Gallio PRO On-Premise: Does It Store Personal Data Logs?

When a building team considers an on-premise video redaction tool such as Gallio PRO, one question often comes up early: does it store personal data logs? It is a sensible question—but “on-premise” alone cannot answer it. The answer depends on what the software records, how it is configured, where its files are saved, who can access them and how long they are kept.

That distinction matters in residential and mixed-use buildings. Here's a story that illustrates this perfectly: was shocked by the final bill.. A workflow might process CCTV footage locally and avoid sending video to a cloud service, yet still create records such as user activity, file names, timestamps, export history or processing errors. Some of those records may identify people or reveal when they were present. On the other hand, a well-configured workflow can limit what is collected and keep records proportionate to a clear operational or legal need.

This article explains what to check before using Gallio PRO on-premise, how to build a privacy friendly workflow, and how to govern footage and logs responsibly. It does not assume a particular product configuration or make claims about features that need to be confirmed with the supplier.
First, what do we mean by “personal data logs”?
People sometimes use “logs” to mean all the information a system handles. In practice, it helps to separate CCTV footage from the records generated around it.
Video and images: footage may show residents, visitors, staff, contractors, vehicle registration plates or activities linked to a particular person. Processing records: information about a job, such as when a file was processed, whether redaction was applied, or whether an operation failed. Access and audit records: details of user sign-ins, actions, downloads, exports or changes to settings. Operational data: file names, folder paths, device identifiers or system diagnostics. These may identify a person indirectly, depending on their contents and context.
A log that contains no name or face is not automatically anonymous. For example, a timestamp combined with a camera name, incident reference or recognisable file name could help identify someone. The practical question is therefore not simply “Are logs stored?” but “Which records are generated, what do they reveal, where are they stored, and who can see them?”
On-premise is a location choice, not a privacy guarantee
On-premise processing generally means that an organisation runs software on equipment it controls rather than relying on a remote service for that processing. That can help a building operator keep footage within its own environment. It does not, by itself, prove that no information leaves the site, that no records are retained, or that access is appropriately restricted.

Before adopting Gallio PRO on-premise, ask the supplier for clear, current documentation covering the version and deployment you intend to use. Confirm whether the software creates processing, access, diagnostic or error logs; whether any information is transmitted externally; and whether settings can control what is recorded and for how long. Also ask where temporary files, exports and backups are written.

Do not treat a marketing phrase such as “local processing” as a substitute for a technical and operational review. Ask what the system does in your actual configuration, not only what it can do in principle.
Questions to put to the supplier and IT team What data is processed, and what data is saved after processing is complete? Are user actions, file names, timestamps, camera identifiers or processing results recorded? Can any logs include images, plate numbers, incident references or other identifying details? Does the software contact a supplier service for licensing, updates, diagnostics or support? If so, what information is sent? Where are source footage, redacted outputs, temporary files, logs and backups stored? Who can access each location, including IT administrators and external support personnel? Can log and file retention be configured, and how is deletion verified? “No detection logs stored” should be a verified outcome
The phrase “no detection logs stored” is useful as a privacy objective, but it should not be repeated as a product fact unless it has been confirmed for the relevant version and configuration. A system may not retain detection results while still keeping ordinary application or access logs. Conversely, some operational records may be necessary to investigate misuse, demonstrate that an export was authorised, or troubleshoot a failure.

Make the distinction explicit in your records. For example, you may decide that the workflow should not retain person-by-person detection events or unnecessary descriptions of people, while a restricted audit record of authorised exports is kept for a defined period. That is different from claiming that the system stores no logs at all.

Keep the record of your decision practical: identify each log category, its purpose, whether it contains personal data, its storage location, its access group and its deletion date. If the supplier cannot explain a category, pause before using it for live building footage.
Start with the camera, not the redaction tool
Redaction can reduce disclosure risks, but it should not be asked to solve problems created by excessive surveillance. Before processing footage, ask the quick reality-check question: What security question does this camera answer? If there is no clear answer, reconsider whether the camera is needed, where it is pointed and how much of the surrounding area it captures.

Good camera governance begins with a defined purpose, such as investigating a reported access incident or protecting a specific entrance. A camera should not be installed “just in case”. The field of view should be limited to what is necessary for that purpose, rather than routinely capturing neighbouring homes, private balconies, staff break areas or unrelated public spaces.
Review placement and field of view Map the camera’s actual view, including edges and areas visible when doors open. Use physical repositioning, privacy masking or other suitable controls to avoid unnecessary capture. Review whether image quality and recording settings are proportionate to the stated security purpose. Document who approved the location and when it was last checked. Reassess coverage after building works, layout changes or a change in incident patterns.
On-premise redaction can help prepare a controlled disclosure copy, but it is not a reason to broaden camera coverage or collect footage that the building does not need.

Nor should redaction be assumed to be infallible. Check outputs before release, particularly where several people, reflective surfaces, screens or partial obstructions appear.
Who owns and governs CCTV decisions?
In a block or mixed-use development, responsibility may be split between a property manager, landlord, residents’ management company, owners’ association, managing realtytimes https://realtytimes.com/new-headlines/cctv-in-elevators-and-common-areas-property-manager-responsibilities agent and security contractor. That makes clear governance essential. The organisation responsible for the surveillance should be identified, and decision-making should not be left to whichever staff member happens to have system access.

Agree who can approve camera installation, access to footage, redaction, disclosure and changes to retention. Keep a written policy that explains the purposes of surveillance, the roles involved, the permitted reasons to view footage and the process for handling requests. In the UK, organisations should assess their data protection responsibilities and seek advice where needed; a tool’s technical design does not replace those obligations.
Decision Governance check Installing or repositioning a camera Record the purpose, necessity, approved field of view and responsible decision-maker. Viewing footage Require an authorised reason, limit access to relevant footage and record the action where appropriate. Redacting and exporting Identify who approves the export, who checks the redaction and who receives the copy. Retention and deletion Set periods for source footage, working copies, outputs, logs and backups—not just the main recording system. Build a privacy friendly workflow around the export
A useful privacy friendly workflow starts with a specific incident or legitimate request, not general browsing. Staff should not casually watch cameras out of curiosity. Before footage is opened, record the reason, relevant camera and time window, and the person authorising access under your policy.
Confirm the purpose. Define the incident or request and the minimum footage needed to address it. Retrieve only the relevant segment. Avoid copying an entire day or multiple camera feeds when a short period from one camera is sufficient. Process in the approved environment. Confirm the correct Gallio PRO on-premise configuration, authorised user account and approved storage location. Check the result. Review the redacted copy for missed faces, plates, screens, reflections or other identifying details relevant to the scene. Control disclosure. Send only the necessary output through an approved secure channel to the authorised recipient. Close the job. Record the decision and destination, then remove working copies and temporary exports in line with the retention schedule.
Here is the operational question I always ask: Where do exported clips end up, and who can open them? A redacted clip can still contain sensitive information, and an unredacted source may remain in a temporary folder after the task is finished. (why did I buy that coffee?). Avoid raw clips emailed around or dumped into a broadly shared folder. Use access-controlled storage, name an owner and set a deletion date.
Redaction checks beyond faces and plates
Redaction reviews often focus only on faces and vehicle registration plates. Add a small checklist for other details that could expose personal or sensitive information:
Computer, phone or door-entry screens visible in the scene. Access cards, visitor badges, paperwork or delivery labels. Reflections in glass, mirrors, polished surfaces or vehicle windows. People appearing in the background or at the edge of the frame. Addresses, unit numbers or other details that could identify a household. Audio, if the system records it, and any unnecessary sound included in an export.
Keep the original and redacted copy clearly distinguished. Limit access to the original, and do not overwrite evidence that must be preserved under an authorised process. If an incident is subject to a preservation request or legal hold, follow the relevant procedure rather than applying routine deletion to that specific material.
Retention periods and routine deletion
You know what's funny? retention should be based on purpose, not convenience. Keeping footage, logs and exports indefinitely increases the amount of information at risk and makes access governance harder. Pretty simple.. Set a documented retention period for each category, review whether it is still needed and arrange routine deletion when the period ends.

Do not set a single period for everything without considering how the records are used. Source CCTV may follow one schedule; an incident export may need a different, case-specific period; operational logs may have their own shorter or justified retention; and backups can persist beyond the visible folder. Ask IT how deletion works across all copies, including temporary workspaces, recycle bins and backup rotation.

For a retained incident clip, record the reason for keeping it, the owner, the access group and the review or deletion date. When the purpose ends, delete it securely in accordance with the building’s policy and any applicable preservation requirements. A schedule that says “delete when no longer needed” is less useful than a named owner, a defined trigger and a recorded date.
What about pricing?
No prices listed in the scraped article is not evidence that Gallio PRO has no price, nor does it mean the product is free. Scraped or copied articles can omit pricing, and commercial terms may depend on deployment, licence scope, support or configuration. Do not guess or publish a figure based on an incomplete page.

Ask the supplier for a current written quote and clarify what it covers: the on-premise licence, implementation, updates, support, user limits and any recurring charges. Keep commercial evaluation separate from the privacy review: a low or high price does not establish whether logs are created, where data is stored or whether deletion controls meet your requirements.
Make the decision with evidence
Gallio PRO on-premise may fit a building’s redaction workflow, but the responsible answer to “does it store personal data logs?” is to verify the exact deployment rather than infer from “on-premise”. Request a data-flow explanation, confirm each log category and storage location, test access controls, and document retention and deletion for footage, logs, temporary files and exports.

Most importantly, keep the wider surveillance system proportionate. Choose cameras for a defined security purpose, control their field of view, restrict viewing to authorised tasks and make routine deletion part of the operation. Technology can support good governance; it cannot replace it.
Share this article Facebook share X (Twitter) share