Short answer: An air-gapped VMS records, plays back and searches footage on a network with no route to the internet. Most video software can do the recording part offline. What usually fails is everything around it: licence checks, update downloads, time sync, cloud analytics and vendor remote support. Plan for those five things and an offline server room is unremarkable to run.
Why run surveillance with no internet?
Some sites are air-gapped by rule: defence establishments, power plants, data halls, research labs, courts and some factories. Others choose it because the camera network is the most attackable thing in the building. A camera with a default password and a route to the internet is how a surveillance system ends up in a botnet. Taking the route away removes the whole class of problem.
The cost is that nothing on that network can ask the outside world for anything. That is where typical products stumble.
What stops working offline
- Licence checks. Many VMS products phone home on start, on a schedule or every time a camera is added. Some fail closed after a grace period of 7 to 30 days. Ask which.
- Updates. An “update now” button that downloads from the vendor does nothing. You need updates as a file you can carry in on removable media, with a way to verify it is the vendor’s file.
- Time sync. Cameras and servers default to public NTP pools. With no route out, clocks drift, and after enough drift ONVIF logins fail and timelines stop matching across cameras.
- Cloud analytics. Person detection, plate reading and “search by description” that run in the vendor’s cloud simply stop. Only analytics that run on your server survive.
- Remote support and relays. Vendor remote sessions, mobile apps that connect through the vendor’s relay and email alerts through the vendor’s mail service all need the internet.
- Browser-loaded assets. A surprising number of web consoles load fonts, maps or scripts from a CDN. Offline, the page half-renders.
Planning a server room with no internet access
Time. Put an NTP server inside the gap. A GPS-disciplined clock is the usual answer; a small appliance costs less than one camera. Point every camera and the VMS server at it. Check drift once a quarter.
Updates by file. Agree the procedure before go-live: the vendor publishes a signed package and a checksum, you verify both on a machine outside the gap, then carry the package in. Keep the previous version alongside so a rollback is a file swap. A VMS that is a single binary makes this a two-minute job; one that needs an installer, a database upgrade and a reboot makes it an afternoon.
Accounts. With no directory server inside the gap, the VMS must run on local accounts. If you do have an internal LDAP or AD, the VMS should bind to that over the local network without touching anything external. Either way, keep a local owner account whose password is held offline for the day the directory is unavailable.
Alerts. Camera-down and disk-full alerts need a local destination: an SMTP relay inside the gap, a syslog collector or simply the console in the control room. Confirm the VMS can send to a local address rather than only to the vendor’s service.
Certificates. A server that cannot reach a public certificate authority cannot renew a public certificate. Use a self-signed certificate the client apps pin, or an internal CA. Either is fine; what you want to avoid is a browser warning that staff learn to click through.
Hardware spares. No internet means no next-day shipping fix for a dead disk if the site is remote. Keep a spare disk and a spare camera on the shelf.
What to ask a vendor
- Does the software run with no internet connection at all, indefinitely, with no grace period?
- Is licensing tied to an online check, a hardware key or a file?
- How are updates delivered, and how do we verify the file is yours?
- Do any features (search, analytics, mobile access, alerts) depend on your cloud?
- Can the server take time from a local NTP source and the console load with no external assets?
- Can we export footage and configuration without your help if we stop using the product?
Get the answers in writing. “Works offline” on a datasheet often means “records offline for a while”.
Where Supervision fits
Supervision is a single Go binary with an embedded SQLite database, and it never dials out. Licensing is per deployment, agreed through contact, with no online check. Updates are a file you bring in and swap for the old one. AI search runs on your own server, so it works with no internet. Health checks run every 10 seconds against the cameras on the local network, and the desktop app pins the server’s self-signed certificate on first connect. Air-gapped deployments are described on the enterprise page, and the security design on the security page.
Supervision is self-hosted video management software for any camera brand. If this is the kind of problem you're solving, tell us about your cameras and we'll talk it through, or email hello@bipolarfactory.com.