Best cloud-based security cameras for business in 2026: choose the architecture first
Choosing the best cloud-based security cameras for business starts with architecture rather than camera brand, and Spot AI's answer is hybrid edge-to-cloud: an Intelligent Video Recorder (IVR) keeps full-resolution video in the building while the cloud handles access, search, and management. Spot AI runs on the cameras a business already owns, so the real decision is where the recording lives, because that sets the upload each site needs, what survives an internet outage, and who pays for retention. Spending is moving toward the edge: IDC reports that worldwide edge computing spending reached $265 billion in 2025 and expects it to nearly double by 2029, with Retail & Services the largest contributor, driven by use cases such as video analytics (Source: IDC).
To compare systems by what they do with recorded video, see our guide to security camera systems sorted by what they do with footage; for where analytics processing should run inside a plant, see our edge versus cloud processing guide for IT and OT leaders.
Key takeaways
- Three architectures carry the cloud-based label: cloud-only (a provider's data center holds the recording), hybrid edge-to-cloud (a recorder or camera on site holds it), and on-premises with cloud management (the business's servers hold it).
- Spot AI's IVR keeps full-resolution video on site and sends metadata to the cloud, so continuous recording stays off the uplink and deployments stay PCI-clean.
- Continuous cloud recording needs upload equal to cameras times bitrate, around the clock: 24 cameras at 4 Mbps need 96 Mbps before headroom.
- Storage in gigabytes equals Mbps × 86,400 × days × cameras ÷ 8,000, so 30 days at that site is about 31 TB wherever it is stored.
- Before signing, disconnect one pilot site for an hour, convert the uptime target into minutes, and check the six device capabilities NIST lists.
Key terms
- Recording of record: the copy of the video a business relies on for evidence. The architecture decides whether it sits in a provider's data center, on site, or on the business's own servers.
- Hybrid edge-to-cloud: a design that records and analyzes video on site and uses the cloud for access and management. Spot AI runs it through the IVR, which keeps full-resolution video in the building and sends metadata across the network.
- Bitrate: the data rate of one camera stream in megabits per second (Mbps). It sets the upload a cloud-only design needs and the storage every design needs.
The three architectures behind cloud-based security cameras for business
Spot AI runs on the first of the three shapes below, hybrid edge-to-cloud. Each entry gives a best fit, a limitation, the outage behavior, and examples to evaluate, with every vendor fact checked against that vendor's own documentation on October 9, 2026.
Hybrid edge-to-cloud with a local recorder
Spot AI is built on this architecture: the IVR connects to the site's existing IP cameras, records full-resolution video locally, runs detection at the edge on NVIDIA GPUs, load-balances heavier work to the cloud, and sends metadata to a cloud dashboard where teams search and manage every site. On that video, Spot AI's 15+ pre-trained Video AI Agents detect incidents, deter with strobes, horns, and natural-conversation talkdown, and help teams investigate and resolve them.
Best for: multi-site businesses with modest uplinks, long retention needs, card-handling areas that should stay PCI-clean, or a mixed camera estate. Legacy analog cameras reach Spot AI through the IVR. Running dozens of such sites is a discipline of its own, covered in our operating model for managing cameras across 50 or more locations.
Limitation: a recorder on site has to be powered, placed, and eventually refreshed, and its disk sets the ceiling on local retention.
When the connection drops: recording continues on the recorder, while remote viewing, cloud search, and internet-routed notifications wait for the link. The outage costs remote visibility rather than footage, provided the recorder, switch, and modem sit on backup power.
A second hybrid shape stores video inside each camera. Verkada cameras keep recording without a network connection as long as they have power and sync their footage once reconnected; by default Verkada does not store recorded footage in the cloud, its on-camera storage comes in 30, 60, 90, 120, or 365-day options, and non-Verkada cameras join through a Command Connector. Rhombus cameras likewise record to onboard storage through a disconnection and resynchronize with the cloud afterward, and existing cameras with RTSP streaming join through the Rhombus Relay connector.
Examples to evaluate: Spot AI; Coram, whose Coram Point stores video locally and makes it accessible through Coram's cloud apps; and, for the in-camera variant, Verkada and Rhombus. For the analytics layer on top, see our list of AI video analytics companies by what they do with a camera feed.
Cloud-only recording
Spot AI keeps the recording on site, and cloud-only recording makes the opposite trade: the recording of record lives in the provider's data center, so every camera streams continuously over the internet.
Best for: small sites with few cameras, strong upload, short retention, and no appetite for hardware beyond a small gateway.
Limitation: upload has to carry every camera around the clock, and retention is billed as subscription storage, so each extra day of history is a recurring cost.
When the connection drops: new video stops reaching the recording of record. What survives is whatever the camera or gateway buffers locally and uploads once the link returns.
Examples to evaluate: Eagle Eye Networks, which describes its Bridge appliance as buffering video in case the internet connection goes down, with the video stored in the Eagle Eye data center.
On-premises with cloud management
Spot AI shares one trait with this design, since both keep the recording on site; the difference is that here the business's own recording servers hold the video and a cloud service adds remote health monitoring and administration.
Best for: campuses and regulated sites with a server room, IT staff who already run a video management system (VMS), and a policy that video stays on the local network.
Limitation: hardware and upgrades are the owner's job. Milestone's own description of a traditional on-premises XProtect deployment says footage is saved on local recording servers and system upgrades are performed manually.
When the connection drops: the local servers keep recording, and the cloud management view loses sight of that site until the link returns.
Examples to evaluate: Milestone XProtect with XProtect Remote Manager, which Milestone describes as a cloud-based tool for managing multiple XProtect installations from one interface, with system health monitoring that covers server status and storage retention. Teams staying with a VMS can compare the field in our video management software guide.
Decision matrix: hybrid, cloud-only, and on-premises side by side
Spot AI appears in the hybrid column, the architecture it runs on, and the matrix compares the three designs on what changes the network, the outage story, and the fit.
Criterion | Hybrid edge-to-cloud (Spot AI) | Cloud-only recording | On-premises with cloud management |
|---|---|---|---|
Where full-resolution video lives | Spot AI keeps it on the IVR at each site | In the provider's data center | On the business's recording servers |
Sustained upload per site | Spot AI sends metadata, plus the live views and clips people open | Cameras × bitrate, all day (24 × 4 Mbps = 96 Mbps before headroom) | Remote viewing and management traffic |
When the internet link drops | Spot AI keeps recording on the IVR; remote access returns with the link | Recording relies on the local buffer | Servers keep recording; cloud monitoring goes dark for that site |
Cameras you can use | Spot AI works with any ONVIF IP camera, plus legacy analog through the IVR | Models the provider supports for streaming | Devices the VMS supports, commonly ONVIF |
Best for | Spot AI fits multi-site operations with modest uplinks and long retention | Small sites with few cameras and strong upload | Campuses with a server room and VMS staff |
Main limitation | Spot AI's IVR is on-site hardware to power and eventually refresh | Upload and storage fees grow with every camera | Upgrades and hardware refresh fall to the owner |
Examples to evaluate | Spot AI, Coram; in-camera storage: Verkada, Rhombus | Eagle Eye Networks | Milestone XProtect with XProtect Remote Manager |
If the hybrid column describes your sites, book a demo with one site's camera list and measured upload speed in hand. Spot AI goes live in days on existing IP cameras, so a pilot on that site can follow. For a vendor-by-vendor view, see our comparison of cloud VMS platforms; for the same choice weighed against shrink outcomes, see our cloud versus on-prem decision framework for retail.
Per-site bandwidth arithmetic
Spot AI keeps continuous recording off the uplink, and the reason is arithmetic: the upload that cloud-only recording needs grows with every camera on site.
Upload (Mbps) = cameras × average bitrate (Mbps) × (1 + headroom)
The worked example uses planning inputs, not measurements: a store with 24 cameras averaging 4 Mbps each, plus 25% headroom for bursts. Read each camera's real bitrate from its stream settings, because resolution, frame rate, codec, and scene activity all move it.
- 24 cameras × 4 Mbps = 96 Mbps of continuous upload.
- 96 Mbps × 1.25 = 120 Mbps with headroom, 24 hours a day.
- Over 30 days, the 96 Mbps average moves about 31.1 TB off the site.
On a 20 Mbps upload line, the formula caps continuous cloud recording at four such cameras, since 20 ÷ (4 × 1.25) = 4, leaving nothing for point-of-sale, voice, or back-office traffic. In a hybrid design the uplink carries metadata plus the video people choose to watch, so budget it from behavior: two investigators each watching one remote stream at 4 Mbps add 8 Mbps while they watch.
When a site has no wired uplink at all
Spot AI supports Starlink back-haul for sites without a wired connection, and it also runs on security trailers, the usual answer for a lot, yard, or temporary site with no fixed cameras or power. Our guide to running security trailers and fixed cameras in one system covers that setup, and the buyer's guide to mobile security trailers covers the units.
Retention arithmetic: what 30 or 90 days takes in storage
Spot AI holds history on the IVR, but the storage math is the same wherever the history sits:
Storage (GB) = bitrate (Mbps) × 86,400 × days × cameras ÷ 8,000
The 86,400 is the seconds in a day, and dividing by 8,000 converts megabits into gigabytes. One camera at 4 Mbps records 43.2 GB a day; the table scales that to the 24-camera store.
Retention | One camera at 4 Mbps | 24-camera site at 4 Mbps |
|---|---|---|
1 day | 43.2 GB | 1,036.8 GB (about 1 TB) |
30 days | 1,296 GB (about 1.3 TB) | 31,104 GB (about 31.1 TB) |
90 days | 3,888 GB (about 3.9 TB) | 93,312 GB (about 93.3 TB) |
Tiering cuts that sharply. Keep 90 days only on the eight cameras covering registers, doors, and the dock, and 30 days on the other 16: 8 × 3,888 GB + 16 × 1,296 GB = 51,840 GB, about 44% less than 90 days everywhere.
Who pays for those terabytes is the architectural difference. Cloud-only makes them a subscription line that grows with every camera and retained day; hybrid makes them recorder capacity sized once per site, with the cloud holding metadata and saved case clips; on-premises makes them server disks with a refresh cycle. Our explainer on cloud storage for camera footage covers the options.
Run both formulas on your largest site before any demo. Cameras times bitrate gives the upload a cloud-only design needs, and the storage formula gives what every design needs, so those two numbers alone rule architectures in or out.
Uptime and support terms to put in the contract
Spot AI keeps recording on site through a cloud outage, so in a hybrid design an uptime figure covers the cloud dashboard rather than the recording; in a cloud-only design, it covers both. Convert each percentage into minutes:
- 99.9% allows about 43.2 minutes of downtime in a 30-day month, or 8.76 hours a year.
- 99.95% allows about 21.6 minutes a month, or 4.38 hours a year.
- 99.99% allows about 4.3 minutes a month, or about 52.6 minutes a year.
The other terms worth getting in writing are:
- What the uptime figure measures (dashboard, API, alert delivery, or recording) and how it is reported.
- The remedy when it is missed, as service credits with a stated calculation.
- Response times by severity, with "a site has stopped recording" as the top severity.
- Swap terms for the recorder or gateway: advance exchange, delivery time, and installation.
- A recovery point for footage. NIST defines a recovery point objective as "the point in time to which data must be recovered after an outage" (Source: NIST). Ask how much footage each failure costs: internet outage, cloud outage, or recorder failure.
- Update cadence and maintenance windows the business can schedule.
- Export on exit: footage and case records in standard formats, and the time allowed to pull them.
For SOC 2 reports, data residency, and single sign-on, use our SOC 2 checklist for video platforms.
The device controls IT will test
Spot AI is NDAA-compliant and follows SOC 2 practices with a zero-trust design, and IT will still test the devices themselves: cameras, recorder, and the path to the cloud. NIST's IoT device baseline, NISTIR 8259A, names six capabilities a device needs to be securable, and each maps to a check a pilot can run (Source: NIST):
- Device identification. Every camera and recorder appears in the inventory with a unique identifier, matching what is mounted on site.
- Device configuration. Only authorized roles can change settings such as resolution, retention, and detection zones.
- Data protection. Video is encrypted in transit and at rest, and the vendor can say who holds the keys.
- Logical access to interfaces. Unused ports are off, remote access needs no inbound port-forwarding, and sign-in runs through single sign-on (SSO) with role-based access by site.
- Software update. Firmware and recorder software update through a secure mechanism, remotely, on a schedule IT controls.
- Cybersecurity state awareness. The system reports device health, offline and tamper events, and who viewed or exported what; our guide to camera downtime covers the health side.
Before Spot AI, Nashville Rescue Mission ran its cameras on an on-premises server that allowed only five users at a time, which made camera access unreliable. Spot AI gave the organization unlimited user access through its existing SSO provider, remote access, and AI search with people and vehicle filters and thumbnail previews, which reduced the time staff spent looking through footage.
"The biggest benefit of Spot AI is how easy it is to look up incidents, see the footage, and then share it and collaborate."
Ben Grady, Manager of IT and Database Administration, Nashville Rescue Mission
How to choose in four steps
Spot AI adopts a site's existing IP cameras, so a pilot can start on the estate already in place, and these four steps turn the architecture choice into evidence whichever vendors are on the shortlist:
- Inventory each site: camera count, model, ONVIF or RTSP support, and each stream's bitrate.
- Measure upload at the busiest hour, minus what point-of-sale, voice, and back office already use.
- Set retention by camera group and run the storage formula for the largest and smallest site.
- Disconnect one pilot site from the internet for an hour, then check the recording, any gap, and catch-up time. Our 60-day video AI pilot plan sets out the rest of the pilot.
Treat the one-hour disconnect as the deciding test. Recording that continues points to a hybrid or on-premises design, and a gap backfilled from a buffer shows how long an outage a cloud-only site can absorb.
For a business with cameras already installed, the best cloud-based security cameras are often the ones on the wall, connected to an architecture that fits each site's uplink and retention policy. Spot AI connects those cameras to a hybrid edge-to-cloud design, keeps full-resolution video on site, and goes live in days. Book a demo on your own video, or read how Nashville Rescue Mission moved past a five-user server limit.
Frequently asked questions
Do cloud-based security cameras keep recording when the internet goes down?
Spot AI keeps recording on the IVR during an internet outage, because the recording of record does not travel over the link. Cloud-only designs rely on a local buffer, and its reach is simple to calculate: hours = storage in GB × 8,000 ÷ (bitrate in Mbps × 3,600). A camera or gateway holding 128 GB for one 4 Mbps stream covers about 71 hours before the oldest buffered video is overwritten.
How long do security cameras keep footage?
Spot AI keeps footage as long as the retention a business sets and the IVR's storage allow; no system has a universal default. Set the period from the longest gap between an incident and a request for the video, such as a delayed damage claim or a police request, plus a margin. Write it down per site, because a policy that lives only in a recorder's settings drifts when that recorder is reconfigured or retired.
Is a cloud camera system cheaper than an on-premises system?
Spot AI's hybrid design runs on the cameras already on the wall, so the camera line is the first one to settle in a five-year model. Put five lines side by side for each design: cameras (the existing estate plus any additions), on-site hardware and its refresh, the subscription per camera, any uplink upgrade, and the staff time to run it. Hold camera count and retention identical across all three, or the comparison measures the assumptions instead of the architecture.
What does NDAA compliance mean for a cloud camera system?
Spot AI is NDAA-compliant, which matters most to businesses that sell to or contract with the federal government. Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 bars executive agencies from buying equipment that relies on covered video or telecommunications gear from a short list of named manufacturers and their affiliates, and from contracting with companies that use it. Ask for the compliance statement to cover every device in the design, including the recorder or gateway.
Can cloud-based security cameras work with cameras a business already owns?
Spot AI works with any ONVIF IP camera a business already owns, and legacy analog cameras connect through the IVR, so the existing estate is the starting point. Two stream settings matter for any cloud design: the lower-resolution secondary stream most IP cameras offer for remote viewing, which keeps live views light on the uplink, and the main stream's bitrate, which sets storage. Check both during the inventory.
About the author
Dunchadhn Lyons, Director of AI Engineering
Dunchadhn Lyons leads Spot AI's AI Engineering team, building real-time video AI for operations, safety, and security, turning video data into alerts, insights, and workflows that cut incidents and boost productivity.