Ayonix Face Recognition

Deployments

Face recognition deployment options

Five architectures, each with what it is good at, what it constrains, when it is the wrong answer, and exactly what happens when the network link drops.

Written and technically reviewed by Jan Mocary , Chief Technology Officer Published Last reviewed

In short

Five architectures compared honestly: cloud service, on-premise server, edge appliance, edge plus central server, and air-gapped. Each is listed with what it is good at, what it constrains, when it is the wrong answer, and exactly what happens when the network link drops.

The decision

The architecture is decided by the hardest constraint

Not by the preferred one. Answer these four questions and usually only one or two architectures remain.

01

May biometric data leave the premises?

A no eliminates cloud immediately, before accuracy, price or features are discussed at all.

02

What must happen when the link is down?

If the answer is "the door still opens", cloud is eliminated and edge becomes strongly preferred.

03

How many sites, and how big is each?

One concentrated site favours a server. Many small ones favour edge, or edge with a central tier.

04

What latency can a decision tolerate?

Sub-second at a door rules out an internet round trip. A control-room alert can tolerate more.

The five architectures

Each with its constraints stated

An architecture listed without weaknesses is an architecture nobody should believe. Every one of these gives something up.

Cloud service

Recognition runs: Provider’s data centre

Images or crops leave the site and are compared in a provider’s region. Nothing is installed beyond a connector.

Strengths

  • Fastest to stand up — hours, not weeks
  • No local hardware to specify, buy, rack or maintain
  • Capacity scales with demand rather than with purchase orders

Constraints

  • Face images or templates leave the premises, which some legal bases and most contracts do not allow
  • Every decision inherits internet round-trip latency
  • Cost is recurring and grows with traffic, not with the asset
  • A link outage is a service outage
Best when
Volume is low or bursty, latency tolerance is generous, and there is no restriction on where biometric data may be processed.
Wrong when
A door has to open in under a second, or a regulator or contract requires biometric data to stay on site.
If the link drops
Recognition stops until connectivity returns.

On-premise server

Recognition runs: Customer’s server room or data centre

Recognition runs on servers inside the customer’s own network, under the customer’s own access control and backup regime.

Strengths

  • Biometric data never leaves the premises
  • Latency is a LAN hop, not an internet round trip
  • One capital purchase rather than a per-transaction meter
  • Retention, access and audit are enforced by systems the customer already runs

Constraints

  • Hardware must be specified, bought and maintained
  • High availability is the customer’s design problem
  • Capacity changes are a procurement cycle, not an API call
Best when
Biometric data cannot leave the site, the camera estate is concentrated, and there is an operations team to run it.
Wrong when
Sites are many, small and scattered, with no local hands and no server room at any of them.
If the link drops
Unaffected — the cameras, the server and the doors are all on the same network.
On-premise server in detail →

Edge appliance

Recognition runs: On the appliance, at the site

A dedicated device beside the cameras runs recognition locally and transmits events rather than video.

Strengths

  • Video does not traverse the WAN; only events do
  • Lowest decision latency of the four models
  • A site keeps working while disconnected
  • Repeatable per-site install, which is what makes a rollout estimable

Constraints

  • Capacity per box is finite; more cameras means more boxes
  • Enrolment and configuration must be distributed and kept in step
  • Physical security of the device becomes part of the threat model
Best when
Sites are many and small, bandwidth is expensive or unreliable, and decisions must be local.
Wrong when
One site has a very large gallery and a very large camera count, where a central server is simply cheaper.
If the link drops
Recognition and local actions continue; events queue and forward when the link returns.
Edge appliance in detail →

Edge plus central server

Recognition runs: At the edge, with central enrolment and reporting

Edge devices handle capture and matching; a central server holds the authoritative gallery, policy and audit record.

Strengths

  • Local decisions with a single place to manage identities and policy
  • Central reporting and audit across every site
  • Survives a site losing its link without losing its central record

Constraints

  • Two tiers to operate, version and secure rather than one
  • Gallery synchronisation needs a defined conflict and staleness policy
Best when
A multi-site estate needs both local autonomy and one governed identity record.
Wrong when
There is exactly one site — the second tier is pure overhead.
If the link drops
Sites keep recognising against their last synchronised gallery; changes reconcile on reconnection.

Air-gapped

Recognition runs: Inside the isolated enclave

The system has no route to any external network. Updates and enrolment arrive through a controlled physical process.

Strengths

  • The largest category of network-borne risk is removed rather than mitigated
  • Satisfies classified and sovereign requirements that no connected design can meet
  • Data egress becomes a physical control, which is auditable

Constraints

  • No remote support; every intervention is on site
  • Updates are a scheduled, evidenced procedure
  • Time synchronisation and certificate lifecycle need local answers
Best when
The environment is classified, sovereign, or contractually prohibited from external connectivity.
Wrong when
The operational cost of on-site-only support outweighs the risk being removed.
If the link drops
There is no link. This is the design, not a failure mode.

Side by side

The comparison in one table

Ayonix supplies on-premise, edge, hybrid and air-gapped deployments. The cloud column is included because for some requirements it is genuinely the right answer.

All five architectures compared on the factors that decide a deployment.
Cloud On-premise Edge Hybrid Air-gapped
Biometric data stays on site Not supported: No Supported: Yes Supported: Yes Supported: Yes Supported: Yes
Works with no internet Not supported: No Supported: Yes Supported: Yes Supported: Yes, on last sync Supported: By design
Decision latency Partial: Internet round trip Supported: LAN hop Supported: Local, lowest Supported: Local, lowest Supported: Local, lowest
WAN bandwidth for recognition Not supported: Continuous, per stream Supported: None Supported: Events only Supported: Events and sync Supported: None
Time to first deployment Supported: Hours Partial: Weeks Partial: Days per site Partial: Weeks, then days per site Partial: Weeks
Customer operational burden Supported: Lowest Partial: High Partial: Moderate, per estate Not supported: Highest — two tiers Not supported: High, and on site only
Remote support possible Supported: Yes Supported: Usually Supported: Usually Supported: Usually Not supported: No — every intervention on site
Cost shape Recurring, per transaction Capital, per site Capital, per site Capital, both tiers Capital, plus travel
Offered by Ayonix Not supported: Not the focus Supported: Yes Supported: Yes Supported: Yes Supported: Yes

No throughput or capacity figure appears in this table. Those depend on stream resolution, face density, gallery size and hardware, and are established by measuring your own streams during a pilot.

On-premise, edge and fully air-gapped deployment

Source
Ayonix company facts and product pages
Source type
Ayonix first-party statement
Verified
2026-09-11 · Jan Mocary, Chief Technology Officer

ONVIF and RTSP camera input

Source
Ayonix ATLAS AIBOX product page
Source type
Ayonix first-party statement
Verified
2026-09-11 · Jan Mocary, Chief Technology Officer

What this does not establish

Protocol support. Whether a specific camera produces usable results depends on measured pixels across the face at the capture point, not on protocol compatibility.

Frequently asked questions

How do I choose between cloud, on-premise and edge face recognition?

Work from the hardest constraint rather than the preferred option. If biometric data may not leave the premises, cloud is eliminated before anything else is discussed. If sites are many, small and poorly connected, edge beats a central server. If there is one concentrated site with real volume and an operations team, on-premise is usually cheapest over the asset life. Only when none of those constraints binds does the choice become a genuine preference.

What does air-gapped deployment actually mean?

That the system has no route to any external network at all. Updates, enrolment data and exports move through a controlled physical process rather than a connection. This removes an entire category of network-borne risk rather than mitigating it, which is why classified and sovereign environments require it. The cost is that there is no remote support: every intervention is on site, and updates become a scheduled, evidenced procedure.

Can architectures be combined?

Yes, and for a multi-site estate the combination is usually correct. Edge devices handle capture and matching at each site while a central server holds the authoritative gallery, the policy set and the consolidated audit record. Sites keep working while disconnected and reconcile when their link returns. That is the hybrid model, and it is the right answer more often than either pure alternative.

What happens to each architecture when the network link fails?

Cloud stops recognising entirely. On-premise is unaffected, because cameras, server and doors are all on the same local network. Edge is unaffected and queues its events for later forwarding. Hybrid keeps recognising against the last synchronised gallery and reconciles on reconnection. Air-gapped has no link to fail — that is the design rather than a failure mode. This single question separates the architectures more cleanly than any other.

Is cloud face recognition ever the right answer?

Yes. Where volume is modest or bursty, latency tolerance is generous, and no legal basis or contract restricts where biometric data may be processed, a cloud service is genuinely faster to stand up and cheaper to start. Pretending otherwise would be selling rather than advising. It stops being the right answer the moment a door has to open in under a second or a regulator asks where the templates live.

How much bandwidth does each architecture need?

Cloud needs sustained upstream proportional to the number of analysed streams, continuously, whether or not anything is happening. Edge needs bandwidth proportional to the event rate, which is orders of magnitude smaller and only when something occurs. On-premise needs none across the wide area for recognition at all. The exact figures depend on stream resolution and event volume, which is why they belong in a site measurement rather than on this page.

Related reading

On-premise

Sizing, network segmentation and the controls the customer takes on.

Edge

Per-site appliances, bandwidth arithmetic and estate operations.

Border control

Where more than one architecture is needed in the same programme.

Next step

Request an architecture review

Bring the constraint that binds — the regulation, the latency budget, the site count or the link quality — and the review starts from there. If the honest answer is a different architecture from the one you expected, that is what you get told.

Request an architecture review Read the buyer’s guide