A count is not an identity. A local record is not an upload to a vendor. Video stays with the operator — because that is both the law and the trust.
A railcar is a public space with a right to feel safe, and a right not to be named on the way to work. Both are true.
By default TRAFFIQ does not run face identification. Violence, running and fire are behaviour categories — not names. Documentation is kept locally. If a regulator asks where the data lives, the answer is «in the railcar, with you». Not in a manufacturer’s cloud.
On-board processing is not a gimmick. It is the only way to meet both the space limit and the duty to keep sovereignty over footage. The event goes up to the control room. The raw video stays. That is also how operations at different security levels work around the world.
There are capabilities we will not switch on because someone saw them in an airport catalogue. A railcar is not a border. Choosing the capabilities is part of the contract with the public sitting in the seat.