The challenge

A hosting partner brought us a customer who needed to let fleet operators share dashcam and incident video with insurers — securely, at scale, and without handing sensitive claims footage to a third-party consumer platform. Off-the-shelf video sharing couldn't meet the security, permissioning and compliance bar that regulated insurance work demands.

We built a quick prototype for a trade-show demonstration of the concept. That prototype became VUEcloud.

What we built

Over several years we developed VUEcloud into a microservice, Kubernetes-based, highly available platform with integrated APIs connecting systems and end users. It allows them to share:

• Video — such as incident and dashcam footage, from a huge range of devices: many hundreds of TiB of content, amounting to tens of thousands of videos.
• Images — in a wide variety of formats.
• Files — documents and software, wherever they need to be shared.
• Structured data — including a tool that processes complex CSV data and field mappings into rich visual reports.

At its core is a fine-grained permissions system that controls access from the system level, down through categories, to the permissions on a single bucket of data (a "node"). For an insurer, a node might represent a claim, and a handler can use it to request supporting evidence. A fleet operator can upload footage directly from its own systems and pass relevant material through to the insurer's cloud, while keeping its own pool of video — including material used internally for training.

The latest iteration adds socket-based live updates, giving users instant feedback on events as they browse. A claims handler sees material the moment it arrives, and where several people are contributing to a node, each sees the others' additions in real time (subject to permission) — while the overhead stays tiny, because only the specific updates each subscribed user needs are sent.

How does it scale cost-efficiently?

The microservice architecture lets the entire stack scale with demand. When traffic is quiet, resources — and therefore cost — are minimised; when it's busy, they scale automatically, from around fifty pods up to many times that. Because the platform scales so freely, the only real bottleneck is the network capacity of the cloud provider itself. This cuts the platform's static, always-on application footprint by around 80%: rather than running many services continuously, we use serverless patterns to flex compute on demand — so resources track real usage instead of provisioning for peak.

The platform is cloud-provider agnostic, built on cloud-native, portable technologies throughout to avoid vendor lock-in. It runs on Kubernetes, with a multi-tiered storage approach — from fast, high-IOPS block storage for working data through to long-term object storage — behind load-balanced, horizontally scalable application containers. That means clients aren't tied to a single provider's pricing or roadmap.

How is the data secured and kept compliant?

We architect VUEcloud to meet the rigorous regulatory controls our customers operate under — including the requirements of GDPR, SOC 2 and Cyber Essentials Plus. The deployed solutions are independently audited by several security companies on our customers' behalf, and subjected to thorough penetration and application security testing. Because security is designed into the architecture rather than bolted on afterwards, the platform meets those standards naturally — and has passed every audit and test it has faced.

Security is built into how we ship, not bolted on:

• CI pipeline designed to check, audit, test and build, with static analysis and vulnerability scanning in the standard chain, so we're continuously reviewing and refining output.
• Change management with planned releases and stability release chains. Detailed tracking integrated with monitoring lets us correlate issues to specific releases and resolve them efficiently and reliably.
• Monitoring both in-cluster and via remote checks, wired into our alert channels and trackers — so we're often ahead of developing issues, with specific signals checked with precision.

How do you develop and test without exposing customer data?

Customer data is strictly separated: staging and development environments never use real customer data. We prove changes on our own infrastructure before they reach a customer environment.

To do that we run our own on-site private cloud — a hyperconverged platform running RKE2 Kubernetes clusters on a virtualisation layer. It lets us prototype ideas and test to destruction in complete isolation from live and QA systems. So the platform our customers depend on is only ever exposed to changes that have already been proven elsewhere.

The outcome

What began as a single idea is now a thriving platform used by six of the UK's largest insurance companies and many of the country's largest fleet operators. It has been in operation for over a decade with consistently high availability — thanks to its highly available architecture — serving tens of thousands of users and handling many terabytes of video and data, and helping insurers cut the time it takes to process a claim.

It's a clear example of what we do: take a simple concept and turn it into a production-grade, secure, scalable system — a depth of capability we bring to every engagement, especially in regulated industries.

Got an idea of your own to realise? VUEcloud began as a single concept and became a platform that regulated industries depend on. That journey — from idea to a secure, scalable, production system — is what we do.

FAQ

Who uses VUEcloud? Six of the UK's largest insurance companies and many of its largest fleet operators, for secure sharing of video, images, files and claims data.

Is it tied to a specific cloud provider? No. It's built on cloud-native, portable technologies and is agnostic to the cloud provider, avoiding vendor lock-in.

How is access controlled? Through a fine-grained permissions system that spans from the system level, through categories, down to individual data buckets (nodes).

Has it been independently security tested? Yes. The solutions we build are independently audited on our customers' behalf against the controls required by GDPR, SOC 2 and Cyber Essentials Plus, and put through thorough penetration and application security testing — passing every one.

Can it handle structured claims data, not just video? Yes. Alongside video, images and files, it processes complex CSV data and mappings into rich visual reports.