Video retention and chain-of-custody policy guide

How to build a video retention policy with chain of custody in 2026

A video retention policy decides how long recorded footage lives, where it lives, and who can touch it. Chain of custody decides whether that footage still counts when a case reaches law enforcement, an insurer, or a courtroom. The stakes keep rising: 52% of retailers report increases in shoplifting and merchandise theft tied to organized retail crime groups, and 66% report transnational crime rings targeting their companies since 2024 (Source: NRF). This guide gives loss prevention, security, and IT leaders a practical framework: retention windows by use case, the custody and audit-trail practices that keep footage defensible, and templates to adapt.

Why retention and chain of custody decide whether video counts

Most organizations already record plenty of video. Far fewer can produce a specific clip six months later with a record of everyone who touched it. A December 2025 report from the National Institute of Standards and Technology found that evidence-management practices vary substantially across organizations, from manual paper tracking to digital systems, and recommended written policies based on established standards, routine audits, and tracked performance indicators (Source: NIST).

The failure modes are predictable. Footage gets overwritten before an investigator asks for it. A clip gets emailed around until nobody can say which copy is the original. Storage budgets balloon because everything is kept forever "just in case." A written policy, paired with a documented custody process, addresses all three at once. If your team is also formalizing how incidents get escalated in the first place, the incident escalation policy guide pairs naturally with this one.

There is also a quieter payoff. A policy that classifies footage lets you spend storage where it earns its keep: short windows for routine recording, long windows only for the material that carries legal or financial weight. Teams that skip the classification step usually end up paying for the longest window everywhere, or worse, discovering after an incident that the cheapest window applied to the camera that mattered.

The video evidence lifecycle: capture, retain, export

Every piece of footage moves through the same lifecycle, and the policy should name each stage:

1. Capture. Cameras record continuously or on detection events. At this stage everything is routine footage with a short shelf life.
2. Triage. A detection, a report, or a review flags a segment as potentially relevant. Speed matters here, because triage has to happen before the overwrite window closes.
3. Preservation. The flagged segment is moved out of the automatic overwrite pool and into an incident record or case, with its original timestamps intact.
4. Retention. The preserved clip follows the window assigned to its footage class: incident evidence, regulated record, insurance claim, or legal hold.
5. Export. When law enforcement, an insurer, or counsel requests the material, it leaves the system in original quality with its custody record attached.
6. Disposition. When the window expires and no hold applies, the material is deleted on schedule and the deletion is logged.

Investigation workflows sit on top of this lifecycle. For the detect, investigate, resolve, and export loop itself, see the incident resolution guide.

Retention windows by use case

How long to keep security camera footage depends on what the footage is for. The windows below are drivers to review with counsel, not legal advice:

Regulated industries such as banking and healthcare typically run longer windows under their own rules. The policy should name those exceptions explicitly rather than stretching the default window for everyone.

How to write the policy in seven steps

The steps below turn the lifecycle and the windows into a working document:

1. Inventory your recording estate. List every camera, recorder, and storage tier, and map each to the risk zones it covers. A policy written against an imagined estate fails its first audit.
2. Define footage classes. At minimum: routine, incident evidence, regulated record, and legal hold. Every clip belongs to exactly one class at any moment.
3. Set a window per class with counsel. Use the drivers above, then check that your storage can actually deliver each window at full camera count and resolution. A window the hardware cannot hold is fiction.
4. Assign owners. Loss prevention or security owns cases and preservation decisions; IT owns storage, access control, and deletion mechanics. Name roles, not people.
5. Define preservation triggers. An incident report, an insurance claim, or a litigation notice moves footage out of the overwrite pool the moment it fires. Write down who can trigger preservation and how fast it must happen.
6. Define the export and custody procedure. Original format, original timestamps, a named handler, and a logged transfer for every copy that leaves the system.
7. Audit quarterly. National guidance recommends routine audits and tracked performance indicators for evidence handling (Source: NIST). Sample real clips: can you produce them, and does the custody record hold?

Where retention actually happens: edge, cloud, and hybrid storage

The retention schedule is only as real as the storage architecture underneath it, and the architecture decision shapes cost, bandwidth, and how quickly evidence can be preserved. Three approaches dominate:

For multi-site operators the architecture question is usually decided at the portfolio level, alongside deployment model and camera compatibility. The policy does not need to pick a winner; it needs to state where each footage class lives, who controls that storage, and how preservation works in that location. What it must never do is assume a window the hardware has not been proven to deliver.

Chain of custody and audit trails for video evidence

Chain of custody is a process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled it, the date and time it was collected or transferred, and the purpose of each transfer (Source: NIST CSRC). For video, the custody record should capture:

• A unique identifier for the clip or case, with original recording timestamps.
• Every handler in chronological order: name, role, date, time, and purpose.
• Storage locations and every transfer between them.
• An integrity marker, such as a file hash, where the system supports one.
• An access log covering views, exports, and shares, not just physical handoffs.

Two practices do most of the work. First, keep one authoritative copy inside the system of record and treat every export as a logged event. Second, prefer platforms where viewing and exporting write to the audit trail automatically, because a custody record maintained by hand in a spreadsheet is the first thing a defense attorney pulls apart. The goal is verified, timestamped evidence, and a record strong enough to answer challenges rather than a claim that the material is beyond dispute.

Exporting evidence for law enforcement and insurers

An export is where the policy proves itself. Detectives and adjusters need original-quality video, intact timestamps, and a custody record that survives scrutiny, packaged as one case rather than a folder of loose files. Teams that centralize this step report material gains: All Star Elite, an 80-store retailer, reports investigations running more than 50% faster after moving case management into one database, with law-enforcement case timelines dropping from 2-3 months to 1 month (customer-reported).

"The ability to formalize our incident reporting, have all our cases on one database, and attach videos to those cases has been a game changer."

Andrew Gonzalez, Corporate Director of Loss Prevention and Safety, All Star Elite

Before any package leaves the building, run a short release checklist:

1. Confirm the request is legitimate and logged: the case number, the requesting officer or adjuster, and the legal basis for release.
2. Export from the system of record in original quality, never from a copy that has already circulated by email or chat.
3. Attach the custody record and the relevant incident report so the recipient gets the history, not just the pixels.
4. Log the release itself as a custody event: handler, recipient, date, time, and format.
5. Keep the authoritative copy preserved internally until the case closes and counsel signs off on disposition.

Policy templates to adapt

Two building blocks cover most of the document. Copy them into your draft and adjust with counsel.

Retention schedule template. One line per footage class:

1. Routine footage: [X days], owner IT, overwritten automatically, no approval needed.
2. Incident evidence: retained until case closure plus [X months], owner LP/security, preserved on incident report.
3. Regulated records (for example recordable injury events): [window matching the regulation], owner EHS with IT, preserved on recordable determination.
4. Legal hold material: retention suspended, owner general counsel, preserved on hold notice, released only in writing.

Chain-of-custody log fields. For every preserved clip: case ID, clip identifier and hash, original camera and timestamps, preserving handler and trigger, each subsequent handler with date, time, and purpose, every export with recipient and format, and final disposition with date and approver.

How modern video platforms put the policy into practice

The policy gets much easier to run when the platform does the bookkeeping. As one worked example, Spot AI pairs a hybrid edge-to-cloud architecture with case-based evidence handling: the Intelligent Video Recorder (IVR) keeps full-resolution video inside the facility while only metadata crosses the network, and incidents are documented as timestamped, organized cases rather than loose exported files. Its AI Security Guard follows a detect, deter, and document pattern, so the footage that matters is flagged and preserved in context instead of being found after the overwrite window has passed. Evaluating platforms on these mechanics, alongside deployment model and camera compatibility, is covered in the enterprise video security guide.

Whatever platform you run, hold it to the policy's standard: footage classes it can express, preservation triggers it can automate, audit trails it writes on its own, and exports that carry their history with them.

If you are formalizing retention and evidence handling this year, see how Spot AI approaches video evidence management, and browse real evidence workflows in the customer stories.

Frequently asked questions

How long should businesses retain security camera footage?

There is no single legal number for most commercial settings. Set windows per footage class: routine footage for days to weeks, incident evidence until case closure, regulated records per the controlling rule, and legal-hold material until released. Confirm the windows with counsel and verify the hardware actually delivers them.

What is chain of custody for video evidence?

It is the chronological record of everyone who possessed or handled the evidence, with dates, times, and the purpose of each transfer, as defined in NIST guidance. For video it also covers views, exports, and shares. A complete record is what keeps footage defensible when it is challenged.

What should a video retention policy include?

Six elements: an inventory of cameras and storage, named footage classes, a retention window per class, owners for cases and for storage mechanics, preservation triggers such as incident reports and legal holds, and an export procedure with custody logging. Quarterly audits keep the document honest.

How do you export video evidence for law enforcement or insurers?

Export in original quality with original timestamps, attach the custody record, and package everything as one case file. Log the export itself: who released it, to whom, when, and in what format. Retailers that centralized this report law-enforcement case timelines dropping from months to weeks.

Does OSHA require keeping video of workplace incidents?

OSHA's recordkeeping rule requires injury and illness records, such as the 300 log and 301 incident reports, to be retained for five years; it does not mandate video itself. Many operators align video of recordable events with that five-year window so the record and its supporting footage expire together.

About the author

Joshua Foster, IT Systems Engineer. Joshua Foster is an IT Systems Engineer at Spot AI, where he focuses on designing and securing scalable enterprise networks, managing cloud-integrated infrastructure, and automating system workflows to enhance operational efficiency. He is passionate about cross-functional collaboration and takes pride in delivering robust technical solutions that empower both the Spot AI team and its customers.