When it kicks off, press once.
Witnal records video and sound, hashing each segment on the device the moment it is written. Everything streams off the phone while the incident is still happening. What has already left is beyond a smashed or taken phone.
No facial recognition and no 999 autodial, by design.
- 00:00:01Capturedsegment 01 · video and sound
- 00:00:01Hashed242c6ceb…819aaaff
- 00:00:03Streamedwhile recording continues
- 00:01:42Receivedhash recomputed, matches
- 00:02:00TimestampedRFC 3161 authority
- 00:02:09Sealedoriginal never rewritten
2,000+
incidents of violence or abuse against UK retail staff a day, on the British Retail Consortium's count
2026
the year the Crime and Policing Act created a standalone offence of assaulting a retail worker
The law moved. The footage still has to prove what it is.
What one press sets off
The sequence below is Witnal's own custody log, in the order it is written. Nothing here is a metaphor.
- 00:00
Captured
Video and sound start together from one press. The button is the whole interface, because nobody browses menus mid-incident.
- 00:00
Hashed
Each segment gets its SHA-256 hash on the device, the moment it is written. Change a single frame later and the number no longer matches.
sha-256 242c6ceb9f9a5e53…c406c76a819aaaff
- 00:01
Streamed
Segments leave the phone while recording continues. Evidence that has already left cannot be taken with the phone.
- 01:42
Verified
On arrival, the server recomputes every hash. A mismatch quarantines the segment and says so; the quarantine is itself a line in the custody log.
recomputed 242c6ceb… · matches the device hash
- 02:00
Timestamped
An independent timestamp authority signs the evidence hash under RFC 3161. The time on your record is somebody else's word, not ours.
- 02:09
Sealed
The original is written once and never rewritten. From here, every action on it is one more line in a log that only grows.
chained to segment 02 · retained until 26 Aug 2032
What you end up with
A record with its handling attached.
Each exhibit keeps its device hash, the server's matching recount, its place in the chain, the authority's token and the date its retention ends. None of that proves the camera saw the truth; no software can. What it proves is narrower: the file is the one sealed at capture and any change since would break its hash. Every action taken through Witnal is one more line in the log.
The log is append-only. A mistake is corrected by a further entry, never by editing an old one.
The pipeline is built against the College of Policing's guidance on CCTV evidence and the Home Office procedure for digital images.
- Device hash
- 242c6ceb9f9a…c76a819aaaff
- Server hash
- Recomputed on ingest, matches
- Chain
- First in the sequence
- Timestamp
- RFC 3161 token, held with the segment
- Retained until
- 26 Aug 2032
What the police get
A statement drafted from the evidence
Witnal drafts the witness statement from the sealed segments and the account on the record, in the structure police digital evidence systems expect. Where the evidence is silent, the draft says so in a list of open questions for the witness rather than guessing. You approve it or you do not. Witnal never submits on your behalf.
The right force, first time
Witnal works out the force covering your postcode and prepares the report for Single Online Home, statement and stills attached. A person files it; Witnal records when. If the right channel is 999, it says so and you dial.
A number you can chase
The crime reference that comes back is kept against the incident, with a date on every step. Six days of silence becomes a fact you can raise rather than a feeling.
Lawful sharing, nothing else
Where the shop belongs to a Business Crime Reduction Partnership or the National Business Crime Solution, Witnal prepares the share into the scheme, with the lawful basis recorded against it. No membership, no share.
What Witnal will not do
The refusals are design decisions. Each one has a reason you can check.
Recognise anyone
There is no face matching and no watchlist. Witnal keeps no database of people, so there is nothing to match a face against. A face in a recording is ordinary evidence for the police, exactly as it would be from the camera above your till. Detection runs for one job only: finding faces, so a person can mark who was uninvolved before a shared copy blurs them out.
Call the police for itself
Witnal recommends the channel and shows its reasoning. A person acts on it. It never dials 999.
Call your evidence tamper-proof
No file is tamper-proof, so Witnal claims only what it can show: a changed segment stops matching its hash and a touched record carries the extra log line.
Promise an outcome
Whether evidence is admitted is for a court; so is what it proves. Witnal's work stops at what it can demonstrate: the file and its handling.
Train on your footage
Your footage trains nothing. It is used to report the crime and for any lawful share you choose to make. Nothing beyond that.
Publish anything
There is no public feed and nothing here names a suspect. Sharing exists only into lawful schemes the shop already belongs to.
Your data, plainly
Recording people creates duties under UK GDPR and your shop carries them as the data controller. A tool built for evidence should make each duty straightforward to meet and to show. Plainly:
- Private by storage
- Evidence objects are private. An anonymous request for one gets a refusal.
- Dated by default
- Every sealed segment carries a retention date, written into the record itself.
- Every action in the log
- Every action taken through Witnal lands in the append-only custody log, views included.
- Blurred before sharing
- Uninvolved people are blurred out of any copy shared into a scheme. The blur discards pixels outright, so it cannot be reversed. The sealed original is never touched.
- Nothing without asking
- Beyond the essential sign-in cookie, nothing is set unless you accept analytics on the cookie notice. The contact form keeps what you send, with the time it arrived. Your theme choice stays in your browser.
Where Witnal is today
Witnal is built and running; this page shows it as it runs. The shop in the record above is a demonstration, seeded into every build. No customer names appear here because there are no customers to name yet. Inventing some would be a strange start for an evidence product.
Capture currently runs in the browser, which proves the pipeline rather than the finished device story. A phone suspends a backgrounded web page, so the capture that ships will be a native app feeding the same sealed pipeline.
Witnal is built by RSE Labs, a London software studio. To see a record built live, ask: witnal.com/contact