Frequently asked questions

We build and run AI security monitoring across three areas — servers, APIs and websites; networks; and premises via CCTV — and we deliver the human security work around them: testing, incident response, forensics, compliance readiness and advisory.

Because any number we published would be wrong. "Website audit" describes two days of work for one client and two months for another. Cost follows scope, estate size, urgency and whether you need a project or ongoing cover, so every engagement starts with a scoping conversation and a written scope. Nothing is charged before you have agreed it.

Ordinary monitoring compares events against a list of known-bad signatures, so it recognises yesterday's attack. Ours learns what normal looks like in your environment and acts on behaviour — a script writing where it never wrote before, a host scanning its neighbours, an item leaving a counter while nobody is watching. That is what makes a threat nobody has named yet catchable.

No, and nobody honest will. What monitoring changes is how long a problem goes unnoticed, and dwell time is usually what decides the size of the loss. Every platform page on this site states its limits plainly for that reason.

No. We require written authorisation from the owner before any scan, test or deployment. That is not a formality — testing without authorisation is a criminal offence in India and in almost every other country, and doing it would expose both of us.

Never, for anything. Access is granted through your own provider's controls, scoped per task, and revocable by you. If someone contacts you claiming to be from Mounteyes and asks for a password, OTP, recovery code or card detail, it is not us — report it to [email protected].

We can guide you correctly and quickly through the official recovery, appeal and complaint routes, and prepare the evidence those processes ask for. We cannot bypass a platform's security, and no outcome can be guaranteed. For financial fraud, speed matters more than anything else: call 1930 and file at cybercrime.gov.in immediately, and do that before contacting us if you have not already.

Only if you choose that. For CCTV, processing can run on-premise with only alerts and their clips leaving the site, and for organisations with a policy against video leaving the building that is the default. For server and network monitoring we collect what monitoring requires and nothing beyond it.

No. Filtering happens before your application does work, so most blocked traffic never reaches your database, and we baseline response times before enabling anything so the before-and-after is measured rather than asserted.

Usually not — most existing IP and analogue setups work through your current DVR or NVR. We assess the feeds first and tell you which cameras need repositioning or replacing to support the detections you want, before you spend anything.

With notice, yes — and we require it. Your staff must know monitoring is in place and what it is used for, there must be visible notice at entrances, a stated retention period and restricted access to footage. We will not set up covert staff surveillance.

Enquiries are answered within 24 hours, usually sooner. For monitoring customers the response window for an incident is agreed in the contract, and anything the platform can safely contain by itself is handled immediately rather than waiting for a human.

Both. A single-server shopfront and a multi-site network get the same platform and the same engineers — the scope differs, not the standard. We will also tell a small business when the honest answer is that it needs two configuration changes rather than a retainer.

We work with businesses worldwide, from our base in Jaipur, India, across retail, hospitality, healthcare, education, manufacturing, professional services and technology. Server, website, API and network work is delivered remotely in any country; AI CCTV deployment needs a site assessment first, so it is offered where we can visit.

A scoping conversation first, and nothing is installed before it. We ask what you are running, what has already gone wrong, and what you would consider an unacceptable loss, and you leave with a written scope stating what would be monitored, what would not, and what we would escalate on. Then an assessment of what is actually there — exposed services, patch state, camera coverage and blind spots — and you get those findings in writing whether or not you continue with us. Deployment, a baseline period and live monitoring follow. The full sequence is set out on our platforms page.

It depends on the size of the estate, and we will tell you which case you are during scoping rather than afterwards. A single-server setup with a handful of cameras is usually a matter of days. A multi-site network, or anything needing physical camera work, takes longer. Alerting then stays deliberately conservative through the baseline period while the platform learns what normal looks like for you — switching on aggressive alerting from day one produces noise, and noise is why monitoring gets ignored by week three. Anyone quoting you a same-day deployment is describing a demo.

Four things, and none of them is a credential belonging to you personally. Written authorisation from someone able to grant it, because we only monitor or test systems you own or are authorised to assess. Access scoped to the work — the specific servers, feeds or network segments in scope and nothing wider. A named contact who can make a decision during an incident, plus a fallback for when they cannot be reached. And your decision on what may be contained automatically versus what must wait for a human, which is the single most consequential setting in the deployment. We never need your password, an OTP or a recovery code.