Who Controls Your Surveillance Video? The Case for On-Premises Data Ownership

Solutions November 4, 2026

The location of your footage is a security decision

Video surveillance captures some of an organization’s most sensitive operational information. Cloud-based systems offer convenience and remote access, but storing footage with a third party also introduces dependence on that provider’s access controls, operations, and incident response. For public agencies, healthcare organizations, and critical infrastructure operators, where video resides deserves the same scrutiny as who can view it.

Cloud and remotely accessible surveillance: lessons from documented incidents

Verkada (2021; FTC action in 2024). Attackers used credentials obtained through an exposed support server to access Verkada’s centralized management platform. Verkada reported that video or images from cameras belonging to 97 customers were viewed. In 2024, the FTC alleged inadequate safeguards and said the attackers had access to more than 150,000 live cameras. This illustrates the potential reach of compromised provider-level access—not that every camera’s footage was viewed. [1, 2]

ADT (April 2026). ADT disclosed unauthorized access to certain cloud-based environments involving limited customer and prospective-customer information. ADT stated that customer security systems were not affected or compromised. Although this was not a surveillance-video breach, it illustrates the third-party data exposure organizations must evaluate when relying on security vendors’ cloud environments. [3, 4]

Flock Safety (2025). Reporting by 404 Media documented at least 60 internet-exposed Flock Condor camera interfaces, some providing unauthenticated access to live feeds, archived footage, and administrative controls. Flock characterized the issue as a limited configuration problem that was addressed. This was an internet-access and configuration exposure, not a verified compromise of centralized cloud storage. [5]

Control over access, retention, and chain of custody

With properly configured on-premises video systems, organizations can keep primary recordings in their own facilities and establish local rules for access, retention, auditing, and deletion. Segmented networks and strong identity controls can help limit exposure. On-premises deployment is not automatic compliance: policies, encryption, patching, backups, and audit trails still matter.

Meeting regulatory and public-sector obligations

Requirements under frameworks such as HIPAA, GDPR, and state privacy laws vary by jurisdiction and by the information recorded. A locally managed architecture can simplify data-residency decisions and help organizations document custody and access. Security leaders should map surveillance data flows to the specific obligations that apply, rather than assume a deployment model alone satisfies them.

AI analytics without surrendering custody

iCetana AI connects to existing CCTV and video management systems to identify unusual activity while reducing the volume of routine footage requiring attention. In its customer- or partner-managed on-premises deployment, customer video, events, and credentials remain on local infrastructure rather than passing through iCetana systems. This approach can reduce reliance on externally hosted video processing and third-party access pathways while enabling advanced AI analytics. Local deployment still requires strong identity controls, network segmentation, patching, and auditing.

The takeaway

The incidents above point to a practical question for security leaders: how much access to sensitive video and associated data should an outside provider need? The answer is not simply “cloud versus on-premises.” It is about minimizing unnecessary exposure, retaining oversight of credentials and footage, and designing security controls around the organization’s obligations.

For agencies and operators that prioritize data sovereignty, iCetana AI offers a way to add intelligent video analytics to existing surveillance infrastructure without transferring customer video to an iCetana-hosted cloud service. With processing deployed on customer- or partner-managed infrastructure, organizations can preserve local custody, define their own retention and access policies, and reduce avoidable external dependencies.