Self-Exclusion Alerts
Raises a possible match when someone enrolled in your self-exclusion scheme appears to have come in.
SentinelGate — Self-Exclusion and Age Checks at the Door and the Kiosk
On-premises facial recognition for retail betting shops and self-service kiosks. SentinelGate alerts your staff when a customer who has voluntarily self-excluded appears to have come in, and prompts an ID check when a customer looks under your challenge age.
-
Self-exclusion
Possible match
-
Age check
Age verification required — please check ID
-
Age pass
ID checked
What is SentinelGate?
A second pair of eyes. The decision stays with your staff.
SentinelGate is deliberately narrow. It is not CCTV analytics and it is not a security system. It watches for two things, tells a member of staff what it thinks it has seen, and leaves the judgement to them.
Age-Check Prompts
Prompts staff to ask for ID when a customer looks younger than the challenge age you set.
Staff Decide
It never decides who someone is or how old they are, and never refuses service. Every alert is a prompt for a person to verify.
Stays on Your Premises
Faces are processed on a machine on your premises. No cloud service is needed for it to work.
Where it runs
One product for the shop, the kiosk and the door.
The same software is set up for the place it is watching. Each installation says what it is, so an alert tells you where it came from.
Retail shop
One machine watches the whole location through up to four cameras, with the staff screen at the counter.
Self-service kiosk
Runs on the terminal itself. Where nobody is standing at the screen, it can lock the kiosk until staff have checked.
Entrance unit
A single camera at the door, for a shop that wants to know as a customer arrives.
How it works
From a request at the counter to a quiet word with the customer.
-
Step 1
Enrol at the counter
A customer asks to self-exclude. Staff record their consent, take three to five captures of their face and set the date the exclusion ends.
-
Step 2
Watch who comes in
SentinelGate follows each face the camera sees, and sets aside any that are too small, too turned away or too blurred to judge fairly.
-
Step 3
Raise a possible match
Several separate captures of the same visitor have to agree before anything is raised. Staff then see the alert on screen, once per visit, and your own systems are notified.
-
Step 4
Staff verify and record
A match is only ever "possible". A member of staff looks, handles the conversation the way your policy says, and records what they did, on the device or in your own systems.
Age checks
A prompt to ask for ID, not a verdict.
When a customer looks younger than your challenge age, staff see "Age verification required — please check ID". The challenge age is yours to set, and defaults to 25.
Estimating age from a face is approximate, so SentinelGate treats it as a reason to ask and never as proof of age. Your staff check ID exactly as they do today.
- Age passes. A customer whose ID has been checked can, with their consent, be remembered so they are not asked again on every visit.
- A band, not a number. An age-check alert records that the customer looked under the challenge age. It never records an estimated age, and the prompt staff see names no age at all.
- No picture kept. So staff know whom to ask, the face can be shown on their screen for a short while, two minutes as standard. It is held in memory and never written to disk.
At the kiosk
When nobody is at the screen, the screen can wait for staff.
At a self-service kiosk there may be no member of staff nearby to see a prompt. SentinelGate can lock the kiosk's screens when it raises an age check or a possible self-exclusion match, and ask the customer to see a member of staff.
The lock holds the screen until a person has looked. It is not a decision about the customer: SentinelGate never judges anyone's age or identity for itself.
- Yours to switch on. Nothing locks until you choose which cameras may lock the screens and set a release PIN. Age checks and self-exclusion matches each have their own switch.
- Staff release it. A member of staff enters their staff number and the PIN, and records whether ID was checked.
- The customer is not told why. The screen asks them to see a member of staff. It shows no picture and no age.
- It can clear when they leave. If you choose, a lock is released once the person who caused it has gone. Coming back locks the screens again.
- Every lock is recorded. When it started, when it was released, by whom and with what outcome all go in the audit log.
Privacy by design
Built to hold as little as possible.
Facial recognition is special-category processing under GDPR. As standard, SentinelGate is set up to collect the minimum and to keep it on your premises.
No alert, no trace
A visitor who raises no alert leaves nothing behind on the machine. Their frames and measurements are held in memory and dropped when they walk out.
No names, no photographs
An enrolment is a numeric face template, a consent reference, the staff member who took it and an expiry date. It holds no name and no picture.
Evidence that expires
A possible match keeps one face crop, the time and a score, so staff can verify it. All of it is deleted after 24 hours, whatever staff decided.
Deletion that deletes
Every enrolment carries an expiry date. When an enrolment is removed it is erased, along with its alerts, not hidden behind a flag.
Photos and screens are flagged
Each face is checked for signs of a photograph or a phone held up to the camera, and an enrolment is only taken from a live face.
Tamper-evident audit trail
Enrolments, deletions, alerts, staff decisions and deliveries are written to an append-only log in which each entry is chained to the one before, so an edit or a gap shows.
Nothing listening
SentinelGate accepts no inbound connections. What leaves your premises is what you choose to send, to the systems you name.
Careful wording
Alerts say "possible match" and "please check ID". The product never tells staff that someone has been identified.
Integration
Alerts land where your team already works.
Alongside the staff screen, SentinelGate posts each alert to the webhooks you configure, so it can reach your head office tooling, your messaging or your own compliance records.
- Signed and encrypted. Delivered over HTTPS with certificate checking, and signed with HMAC-SHA256 so you can prove an alert came from your gate.
- Retried and recorded. A failed delivery is retried, and every attempt is written to the audit log.
- Decisions follow the alert. What staff record on the device, such as a match confirmed or ID checked, is sent on as an event of its own.
- A face only if you ask for one. Events carry ids, times and scores. A webhook you opt in can also receive a small picture of the face an alert was raised for, so the receiver can see whom to approach.
- Regular check-ins. A heartbeat reports camera status, so you know a gate is healthy before you need it.
- Test before you rely on it. Send a test event to confirm an endpoint is receiving.
What a Site Needs
- One small PC on the premises, or the kiosk's own, running Ubuntu or Windows. No graphics card is required.
- A camera at eye level, at the entrance or on the kiosk: an ordinary IP camera or USB webcam. One machine takes up to four.
- A screen for enrolment and the live view. A kiosk can run without one of its own.
- No connection to a cloud service for detection or matching.
Before You Go Live
Recognising faces on your premises is a serious thing to do, and it should start with a data protection impact assessment and legal review. We work through both with you.
SentinelGate is available for evaluation ahead of general release. Talk to us about trying it in one of your shops or on one of your kiosks.
Support your self-exclusion scheme without taking the decision away from staff.
SentinelGate gives your team a timely prompt, and gives you a record of what was raised and when.
Get In Touch