Professional Vault

KaritKarma / Storage

Professional Vault

REV. d4fd8cfDB · 53 tablesSTORE · S3 + MinIO
Enterprise digital asset management

The newsroom archive, centralised
searchable, and role-aware.

Professional Vault is the central asset back-end behind every KaritKarma editorial product. One library for the whole team. CLIP semantic search, in-house face recognition, a real IPTC editor, and Wenme single sign-on. Built on a hardened Immich fork, extended with a Go metadata service, a Python ML service, and a 5-tier role system.

Byline
L. R. Nirjhar
Source
KaritKarma
Rights
All reserved
Captured
2026-05-16
Library
Central pool
Auth
Wenme OAuth
Roll · 2026-04-18 · field06 frames
PV-2026-04-18-001
FOCUS
EOS R5 / 70-200 f/2.8
ISO 1001/500sf/2.8
PV-2026-04-18-002
Sony A7 IV / 24mm
ISO 4001/250sf/1.8
PV-2026-04-18-003
Z9 / 400mm f/2.8
ISO 8001/1000sf/2.8
PV-2026-04-18-004
Leica Q3 / 28mm
ISO 2001/125sf/4
PV-2026-04-18-005
Pixel 9 Pro / wide
ISO 641/60sf/1.7
PV-2026-04-18-006
EOS R5 / 24-70
ISO 1001/400sf/4
4 faces matchedCLIP indexedIPTC parsed
Database tables
53

Asset, EXIF, IPTC, faces, roles

Role tiers
5

GlobalAdmin to Viewer

IPTC fields
14

Editable in-app, XMP exported

Semantic search
CLIP

Vision-language embeddings

001 · Definition

What is Professional Vault?

Professional Vault is KaritKarma's enterprise digital asset management platform. It is a hardened, source-available fork of Immich with a Go metadata service, a Python ML service, a 5-tier role system, and Wenme OAuth in place of the upstream email/password sign-in. The shipping product runs in a professional greyscale UI; the indigo and violet of the aperture mark only appear as accent.

Compared with Bynder and Brandfolder, PV is self-hosted and source-available. Compared with Adobe Experience Manager Assets, it ships in days, not in a six-figure consulting engagement. Compared with a bare S3 bucket plus a library tool, PV adds CLIP semantic search, central face recognition, a full 14-field IPTC editor, and role-aware projections out of the box.

002 · What PV does

Four subsystems, one library.

Each pillar maps directly to a folder in the codebase. The product is the integration of these four, not a list of feature ticks.

  1. One shared library. Not one per user.

    01 · Central library

    PV inverts Immich's per-user library model. Every asset lives in a single central pool with photographer_id and uploaded_by attribution. Editorial teams see the whole archive on day one, scoped by role, not by ownership.

    Source · Central pool architecture

  2. Search photos by description.

    02 · CLIP semantic search

    Vision-language CLIP embeddings live next to the asset. Search by what is in the picture, not by filename. The same model powers visual-similarity browsing and image-curator suggestions for NewsForge stories.

    Source · In-house ML service

  3. One named person across the whole archive.

    03 · Face recognition

    Central people directory: a public figure gets ONE entity, not one per editor. Faces detected by the ML service feed a shared person table. Tag once, find every photo across years. Partner-asset access is built in.

    Source · ML service plus central person directory

  4. Full IPTC editor, not just a caption box.

    04 · IPTC + EXIF stack

    The metadata-service (Go) extracts EXIF and IPTC on ingest. An in-app editor covers 14 fields: headline, caption, byline, credit, copyright, keywords, location, source, instructions, rights, transmission reference, category. XMP sidecars exported on demand.

    Source · Metadata service plus in-browser IPTC editor

003 · Ingest pipeline

From shutter click to indexed asset.

Every asset crosses the same five stages, regardless of whether it arrives from a desk photographer, a field phone, or the NewsForge AI crawler. The pipeline is owned end-to-end inside the codebase, not bolted on with vendor SaaS.

  1. Step 01

    Upload to central pool

    Drop, drag, or push from a camera, phone, or the NewsForge crawler. The asset lands at /data/pv/{year}/{month}/{assetId} and is mirrored to the S3 bucket immediately.

  2. Step 02

    Metadata extraction

    The Go metadata-service pulls EXIF and IPTC in one pass. Camera, lens, exposure, byline, copyright, headline, keywords. All parsed into dedicated columns, never a JSON blob.

  3. Step 03

    Embeddings + faces

    The Python ML service produces a CLIP embedding for semantic search and detects faces. Detected faces match the central person directory; unknowns queue for human review.

  4. Step 04

    Permission projection

    Role-aware queries decide who can see, edit, and delete. The whole library is visible to every authenticated user by default, gated by what their role can do, not what they own.

  5. Step 05

    Downstream consumers

    NewsForge calls PV by API for image selection on every story. Loom sites pull through the same API for hero and gallery slots. The mobile app browses the same pool.

004 · Role system

Five tiers. One projection per query.

Authorisation is built around who can see what rather than who owns what. Wenme issues the JWT; PV evaluates the role on every read.

RoleScopeGranted actions
Global Admin
System-wideAll permissions across all features and tenants.
Admin
Tenant-wideUser invitation, role assignment, system settings, delete any asset.
Photo Editor
Library-wideEdit IPTC on any asset. Manage faces and people. Cannot delete others' uploads.
Photographer
Own uploadsUpload, edit, and delete own assets. Read the whole library. Tag faces.
Viewer
Read-onlyBrowse and download the shared library. View faces. Cannot upload or edit.

005 · Architecture

The stack, named.

Every layer points to the directory or document in the codebase that owns it. No mystery boxes, no marketing-only tiers.

Postgres 18Redis 8MinIO + S3OAuth 2.1 + PKCE
LayerImplementationSource
Web clientSvelteKit, Tailwind, greyscale chromeweb/
Asset serverNestJS (TypeScript), Postgres 18, BullMQserver/
ML servicePython, CLIP embeddings, face detectionmachine-learning/
Metadata serviceGo, ExifTool-driven EXIF + IPTCmetadata-service/
MicroservicesBackground jobs: thumbnail, embed, OCRserver/microservices/
StorageS3 / MinIO (newsforge/pv/), date-partitionedPV_DEPLOYMENT.md
IdentityWenme OAuth 2.1 + PKCE, invitation-onlyWENME_OAUTH_SETUP.md
Cache + queuesRedis 8docker/docker-compose.newsforge.yml
MobileFlutter, central library awaremobile/

006 · Comparison

Where Professional Vault sits in the DAM market.

Capability comparison versus the four products buyers usually evaluate alongside PV: two SaaS DAM incumbents (Bynder, Brandfolder), the enterprise vendor (Adobe Experience Manager Assets), and the do-it-yourself baseline (S3 plus a library tool).

CapabilityProfessional VaultBynderBrandfolderAEM AssetsS3 + tool
Self-hosted on your own infrastructureOn-prem available, six-figure licence
CLIP semantic search bundled, no extra contractAdd-on, AI BundleSmart CV, paid tierAdd-on, AEM Assets AI
Central people directory with face recognitionSmart Tags, no person entities
14-field IPTC editor in the browserCustom metaproperties onlyLimited IPTC mapping
OAuth identity from your SSO, no extra user tableWenme OAuth 2.1 + PKCESAML add-onSAML add-onAdobe ID requiredIAM, no UI
Per-tenant data isolation in one deployCustom MSM buildBucket-per-tenant only
Source-available code path, no vendor escapeStorage only

Compiled from public product pages of Bynder, Brandfolder, Adobe Experience Manager Assets, and AWS S3, May 2026. Attributable differences only, no marketing claims.

007 · Downstream

One vault. Many consumers.

Internal products call PV as the single source of truth for imagery. External integrators reach the same REST API.

NewsForge

AI newsroom

Image curator pulls from PV. Bulk downloader proxies through PV. Every published story picks its hero from the central library.

Loom

CMS + frontend

Hero and gallery elements reference PV asset IDs. Resize and format conversion happen at PV, not at the site edge.

BizRP

Internal storage tier

Tenants that opt into the central DAM mount PV for product imagery instead of a per-tenant Cloudflare R2 bucket.

008 · Questions

Frequently asked.

Mirrored in JSON-LD so search engines and answer engines can lift them verbatim.

What is Professional Vault?
Professional Vault (PV) is an enterprise digital asset management platform built on a hardened Immich fork with a Go metadata service and a Python ML service. It runs on KaritKarma's own infrastructure, ships with Wenme OAuth, a 5-tier role system, CLIP semantic search, and a 14-field IPTC editor. It is the canonical asset store for KaritKarma's internal products such as NewsForge and Loom.
How does Professional Vault compare to Bynder, Brandfolder, or Adobe Experience Manager Assets?
PV is self-hosted with a source-available code path, while Bynder and Brandfolder are SaaS-only. PV ships CLIP semantic search and face recognition in the base product; the SaaS competitors charge an AI bundle on top. Against AEM Assets it costs a fraction and avoids the Adobe ID requirement. Against a plain S3 plus a library tool, PV adds metadata, faces, roles, search, mobile, and an OAuth-aware web client out of the box.
Does Professional Vault support facial recognition?
Yes. The Python ML service detects faces on upload and matches them to a central person directory. Unlike Immich, where each user has their own people list, PV maintains a single tenant-wide directory: a named subject is one entity across every photo in the archive. Detected but unmatched faces queue for human review by users with editor or admin roles.
Can Professional Vault ingest from an existing S3 bucket or on-prem storage?
Yes. PV stores objects under a date-partitioned prefix in an S3-compatible bucket; the production deployment uses MinIO at storage.lonesock.pro under newsforge/pv/. The same code path works with AWS S3, Cloudflare R2, or any S3-compatible store. Existing assets can be migrated in by attaching the bucket and running the metadata extractor over the prefix.
Who logs in to Professional Vault and how is access granted?
Every user signs in through Wenme OAuth 2.1 with PKCE. There is no email or password form. Access is invitation-only: an admin invites a user inside Wenme, picks the role (photographer, photo editor, admin), and PV auto-provisions the account on first sign-in. Promotions, suspensions, and revocations are managed inside Wenme so PV always trusts the same source of truth.
What downstream products consume the Professional Vault API?
PV is the asset back-end for KaritKarma's NewsForge AI newsroom (image curator, bulk downloader proxy, hero selection on every published story) and for Loom (CMS hero and gallery slots). Internally it is the storage layer of every BizRP tenant that opts for the central DAM rather than per-tenant Cloudflare R2. External integrators reach the same REST API used by the in-house apps.

Get a walkthrough

Put your archive on the same rails as our newsroom.

30-minute tour of the central library, the IPTC editor, the role projections, and the Wenme onboarding flow. We bring a seeded tenant. You bring three reference photos.

Source-available fork
Wenme OAuth, invitation-only
S3 / MinIO native
Role-aware delete trail