The Camera System Handover and Privacy SOP

Purpose

A camera job is not finished when the picture looks good. If the recorder still answers to its default password, anyone on the network can watch the house. If the admin account belongs to the installer, the customer does not own their own video, and the dealer holds remote access to the inside of a home that nobody agreed to in writing. If a camera looks into the neighbor's bathroom window, the customer has a dispute and the dealer installed it. And if retention was never checked, the customer learns the recorder keeps four days when they need footage from last week. This procedure closes every video job the same way: credentials changed, ownership handed over, the dealer's access removed or consented to, retention proven, and every view checked against what it can see beyond the property line.

Scope

Covers the close-out of any residential or light commercial video job: recorder, IP cameras, video doorbells added on a security job, and the customer's app.

Does not cover recorder setup and recording schedules (see related: How to Set Up a Network Video Recorder and Confirm Retention), camera placement (see related: How to Plan Camera Locations on a House), or the wider ethics and law of what a customer may record (see related: Privacy of Cameras and Sensors You Install). The shop does not give legal advice on recording; it tells the customer the questions exist and who answers them.

Roles and responsibilities

Procedure

1. Change every default credential. The recorder, every camera that has its own login, and any doorbell or bridge get a new password that the customer types, at the length and character rules the maker sets. Cameras added to a recorder by its plug-and-play port often take the recorder's password; the tech confirms each camera's own login rather than assuming. Acceptance: the default credential is tried on each device and refused, and the customer's new one is accepted. Wrong looks like one camera still answering to the default on its own address; the stop rule is the job does not close until every device refuses it. Hazard: none at this step, done from a laptop or phone at ground level.

2. Make the customer the owner of the admin account. The recorder's admin account and any cloud or app account are registered to the customer's own email, and the customer sets the password. The tech's install login is deleted, or demoted to a non-admin user if step 3 keeps dealer access. Acceptance: the customer logs in as admin on their own phone, and the user list shows no admin but the customer. Wrong looks like the app account registered to the tech's work email so setup went faster; the stop rule is the account is transferred, or the device removed and re-added under the customer's account, before sign-off. Hazard: none, app work.

3. Remove the dealer's remote access, or document consent to keep it. Remote access is removed unless the customer wants the dealer able to log in for support. If they do, the handover sheet states the account name, what it can do (view live, view recordings, change settings), and how the customer removes it, and the customer signs it. Acceptance: either no dealer user exists, or a signed consent names the user and its rights. Wrong looks like a dealer account left in place because "we always keep one"; the stop rule is it is deleted on site. Hazard: none, app work.

4. Confirm retention, now and at the target date. At handover, the recorder's estimate of days stored, at the actual recording mode, bitrate and camera count, must meet or beat the retention the customer bought (see related: Recorder Storage Math: Bitrate, Days and Cameras). Because a new disk has no history, the office calls back on the day after the target is reached and the customer or tech reads the oldest recording on the timeline. Acceptance: estimate at or above the target at handover, and at the callback, the oldest recording at least as old as the target. Wrong looks like an oldest recording younger than the target at the callback; the stop rule is a tech adjusts recording mode or bitrate, or quotes more storage, and a second callback is set. Hazard: none at the estimate; a later visit that opens the recorder unplugs it before the disk bay is opened, and after power-up confirms every camera is recording again.

5. Check every view against the property line, with the customer. Walk each camera's live view with the customer. Where a view takes in a neighbor's windows, fenced yard, pool or the inside of their garage, re-aim the camera or apply a privacy mask in the recorder so that area is not recorded. Acceptance: each camera reviewed and initialed, with any mask noted. Wrong looks like a customer who wants the neighbor's side yard in view "because of the dog"; the stop rule is the shop does not aim a camera into a neighbor's private space, the customer may record their own property, and the disagreement is noted on the sheet. Hazard: re-aiming an eave camera is a ladder task, set on firm level ground at the angle the ladder's label shows, with any extension ladder tied off or footed, and the tech does not stand on the top three rungs.

6. Settle audio before leaving. Camera audio is off at handover unless the customer turns it on after being told that laws on recording conversations differ by state, with some requiring consent from everyone recorded, and that the question is theirs to take to their own attorney. Acceptance: audio state on each camera written on the sheet and the customer's initials beside the explanation. Wrong looks like a doorbell recording voices by default; the stop rule is that device's audio recording is switched off until the customer decides. Hazard: none, app work.

7. Train the customer and sign the handover. Show the customer how to find an event, export a clip to their phone, check the oldest recording, add and remove a user, and change the admin password. Acceptance: the customer exports one clip by their own hand and signs the handover sheet. Wrong looks like a customer who cannot find yesterday's recording; the stop rule is repeat the search with them until they can. Hazard: none, app work.

When the site does not fit the procedure. A customer who will not choose a password, or wants the same simple one on every device, is told plainly that the recorder is reachable from their network and app; the tech will not set a default or a shared shop password for them, and the refusal is written on the sheet. A light commercial job where employees are on camera adds questions the shop does not answer: notice to staff, whether a camera may cover a break room, and the rules many states have that bar video recording in restrooms and changing areas. The tech does not aim a camera into any such room, notes the owner's other choices on the sheet, and refers the owner to their attorney. A customer who is not home at handover gets no admin transfer by text: the visit is rebooked, because step 2 is done with the customer at the device.

The record this produces

The handover sheet, one per job, signed by the customer: every device with "default refused" ticked, admin owner named, dealer access removed or the signed consent, the retention estimate and target, each camera's view initialed with masks noted, audio state per camera, and the training items. The office stores it and runs the callback from it. When a customer or a neighbor later asks what a camera could see or who could log in, this sheet is the answer.

A worked pass

Six IP cameras and a recorder on a two-story house, retention bought at 14 days, continuous recording on two cameras and motion recording on four.

Step 1. Five cameras refuse the default. Camera 6, the backyard, still accepts it on its own address because it was added by IP rather than through the recorder's port. Changed. All six and the recorder refuse the default. Pass.

Steps 2 and 3. App registered to the customer's email; the tech's account deleted; the customer declines dealer access. User list: one admin, the customer.

Step 4. The recorder estimates 17 days at the settings in use, above the 14-day target. Callback set for day 15.

Step 5. The driveway camera takes in the neighbor's side window. The tech re-aims it lower on a footed extension ladder and adds a mask over the corner that still shows the window frame. Initialed.

Step 6. Audio off on all six and on the doorbell; customer initials the explanation.

Step 4 fails at the callback, day 15. The oldest recording is from day 4, 11 days old, not 14. The estimate assumed a quiet street; the customer's front yard camera has been recording a tree canopy in wind as motion all day, so that one camera is writing close to continuously and eating the shared drive. Stop rule taken: a tech visit narrows that camera's motion zone off the canopy and lowers its sensitivity, and a second callback is set for 14 days after the change. At that callback the oldest recording is 14 days old. Pass, both dates recorded.

References

• See related: Privacy of Cameras and Sensors You Install
• See related: How to Set Up a Network Video Recorder and Confirm Retention
• See related: Recorder Storage Math: Bitrate, Days and Cameras
• See related: The Recorder That Only Kept Four Days