One server per store. Everything inside the building.
ShopVoices is a store-shaped system: one GPU workstation per store runs the speech recognition, the language understanding, the product search, the maps and the analytics — and every assistant on the floor is a thin client of it. Hardened like infrastructure, because that's what it is.
A store-shaped architecture
Every design decision follows from one rule: the store must be able to answer its shoppers on its own — with the internet down, with head office unreachable, with an external service missing.
- One GPU workstation per store runs the whole intelligence layer. Standard hardware; a compact industrial-grade appliance tier exists for the kiosk itself.
- Thin clients everywhere else. Kiosks, counters and handhelds are ordinary Windows and Android devices talking to the store server over the store's own network.
- Data flows one way each. Catalogue, maps and configuration flow down; anonymous statistics flow up; every transfer is initiated from below — the server never dials into a device, and nothing dials into the store.
- Offline is a mode, not an outage. The answer path makes zero cloud calls. Even the estate map's tiles are self-hosted. A kiosk keeps its last-published look and keeps answering with no network at all.
- Bring your own search. Product search is pluggable: the built-in engine by default, or a read-only connection to the retailer's existing search index — with automatic fallback so an engine outage never silences a kiosk.
- Continuity by design. Source-code availability under contract and bring-your-own-search mean the capability outlives any vendor relationship.
The Console draws this topology live, for every store
The illustration above isn't marketing shorthand — it is the actual shape of the system, and the Console renders it live: the store server at the centre, every enrolled device around it with its real-time online state. What your IT team audits is what the diagram shows.
Hardened at every layer a reviewer will ask about
Written for the DPO and IT-security reader: these are the properties you will verify in due diligence, and the architecture is built so that you can.
Device identity by certificate
Every device receives a mutual-TLS client certificate at enrollment. Devices without one don't talk to the server — impersonating a kiosk requires more than knowing a URL.
Rotating device tokens
Device credentials are stored hashed and renewed automatically on a daily cycle. There is no long-lived secret to steal from a shop-floor machine.
Signed releases only
Software updates are cryptographically signed. Head office refuses to publish an unsigned release, and every store server refuses to install one — the update chain has no unsigned link.
Staged rollouts, automatic rollback
Updates move through channels and waves with health-gated promotion. A store that fails its post-update checks rolls itself back and halts the rollout for everyone else.
Access control with scoping
Console users get capabilities, not god-mode: per-section rights scoped per store or region, with session protection and rate-limited authentication.
A full audit trail
Every administrative change — who, what, when — lands in the audit log. Secrets are encrypted at rest, and the administration surface is designed never to execute an uploaded command.
Standard hardware, sized for the job
| Role | Hardware | Notes |
|---|---|---|
| Store server | Standard GPU workstation | Runs speech, understanding, search, maps and analytics for the whole store. One per store. |
| Kiosk | Touch screen + thin client, or a compact industrial appliance | The appliance tier runs the full experience standalone; thin kiosks need only a browser-class device. |
| Counter | Standard Windows mini-PC or tablet | Installed from a per-device installer generated by the Console; verified on real store hardware. |
| Handheld | Standard Android tablets and phones; iOS ready | Verified on current-generation Samsung hardware. |
| Customer mobile | The shopper's own phone | QR to browser — no app, no login, no hardware to buy. |
| Microphones | Built-in, USB array, or wireless battery mics | A wireless mic pairs to any screen through the Console. |
Put it in front of your security team
Request a technical & privacy briefing — architecture, data flows and the security posture, presented for the people who have to sign it off.