CCTV Cloud: Store Camera Recordings in the Cloud

Models for storing camera recordings in the cloud

There are two basic approaches to setting up CCTV cloud recording. In the hybrid model, recordings are first written to the on-site NVR or DVR, and then all cameras or selected ones are copied to the cloud. With direct-to-cloud recording, footage is briefly buffered on site and the main archive is kept in the cloud.

Criterion	Local recording only	Hybrid (local + cloud)	Direct-to-cloud recording
If the device is stolen or fails	Recordings are lost	The cloud copy is preserved	The archive is preserved in the cloud
Dependence on the internet connection	None	Low; copying may be delayed	High; upload speed is decisive
Extending the retention period	Requires adding disks	Cloud capacity is increased	Cloud capacity is increased
Multi-branch management	Each branch separately	Centralized access	Centralized access

For businesses that have already invested in cameras and recorders, especially those spread across many branches, the hybrid model is usually the option that can be rolled out with the fewest changes. Direct-to-cloud recording stands out at newly opened branches or at sites where keeping a recorder on premises poses a security risk; in this model, a redundant internet connection is especially important.

What determines CCTV cloud recording capacity?

• Number of cameras and resolution: higher resolution increases the data volume per camera.
• Frame rate and compression: efficient codecs such as H.265 use less space for the same footage.
• Recording mode: storage requirements differ significantly between continuous recording and motion-triggered recording.
• Retention period: how many days recordings are kept directly determines total capacity.
• Branch internet upload speed: the volume of footage sent to the cloud must not exceed the line’s upload capacity.
• Image quality requirements: cameras that need license plate or facial detail and general-area cameras do not have to record at the same resolution.
• Per-camera policies: capacity can be balanced by keeping critical points for longer and general areas for shorter periods.

Deployment usually starts with an inventory of existing cameras and recorders. Device models and supported streaming protocols are checked, the upload speed of each branch is measured, and then recording transfer is tested with a few cameras at a pilot branch. Once bandwidth and recording quality are verified, the other branches are added with the same configuration. This sequence makes it easier to switch over without stopping the existing on-site setup or interrupting recording continuity.

Access control and KVKK for camera recordings

Under KVKK (Türkiye’s Personal Data Protection Law), camera footage is personal data: who accesses recordings and with what authorization should be logged, the retention period should be proportionate to the purpose, and footage should be scheduled for automatic deletion when that period ends. User-based authorization and access logs on the cloud platform support the technical side of these requirements. For example, a branch manager can view only their own branch’s cameras while the central security team can access all locations, and a record is kept of who exported footage for an incident and when. Using an encrypted connection when transferring footage to the cloud and storing data on infrastructure hosted in Türkiye are important parts of data security measures. This assessment does not replace legal advice; for technical and administrative measures, you can get support from our KVKK & Security Consulting service.

To estimate the storage and the upload speed needed for cloud recording from camera count, resolution and retention, use the CCTV storage calculator.

Recordings stay in Turkey and never leave the country

With MAV Cloud CCTV Cloud, camera recordings are stored on MAV Cloud infrastructure in the Equinix data center in Istanbul; recordings are not transferred to a data center abroad. With some off-the-shelf cloud camera apps, the contract does not clearly state which country the footage is kept in, or the servers are located outside Turkey.

The difference matters under KVKK, Turkey’s Personal Data Protection Law (Law No. 6698). Camera footage is personal data, and transfers of personal data abroad are governed by Article 9 of the law. Under the amendment in force since 1 June 2024, a transfer must rely on an adequacy decision, appropriate safeguards such as standard contracts, or one of a limited set of exceptions; standard contracts must be notified to the Personal Data Protection Authority within 5 business days of signing. Keeping recordings in Turkey at the infrastructure level means no cross-border transfer for storage; access to or copying of recordings from abroad still has to be assessed separately. Other obligations such as privacy notices, retention periods and security measures still apply.

Whichever provider you work with, ask for written answers to these questions at the quotation stage:

• In which country and which data center are the recordings stored?
• Are backups or copies of the recordings sent to another country?
• Can the support team access the recordings from abroad?
• Is footage deleted automatically when the retention period ends?
• Can you get a report of who accessed the recordings and when?

Worked example: 10 cameras, 30 days

Assumptions: 1080p resolution, H.265 compression and an average stream of 2 Mbit/s per camera. Such a camera produces about 21.6 GB of footage per day (2 Mbit/s × 86,400 s ÷ 8). Continuous recording on 10 cameras with 30 days of retention needs roughly 6.5 TB of storage, and direct-to-cloud recording needs at least 20 Mbit/s of sustained upload bandwidth. With motion-based recording, the requirement drops significantly depending on how much movement the scene has. To run the numbers for your own camera count and bitrate, use the CCTV storage calculator.

Footage exported after an incident that has to be kept for a long time can also be stored in S3 Object Storage with Object Lock protection against deletion. To keep your other servers and applications in Turkey as well, see server hosting in Turkey.