The commitments · v1

Nine commitments, and what makes each one true.

These are properties of the machine, not values we hold. Each row names what makes it true and is written so you can check whether we kept it. The page is versioned: a future revision gets a new URL and this one stays where it is, word for word.

Version
v1
Effective
1 September 2026
Commitments
9
Supersedes
Nothing
01Inference in the dockHardware
The threat detection model executes on Luna Dock hardware on your property. Video is never uploaded to be processed. There is no server-side inference path to enable later.
02Local first storageHardware
Footage is stored on the dock. Cloud backup is opt in and off by default. Turning it off never disables local recording, playback or detection.
03Encrypted by defaultFirmware
End to end encryption is active from first boot. It is not a setting, not a paid tier, and not something you have to go and find.
04We hold no keysCryptography
We cannot decrypt your footage. We therefore cannot produce it under subpoena, warrant, national security letter or commercial pressure. Legal process is served on you, the owner of the data.
05No law enforcement portalAbsence
No portal, no bulk request tool, no agency dashboard, no voluntary sharing programme. It is absent from the product and from the roadmap.
06Geofenced to your parcelFirmware
The aircraft is constrained to your property boundary in firmware. It is not a configurable limit, so it cannot be widened by us, by you, or by anyone who compromises either of us.
07Transit framingFirmware
While the aircraft is moving, the camera points down and inward. Neighbouring property is not captured, rather than captured and then discarded.
08No data or analytics salesPolicy
We do not sell customer data, and that includes aggregated, anonymised and de-identified derivatives, which is the loophole this industry normally uses.
09Local footage is never paywalledPolicy
Local storage, playback and detection work forever, offline, with no subscription. A subscription buys monitoring and response. It never buys access to your own recordings.

Seven of the nine hold because of the hardware, the firmware or the cryptography. Two read policy, which means they hold because we decided they would and a decision can be reversed. We would rather label those two than let them read like the other seven.

Charter lock

These commitments will be written into the corporate charter at incorporation, so that an acquirer cannot void them.

Stated plainly for what it is: today this is a promise, and this company's whole argument is that promises are worth less than architecture. It is a dated public commitment with a named trigger, which is stronger than silence and weaker than the real thing. It becomes architecture when the entity exists.

Early access

Luna ships to the first 500 homes.

Join the list and you take a position. Refer someone and you move up it. No deposit, no card, and we will not sell your address any more than we would sell your footage.

A short note every few months, plus the big moments. Nothing else, and never to anyone else.