Skip to Content

Local storage security camera: why I keep the footage at home

Cloud platform flaws, subscriptions, the new Matter standard: the case for local recording, and the rules to follow when you film.
November 10, 2026 by
Local storage security camera: why I keep the footage at home

On 4 November 2026, Home Assistant, the open-source smart home software, started supporting cameras built to the Matter 1.5 standard, with live video that travels straight from the camera to your browser. It is one more step towards the local storage security camera, at a time when cloud platforms keep leaking. My answer to the question "cloud or local?" is simple: your footage should stay on your premises, and you can still view it remotely.

Key takeaways

  • A "cloud" camera sends your footage to its manufacturer's servers. What happens there is no longer up to you: misconfigurations, staff access, attacks.
  • In May 2026, a researcher showed that the platform of a supplier shared by more than 300 camera and baby monitor brands exposed its users' alert images.
  • The Matter 1.5 standard provides for local recording, and open-source software is starting to support it: the cloud-free camera is no longer reserved for tinkerers.
  • Storage on your premises, cameras on a separate network, no recorder open to the internet, remote access through a VPN: these four principles apply to a home, a hotel or a shop.
  • Filming is still regulated: your own property only, a visible sign, a short retention period, and specific rules for employees.

What is happening

Cameras are joining the common smart home standard. On 20 November 2025, the Connectivity Standards Alliance, which brings together the industry's major players, released Matter 1.5. For the first time, the standard covers cameras and video doorbells: live video and audio, privacy zones, and continuous or event-based recording "to local or cloud destinations". On 4 November 2026, Home Assistant 2026.11 added these cameras to its Matter integration: they show up as ordinary cameras, and live video is streamed directly between your browser and the camera.

Cloud platforms, meanwhile, keep leaking. On 11 May 2026, independent researcher Sammy Azdoufal published his work on CloudEdge, the platform run by Meari Technology. According to him, more than 300 camera and baby monitor brands share this same service. He showed that any free account could subscribe to messages from every device on the platform: in five minutes, on a single server, he received messages from 2,117 devices. Images captured on motion detection were stored with no authentication and no expiry, and their addresses circulated in those messages. He puts the affected installed base at about 1.1 million devices, an estimate he describes as conservative. The flaws are listed in the public vulnerability database (CVE-2026-33356, CVE-2026-33359, CVE-2026-33362).

This is not an isolated case, and big names are not spared. Two actions by the US Federal Trade Commission, the FTC, make the point:

  • Ring (31 May 2023): according to the FTC, one employee spent several months viewing thousands of recordings of female customers, including cameras in bathrooms and bedrooms. Hackers also accessed stored videos and live streams of around 55,000 US customers. Ring had to pay 5.8 million dollars to be used for customer refunds.
  • Verkada (30 August 2024): during a March 2021 breach, a hacker had access to more than 150,000 live customer cameras, and could view patients in psychiatric hospitals and women's health clinics.

Finally, the subscription is part of the product. On 1 October 2025, Google replaced its Nest Aware subscription with Google Home Premium: 10 dollars a month or 100 dollars a year for the standard plan, which includes 30 days of video history. Your footage sits with the manufacturer, and the manufacturer sets the price of access to it.

What it means for you: why choose a local storage security camera

For the owner of a shop, a residence or a rental property, a camera rarely films only objects. It films customers, tenants, employees, couriers. That footage is personal data, and you are accountable for it, even when it is stored by a manufacturer you have never met.

Three practical consequences:

  • You do not control the chain. In the Meari case, the problem was not the camera people bought, but the online service shared by hundreds of brands. The name on the box does not tell you who hosts your footage.
  • You depend on a price list and a connection. If the manufacturer changes its plans, or the internet goes down, access to your own recordings can stop. Often at exactly the moment you need them.
  • A poorly isolated camera is a way in. A device connected to the same network as your till or office computers gives an attacker a foothold inside.

The alternative has existed for a long time: cameras that record to a disk on your premises. What is changing is that it is becoming easier to set up, with open standards and open-source software that can now talk to off-the-shelf cameras.

What I have learned

I have equipped my own homes with the systems I offer. My current smart home runs on Home Assistant, without relying on online services from Google, Amazon or Apple. I described it in the article Open-source home automation and AI infrastructure. The connected devices live on a network isolated from the rest of the house, the data stays on site, remote access goes through a VPN, and the automations keep working when the internet goes down. Before that, I renovated and automated a mobile home, down to taking local control of a Wi-Fi connected pellet stove.

What I take from this for video surveillance comes down to three ideas:

  • Local does not mean giving things up. Useful alerts reach your phone and footage can be viewed remotely. The difference is that the path runs through your premises, not through a third party's server.
  • Network separation matters as much as storage. A camera has no reason to talk to your computers or to reach the internet freely. Isolated, it stops being a way in.
  • Failures must be planned for. I have tested these installations at home, internet and power cuts included. A security system that stops when the connection drops does not protect much.

This is what I install today as security and video surveillance: continuous local recording, detection of people and vehicles, cameras on a separate network, and no subscription.

What to do in practice

1. Decide what you film, and why

Before buying, write down the purpose of each camera (an entrance, a car park, a storeroom) and what it sees. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) asks you to limit the field of view to your own property, excluding the neighbouring plot and the pavement, to signal video surveillance with a clearly visible sign, to keep footage only as long as necessary, as a rule 24 hours, and to keep the number of people with access as small as possible. In the European Union, the European Data Protection Board points out that a camera covering, even partially, a public space falls outside the purely private sphere, and that footage should generally be erased after a few days: beyond 72 hours, the retention period has to be justified. If you film employees, additional rules apply: in Switzerland, SECO notes for example that permanent surveillance of checkout staff is not allowed, and that cameras have no place in break rooms or changing rooms. These are guidelines, not legal advice: when in doubt, consult a specialist.

2. Keep the recording on your premises

Choose cameras that can record to a local recorder or server, and that do not force an app or an online account on you to work. Ask the seller, in writing: where does the footage go, and what is left of my system if I decline the cloud service?

3. Put the cameras on their own network

Cameras and the recorder go on a network separate from your computers and your till, with no free access to the internet. This is the measure that best limits the damage if a device turns out to be vulnerable.

4. Do not open the recorder to the internet

To view your footage remotely, use encrypted access, a VPN, rather than opening the recorder to the whole world or relying on the manufacturer's online service. Change default passwords and install updates.

5. Test the failure

Cut the internet, then the power, and check what keeps recording. Place the recorder out of sight, in a locked room, and on backup power if the stakes justify it.

Frequently asked questions

Can a cloud-free camera send alerts to my phone?

Yes. Alerts are sent from your own installation, with the image, and you view recordings remotely through encrypted access. You keep the convenience of a connected camera without leaving your footage with a third party.

What if someone steals the recorder?

That is the real weakness of local storage. You reduce it by placing the recorder out of sight, in a locked room, and, if needed, by sending an encrypted copy of important events to storage you control.

Do Matter-compatible cameras record locally?

The Matter 1.5 standard allows it, but it also allows the cloud: it all depends on the manufacturer and the model. Check where recordings go before you buy, not just the Matter logo on the box.

Going further

I install local, subscription-free, open-source video surveillance systems, on their own or as part of a smart home: the packages are detailed on the Home automation and energy page. To discuss your situation: a 20-minute call.

Sources

Cover photo: Turquo Cabbit / Unsplash, Unsplash license.

Tags: video surveillance, cloud-free camera, security, smart home, Home Assistant, data protection

in News
AI and jobs: prepare your team rather than replace it
AI mostly transforms tasks: mapping them, training people and redefining roles lets you keep your team and its know-how.