C
Cyrano Security
14 min read
Small Claims Field Guide

A security deposit dispute almost never turns on move-in photos. It turns on five exterior-camera fact patterns the rest of the internet ignores.

Every guide on the phrase security deposit rental property stops at the same three bullet points: know your state deadline, itemize deductions, take photos at move-in. Useful, but it leaves out the footage question entirely. This guide is about the five recurring fact patterns that decide small-claims deposit cases, the seven clip-level fields a judge will actually accept, and how an edge AI index against the DVR already in the leasing office closes the evidence gap in under a minute.

Walk a live deposit-dispute retrieval on your DVR
4.9from 50+ properties
Five deposit-dispute fact patterns exterior cameras actually answer
Seven evidentiary fields every clip needs to carry into small claims
Under 60 seconds from plain-English query to candidate clip list
$450 one-time hardware, $200/month software, no camera replacement

The five fact patterns exterior footage has to answer

01 / 05

1. The move-out date the tenant claims vs the date the keys came back

Exterior cameras establish the last track of the tenant or their vehicle. A four-day delta on a monthly rent is a four-digit deduction.

What every SERP result on this phrase leaves out

Search the exact phrase security deposit rental property and you get the California Courts self-help guide, the Massachusetts attorney general, the Texas State Law Library landlord-tenant chapter, a Nolo small-claims walkthrough, a FindLaw explainer, and four property-management blogs. Every one of them lists the same things. State-by-state timelines. What counts as normal wear and tear. A line about photos at move-in and move-out.

None of them answer the question a property manager actually has the week after move-out, which is: when the tenant disputes line item three on the itemized statement and the case is headed to small claims, what evidence will the judge find persuasive, and how do I pull it from the DVR in the leasing office before my state's deadline runs out?

The answer is specific. It is a clip on a named camera, at a timestamp tied to a trusted clock, showing a per-person dwell record in a zone that maps to a line on the statement. It is not a two-hour raw export from channel five. The rest of this page is the field-level specification of that clip, the five fact patterns it has to cover, and the retrieval workflow that lets a leasing office produce it without a contractor.

The five fact patterns, mapped field by field

What each pattern proves, and which event fields carry it

1

1. Move-out date vs keys-returned mismatch

The tenant claims to have moved out on the 28th and paid through the 30th. The office says keys came back on the 2nd. The four-day delta drives a rent deduction. Fields that resolve it: synced timestamp on the last track of the tenant or their vehicle at the parking camera, plus camera identifier tying the track to the building. Cyrano writes trusted_source=ntp_pool to the payload so the defense that the DVR clock was wrong is neutralized.

2

2. Guest or resident? Attribution for common-area damage

Someone kicked in the interior mailroom door between Friday 9pm and Saturday 2am. The tenant says it was not them and has an alibi. Fields that resolve it: track_id across consecutive events, dwell_seconds at the mailroom zone, thumbnail of the person entering the zone. A small-claims judge can read four thumbnails in ten seconds and see whether the tracked figure matches the tenant, a named guest, or a delivery driver.

3

3. Abandonment, defended by consecutive days of no track

The landlord withholds the deposit against two months of unpaid rent on the theory the unit was abandoned on the 15th of May. The tenant says they never abandoned. Fields that resolve it: an event_class filter for resident tracks, run across the 30 days preceding the claim, producing a day-by-day count of confirmed track appearances. Seven consecutive zero-track days at a named entry zone is a strong abandonment fact set, stronger than the absence of mail pickup or utility usage.

4

4. Large-item move damage at hallways and loading areas

Two feet of drywall on the third-floor hallway needs repainting. The deduction is $480. The tenant denies the couch did it. Fields that resolve it: loitering_dwell_exceeded at a hallway zone on move-out day, track_id tying the event to an entry through the front door 90 minutes earlier, thumbnail of the couch. That is a packet the leasing office can assemble in six minutes.

5

5. Pre-existing damage predating lease commencement

The tenant says the carpet stain was there before move-in. Fields that resolve it: a query for the same apartment door or hallway during the 14 days before lease commencement, returning any tracks and timestamps. If there is a pre-lease tenant track at the door on a date a professional cleaner was on site, the landlord has evidence the carpet was cleaned between tenancies; if nothing shows, the tenant's claim stands. Either way, the timestamp has to be trusted, or the entire exercise collapses.

How the evidence flows from the DVR to the small-claims packet

The itemized statement is the spine. The DVR is the source. The Cyrano unit is the indexer that makes the source navigable. The packet the property manager hands to the small-claims clerk is the DVR's own clip export with the seven-field payload attached as a sidecar.

From DVR HDMI out to the deposit-deduction evidence packet

Existing DVR
Itemized statement
Tenant dispute letter
Natural-language query
Cyrano edge AI
Synced timestamp
Camera + zone
Per-person dwell
Clip export

A real retrieval, for a hallway scuff dispute

Below is a lightly redacted log from a Cyrano unit on a 125-unit property in the days before the itemized statement deadline. The property manager has a $480 hallway repaint deduction and the tenant has disputed it. The clerk pulls the clip, attaches the payload, and hands the packet to the attorney.

cyrano query, 16-ch DVR, 125-unit property, deposit dispute pull

The retrieval delta, measured

0sseconds, natural-language query to candidate list
0hhours, manual DVR scrub for a comparable window
0camera feeds indexed per unit
0dday California deadline to return deposit or itemize

On a 16-to-25 camera property. The bottleneck on deposit cases is never whether the footage exists. It is whether the property can retrieve it, timestamped and zone-labeled, before the statutory deadline on the itemized statement runs out.

What a small-claims judge actually sees, with and without an index

The courtroom view of the evidence packet

The landlord hands the clerk a USB drive and an itemized statement. The drive contains three hours of 16-camera multiview export with no zone labels. The DVR clock is eight minutes slow. The tenant's attorney asks which camera shows the specific hallway, and the witness has to narrate the DVR's UI from memory on the stand.

  • Un-searchable raw DVR export
  • No zone labels on any clip
  • DVR clock drifted, not NTP-synced
  • No per-person dwell record
  • No per-track attribution across cameras

The seven payload fields, mapped to deposit fact patterns

Synced timestamp: proves move-out date, rebuts drift defense

Every Cyrano event carries an NTP-synced timestamp plus the DVR's reported offset. The defense that the DVR clock was wrong is neutralized on the face of the payload. For fact pattern one (move-out date vs keys returned) and fact pattern five (pre-existing damage), this field is the whole case.

Zone label: proves the clip matches the statement line

Zones are drawn at install to match the words the property uses in itemized statements. A line that reads hallway-3rd-floor-north is proven by a zone labeled the same way. No translation step at trial.

dwell_seconds: distinguishes transient from deliberate

A 4-second walk-through and a 182-second loiter read very differently. The dwell field decides how much weight the judge gives the clip without watching it in full.

track_id: proves guest-vs-resident attribution

When two tracks need to be correlated across cameras (front entry to elevator to hallway), the track_id is the glue. This field is the core of fact pattern two, guest vs resident attribution for common-area damage.

event_class: proves the clip passed the filter stack

The event class names which filter fired, pre_action_zone_entry or loitering_dwell_exceeded, so the reviewer knows this is a delivered event and not raw noise. A delivered event has evidentiary weight the raw feed does not.

layout_id: proves the zone geometry was correct at capture

DVRs switch from multiview to fullscreen during operator drill-ins. The layout_id locks the pixel-to-world mapping at capture time. Without it, a defense attorney can challenge whether the pixel the track occupied was inside the polygon cited on the event.

Tile thumbnail: closes triage in ten seconds

Cropped to the specific camera tile where the track lived, not the full multiview. The judge, the clerk, and opposing counsel can each read the thumbnail in isolation.

Seven fields, one payload, no vendor dashboard

Every field lives on the edge device as part of the same event record. The audit is against the on-device index. No cloud portal has to be up for the packet to be retrieved or verified.

The evidence packet today, vs the evidence packet with an indexed DVR

FeatureBare DVR, manual scrubCyrano-indexed DVR
Time to assemble packet for one line item3 to 5 hours of staff timeUnder 10 minutes, index-backed
Query interfaceDVR timeline scrubber, per-channel replayPlain English, natural-language search
Clip timestamp trustDVR clock, often minutes driftedNTP-synced + DVR delta recorded
Zone label on clipHandwritten by reviewer, or absentTied to install-time zone names
Per-person attributionRequires manual re-watch and notestrack_id across correlated events
Per-tile thumbnail for triageNone; full-multiview JPEG at bestCropped thumbnail on every event
Hits statutory deadline on 100 unitsFragile during high-turn monthsThroughput supports 100+ move-outs per cycle
Hardware and setupExisting DVR, no change$450 one-time, plugs into HDMI out of DVR
Ongoing costNone incremental$200/month per property

Two things most property managers assume exterior cameras cannot prove

Abandonment, without a notice-of-belief letter

Most state abandonment statutes require some affirmative showing of belief that the tenant has vacated, not a mechanical day-count. Seven consecutive days with no resident track at an entry camera, correlated against the tenant's known track from the month prior, is exactly the evidentiary posture that supports that belief. A Cyrano report across a 30-day window produces the day-by-day count without any manual effort.

Pre-existing damage, with a pre-lease timestamp

When a tenant argues that carpet, paint, or fixture damage predates the lease, the landlord's usual rebuttal is the move-in walk-through photos. Those can be attacked as cherry-picked or backdated. A trusted-clock timestamp on an exterior clip that predates the lease commencement date, tied to a professional cleaner's entry at the apartment door, is a harder piece of evidence to dispute.

The packet-ready workflow, end to end

From itemized statement to small-claims clerk, in one afternoon

  • Open the itemized statement, identify contested line items by zone (hallway, loading dock, mailroom, front entry)
  • Pull the disputed time window for each line from the tenant's response letter
  • Run a plain-English query per line (for example, person moving couch third-floor hallway April 4th 5 to 8 pm)
  • Sort candidate events by dwell_seconds descending; loitering events rise to the top
  • Open top two thumbnails, confirm the subject matches the tenant, note the track_id
  • Pull any correlated tracks for the same track_id from entry cameras earlier the same day
  • Export the underlying DVR clip for each matched track_id with the seven-field payload attached as a sidecar
  • Cross-check zone_label against each line item on the statement; confirm timestamp is inside the disputed window
  • Attach to the small-claims packet alongside the statutory photo set and the itemized statement
  • Send to counsel or file directly, before the statutory return-or-itemize deadline

DVRs and NVRs this workflow already runs on

Hikvision DS series
Dahua XVR and NVR
Lorex LNR and LHD
Swann DVR and NVR
Uniview NVR
Night Owl DVR
Annke NVR
Reolink NVR
Amcrest NVR
Q-See and rebrands

Device agnostic. Any DVR or NVR driving a multiview over HDMI is a supported source. That covers most consumer and property-grade recorders installed in Class B and Class C multifamily in the last decade.

A property-side operator and an evidence-focused reviewer. Cyrano pays neither.

Who wrote this

CS

Cyrano Security

Product team, edge AI for property DVRs

Ships the on-device index and event payload described on this page. Deploys against existing DVR HDMI out on 50+ multifamily properties.

OR

Operations reviewer

150-unit Class B portfolio, Fort Worth

Runs deposit returns and itemized statements monthly. Reviewed the five fact patterns on this page against 18 months of small-claims pulls.

ET

Evidence technique reviewer

Landlord-tenant practice, small claims

Reviewed the seven-field payload and zone-label guidance for alignment with ordinary-course-of-business records and authentication standards in small-claims court.

5 fact patterns

A small-claims deposit dispute is not decided by whether the property had cameras. It is decided by whether the clip pulled from the DVR carries a trusted timestamp, a zone label that matches the line item on the itemized statement, a per-person dwell record, and a track_id that ties together the events across cameras. Five fact patterns account for the contested dollar volume. Seven fields close each one out. If the event payload carries them, the packet is small-claims ready.

Cyrano field notes, multifamily property portfolio, 2025 to 2026

Run a deposit-dispute retrieval on your own DVR

Book a 15-minute demo. You will pick a fact pattern, type a plain-English query into a live Cyrano unit reading a production DVR, and pull a candidate clip with the seven-field payload attached, in the shape a small-claims clerk can accept.

Book a demo

Security Deposit Rental Property: Frequently Asked Questions

What does the phrase security deposit rental property actually cover, legally?

At the state-law level it refers to the money a landlord holds during a tenancy to cover unpaid rent, cleaning beyond normal wear and tear, tenant-caused damage, and in some states unpaid utilities. Every state has its own statute and its own deadline for returning the deposit or itemizing deductions. California's Civil Code section 1950.5 requires the landlord to return the balance and a written itemized statement within 21 calendar days of move-out. Massachusetts sets 30 days. Texas sets 30 days from the tenant's forwarding-address notice. The deadlines and line-item rules are the easy part. The hard part is what happens when the tenant disputes the itemized statement and the case goes to small claims. At that point every claim in the statement needs documentary support, and if the evidence is a cell phone photo with no metadata and a receipt from the paint store, the claim is vulnerable to a rebuttal. That is where exterior property cameras, and specifically the fields carried on each clip, start to matter.

My cameras are only in the parking lot and hallways. They do not cover inside the unit. Why does that footage matter for a deposit dispute?

Because most contested deposit cases are not actually about interior damage a tenant denies causing. They are about five recurring fact patterns that live entirely outside the unit. Fact pattern one, the tenant claims they moved out earlier than the landlord's move-out date. Exterior cameras can establish the last time the tenant, their vehicle, or their guests were tracked entering or leaving the building. Fact pattern two, the landlord attributes common-area damage to the tenant and the tenant says a guest or a delivery driver caused it. Per-person track records tied to the camera that captured the damage window resolve the attribution. Fact pattern three, the landlord claims abandonment and withholds the deposit against unpaid rent. Multiple consecutive days of zero resident tracks, tied to an existing lease, is exactly the evidence that supports an abandonment finding. Fact pattern four, large-item move damage (couches scraping hallway paint, appliances gouging elevator thresholds). A loitering-dwell alert at a loading-dock or hallway zone with a matched thumbnail identifies when and by whom. Fact pattern five, the tenant claims damage pre-existed the lease and the landlord rolled it into the deductions. A timestamped exterior clip predating the lease commencement date is the strongest available rebuttal or support. None of these five require interior cameras. They require exterior cameras with a searchable index and clip metadata a judge will accept.

What metadata does a clip need to carry to be admissible and persuasive in a small-claims deposit dispute?

Seven fields. A frame-level timestamp synced to a trusted clock source, not the DVR's internal clock which has usually drifted by the time the dispute reaches court. A camera identifier, because the zone the clip shows must match the line item on the itemized statement. A per-person dwell_seconds value, because transient passage and 90-second loitering read very differently to a small-claims judge. A zone label tied to a named place the statement references (loading-dock, hallway-3rd-floor, mailroom, front-entry). An event_class naming which filter fired (pre_action_zone_entry, loitering_dwell_exceeded). A layout_id capturing what DVR view was active at capture, because multiview layouts shift pixel-to-world mappings. A tile thumbnail cropped from the multiview for triage. A Cyrano event payload carries all seven by default, emitted on-device from the HDMI out of whatever DVR the property already owns. If the clip goes to small claims without those fields, the landlord's attorney or the tenant's attorney has to reconstruct them by manual review, which the courts increasingly expect as contemporaneous records.

Does exterior camera footage actually hold up as evidence in small-claims deposit cases?

Yes, provided authenticity and chain of custody are established. The rules of evidence that govern small-claims court admit video if a witness can testify to when the recording was made, what system made it, and that the recording fairly represents what it purports to show. The landlord or property manager who supervises the DVR is the standard authentication witness. The practical weakness in most cases is not admissibility, it is credibility: a multi-hour scrub clip with an obviously wrong timestamp, pulled from a DVR whose clock was never synced, opens an attack surface for the other side. The Cyrano event payload carries the DVR's reported time and Cyrano's own clock-synced time side by side in the payload, so even if the DVR clock was drifted at capture, the trusted timestamp is recorded and the delta is documented. Judges and opposing counsel treat this the same way they treat any ordinary-course-of-business record.

How long does the footage retrieval actually take, compared to what a property manager does today?

The target retrieval band on a Cyrano-indexed DVR is under 60 seconds from plain-English query to a list of candidate clips with the seven-field payload attached. The comparable workflow on a bare DVR is to scrub the timeline camera by camera in a 48-hour window, which typically runs 4 to 6 hours per property staff member on a 16-channel recorder. For deposit disputes specifically, the retrieval time matters because the landlord's deduction letter has a statutory deadline (21 days in California, 30 days in Massachusetts and Texas, varying in other states) and the evidence has to be assembled inside that window. Missing the deadline, or returning an itemized statement whose specific line items cannot be supported by pulled footage, is how landlords lose otherwise-valid deduction claims.

What does Cyrano actually cost, and what hardware does it need to run?

Hardware is a one-time $450 per property. Software is $200 per month per property. One unit supports up to 25 camera feeds and plugs into the existing DVR or NVR over HDMI in under two minutes. No camera replacement, no RTSP, no ONVIF discovery, no network re-architecture. The device reads the composite multiview the DVR is already sending to the guard monitor and runs per-tile detection with the filter stack on-device. Footage does not leave the property. For context, one contracted security guard to cover a single portfolio property usually runs $3,000 to $5,000 per month per post. The deposit-dispute use case is not the primary purchase justification for most properties; it is a recurring second-order benefit for any landlord or property manager who runs multiple deposit deductions per year.

What if the property does not have any cameras covering the specific line item on the itemized deduction statement?

Then exterior-camera footage cannot help with that specific line item. The five fact patterns listed on this page are the ones that map cleanly onto cameras most multifamily properties already have (parking lots, building entries, hallways, mailrooms, loading areas, elevator vestibules). If the deduction is for a burn mark on a bedroom carpet, no exterior footage will address it; the landlord defends or the tenant attacks that line with move-in photos, move-out photos, and walk-through video. The point of this guide is not that every deduction is defensible by camera, it is that five specific recurring disputes are, and those five account for a disproportionate share of the contested dollar volume in small claims.

Does this workflow change in the states with strict photo-documentation rules (for example California's 2025 requirement)?

It strengthens the workflow in those states. California's updated rule, effective 2025, requires landlords to include photographs at move-in, before repair work, and after repair work as part of the itemized statement for deductions over $125. Exterior-camera footage complements this, it does not replace it: the move-in and post-repair photos address interior and fixture condition, the exterior footage addresses the five move-out and common-area fact patterns that are typically the source of disagreement. A landlord who supplies both the statutory photo set and a short exterior clip with the seven-field payload for a contested line item is operating well above the evidentiary floor most small-claims judges see.

Is a natural-language query search over security footage actually reliable enough to build an evidence packet around?

The natural-language layer is a retrieval tool, not a substitute for the DVR recording. When someone types a query like man with a brown couch at the loading dock April 4th between 5 and 8 pm, Cyrano returns candidate clips drawn from the DVR's own recorded feed with the full seven-field payload attached. The exported clip is the DVR's native file or a frame-accurate transcode of it, not an AI-generated reconstruction. The AI layer narrows the search from tens of thousands of frames to a short candidate list. The evidentiary chain terminates at the DVR's own recording, which is the same chain courts already accept in trespass, burglary, and landlord-tenant evidence. Nothing about the retrieval method changes the admissibility of the source recording.

Can tenants use this same evidence approach to challenge a deposit deduction?

Yes, if the tenant can get access to the footage. The practical barrier is that the DVR is on the landlord's property and under the landlord's control. In a jurisdiction where a tenant has a pre-filing right to request evidence, or once a small-claims case is filed and discovery opens, the tenant's written request for a specific time window and camera is what triggers the pull. A property on a Cyrano-indexed DVR can respond to that request in minutes rather than days, which reduces the tenant's cost of proof. The guide here is written from the landlord and property-management perspective because they are the Cyrano customer, but the evidentiary asymmetry the index removes is, in net, pro-evidence for both sides.

🛡️CyranoEdge AI Security for Apartments
© 2026 Cyrano. All rights reserved.

How did this page land for you?

React to reveal totals

Comments ()

Leave a comment to see what others are saying.

Public and anonymous. No signup.