The situation.

A production company has teams across the globe, completing at least one field shoot a day and sometimes more than four. Its editors are fully remote and work from an on-prem storage bucket at the company office. Every shoot therefore has to move from camera media in the field to that central store securely, completely, and in a form an editor can use without reconstructing the day from messages and temporary files.

The constraint.

There is no acceptable partial success. A corrupted or missing transfer can force a five-figure re-shoot, while footage without the director's context can leave remote editors unable to do their job. The process also has to work for a field crew at the end of a long day, survive unreliable connectivity and restarts, and expose no general-purpose route for content to leave through an unapproved destination.

What we found.

Footage and instructions were moving through two disconnected systems. Media sat in temporary locations while the director's daily notes were entered separately in a SaaS task-management system. Sometimes the footage arrived without its notes; sometimes the notes existed while footage was missing. Because neither system owned a complete record of the shoot, the two were not reliably linked or updated, leaving work in limbo. The media path had the same ambiguity: a partial copy could look finished, a card could be reused before verification, and there was no durable completeness marker.

What we built.

We designed one ingest contract for both media and context. The kiosk captures the director's notes as required metadata for the shoot, links them to its footage, and refuses to mark the job complete without both. Media is copied to two independent local RAID5 arrays and hashed with SHA-256. Finished scenes transfer to office storage over SSH and rsync through a write-only remote jail, then run a remote verification pass against the source checksums. The completion manifest is pushed last: a remote folder without it is still in flight, while a folder with it has completed transfer and verification. Interrupted uploads keep their partial data and resume into the same destination after restart. The appliance itself boots directly into the kiosk, automatically connects to a split-tunnel VPN, and runs behind a default-deny firewall that permits only pinned infrastructure. Its SSH host key is pinned. A read-only health panel exposes RAID, disk, VPN, firewall, network, and transfer status, while deeper support access requires a password and exits to a console instead of a normal desktop. Final server-transfer logic and end-to-end testing are still in progress before field deployment.

What changed.

The system replaces two ambiguous handoffs with one machine-enforced definition of done: the notes exist, the footage exists in both local copies, the office copy matches the source byte for byte, and the final manifest proves it. Once deployment testing is complete, field crews will have one guided workflow and remote editors will receive each day's media with its production context already attached. Until then, we are treating the work as an in-development system, not claiming production outcomes it has not yet earned.

  • 1 to 4+ global shoots per day
  • 2x RAID5, SHA-256 verification
  • VPN, SSH/rsync, write-last manifest

If this sounds like your operation, apply to work with us.

Apply