks or customer cloud, and communicates with Lumeo's Cloud services for command and control.

Lumeo AI Gateway

Lumeo AI Gateway is the software that runs on the on-prem equipment, in your cloud or Lumeo Cloud, and is installed using an installation script. If you use Lumeo-Ready Gateways, it comes pre-installed on the Lumeo-ready devices. It is responsible for communicating with Lumeo's Cloud via an API, running analytic pipelines, streaming video, and discovering local cameras and video management systems.

Lumeo AI Gateway is written in a secure programming language called Rust (https://rust-lang.org). It is used by many large companies, like Microsoft, Cloudflare, Dropbox, Google, Yelp, Firefox, and more. The language is designed to be highly performant (on par with C/C++) and prevent any memory overflows, buffer overflows, and the types of programming errors that account for a large majority (around 70%) of security vulnerabilities. https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/

Viewing Lumeo Console & Live streams from a Browser

In order to view Live streams in Lumeo console from a browser, your network will need to allow the following ports/connections from the machine you are using to view the streams.

Most networks allow this by default, but if you have a corporate network that restricts connections from user devices you need your network admin to allow the following.

Network Configuration for Gateways - On-prem / Edge Deployment

In the on-prem / edge deployment mode, Lumeo AI Gateway is deployed within your network, while command-and-control functions are performed via Lumeo Cloud.

This section describes the basic network setup for the Lumeo AI Gateway running locally on customer sites.

Recommended Network Configuration

The recommended simplified network configuration for the Gateway running the Lumeo agent:

• We recommend running Lumeo on a Dual-NIC device. Lumeo-Ready Gateways are all mostly equipped with Dual-NICs as well. With a Dual-NIC device, you can connect one NIC to your camera network, and the other to a network with internet access.
• Allow outbound connections to the Cloud (UDP, TCP) with return traffic.
• Allow 554 (TCP, UDP) inbound connections from your local network / VMS IP Address ranges
• Allow ONVIF (80, 443 TCP/UDP), RTSP (554 TCP/UDP) outbound connections to your local cameras & VMS.
  • If your VMS or Camera is running ONVIF / RTSP service on a different port, you will need to open those up too.

Connections & Ports

The main ports for Lumeo AI Gateway are listed in the table.

• outbound direction indicates that the Lumeo agent makes an outbound connection to the specified Domain on those ports. For outbound flows, you must also allow return traffic (in most corporate setups, this is already covered by “allow related/established” on the firewall).
• inbound direction indicates that the Lumeo software listens on that port for inbound connections on the local network.
• Note that no ports need to be opened in your firewall for inbound connections.

Network Configuration - Your Cloud Deployment

In the "Your Cloud" deployment mode, Lumeo AI Gateway is deployed within your cloud/VPC, while command-and-control functions are performed via Lumeo Cloud. The Lumeo AI Gateway access cameras/streams from your on-prem network via your VPC, and communicates to Lumeo's cloud and external services via secure outbound connections.

This section describes the basic network setup for the Lumeo AI Gateway running in your cloud.

Recommended Network Configuration

The recommended simplified network configuration for the Gateway running the Lumeo agent:

• We recommend running Lumeo via Kubernetes for easy scale up. See AWS - ECS or GCP - Kubernetes for details. You can also run a single instance using a VM (see AWS - EC2 Instance, GCP - Compute Instance).
• No restrictions on outbound connections to the Internet (UDP, TCP) with return flows allowed.
• Allow 554 (TCP, UDP) inbound connections from your local network / VMS IP Address ranges if you wish to access RTSP streams from the Lumeo Gateway.
• Allow ONVIF (80, 443 TCP/UDP), RTSP (554 TCP/UDP) connections from your cloud VPC to your local cameras & VMS.
  • If your VMS or Camera is running ONVIF / RTSP service on a different port, you will need to open those up too.

Connections & Ports

The main ports for Lumeo AI Gateway are listed in the table.

• outbound direction indicates that the Lumeo agent makes an outbound connection to the specified Domain on those ports. For outbound flows, you must also allow return traffic (in most corporate setups, this is already covered by “allow related/established” on the firewall).
• inbound direction indicates that the Lumeo software listens on that port for inbound connections on the local network.

Network Configuration - Lumeo Cloud Deployment

In the Lumeo Cloud deployment mode, Lumeo AI Gateways are deployed and managed by Lumeo in the Lumeo Cloud.

While Lumeo Cloud Gateways do not open any publicly accessible ports, they do make outbound connections to your Cameras from Lumeo's cloud.

If you need Lumeo Cloud Gateways to process video from cameras within your firewall, you will need to forward the following ports in your firewall to the camera or the VMS:

Privacy and Compliance

Lumeo is undergoing a SOC 2 audit to ensure that we are compliant with the SOC 2 standard. The SOC 2 audit is a comprehensive review of Lumeo's security, availability, processing integrity, confidentiality, and privacy controls. The audit is conducted by a third-party auditor and is based on the SOC 2 standard, which is a set of standards for security and availability of information systems. The audit is expected to be completed by the end of 2025.

Enterprise prospects and customers can request access to the sub-processer list, pen test and other reports from the Lumeo Trust Center at: https://trust.lumeo.com

Data Retention and Access

The following table details the type of user data collected by Lumeo and where it is utilized and persisted.

• Lumeo Cloud refers to Lumeo-managed cloud services and 3rd party subprocessors that may be used to store the data.
• Lumeo AI Gateway refers to Lumeo AI Gateway software running on the device. Any data stored on device is encrypted on disk.
• Utilization refers to where the data is processed, but not stored.
• Data Storage refers to where the data is stored.