Zero Trust architecture, AWS Wavelength Zone Casablanca, CNDP compliance — built for Moroccan data residency.
Deployment on AWS Wavelength Zone Casablanca ensures transaction data and video streams never leave Moroccan territory — CNDP compliance and native digital sovereignty. Critical processing runs at <10ms from the collection point.
The first architectural decision is not model choice, it is where processing happens. Three options coexist in our deployments: at the edge on the customer site, on Moroccan infrastructure, or in cloud for non-sensitive workloads. The criterion is not raw performance but data sensitivity and tolerance to network loss.
For video, local processing is almost always required: sending dozens of streams to a cloud is expensive in bandwidth, adds latency, and moves the compliance question outside the country.
Law 09-08 governs personal data processing in Morocco under CNDP oversight. Four obligations recur across our projects: a declared purpose, informing data subjects, a bounded retention period, and restricted, logged access.
Our position is simple: compliance is built into the architecture, not into a contractual annex. When processing stays on site and footage never leaves, cross-border transfer stops being a question.
No component is trusted merely because it sits on the internal network. Mutual authentication between services, least privilege by default, and segmentation between the video layer, the transactional layer and administration.
Credentials never live in code or in a versioned configuration file. They are injected at runtime, with rotation possible without redeployment. This is a discipline we apply to ourselves first.
A POS must keep taking payments when connectivity drops, then resynchronise without losing a transaction. Video detection must keep alerting locally even if the notification channel is down. Degraded mode is designed in from the start, never bolted on.
Deployments are reproducible and versioned: the same artefact goes to staging then production, with no manual server work. Monitoring covers availability, end-to-end latency and stream health, not just machine state.
Reversibility is an explicit requirement: operating documentation, recovery procedures, and no proprietary component preventing handover to another team. A system you cannot take over is not infrastructure, it is a dependency.