The Vendor Audit: We Graded Genetec's ALPR Disclosures Against Its Own Documents. It Got a 62.

The lowest score on the card, and the one that pulls an otherwise strong result down into the middle. The Global Privacy Policy is headed "EN | 2020.07.24" on every page. Its closing section reads: "This privacy policy has been last updated on December 4, 2019." Those are two different dates in one document about that document, and the later of them is more than six years before this audit. The Product Privacy Sheet governing AutoVu carries the same December 2019 vintage. Nothing in either has been revised to describe cloud ALPR as it is sold in 2026 — the policy predates the AutoVu CloudRunner service named in the company's own 2023 certifications release, meaning the product is certified in one document and absent from the document that governs its data. The content is not wrong; it is old, and a privacy policy is a promise whose value depends on describing the thing you actually bought. Credit where due: the policy explicitly states it "takes into account the provisions of Regulation 2016/679" — the GDPR — and the substantive terms it does contain are, as the rest of this card shows, better than either competitor's. That is exactly why the staleness costs so much. This is the one area where the strongest set of commitments in the series is undermined by the company's own filing discipline.

The one area where Genetec scores meaningfully below both competitors, and the reason is a single clause. The Product Privacy Sheet describes a genuine mechanism: the Directory "is responsible for the authentication of all user connections and, as such, will capture user identifiers to uniquely identify authorized users," and "the Product keeps a record of all user activities as part of its audit trail, which may also include changes to the system configuration made by each user." Then: "By default, this Data is stored for a period of 90 days, but you may disable its capture." That last clause is the finding. Flock's logging is described as automatic and supervisor-reviewable; Motorola's enumerates five mandatory fields including a required purpose and states that "Required reasoning notation to query the LPR database is mandatory." Genetec's is a default the administrator can turn off entirely. An audit trail that the audited party may disable is a different kind of object from one they may not — it protects an agency that wants oversight and offers nothing against one that does not. The 90-day default is reasonable and clearly stated, and the access-history logging for Synergis carries the same default. But neither competitor gives the customer a documented switch to stop recording who searched what, and that is a real deduction rather than a stylistic one.

Structurally the cleanest retention story in the series, and incomplete in one specific way. For AutoVu, the Product Privacy Sheet says the data "is stored according to the retention periods you define, which may vary depending on the type of Data," and for other components that data "will be stored in the Product until you decide to delete it." Crucially — and this is what separates it from Motorola — there is no second category. No dataset retained by the vendor "as long as it has commercial value," no commercially collected archive the customer neither owns nor can delete. The company-side commitment in the Global Privacy Policy is ordinary but consistent: personal data is kept "only for as long as it is necessary for us to fulfill our obligations," after which "we will put necessary efforts to permanently dispose of" it. Where Genetec's disclosure falls short of Flock's is specificity. Flock names a number — 30 days, extendable to one year with elected-official approval — which is checkable and arguable. Genetec names 90-day defaults for the audit trail and access history but names no default at all for the license plate reads themselves, leaving the single most privacy-relevant retention period entirely to the deploying agency with no vendor-suggested baseline. "You decide" is honest. It is also the answer that puts the whole question back on a city council that may not know it was asked.

The best-handled certification claim of the three, mostly for one reason a reader can act on. Genetec's January 26, 2023 release names ISO/IEC 27017 — the cloud-specific information security standard — and scopes it explicitly to Security Center SaaS Edition rather than implying it covers everything. It also cites SOC 3, and that matters: SOC 3 is the publicly distributable report. Motorola's compliance guide offers SOC 2 "available under a Non-Disclosure Agreement," which means its strongest third-party assurance is one no resident, reporter, or council member can read; Genetec points at a report that anyone can. The Global Privacy Policy separately describes "server authentication and data encryption, to protect personal data during transit over the internet and at rest." Two deductions. First, these claims live in a press release and a resource page, not in the governing privacy documents — a reader following the policy chain never encounters them. Second, the ISO/IEC 27017 scope cuts both ways: naming one product honestly also means the certification does not cover the on-premises deployments many police agencies actually run, and the release does not say what does. Specific and verifiable beats broad and unbacked, which is why this outscores Flock's unsubstantiated FedRAMP badge and Motorola's borrowed Azure certificates.

Genetec sells cross-agency sharing the way its competitors do, and describes it without the framing problems that cost them points. The AutoVu material says the system "lets you manage all of your hotlists from one system and decide whether to share plate reads or hits beyond your organizational boundaries," with Federation and covert hotlists offered as the mechanism. That is opt-in, per-organization, and stated plainly — there is no equivalent here of Flock's Trust page answering "Is there a national database of my data? No" while the catalogue sells a National LPR Network. More significantly, there is no equivalent of Motorola's DRN arrangement: no separate commercial dataset gathered by repossession contractors, owned by the vendor, and made queryable by police as a paid upgrade. What a Genetec customer shares is what a Genetec customer collected. The deduction is for thinness rather than contradiction. Federation is described in marketing terms — capability, not governance — and neither privacy document explains what a federated share means for retention when two agencies set different periods, who audits a cross-boundary query, or how a share is revoked. Flock's opt-in architecture is documented in more detail across its Trust pages than Genetec's is anywhere. Good default, light paperwork.

Genetec never makes the claim that sank Flock's equivalent area. There is no trust page here announcing "It captures vehicles. Not people." What the Product Privacy Sheet does instead is enumerate the capture in flat, unflattering detail: license plate number and state of issuance; images of the vehicle; metadata including make, model, speed and relative motion; unique device identifiers; geolocation and timestamps; and cameras that "capture, and store internally, license plate identification, images and metadata... until such Data is offloaded." Then the sentence that earns the score: the images "may include images of the license plate of the vehicle, the vehicle itself and images of the surrounding areas, which may include images of individuals passing by at the time the images were captured." No competitor in this series writes that sentence. Flock spent an entire Trust page implying the opposite while selling person search; Motorola asserted its data "is not considered personally identifying information." Genetec simply says a camera pointed at a road photographs the people on it. Points come off because the disclosure is descriptive rather than governed — having conceded that bystanders are in the frame, neither document says what happens to those images, whether they are subject to the same retention the customer sets for plate reads, or whether any masking is applied by default. The honesty is real and unusual. The follow-through is missing.

The strongest substantive area on the card, and the clearest separation from both competitors. Three things do the work. First, the Global Privacy Policy states without qualification: "We do not sell or rent any personal data to any third party." Second, the law-enforcement disclosure clause is limited to compulsion — Genetec "may be required to disclose information... to governing and law enforcement authorities, including where required by law, a court order, or by other legal obligations." Set that against Flock's policy, which permits disclosure on a "good faith belief that such access... is reasonably necessary," a standard the vendor applies to itself with no customer notification required. Genetec's clause has no such escape hatch. Third, and structurally most important, the Product Privacy Sheet documents a deployment in which the vendor holds nothing at all: in a Local Environment "all Data is stored in the data hosting systems and servers provided by you and is not made available to Genetec except as outlined in this document." Neither Flock nor Motorola offers an architecture in which the company has no copy. The Cloud Environment is described with the ordinary multi-tenant assurance that each customer's data "is logically segregated." Deductions: sharing with "affiliated companies, parent entities and subsidiaries, for internal business purposes" is permitted in terms broad enough to cover a lot, and the connected services GUS and SAM are "configured to allow Genetec to receive Data described above by default" — opt-out, not opt-in, though both are disclosed and both can be disabled or anonymised.

The highest score in the Vendor Audit so far, awarded for a single paragraph that most readers will never open. Genetec reserves the ordinary right to revise its policy "from time to time, without prior notice" — and then constrains it in the way that matters: "The revised version of this document terms will take effect as soon as it is made available on our website with regards to all new customers," with a commitment that material changes to how personal data is processed get "a more prominent notice." Read that against the last section of Motorola's LPR Usage & Privacy Policy, quoted on the previous card: revisions there "will be retroactively applicable to data collected prior to any revision of this policy." Same clause, opposite direction. One vendor's promises are a floor that holds for the data you already handed over; the other's are a snapshot the vendor may re-photograph at will. This is the least glamorous item on any of these three cards and arguably the most consequential, because it determines whether every other commitment is durable or provisional. Points come off only for the drafting — "The revised version of this document terms" is garbled, "without prior notice" sits awkwardly beside the notice commitments that follow it, and the paragraph never says what happens to existing customers, leaving the protective reading to inference rather than statement. Best-in-series terms, expressed in a sentence that needed one more edit.