There is a class of person for whom “home security” is not a convenience — it is a survival requirement. Journalists whose reporting draws threats. Activists whose addresses have been doxxed. Public figures stalked through data brokers. Domestic violence survivors who changed their locks, changed their number, and still do not sleep well.
These people do not need a doorbell camera that uploads to Amazon’s cloud. They need a private security camera system with no third party — a perimeter that watches, listens, and remembers, but never phones home. That is what H3 Citadel is built for.
What H3 Citadel Actually Is
Citadel is the third tier in the Sovereign Sentry product line: a complete home perimeter system designed for people whose safety depends on operational security, not marketing promises. The kit runs $2,400 and includes:
- 12× The Vigil — camera nodes with local H.265 encoding, end-to-end encryption keys, and motion-intent AI that runs on-device. No cloud upload. No remote access unless you explicitly grant it.
- 6× The Listener — audio nodes with glass-break detection, voice-intent analysis, and an ultrasound beacon for proximity awareness. Consent-gated: audio only activates when the system is armed and the zone policy allows it.
- 8× The Threshold — contact sensors for every door, window, and gate. Tilt and vibration detection. 18-month battery. Mesh-connected, so if one dies, its neighbors fill the gap.
- 4× The Spine — mesh routers that form the backbone. POE or battery. They handle mDNS discovery, CRDT state sync, and supervision tree health. If a Spine node fails, the mesh self-heals around it.
- Dual Hearth hubs — the brain of the system, running local NVR storage and the Love Equation governance layer. Two hubs means full redundancy: if one is destroyed or seized, the other continues recording.
- 4G-LTE failover gateway — because a determined adversary will cut your internet before they approach. The mesh continues recording locally; the gateway provides remote alerting over cellular when the landline is gone.
That is the hardware. The software is where Citadel becomes something different from every other security system on the market.
The Love Equation: Governance Without a Cloud
Most security cameras give you one setting: on or off. Maybe a schedule. Maybe “zones” that you cannot actually audit. The Love Equation governance layer in Citadel treats access as a relationship with explicit terms.
Every person who can see your camera feeds has a per-person access tier. Your partner sees everything. Your babysitter sees the front door and living room during her shift. Your neighbor sees only the shared driveway camera when you are traveling. Your mother-in-law sees nothing unless you manually grant it.
Every access event is logged. Not “logged” in the sense of a cloud dashboard that nobody checks — logged locally, cryptographically signed, and auditable through the Hearth hub’s governance constellation. You can answer the question “who saw what, when” at any time, without calling support or filing a data request.
Your identity is sovereign territory. The Love Equation enforces that principle at the device level.
Geo-Sovereignty: The Perimeter Knows Where It Is
Citadel includes geofenced arming. When you leave for the day, the system arms automatically based on your phone’s proximity — but the logic runs locally on the Spine mesh, not on a cloud server. When you return, it disarms. No account required. No location data sent to anyone.
This is geo-sovereignty in practice: the system knows where it is, adjusts its behavior accordingly, and never shares that information with a third party. For someone hiding from a stalker, this matters more than any megapixel count.
Dual-Hub CRDT: Why Two Hearths Matter
If a single hub is a single point of failure, two hubs with CRDT reconciliation are a survival strategy. The dual Hearth configuration means both hubs maintain independent recording state, and when they reconnect — after a power outage, after a network partition, after whatever disruption — they merge their state without conflict.
CRDT (Conflict-free Replicated Data Types) is the same technology that lets distributed databases stay consistent without a central coordinator. In Citadel, it means that if one hub is destroyed, stolen, or seized by an attacker, the other hub has a complete and consistent record up to the point of separation. No footage is lost. No state is corrupted.
This is not theoretical. The Recovery Runbook chapter covers exactly this scenario: what happens when the worst occurs, and how the system recovers without depending on anyone else’s infrastructure.
What 12 Vigils Actually Cover
Twelve camera nodes is not an arbitrary number. For a typical property — house, yard, driveway, gate — it means every approach vector has overlapping coverage. A single camera can be defeated by angle, timing, or a well-placed hat. Two cameras covering the same zone from different angles cannot.
Each Vigil runs motion-intent AI locally. It does not upload video to the cloud for processing. It does not send thumbnails to Amazon Rekognition. It analyzes motion patterns on the device — human vs. animal vs. vehicle vs. wind — and makes alert decisions locally. The footage stays on the Hearth’s NVR. The metadata stays on the mesh.
For the cost of trust — what you are actually paying for when you buy a security system — Citadel eliminates the largest line item: the third-party cloud that becomes a subpoena magnet, a breach target, and a surveillance liability.
Off-Grid is Not Optional
The 4G-LTE failover gateway is not a nice-to-have for Citadel customers. A person with a restraining order against a violent ex does not get to assume their internet will stay up. A journalist whose reporting just went viral does not get to assume their ISP will remain neutral.
When the landline is cut, the mesh continues recording to local NVR storage. The LTE gateway sends alerts to your phone over cellular. When the power goes out, battery-backed Spine nodes and Vigils continue operating. The system was designed from the start to work without dependencies — because the sovereign stack is local-first, cloud-optional.
This is not a marketing feature. It is an engineering decision that flows from the same principle as the entire Mesh-in-a-Box philosophy: the mesh under the mesh keeps working when the outside world stops cooperating.
The Math
$2,400 for the kit. No monthly fee. No cloud subscription. No “storage plan.” No account to create. The hardware is yours; the data is yours; the governance is yours.
Compare that to the alternative: a consumer camera system that costs $200 upfront and $10/month forever — $1,400 over ten years in subscriptions alone, plus the unquantifiable cost of your footage living on someone else’s server, accessible to their employees, their contractors, and their legal team when the subpoena arrives.
Citadel is not cheaper than a Ring doorbell. It is cheaper than the true cost of not having sovereignty over your own perimeter.
Who This Is For
Citadel is for the person who has already thought about what happens when the system fails. It is for the journalist who needs to know that their source’s face is not sitting on an AWS server in Virginia. It is for the activist whose address has been published and who needs a perimeter that does not depend on the goodwill of a corporation. It is for the public figure who has learned that “privacy settings” are suggestions, not guarantees.
It is for anyone who has decided that the sovereign stack is not a luxury — it is a minimum viable safety plan.
The mesh watches. The mesh listens. The mesh remembers. And the mesh answers to no one but you.
