Matthew Diakonov, Written with AI

Published April 28, 202614 min read

For property operators on day one of a deployment

Responsible AI camera deployment is a list of files on the device, not a paragraph in a brochure.

Almost every existing playbook on this topic is a vibe. Balance security and privacy. Communicate openly with tenants. Use edge AI because it is more private. None of that is wrong, and almost none of it is checkable on the day the install truck leaves the property. On day 30, when a tenant raises a concern in a leasing review or a city housing board sends a question, an operator who answered those prompts with adjectives has nothing to point at.

What follows is a different shape: the seven things you can verify on the device the day the install is finished, with file paths, retention windows, and config files from a real edge AI retrofit running on a 180-unit Class C multifamily property. The unit shown is a Cyrano, but the structure of the verification is what matters. If your vendor cannot answer these in the same shape, the deployment is not yet responsible, regardless of what the brochure says.

Short answer

A responsible AI camera deployment answers seven concrete questions at install, not at procurement. Where do video frames live. How long does anything persist. What is searchable, and by whom. What is logged when an operator pulls a clip. What is in the exclude polygon. What is the tenant notice. What happens to all of this if the property changes hands. On an edge unit, every one of those answers is a file or a config flag you can read. On a cloud-only product, several of those answers are a vendor promise.

The rest of this page walks through each of the seven, with the file path or the config field, the value we ship by default on a multifamily retrofit, and the question to ask if you are buying from a different vendor. None of this is theoretical. It is the shape of an install we have done.

1. Where do the video frames live

The first question is the structural one. Edge or cloud. The difference is not a feature, it is whether a frame from a hallway camera ever leaves the building. On an edge unit, the answer is no. The perception tier (object detection, tracking) and the state tier (zone polygon lookup, dwell counters) and the planner tier (alert routing, threat level) all run on the unit physically wired into the DVR. The only outbound bytes are the alert text, the structured event metadata, and the clip URL that an on-call can tap.

On a cloud product, every camera tile is encoded and shipped to a remote cluster for inference. That changes who is responsible for those frames in transit, who logs the access, who applies retention, and what jurisdiction the data sits in. None of those are vendor failures, they are structural consequences of where the model runs. The responsible default for residential property is local inference, with the cloud reserved for the structured metadata that does not contain pixels of a tenant.

Frame path on an edge AI retrofit

The clip is served from the device, not from a cloud bucket. There is no S3-equivalent that holds a copy. If you take the unit off the network for an afternoon, the clip vanishes from the operator's phone the moment they refresh. That property is the most concrete statement of responsibility you can ship.

2. How long does anything persist

Two clocks, not one. Clips persist for as long as you might reasonably need to investigate an incident. Metadata (the alert rows with no pixels, just the structured fields) persists much longer because the rows are small and useful for trend reports. Combining them into one window is a common and avoidable mistake. A 1-year clip retention is irresponsible by default. A 7-day clip retention is too short for most insurance and police timelines. 30 days, with explicit hold support for any clip tied to an open investigation, is the responsible default we ship on multifamily.

cyrano@unit-multifam-22

The retention sweep is a small job that runs once a night, walks the clips directory, and unlinks anything past the window unless the file is in the hold directory. The hold directory is for clips a property manager has explicitly preserved during an active investigation. After the sweep runs, expired clips are gone from the device disk. There is no cloud copy to forget. If a discovery motion or subpoena arrives 60 days later, the clip is gone, and you say so on the record. That is the responsible answer.

3. What is searchable, and by whom

Operator roles, not shared logins. Three roles on a typical multifamily install. On-call can view active alerts and pull clips during their shift. Property manager can view all alerts and pull any clip in the retention window, and can adjust zone polygons. Admin can change retention settings, edit the dispatch tree, and add or remove operators. Each role is a token tied to a person, not a shared password the leasing office wrote on a sticky note. When a person leaves the property team, the token is revoked, not the password rotated.

The three operator roles, by capability

On-call (token-scoped): can read live alerts, pull clips for events during their shift, acknowledge a row in the outbox audit trail.
Property manager: everything on-call has, plus pull any clip in the retention window, edit zone polygons, mark a clip as hold.
Admin: everything property manager has, plus edit retention, edit the dispatch tree, add or remove operator tokens, run the wipe-and-handoff job.
No shared login. Every action is attributed to a token id; the access ndjson row carries the operator id, not a generic user.
Tokens are rotatable per-operator from the dashboard; revoking one operator does not interrupt anyone else's access.

The shape of the question is not what is the password. The shape is who can do what, and how do I confirm a former operator has lost their access. On a unit with role-scoped tokens, the answer is a token list in the dashboard with a revoke button. On a system with shared logins, the answer is rotate the password, which is the wrong answer at scale.

4. What is logged when an operator pulls a clip

An audit row, not a vague entry in a generic access log. Every time an operator clicks a clip URL, a row is appended to a separate file on the device. That file is what you go to when a tenant asks who looked at the lobby footage at 2 AM last Tuesday. The file is append-only and the entries carry enough fields to answer that question without reconstructing it from a vendor screenshot.

cyrano@unit-multifam-22

The honest version of this audit trail is the row that does not exist. A quiet shift produces zero rows because nothing was looked at. That is what an audit looks like when nothing happened. A vendor that promises we log everything and then cannot produce a row for a specific operator on a specific camera at a specific time does not have an audit trail, they have a marketing line.

5. What is in the exclude polygon

Every camera has an include polygon (the area the perception tier is allowed to detect on) and an exclude polygon (the area it is explicitly forbidden to detect on, even if the camera physically sees it). The exclude polygon is where responsible deployment is decided in geometry rather than in legal copy. Inside a unit door, even the few inches the camera catches when the door swings. Bathroom and locker entrances in shared amenity space. Pool deck during designated tenant-only hours if state law treats those as private. Mailbox interiors. Anything a state or municipal statute marks as expectation-of-privacy.

Camera	Include zone	Exclude polygon	Reason
hall-3-east	corridor floor	last 18 in. before each unit door	door-swing privacy
amenity-gym-01	entry vestibule	locker bay arc	expectation of privacy
mail-room-01	access aisle	box face plane	contents privacy
pool-deck-02	gate area	deck and water (08:00 to 22:00)	tenant hours, state-specific
parking-1-rear	lot interior	sidewalk strip beyond fence	public right-of-way

The verification step on day one is a walk-through. For each excluded zone, point a person at the area and watch the dashboard. If a detection fires inside an excluded polygon, the polygon is wrong and the install tech fixes it before they leave. The exclude pass should generate zero detections by design. This is a five-minute walk and it is the difference between a deployment that is responsible by geometry and one that is responsible by assertion.

6. The tenant notice and what it actually says

The notice does four things. It tells tenants AI-assisted monitoring is in use on common areas, that footage is processed on a device at the property and not uploaded to a cloud, what the retention window is in plain English, and who to contact with a question. The signage at every property entry mirrors the second and third lines. Together those make the deployment defensible if a tenant raises a concern in a leasing review or a city housing board sends a letter.

This property uses advanced AI security technology to keep our community safe. Cameras may be recording in common areas. For more information, contact the leasing office.

Does not say where footage is processed; tenant assumes cloud.
Does not state a retention window.
No tenant point of contact for an access request.
Does not exclude the inside of units explicitly.
Reads like marketing, not policy.

A tenant who only ever reads the sign by the front door should be able to tell from those two lines that frames stay on site and the window is finite. That is the bar. Anything less concrete is a vendor brochure pasted on a wall.

7. What happens at a management transition

Properties change hands. Management companies turn over. A responsible deployment has a 30-minute handoff job that exports what the new owner needs, transfers any clips on hold for active investigations, and wipes the rest. The alternative, which is common, is that a unit accumulates years of footage that nobody owns and nobody can defend, and the next discovery motion finds it. The job is not glamorous, and it is the most consequential piece of operational hygiene in this category.

The handoff job, in three steps

Export the structured event log (outbox.ndjson) and the access log (access.ndjson) for the agreed window, typically the last 12 months. Hand them to the new owner as files.
Bundle any clip on litigation hold or tied to an active investigation; transfer those out of band. Document each one in the export manifest.
Run the wipe pass: unlink every non-hold clip, truncate the audit files past the export window, rotate every operator token. New owner gets a clean device with their own tokens and their own retention config.
Document the export and the wipe in writing. Both parties keep a copy. The old owner has a defensible record of what was handed off and what was deleted.

On an edge unit this works because the data the device holds is the data that exists, full stop. There is no parallel cloud archive that persists past the handoff. On a cloud product the wipe is a cross-vendor request and the window in which old footage might still exist somewhere is a function of contracts, not of code. That difference is the cleanest reason to put inference on the device for a residential property.

What to ask any AI camera vendor on day one

Five questions that separate vendors who have shipped a real deployment from vendors who are reselling a brochure. None are gotchas. They are the questions a property attorney or an insurance adjuster will ask within a year of any incident.

Where does inference run? A real answer names a chip on the device and a process. A non-answer is the cloud or our platform.
What is the file path of the audit trail and can I tail it? A real answer is a path. A non-answer is a UI screenshot of an activity feed.
What is the default clip and metadata retention, and where do I change it? A real answer is a config file with a number. A non-answer is contact support.
What is in the exclude polygon for a hallway camera by default? A real answer describes the polygon. A non-answer is we will work with you on that.
What does the management transition job look like? A real answer is an export plus a wipe with a documented manifest. A non-answer is we will help if needed.

A vendor who answers all five with file paths, config flags, and concrete numbers has built something a property operator can verify. A vendor who answers with adjectives is selling a posture, and the posture is what you will be holding in your hand the first time a tenant asks a hard question.

See a real edge AI install, file by file

10 minutes on a call. We will tail outbox.ndjson and access.ndjson on a deployed unit, walk through the retention config, and show the exclude polygon walk-through on a hallway camera. No screenshots, just the actual files.

Specific questions, specific answers

What does responsible AI camera deployment actually mean on a property, in concrete terms?

It means the answer to seven questions is decided at install, not assumed at procurement. Where do video frames live (on the device or in a cloud bucket). How long does anything persist (retention window in hours or days, written into a config file). What is searchable and by whom (operator role, not a single shared login). What is logged when an operator pulls a clip (an audit row, not a vague access log). What is never recorded (zones the polygon explicitly excludes, like the inside of a unit door). What gets shared with the police on a subpoena (the clip and metadata, not the live feed). And what happens to all of this when the property changes management (a documented data export and wipe). On a Cyrano retrofit those answers are files on the device. /var/lib/cyrano/meta/outbox.ndjson holds the alert audit trail. /var/lib/cyrano/clips/ holds the rendered clips with a retention sweep. The zone JSON holds the exclude polygons. None of those are screenshots, they are inspectable artifacts.

Why does where the model runs matter for tenant privacy, not just for marketing?

Because the model location decides whether a video frame ever leaves the property. A cloud-only product encodes every camera frame, ships it over the network to a remote inference cluster, and depends on someone else's logging, retention, and access policy to decide what happens next. Responsibility for the frame is now split across vendors, contracts, and a network you do not control. An edge product runs the perception, state, and planner tiers on a unit at the property, so the frame is processed in the same physical room as the DVR. The only outbound traffic is the alert text, the structured metadata, and a clip URL that an authorized on-call can tap. Frames stay local unless the on-call explicitly serves one. That is a structural difference, not a wording difference, and it is the cleanest way to satisfy a tenant communication that says we do not upload your hallway to a third party.

What zones should be in the exclude polygon, and how do I confirm they are excluded after install?

Inside a tenant unit door, regardless of whether the camera can see the inside (it usually can a few inches in when the door swings). Bathrooms and locker rooms in shared amenity spaces. Pool areas during designated tenant-only hours if state law treats those as private. Mailbox interiors. Anywhere a state or municipal statute marks as expectation-of-privacy. To confirm exclusion after install, open the zone JSON on the device (the file holds an array of zone objects with a polygon field and an exclude flag) and walk the property with the install tech. For each excluded zone, point a person at the area and watch the dashboard. If a detection fires, the polygon is wrong. The exclude pass should generate zero detections. This is a five-minute walk-through and it is the difference between a deployment that is responsible by design and one that is responsible by hope.

How long should clips and metadata persist, and what is the right way to think about retention?

Two clocks, not one. Clip retention is a function of how often you actually pull a clip for an investigation. On a 180-unit multifamily we typically configure 30 day clip retention with an automatic sweep that deletes anything older. Metadata retention (the alert rows in outbox.ndjson, with no video, just the structured fields) we configure for 365 days because the rows are tiny and useful for trend reports to ownership and insurance. The retention sweep is a cron-like job on the unit that walks the clips directory once a night and unlinks anything past the window. After the sweep runs, the clips are gone from the device disk. There is no cloud copy to forget about. If a police subpoena arrives 60 days after an incident, the clip is no longer on disk and you say so on the record. That is the responsible answer. The irresponsible answer is a 5-year cloud archive that nobody knows exists until a discovery motion finds it.

Who can pull a clip, and how is that access actually controlled in practice?

Three operator roles on a typical property. On-call (can view alerts and pull clips during their shift, write access to the outbox audit trail), property manager (can view alerts and pull any clip during business hours, can change zone polygons), and admin (can change retention settings, change dispatch tree, add or remove operators). Each role is a token, not a shared password. Every clip pull writes a row to a separate audit file (/var/lib/cyrano/meta/access.ndjson) with the operator id, the alert id, the camera, the zone, and the timestamp. That audit file is where you go when a tenant asks who looked at the lobby footage at 2 AM last Tuesday. A vendor that cannot produce that file on request is selling an access policy that does not exist.

What does responsible deployment look like for tenant notice and signage, and why is the wording specific?

Notice has to say four things to be defensible. First, that AI-assisted monitoring is in use on common areas (not the inside of units). Second, that footage is processed locally on a device at the property and not uploaded to a cloud. Third, the retention window in plain English (clips up to 30 days, structured event logs up to one year). Fourth, the property contact for a tenant who wants to ask a question or request access to a clip that involves them. The signage at every entry should mirror lines two and three because tenants who only ever see the sign should still know that frames stay on site. None of this is gold-plating. It is what makes the deployment defensible if a tenant raises a concern in a leasing review or to a city housing board. We have a sample notice and a sample sign in the dashboard, and we customize them per state.

What about facial recognition? Should an AI camera system use it on a residential property?

On residential multifamily, no. The reason is not that the technology is bad, it is that facial recognition introduces a separate body of law (BIPA in Illinois, similar statutes in Texas, Washington, and other states) and a separate consent regime (biometric data, opt-in, retention rules, deletion rights), and the operational lift to comply is significant. The detections that actually drive incident reduction at a 180-unit property are person, vehicle, package, and dwell, none of which require identifying who the person is. We deliberately do not run face recognition on the perception tier. The dashboard says masked man near gate as a description, not a name. If a property has a specific reason for face recognition, like a gated community with a known-resident allow list, that is a separate conversation with separate consent flows and a separate per-property opt-in, and it does not happen by default.

What goes on the audit trail, and what does an honest audit row look like?

Two trails. The alert trail (outbox.ndjson) records every detection that crossed dwell and was promoted to an alert, with the camera, zone, dwell, threat level, and clip path. The access trail (access.ndjson) records every operator action that touched a clip or a config: who looked at what, who changed which polygon, who edited retention. Both files are append-only and live on the device disk. The honest audit row is the row that exists when nothing happened: the operator who never looked at a clip during a quiet shift produces no rows, which is the right answer. The dishonest version is a vendor that says we log everything but cannot produce a row for a specific request because the log is in a cloud system the property does not control. On a Cyrano unit you can tail both files on a console.

What changes when a property changes management or sells? How do you not leave a data trail behind?

A documented data handoff. Three steps. Export the metadata audit trails (outbox and access ndjson) for whatever window the new owner needs, usually 12 months. Render and bundle any clips that are tied to open incidents or pending litigation hold, and transfer them out of band. Then run a wipe pass on the device that unlinks every clip, truncates the audit files past the export window, and rotates the operator tokens. The new owner gets a clean device with their own tokens and their own retention config. The old owner has a documented export and a documented wipe. We do this on every management transition because in the absence of a policy, devices accumulate years of footage that nobody owns and nobody can defend. The handoff is a 30 minute task; not having one is a years-long liability.

How do I tell a responsible AI camera vendor from one that is just selling marketing language?

Five questions. Where does inference run, on the device or in the cloud (a real answer names a chip and a process). What is the file path of the audit trail (a real answer is a path; a non-answer is a UI screenshot). What is the default retention for clips and for metadata, and where do I change it (a real answer is a config file; a non-answer is contact support). What is on the exclude polygon for a unit-door camera by default (a real answer describes the polygon math; a non-answer is we will work with you). What happens if the cellular link drops for two hours during an incident (a real answer is the alert lands locally and replays in order on reconnect; a non-answer is the cloud handles failover). A vendor who answers all five with file paths, config flags, and concrete numbers has built a system you can verify. A vendor who answers with adjectives is selling a posture.