Sense. Remember.
Reason. Prove.
geo.qa answers questions about real places. Each answer comes from dated observations, and each observation carries a Signature (Ed25519)A short code that only the holder of a private key can make. Anyone with the public key can check it. A valid signature shows who signed and that nothing changed.. You can check the signature yourself, without trust in us.
Many sensors, one address.
Satellites, cameras, drones, weather models and people all observe the same ground. geo.qa files each observation against the same address. A satellite pass, a radar look and a gate camera can all describe one patch of ground at one time.
What sees from the ground
Eight kinds of sensor write facts today:
- Optical and radar satellites (in the table below).
- Thermal: land-surface temperature, for fires, flares and machinery.
- Drones: close inspection of one site, on request.
- Fixed cameras (CCTV) through RTSP or ONVIF. The London page uses the public TfL JamCam cameras.
- Other connected video, placed on the map frame by frame.
- Weather fields (ERA5 and Met.no).
- Field reports: a note from a person, signed with that person's key.
We plan four more kinds. They are not live yet: vehicle cameras, ground sensors (SCADA and IoT), ship tracks (AIS) and sound. The address model already has a slot for each.
The picture stays at the source
For the cameras and sensors that you run, an encoder on the device turns each frame into a compact vector (a latent). Only the latent leaves the device, not the picture. On the ground, a decoder puts each latent on its cell, band and time slot. Thus you can keep your images private and still have an audit trail.
Satellite scenes arrive already encoded, from the public emem.dev ledger.
- satellite
- Sentinel-2, latest clear pass
- cloud
- —
- street cameras
- 267 in London, newest card 4 min old
What flies overhead
| Source | What it measures | Ground detail | How often |
|---|---|---|---|
| Sentinel-2 | Optical bands, greenness (NDVI), water (NDWI), true colour, change | 10 m | About every 5 days |
| Sentinel-1 | Radar: structure, moisture, flood, motion. It sees through cloud. | About 10 m | Every 6 to 12 days |
| MODIS | Greenness over a long record, for trends | 250 m | Every 8 days |
| ERA5 | Weather history: temperature, rain, wind, soil moisture | 0.25° | Daily |
| Met.no | Weather forecast fields | Station or grid | Hourly |
| Hansen Global Forest Change | Forest cover and the year of forest loss | 30 m | Yearly |
| JRC Global Surface Water | Where and how often water is present | 30 m | Monthly |
| FIRMS | Active fires | 375 m | Daily |
| CAMS | Air quality and aerosols | About 40 km | Daily |
| SoilGrids | Soil properties | 250 m | Fixed |
| Overture Maps | Building outlines and places | Vector | On each release |
One cell, one fact.
The address
Every place has an address called a Cell (cell64)A fixed square of ground, about 10 m on a side (9.55 m north to south). Each cell has one address. All facts about that ground use the same address, so two agents mean the same place.. The open grid uses cell64: a 64-bit number for a square of ground about 9.55 m on a side at the equator. That is about the width of one Sentinel-2 pixel. Anyone can compute a cell64 address with a few lines of code.
For private work, geo.qa also uses H3 cells at more than one size. Thus a tenant can address a field, a neighbourhood or a city, and roll values up from one size to the next.
The fact
A FactOne observation of one cell, for one band, at one time. A fact has a content id: if one byte changes, the id changes. is one value for one cell, for one band (the quantity) and one time slot. Each fact also holds its source, a hash and an Ed25519 signature. Nobody overwrites a fact. A new observation adds a new fact, so you can always read the past.
Each fact says how geo.qa made it: a measurement, a value computed from measurements, or a Model outputA value that a model computed, for example a weather forecast. It is not a measurement. We label it so that you do not mix the two.. The system never fills a gap with a silent guess. When it has no value, it says so.
- place
- …
- cell64
- …
- band
- indices.ndvi
- value
- …
- observed
- …
- fact id
- …
Several views of one place
Different questions need different kinds of vector. geo.qa keeps several, side by side, and sends each question to the one that fits:
| Vector | Made from | Used for |
|---|---|---|
| 128 values (GeoTessera) | Sentinel-1 and Sentinel-2 at 10 m | Find places that look like this one |
| 1,024 values (two foundation encoders) | Sentinel-2, and the Harmonised Landsat Sentinel series | What a scene shows. Where the two encoders disagree, the page shows the difference |
| 768 values (BGE) | Text: questions, captions, field notes | Search by words |
| 1,792 values (state vector) | All measured bands of a cell at one time | Training and forecasts |
Where geo.qa stores the facts
Postgres holds the facts. It is the record of each observation. Each tenant has its own schema, and row-level security keeps each tenant apart below the application. Each row carries its provenance and its signature, so the store can check itself.
Vespa holds a search index of the same facts, for speed. geo.qa writes each fact to Postgres first and then copies it to the index. Thus the two stores always agree about what happened.
Agents call tools.
One protocol for agents
An AI agent reads geo.qa through MCPModel Context Protocol. An open standard that lets an AI agent find and call tools. Add a server URL to your agent, and the agent can use its tools. (Model Context Protocol) or through plain REST. Typical tools: find a place, read the facts of a cell, find similar places, and forecast. Each answer gives the ids of the facts it used. Thus the agent can name each observation behind each sentence.
Public and private memory
emem.dev is the open, free Earth memory. Anyone can read it without a key or an account. geo.qa is the private layer on top. It uses the same protocol, so public facts and private facts cite in the same way.
Public data flows into a tenancy. Private data never flows out. Two fences enforce this: the schema with row-level security in the store, and a tenant filter at the gateway. An agent in tenant A cannot read a cell of tenant B, even with the same coordinates. Both tenants can read the public ledger. Neither can write to it.
Train your own model
The memory is also training data. Each dated fact can supervise a model that you train, own and deploy inside your own boundary. Examples: dynamics (JEPA), forecasts and detection. The public JEPA head of emem.dev is a starting point. It is not a finished product.
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "emem_recall",
"arguments": {
"cell": "<cell64>",
"bands": [
"indices.ndvi"
]
}
}
}32 tools listed on three MCP servers. Read in …; the answer gives the fact id above, so the agent can cite it.
A receipt that you check yourself.
The receipt
Each answer comes with a ReceiptA signed record of an answer. It lists the cells, the fact ids, the time and the request. You use it to check the answer without trust in us.. The receipt lists the cells, the fact ids, the time and the request, and it carries a signature.
- emem.dev facts: a BLAKE3 digestA 32-byte fingerprint of data. The same bytes always give the same fingerprint. Different bytes give a different one. hash over canonical CBOR, signed with Ed25519.
- geo.qa camera receipts (London): a SHA-256 hash over canonical JSON, signed with Ed25519.
To check a receipt, you rebuild the hash from the receipt's own data. Then you check the signature against the published key in /.well-known/geoqa.json. You do not need to call our server. The Verify page does this in your browser.
The log
geo.qa adds each signed receipt to an append-only Transparency logAn append-only list of every signed record. You can prove that an entry is in the log, and that nobody removed or changed old entries.. You can ask for the proof that a receipt is in the log, and fold it to the signed log head yourself. Today no independent party co-signs the log head. Until one does, the log proves append-only order to one reader only.
A log also proves order. A plan written before the result is worth more than one written after it. On the Verify page, your browser proves from emem's log that the emem lab wrote its plan before the audit of its result.
What a receipt does not prove
A valid signature proves that these bytes came from geo.qa and that nobody changed them. It does not prove that the sensor or the model was right about the world. It also does not prove any sentence that is written outside the signed data.
Receipt check in progress…
Log head: …
Where geo.qa sits among world models.
Genie, Marble and Cosmos generate places and video that look plausible. That is useful for training robots. It is not a record of a real place.
Niantic's Large Geospatial Model places a camera in real 3D space. Google's AlphaEarth Foundations gives a yearly embedding of the planet at 10 m. These are close to what geo.qa does, and they are good.
- Provenance: every answer has a signed receipt that you check offline.
- Time: the history is append-only, so you can compare one cell on 4 May and on 11 May.
- Ownership: the memory is your tenancy, with your keys and your jurisdiction.
- Training: you can train your own model on your own memory.