KaritKarma / Storage
Professional Vault
The newsroom archive, centralised
searchable, and role-aware.
Professional Vault is the central asset back-end behind every KaritKarma editorial product. One library for the whole team. CLIP semantic search, in-house face recognition, a real IPTC editor, and Wenme single sign-on. Built on a hardened Immich fork, extended with a Go metadata service, a Python ML service, and a 5-tier role system.
- Byline
- L. R. Nirjhar
- Source
- KaritKarma
- Rights
- All reserved
- Captured
- 2026-05-16
- Library
- Central pool
- Auth
- Wenme OAuth
- Database tables
- 53
- Role tiers
- 5
- IPTC fields
- 14
- Semantic search
- CLIP
Asset, EXIF, IPTC, faces, roles
GlobalAdmin to Viewer
Editable in-app, XMP exported
Vision-language embeddings
001 · Definition
What is Professional Vault?
Professional Vault is KaritKarma's enterprise digital asset management platform. It is a hardened, source-available fork of Immich with a Go metadata service, a Python ML service, a 5-tier role system, and Wenme OAuth in place of the upstream email/password sign-in. The shipping product runs in a professional greyscale UI; the indigo and violet of the aperture mark only appear as accent.
Compared with Bynder and Brandfolder, PV is self-hosted and source-available. Compared with Adobe Experience Manager Assets, it ships in days, not in a six-figure consulting engagement. Compared with a bare S3 bucket plus a library tool, PV adds CLIP semantic search, central face recognition, a full 14-field IPTC editor, and role-aware projections out of the box.
002 · What PV does
Four subsystems, one library.
Each pillar maps directly to a folder in the codebase. The product is the integration of these four, not a list of feature ticks.
One shared library. Not one per user.
01 · Central libraryPV inverts Immich's per-user library model. Every asset lives in a single central pool with photographer_id and uploaded_by attribution. Editorial teams see the whole archive on day one, scoped by role, not by ownership.
Source · Central pool architecture
Search photos by description.
02 · CLIP semantic searchVision-language CLIP embeddings live next to the asset. Search by what is in the picture, not by filename. The same model powers visual-similarity browsing and image-curator suggestions for NewsForge stories.
Source · In-house ML service
One named person across the whole archive.
03 · Face recognitionCentral people directory: a public figure gets ONE entity, not one per editor. Faces detected by the ML service feed a shared person table. Tag once, find every photo across years. Partner-asset access is built in.
Source · ML service plus central person directory
Full IPTC editor, not just a caption box.
04 · IPTC + EXIF stackThe metadata-service (Go) extracts EXIF and IPTC on ingest. An in-app editor covers 14 fields: headline, caption, byline, credit, copyright, keywords, location, source, instructions, rights, transmission reference, category. XMP sidecars exported on demand.
Source · Metadata service plus in-browser IPTC editor
003 · Ingest pipeline
From shutter click to indexed asset.
Every asset crosses the same five stages, regardless of whether it arrives from a desk photographer, a field phone, or the NewsForge AI crawler. The pipeline is owned end-to-end inside the codebase, not bolted on with vendor SaaS.
- Step 01
Upload to central pool
Drop, drag, or push from a camera, phone, or the NewsForge crawler. The asset lands at /data/pv/{year}/{month}/{assetId} and is mirrored to the S3 bucket immediately.
- Step 02
Metadata extraction
The Go metadata-service pulls EXIF and IPTC in one pass. Camera, lens, exposure, byline, copyright, headline, keywords. All parsed into dedicated columns, never a JSON blob.
- Step 03
Embeddings + faces
The Python ML service produces a CLIP embedding for semantic search and detects faces. Detected faces match the central person directory; unknowns queue for human review.
- Step 04
Permission projection
Role-aware queries decide who can see, edit, and delete. The whole library is visible to every authenticated user by default, gated by what their role can do, not what they own.
- Step 05
Downstream consumers
NewsForge calls PV by API for image selection on every story. Loom sites pull through the same API for hero and gallery slots. The mobile app browses the same pool.
004 · Role system
Five tiers. One projection per query.
Authorisation is built around who can see what rather than who owns what. Wenme issues the JWT; PV evaluates the role on every read.
| Role | Scope | Granted actions |
|---|---|---|
Global Admin | System-wide | All permissions across all features and tenants. |
Admin | Tenant-wide | User invitation, role assignment, system settings, delete any asset. |
Photo Editor | Library-wide | Edit IPTC on any asset. Manage faces and people. Cannot delete others' uploads. |
Photographer | Own uploads | Upload, edit, and delete own assets. Read the whole library. Tag faces. |
Viewer | Read-only | Browse and download the shared library. View faces. Cannot upload or edit. |
005 · Architecture
The stack, named.
Every layer points to the directory or document in the codebase that owns it. No mystery boxes, no marketing-only tiers.
006 · Comparison
Where Professional Vault sits in the DAM market.
Capability comparison versus the four products buyers usually evaluate alongside PV: two SaaS DAM incumbents (Bynder, Brandfolder), the enterprise vendor (Adobe Experience Manager Assets), and the do-it-yourself baseline (S3 plus a library tool).
| Capability | Professional Vault | Bynder | Brandfolder | AEM Assets | S3 + tool |
|---|---|---|---|---|---|
| Self-hosted on your own infrastructure | On-prem available, six-figure licence | ||||
| CLIP semantic search bundled, no extra contract | Add-on, AI Bundle | Smart CV, paid tier | Add-on, AEM Assets AI | ||
| Central people directory with face recognition | Smart Tags, no person entities | ||||
| 14-field IPTC editor in the browser | Custom metaproperties only | Limited IPTC mapping | |||
| OAuth identity from your SSO, no extra user table | Wenme OAuth 2.1 + PKCE | SAML add-on | SAML add-on | Adobe ID required | IAM, no UI |
| Per-tenant data isolation in one deploy | Custom MSM build | Bucket-per-tenant only | |||
| Source-available code path, no vendor escape | Storage only |
Compiled from public product pages of Bynder, Brandfolder, Adobe Experience Manager Assets, and AWS S3, May 2026. Attributable differences only, no marketing claims.
007 · Downstream
One vault. Many consumers.
Internal products call PV as the single source of truth for imagery. External integrators reach the same REST API.
NewsForge
AI newsroom
Image curator pulls from PV. Bulk downloader proxies through PV. Every published story picks its hero from the central library.
Loom
CMS + frontend
Hero and gallery elements reference PV asset IDs. Resize and format conversion happen at PV, not at the site edge.
BizRP
Internal storage tier
Tenants that opt into the central DAM mount PV for product imagery instead of a per-tenant Cloudflare R2 bucket.
008 · Questions
Frequently asked.
Mirrored in JSON-LD so search engines and answer engines can lift them verbatim.
What is Professional Vault?
How does Professional Vault compare to Bynder, Brandfolder, or Adobe Experience Manager Assets?
Does Professional Vault support facial recognition?
Can Professional Vault ingest from an existing S3 bucket or on-prem storage?
Who logs in to Professional Vault and how is access granted?
What downstream products consume the Professional Vault API?
Get a walkthrough
Put your archive on the same rails as our newsroom.
30-minute tour of the central library, the IPTC editor, the role projections, and the Wenme onboarding flow. We bring a seeded tenant. You bring three reference photos.