The reason multifamily real estate investors have never shared operational-security data with their LPs is a privacy boundary. This guide is about how it moves.
Every guide for multifamily real estate investors teaches cap rate, IRR, agency financing, market selection, and syndication structure. BiggerPockets, Yardi, RealPage, Multifamily Insiders, Roofstock, BAM Capital. None of them explain why every quarterly LP letter you have ever read says exactly one sentence about security, and that sentence is always qualitative. Not because security does not matter to LPs, but because the pipeline from a DVR in a closet to a number on a quarterly slide ran through raw resident video, and nobody was going to ship raw resident video to an LP.
The pipeline is a solved problem. This page is the architecture. Three tiers, three redaction levels, three stakeholder surfaces, one source of truth. The layer that reaches the LP is a million times smaller than the layer that could cause a privacy issue. That is why, for the first time, a multifamily investor can put an operational-security number on the same slide as portfolio occupancy without a data-room redaction workflow.
See the three tiers in a live demoWhy the top results for this keyword all sidestep the same question
Search “multifamily real estate investors” and the first-page results are predictable. BiggerPockets publishes a how-to-get-started piece. Yardi and RealPage publish software-vendor playbooks. Multifamily Insiders publishes a conference preview. Roofstock and BAM Capital publish syndication-vs-direct explainers. Every one of them competes on the same shelf: cap rate, IRR, financing structure, market selection, syndication mechanics, Class A vs Class B vs Class C.
None of them touches the reason the quarterly LP letter that lands in every allocator’s inbox has one sentence on security, and that sentence is always qualitative. The reason is an old data boundary: the only way to get anything concrete out of the DVR was to pull raw video, and raw video cannot move across a property boundary without a privacy review. Until the boundary gets redrawn, the LP letter says “security is stable” because that is the only thing it can say.
The rest of this page walks through what the new boundary looks like, what volume of data lives on each side of it, what the LP actually sees, and why this is the first architecture where an operational-security number fits into a quarterly packet the same way an occupancy number does.
The three tiers, drawn as data flow
Three stores. Three stakeholder surfaces. Three redaction levels. The orange box is the edge device sitting inline on the HDMI cable between the DVR and the wall monitor in the office closet. Everything to the left of the hub stays inside the property fence. Everything to the right is what a GP, an LP, or a lender reads from the portfolio dashboard.
The edge device is the redaction boundary
The numbers that make the boundary real
The three tiers are separated by a factor of roughly 10,000 in data volume. That separation is what makes the architecture shareable. Tier 2 is small enough to embed in an email and broad enough to underwrite a quarterly KPI. Tier 0 is large enough to satisfy a 30 or 90 day retention requirement and is never touched by anyone outside the on-site property manager.
Who sees what, and why each stakeholder gets a different surface
The investor does not want to see raw video. The property manager does. The LP wants a number on a slide, not a thumbnail gallery. The three tiers exist because the three stakeholders need three different levels of granularity. The Cyrano architecture gives each of them exactly the tier that matches their job, and nothing more.
Tier 0 surface: the on-site property manager
Keeps the DVR UI they have always had. Full continuous footage, brand-native interface, 30 to 90 day retention per the property's existing policy. Forensic review for incidents with legal or insurance weight. This layer is unchanged by anything Cyrano does.
Tier 1 surface: the GP and asset manager
Sees the indexed event feed in the Cyrano dashboard. Every row has tile.label, event_class, timestamp, and a thumbnail path. Filters by property, by tile, by hour-of-day, by event class. A 480 by 270 JPEG thumbnail is paired with every event for visual confirmation without unlocking the DVR. Roughly 18 KB per thumbnail, 150 MB per property per month.
Tier 2 surface: the LP, the lender, and the broker
Sees daily aggregate rows rolled up to the property, and portfolio-weighted totals rolled up to the fund. property_key, date_utc, indexed_events_count, events_by_class, resident_days, indexed_rate_per_1000. No thumbnails, no individual events, no path to a frame of video. The entire Tier 2 store for a 30 property portfolio is smaller than a single email attachment.
The key design choice: each surface is terminal
A user on the LP surface cannot click through to a thumbnail. A user on the GP surface cannot click through to raw video. Each tier is a hard boundary, enforced at the edge device, not a permissions toggle that can drift. This is what makes the architecture auditable to privacy counsel.
What a Tier 2 row actually looks like on disk
The unit of sharing is a daily aggregate row per property. This is what a multifamily real estate investor attaches to a quarterly LP packet, drops into a data room, or emails to a lender’s analyst. The row is keyed on a property slug, not an address. It carries no resident identity, no thumbnail paths, and no references to an individual frame of video.
And what the Tier 1 row looks like, which never leaves the edge
The Tier 1 row is richer. It carries tile.label, a confidence score, a dwell time, and a pointer to the 18 KB JPEG thumbnail on the local disk of the edge device. The GP and the on-site team read this in the Cyrano dashboard. The thumb_path is deliberately a local filesystem path, not a signed URL; the file does not get uploaded anywhere.
The 480 by 270 thumbnail resolution is the pixel contract for what leaves the property
The thumbnail is the single pixel artifact that ever crosses the property boundary under the Cyrano architecture, and only on explicit demand from the GP surface. 480 by 270 is a 16:9 downscale of a standard multiview tile, encoding to roughly 18 KB as a JPEG. That size is large enough to resolve a person’s presence at a gate or a vehicle’s lane position, but small enough that facial identification against a general database is unreliable.
The resolution is a deliberate ceiling, not a leftover default. A full-resolution clip on Tier 1 would push the per-property edge store from 150 MB per month into multiple GB per month and would move the clip back into the privacy-review category for downstream sharing. The ceiling is what keeps the Tier 1 store operationally useful to the property manager while keeping the Tier 2 rollup shareable with the LP.
This is the uncopyable part. A competing architecture can change the size of the payload. It cannot change where the redaction boundary sits without rewriting the product. Cyrano’s redaction happens at the edge, on the HDMI frame, inside the same closet as the DVR. That is the specific property that makes the Tier 2 rollup safe to send to an LP.
The workflows the Tier 2 boundary unlocks for a multifamily investor
Once the redaction boundary exists at the edge, a handful of workflows that used to require a custodian review and a legal sign-off collapse into a SQL query and a CSV export. Each of the cards below is a workflow that was previously blocked by the “raw video privacy” barrier, and is now Tier 2 native.
Put operational-security on the same slide as occupancy
Quarterly LP letter now carries a portfolio-weighted indexed incident rate alongside portfolio-weighted economic occupancy. Same granularity. Same shape. No custodian review, no redaction review, no legal sign-off required.
Populate the data room without a clip pull
Disposition broker embeds the 24 month Tier 2 CSV in the OM data room. Buyer's analyst reads the trend line without asking to see video.
Attach a supporting exhibit to the loan file
Agency or bridge lender receives a chart pack of Tier 2 aggregates alongside the T-12. Not required, but materially strengthens the asset narrative.
Share with the GL carrier without exposing residents
Carrier underwriter reads measured incident frequency by class. Never touches a thumbnail. The carrier conversation upgrades from anecdote to data.
Cohort-benchmark across the portfolio
Every property contributes a daily aggregate in the same shape. Asset manager ranks properties by indexed rate without waiting for regional-manager reports.
Hand off to a buyer at close without a data migration
Tier 1 store stays with the asset. New owner inherits the indexed history from day 0. No export, no reshape, no custodian handoff.
Before the boundary existed, and after
Same portfolio. Same properties. Same DVRs. The only thing that changes is where the redaction line sits. In the old model, every request for operational-security context went through raw video, which blocked it at the privacy review. In the new model, the redaction is already done at the edge, and the Tier 2 rollup is ready to share.
A GP wants to put operational-security data in the quarterly LP letter. The only source of data is the DVR. To get a number out of the DVR, somebody has to pull video. Raw video can identify residents. Sharing identifiable video with an LP requires a privacy review, which requires a redaction workflow, which requires a custodian, which requires a budget. The GP writes 'security is stable' in the letter and moves on.
- Every data request runs through raw video
- LP letter can only carry qualitative language
- Data room for disposition never includes operational security
- Loan file has no operational exhibit
The SQL that rolls up Tier 2 across the portfolio
The portfolio-weighted indexed rate is one SQL query against the Tier 2 aggregate store. No join to Tier 1. No access to thumbnails. No access to raw video. The result is safe to embed in a quarterly letter and safe to drop in a loan file as supporting material. The query shape is intentionally the same as the query an investor would write against a rent roll, because the goal is parity with the financial KPIs.
A terminal view: running the rollup, then exporting for the LP packet
The whole operational cycle for a GP preparing a quarterly letter is a 4 line shell session. The first line queries the Tier 2 aggregate store. The second line writes the CSV. The third line confirms the row count. The fourth line is the checksum that ends up in the footnote of the quarterly letter so the LP can verify the artifact was not altered downstream.
The checklist counsel asks for when reviewing the pipeline
When a privacy counsel or a cybersecurity reviewer first looks at the Cyrano pipeline, the review compresses to a short checklist. Every line below is a question a reviewer asks, and every line below is answered by where the redaction boundary sits, not by a policy document on top of it.
PRIVACY REVIEW CHECKLIST
- Does raw resident video ever cross the property boundary? No.
- Does the pipeline require a new network seat on the property LAN? No.
- Does the pipeline require DVR admin credentials? No.
- Does the Tier 2 payload contain any field that can identify a resident or unit? No.
- Is the Tier 1 thumbnail resolution bounded so facial identification is unreliable? Yes, 480x270.
- Is the Tier 0 retention policy changed? No. DVR retention remains under the property's existing policy.
- Can a Tier 2 user navigate to a Tier 1 thumbnail or a Tier 0 frame? No. Boundaries are terminal.
- Is the pipeline auditable? Yes. cyrano-cli privacy-check runs on every export before it ships.
How this compares to the two patterns investors already know
The two existing patterns for operational-security data in multifamily are “the property manager pulls a clip on demand” and “a cloud VMS replaces the DVR.” Neither one produces a Tier 2 rollup. The first one stops at the clip request. The second one ships raw video to the cloud, which re-creates the privacy-review problem at a different boundary.
| Feature | PM pulls a clip | Cyrano three-tier |
|---|---|---|
| Data that crosses the property boundary | Raw video on request, with custodian review | Tier 2 aggregate only, approximately 2 MB per property per month |
| LP visibility into operational security | Qualitative sentence in quarterly letter | Portfolio-weighted indexed rate on the same slide as occupancy |
| Clip pull turnaround | Hours to days, depending on custodian | No clip pull. Thumbnail already paired with the event on Tier 1. |
| Privacy review at share time | Per clip, per share | Once, at pipeline design. Every export inherits it. |
| Disposition data room | No operational-security exhibit | 24 month Tier 2 CSV, embedded by default |
| Loan file supporting exhibit | Not offered | Tier 2 chart pack, attached to the borrower narrative |
The one sentence version for a multifamily investor
The first time you can share an operational-security KPI with your LPs on the same slide as portfolio-weighted occupancy is the first time you have a pipeline that does the redaction at the edge device, not at the data room.
That is the whole argument. Every other detail on this page is a consequence of that one architectural choice. The 480 by 270 thumbnail ceiling, the 2 MB per property per month egress budget, the terminal stakeholder surfaces, the SQL that rolls up without touching Tier 1, the loan file exhibit, the disposition CSV. Same tree, same root.
“The spread between Tier 0 and Tier 2 volume. A factor of 10,000 in data volume is what makes the portfolio rollup shareable without a privacy review.”
Cyrano pipeline design
“For the first five years I managed multifamily assets for LPs, every time I asked for security data the answer was a clip, and every clip was a redaction headache. We stopped asking. The three-tier rollup lets me put an operational number on the same slide as occupancy, which is a conversation I have wanted to have in an LP letter for a decade.”
See the Tier 2 rollup against your own portfolio
Live walk through what ships off-property, what stays on the edge, and what the LP dashboard looks like next to your occupancy slide.
Book a call →FAQs multifamily investors ask about the three-tier data boundary
Why has operational security never appeared in the quarterly reporting packet a multifamily real estate investor sends to LPs?
Because every path to the underlying data went through raw footage. A property manager could pull a clip from the DVR, but the clip carried identifiable resident video, which a GP cannot ship to an LP, a lender, or a broker without a privacy review and a redaction workflow. Without a redacted shareable artifact, the only thing an investor could put in a quarterly report was a sentence like 'cameras are installed and operational.' That sentence is a qualitative claim, not a KPI. Cyrano changes the shape of the artifact: the data that leaves the property is already redacted at the edge, so what lands in the quarterly packet is a count of normalized events plus, where necessary, a 480 by 270 pixel thumbnail keyed on tile.label and a timestamp, not an identifiable video clip.
What are the three tiers in the data egress architecture specifically?
Tier 0 is the raw continuous footage, which lives on the DVR exactly where it has always lived, and never crosses the property boundary. A 16 camera property produces roughly 10 TB of Tier 0 footage per month. Tier 1 is the indexed event row plus the 480 by 270 JPEG thumbnail, which live on the Cyrano edge device in the same closet as the DVR. A typical 16 camera property writes approximately 150 MB of Tier 1 data per month. Tier 2 is the aggregate counts, which ship to the portfolio dashboard over the property's existing internet connection. Tier 2 is approximately 2 MB per property per month. The three tiers differ by a factor of 10,000 in volume. That spread is what makes the architecture shareable: the layer the investor shows to an LP or a lender is a million times smaller than the layer that could cause a privacy problem, and it is the only layer the LP ever sees.
What is in the Tier 2 payload that actually lands on the portfolio dashboard?
Per property per day, a row that looks roughly like: property_key, date_utc, indexed_events_count, events_by_class, resident_days, indexed_rate_per_1000_resident_days. Across 30 days and 30 properties that is 900 rows of at most a few hundred bytes each. The property_key is a pseudonymous slug like oakridge-312, not an address. Event counts are integers. The ratio is a float. Nothing in the Tier 2 payload names a resident, names a unit, or references a specific frame of video. Nothing in the Tier 2 payload requires a privacy review to include in a report or a data room. The entire Tier 2 volume for a 30 property portfolio fits in an email attachment.
Why does the 480 by 270 pixel thumbnail exist at all, and why at that specific resolution?
The thumbnail exists so that when an investor, a property manager, or a legal team needs to visually confirm what an event_class label means, they have a picture to look at without having to unlock the DVR for full video. 480 by 270 is a 16:9 downscale of a standard multiview tile. It is small enough to be roughly 18 KB as a JPEG, which keeps the Tier 1 storage footprint under 150 MB per month for a busy property. It is large enough to resolve a person's presence at a gate and a vehicle's lane position, but small enough that facial identification against a general database is unreliable. The resolution is a deliberate balance point, not a leftover default. That balance point is what makes the thumbnail safe for the property-manager's incident log but not useful for the kind of indiscriminate surveillance analysis that would create a privacy exposure.
Does the Tier 2 payload carry enough information to compute an underwriting-grade KPI?
Yes. The aggregate that lands on the portfolio dashboard is enough to compute indexed incidents per 1000 resident-days per property per day, which rolls up to a portfolio-weighted rate across the hold period. A multifamily real estate investor with 12 properties can read one portfolio-weighted number on the same dashboard as portfolio-weighted occupancy, rent growth, and NOI per unit. Drilling into a property gives 30 to 365 daily aggregates, a ranked tile.label breakdown, and an hour-of-day distribution. If any of those drill-downs surfaces a question that needs a visual, the paired 480 by 270 thumbnail is pulled from Tier 1, not from raw video. The drill stops at Tier 1 for every stakeholder except the on-site property manager, who still has Tier 0 access the same way they always did.
What does the LP actually see, versus the GP, versus the on-site property manager?
Three surfaces, three redaction levels, one source of truth. The on-site property manager keeps the DVR UI they have always had, with full Tier 0 video for forensic review. The GP or asset manager sees Tier 1 in the Cyrano dashboard: event rows, tile.label filters, hour-of-day charts, and a gallery of 480 by 270 thumbnails for context. The LP sees Tier 2 only: the aggregate counts, rolled up to the portfolio level, with the ability to drill to per-property daily aggregates but not to individual events or thumbnails. Each stakeholder gets enough to do their job and nothing more. A data request from the LP to the GP used to require pulling a clip, reviewing it for resident identifiability, and redacting it. Under the three-tier model, the LP's dashboard is already at the right granularity, and there is no clip-pulling request in the first place.
Is this a substitute for a resident privacy notice, tenant disclosures, or state-specific video retention rules?
No. Cyrano does not change the legal framework around video surveillance at a multifamily property. The DVR still retains video under the same retention policy the property already has, and the property still has to provide the same tenant notices it has always provided. What the architecture changes is the chain of custody for operational-security data that leaves the property. Tier 1 thumbnails are not retained beyond the operational event window, Tier 2 rows do not contain identifiable information at all, and no raw continuous video ever leaves the property under the Cyrano pipeline. A privacy counsel reviewing a multifamily portfolio's operational-security reporting program will find that the boundary between what is inside the fence and what leaves the fence is drawn at the edge device, not at the cloud.
How much internet bandwidth does Tier 2 consume per property?
Approximately 2 MB per property per month, spread across the month. At the peak of a daily roll-up that is a few hundred KB. The Cyrano edge unit is designed to co-exist on the property's existing leasing-office internet connection without measurably affecting anything. By contrast, a cloud VMS that streams raw video upstream typically wants 5 to 50 Mbps of continuous upstream bandwidth per property, which in Class B and Class C multifamily is usually not available and is never budgeted. The 2 MB per month egress profile is why Cyrano can be installed on a 1960s Class C property with a DSL-era connection in the leasing office and still ship a daily aggregate to the investor's portfolio dashboard without a network upgrade.
What specifically does the investor attach to a loan file or an OM when selling the asset?
The artifact that goes into a loan file or an offering memorandum is a rolling 12 to 24 month aggregate: one CSV with per-day rows, one PDF chart pack showing the indexed rate over time, the ranked tile.label breakdown, and the hour-of-day distribution. No thumbnails, no raw video. The lender's analyst reads the chart pack alongside the T-12. The broker includes the CSV in the data room. Both artifacts are Tier 2, meaning the investor is not making a judgment call on whether a specific frame of video is shareable. The boundary was drawn when the event was written, not at the point of sharing.
Does this work if the property has a cloud VMS in addition to a DVR?
Yes. Cyrano reads the HDMI output of whatever recorder or NVR is driving the multiview to the wall monitor in the office closet. If the property also has a cloud VMS, that stack is unchanged. The cloud VMS is the property manager's tool. Cyrano is the investor's tool. The two pipelines do not overlap. The three-tier egress boundary is a property of the Cyrano architecture, not an integration with the VMS.
What happens when the property changes management companies mid-hold?
Nothing at the Tier 1 or Tier 2 layer. The new property manager inherits Tier 0 (the DVR) under the new engagement. The Cyrano edge device continues reading HDMI output, and the event rows and thumbnails continue landing in the same Tier 1 store. The investor's portfolio dashboard (Tier 2) sees no discontinuity. If the new property manager replaces the DVR, Cyrano re-OCRs the painted tile-name strip on the first frame of the new multiview and re-keys tile.label, so the event table continues without a schema migration. For the investor, a management change is a line item on an operating statement, not a rebuild of the operational-security reporting stack.
What is the biggest objection investors raise when they first see the three-tier architecture?
The objection is usually 'why is the thumbnail 480 by 270 instead of full resolution.' The honest answer is that the 480 by 270 is an intentional ceiling. A full-resolution clip on Tier 1 would turn the per-property edge store from 150 MB per month into multiple GB per month, and more importantly it would move the clip back into the privacy-review category for any downstream sharing. The ceiling is what keeps the Tier 1 store operationally useful to the property manager while keeping the Tier 2 rollup shareable with the LP. Investors who understand the shape of the boundary stop objecting to the ceiling and start using the Tier 2 aggregate as the input to their own dashboards, which is the intended workflow.
Adjacent investor-angle guides
Keep reading
Investing in Multifamily Real Estate
The operational-security line item missing from every underwriting model, derived from the same 9 field event payload that feeds Tier 1.
Invest in Multifamily Real Estate
Portfolio KPI normalization. How tile.label becomes the stable key that survives DVR swaps across a 5 to 7 year hold.
Multifamily Real Estate Investment
The pre-LOI dead camera audit. A 5 state tile vector that takes under 5 minutes of DD time to produce.
Comments (••)
Leave a comment to see what others are saying.Public and anonymous. No signup.