Business Security Cameras: NVR vs Cloud, Storage, Privacy

A small business camera system comes down to five decisions: where footage is stored (a recorder on site or the cloud), how cameras get power and data (almost always one Ethernet cable using PoE), how much resolution each view needs, how many days of footage to keep, and how the cameras are kept apart from the rest of your network. In California, add two legal points before you mount anything: recording audio of confidential conversations requires the consent of everyone involved, and employers may not record in restrooms, locker rooms, or changing rooms.

NVR or Cloud: Where Should Footage Live?

An NVR (network video recorder) is a box in your office with hard drives that records every camera. A cloud system sends video over your internet connection to the vendor’s servers, usually with a small amount of storage in each camera as a buffer. Many current systems are hybrids: they record locally and let you view remotely through the vendor’s app.

	On-site NVR	Cloud
Upfront cost	Higher: recorder plus drives	Lower per site, cameras may cost more
Ongoing cost	Drive replacement, occasional maintenance	Subscription per camera, for as long as you use it
Internet upload needed	Only when someone views remotely	Continuous, per camera
If the internet goes down	Keeps recording	Depends on the camera’s own buffer
If the recorder is stolen or fails	Footage is lost unless copied elsewhere	Footage is off site
Retention	Limited by the drives you buy	Limited by the plan you pay for
Updates	Someone must apply them	Usually automatic

Neither is the right answer for everyone. An NVR suits a location with many cameras, long retention, or limited upload speed. Cloud suits a few cameras, several small locations, or an owner who wants nothing to maintain. If you choose an NVR, put it somewhere locked, and consider copying key cameras off site.

What Is PoE and Why Does It Matter?

PoE (Power over Ethernet) delivers power and data to a camera over a single network cable, so cameras do not need a power outlet nearby. A PoE switch or the NVR’s built-in ports supply the power.

Per Cisco’s overview of the standards, PoE+ (IEEE 802.3at) supplies up to 30 W per port, the newer 802.3bt supplies up to 60 W or 90 W, and the maximum cable run is 100 meters (about 328 feet). Three planning points follow:

1. Check each camera’s power draw on its datasheet. Fixed cameras usually need little. Pan-tilt-zoom models and cameras with heaters or strong infrared lights need more and may require PoE+ or higher.
2. Add up the total. A switch has an overall power budget as well as a per-port limit. Eight cameras that each draw 8 W need at least 64 W of budget, plus headroom.
3. Measure the cable runs. Anything beyond 100 meters needs a different approach, such as an intermediate switch or a fiber link.

Wired PoE cameras are more dependable than Wi-Fi cameras for anything permanent. Wi-Fi cameras still need a power outlet, and continuous video competes with everything else on the wireless network. If your Wi-Fi is already struggling, see why office Wi-Fi keeps dropping.

How Much Resolution Do You Need?

Resolution is the number of pixels in the image: 1080p is about 2 megapixels, and 4K is about 8 megapixels. What matters is how many of those pixels land on the thing you care about. A 4K camera covering an entire parking lot may put fewer pixels on a face than a 1080p camera aimed at a doorway.

Decide the job of each camera first:

• Overview (is someone in the stockroom, what happened in the lobby): a wide view at modest resolution is enough.
• Identification (a face at the entrance, a license plate at the driveway): a narrow view aimed at a choke point, at a height and angle that catches faces, with attention to backlighting from glass doors.

More cameras with narrower views usually beat fewer cameras with higher resolution. Higher resolution also costs storage and bandwidth, which is the next calculation.

How Much Storage Do You Need? A Worked Example

Storage depends on bitrate, which is how much data each camera produces per second. It is set or shown in the camera’s or recorder’s settings, in megabits per second (Mbps). It varies with resolution, frame rate, compression (H.265 produces less data than H.264 for similar quality), and how much movement is in the scene, so use your own cameras’ real numbers where you can.

The arithmetic:

Bitrate in Mbps × 10.8 = gigabytes per camera per day (there are 86,400 seconds in a day, 8 bits in a byte, and 1,000 megabytes in a gigabyte).

Worked example, assuming 8 cameras averaging 4 Mbps each, recording continuously, kept for 30 days:

1. One camera for one day: 4 × 10.8 = 43.2 GB
2. Eight cameras for one day: 43.2 × 8 = 345.6 GB
3. Thirty days: 345.6 × 30 = 10,368 GB, or about 10.4 TB

So this system needs roughly 10.4 TB of usable space. Allow around 20 percent headroom and remember that a drive’s usable capacity is a little below the number on its label, which points to something like a 14 TB or 16 TB drive, or two drives.

Ways to reduce it:

• Record on motion only. If the scenes are active about a third of the time, the same example needs roughly 3.5 TB.
• Use H.265 if every camera and the recorder support it.
• Lower the frame rate on overview cameras. Fifteen frames per second is smooth enough for most security use.
• Shorten retention on low-value cameras and keep longer retention at entrances.

Two free calculators will do this for you: Seagate’s surveillance storage calculator and AXIS Site Designer, which also estimates bandwidth. Use drives rated for surveillance recording, since they are built for continuous writing.

For cloud systems, run the same math on your upload speed. Eight cameras streaming 2 Mbps each need 16 Mbps of upload all day. Check your internet plan’s upload figure, not the download figure.

How many days to keep is a business decision. Ask your insurer and, in regulated fields, your attorney or compliance advisor whether a minimum applies to you.

How Do You Keep Cameras From Becoming a Network Risk?

A camera is a small computer with a network connection that often goes years without an update. Treat it as untrusted.

1. Put cameras and the recorder on their own VLAN, with firewall rules so they cannot start connections to your computers or servers. Our network segmentation guide has a starter layout.
2. Never port-forward a camera or recorder to the internet for remote viewing. Use the vendor’s app (which connects outbound) or a VPN. See secure remote access.
3. Change every default password at installation, and keep the credentials in your password manager, not only with the installer.
4. Update firmware on cameras and the recorder on a schedule.
5. Limit internet access from the camera VLAN to what the system needs.
6. Give each person their own viewing login and remove it when they leave.
7. Get alerts when a camera goes offline or a recorder drive fails. This fits with network monitoring.

Does NDAA Compliance Matter for Your Business?

For most private businesses it is not a legal requirement. For some buyers it is.

Section 889 of the 2019 National Defense Authorization Act restricts the federal government’s use of certain telecommunications and video surveillance equipment. The federal acquisition clause that implements it, FAR 52.204-25, names video surveillance equipment produced by Hytera Communications, Hangzhou Hikvision Digital Technology, and Dahua Technology (and their subsidiaries and affiliates) when used for public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes. According to the government’s Section 889 summary, Part A (effective August 13, 2019) stops agencies from buying such equipment, and Part B (effective August 13, 2020) stops agencies from contracting with entities that use it. Separately, 2 CFR 200.216 prohibits recipients and subrecipients from spending federal grant or loan funds on it.

Who should ask about this before buying:

• Federal contractors and subcontractors.
• Organizations buying with federal grant or loan money, which can include nonprofits, clinics, and schools.
• Businesses whose customers’ contracts pass these requirements down.

Some cameras sold under other brand names are manufactured by the named companies. If this applies to you, ask the seller for a written statement that the specific models are Section 889 compliant, and keep it on file. How the rules apply to your contracts is a question for your contracting officer or attorney.

California Privacy Rules to Know Before You Install

This is general information, not legal advice. Speak to an employment attorney about your situation.

Audio. California Penal Code 632 makes it a crime to use a recording device to record a confidential communication “intentionally and without the consent of all parties”. A confidential communication is one carried on in circumstances that reasonably indicate a party wants it confined to those present. The penalty is a fine of up to $2,500 per violation, up to a year in county jail, or both. Many cameras ship with a microphone that is on by default. The cautious default is to switch camera audio off unless you have taken legal advice on notice and consent.

Restrooms and changing areas. California Labor Code 435 states that no employer may cause an audio or video recording to be made of an employee “in a restroom, locker room, or room designated by an employer for changing clothes, unless authorized by court order”. Recordings made in violation cannot be used by the employer for any purpose.

Practical steps: aim cameras away from those areas and their doorways, tell employees in writing where cameras are and what they are for, post visible notices at entrances, and restrict who can view and export footage. Medical and dental offices should also keep cameras out of treatment areas and make sure no screen or paperwork with patient information is readable in a camera’s view. See our pages for medical and dental practices and retail.

What to Decide Before You Buy

• What is each camera for: overview or identification?
• NVR, cloud, or hybrid, and what is the five-year cost including subscriptions and drives?
• How many days of retention, and what storage or plan does the math say that needs?
• Is there cable access to each location, within 100 meters of a switch?
• Does the switch have enough PoE budget?
• Is audio off?
• Does Section 889 apply to you?
• Who will own the admin login, apply updates, and check that every camera is still recording?

When a Simple Setup Is Enough

A small shop or office with one or two entrances does not need a designed system. Two or three reputable cloud cameras on an isolated network, with audio off, unique passwords, and MFA on the account, is a reasonable setup. The planning above starts to matter at around half a dozen cameras, multiple locations, long retention, or regulated environments.

Common Mistakes

• Buying by megapixels instead of by what each view has to show.
• Sizing storage by guesswork, then finding only nine days of footage when thirty were expected.
• Cameras on the same network as office computers.
• Port-forwarding the recorder for phone viewing.
• Default or installer-only passwords, so the business cannot get into its own system.
• Leaving microphones on.
• Nobody checking that cameras are still recording until footage is needed.

Common Questions

Can You Mix Camera Brands on One Recorder?

Often, yes. Many cameras and recorders support ONVIF, an industry standard for basic video compatibility. Expect the core functions (live view and recording) to work, and expect brand-specific features such as smart motion detection to work only with the matching brand. Cloud systems generally require their own cameras.

Do Security Cameras Slow Down the Office Network?

Wired cameras on their own VLAN and switch ports have little effect, because their traffic goes to the recorder and nowhere else. The exceptions are Wi-Fi cameras, which share airtime with everything else, and cloud cameras, which use internet upload continuously.

Are Wi-Fi Cameras Good Enough for a Business?

For a temporary or hard-to-cable spot, they can be. For permanent coverage, a cabled PoE camera is more dependable: it has steady power and a connection that does not depend on signal strength or wireless congestion.

Is It Legal to Record Audio With Business Cameras in California?

California requires the consent of all parties to record a confidential communication under Penal Code 632. Because camera microphones can easily capture private conversations, the cautious approach is to disable audio unless an attorney has advised you on notice and consent for your situation.

How Long Should a Business Keep Camera Footage?

There is no single rule for all businesses. Thirty days is a common planning figure, not a legal standard. Check with your insurer and any regulator or contract that applies to you, then size storage to match using the calculation above.

How Coastal Growth Co. Can Help

We plan and install camera systems as part of the network they depend on: camera placement by purpose, PoE and storage sizing, a separate camera VLAN, secure remote viewing, and credentials handed over to you. We can also review an existing system for exposure and recording gaps. See our networks, Wi-Fi, and security camera services, or contact us to describe your space. Scope and price are agreed before any paid work.