Short answer: Treat a VMS like any other server software that holds sensitive data, because that is what it is. The ten questions below separate products built for an IT department from products built for a camera installer. Ask them before the demo, and ask for the answers in writing.
1. Where does the footage live, and who can reach it?
The first question is data residency. Does video stay on a server you control, or does it go to the vendor’s cloud, and in which country? If the vendor can reach the footage for support, how, and is that access logged? For a self-hosted product the answer should be “on your disks, and we cannot see it”. For cloud, get the region and the sub-processor list.
2. Is everything encrypted in transit?
Three hops matter: camera to server, server to client, and server to anywhere else. Camera-to-server is usually plain RTSP on the LAN, so ask whether the vendor expects cameras on a separate VLAN. Server-to-client should be HTTPS or equivalent for both the console and the video, including live video, not only the login page. Ask which ports are used and whether any of them must be open to the internet. The right answer is none.
3. Is there an audit log, and what is in it?
Who added or removed a camera, who exported footage, who created or changed a user. If the product cannot show you that, it cannot support an investigation or a data-protection request. Ask whether the log is tamper-evident, how long it is kept and whether it can be shipped to your SIEM.
4. Can users sign in with our directory?
SAML 2.0, LDAP or Microsoft Entra ID. The point is not convenience; it is that a leaver loses access to cameras on the same day they lose their email. Ask how directory groups map to roles and whether there is a local break-glass account for when the directory is unreachable.
5. How are updates delivered and signed?
Updates are code that runs on a server with access to your cameras. Ask how you verify an update is genuinely from the vendor, whether you can apply it on your own schedule, and what the rollback is. An update that is one signed file replacing another is easy to reason about. An installer that fetches components over the internet at install time is not.
6. Does it work offline?
Not “does it record when the internet drops” but “does it run, indefinitely, on a network with no route out”. Licence checks, analytics and mobile apps are the usual dependencies. Sites that must be air-gapped need a clear yes.
7. Which cameras does it support, and which does it prefer?
A VMS that supports ONVIF Profile T and plain RTSP will take cameras from Axis, Hanwha Vision, Bosch, Vivotek, i-PRO, CP Plus, Sparsh, Matrix Comsec, Honeywell and most others. One that works best with its own cameras, or that charges extra per third-party camera, is a lock-in disguised as a feature. Ask what happens to features such as search or analytics with a camera from another maker.
8. What is the licensing model, exactly?
Per camera, per server, per user, per site, per year, perpetual with maintenance, or a mix. Ask what happens at renewal if you do not renew: does the software stop, stop accepting new cameras, or carry on without updates? Ask what a camera count change costs mid-term. Ask whether the licence needs an online check.
9. How do we leave?
Assume you will replace the product in five years. Can you export all footage as standard MP4 files, with timestamps, without the vendor’s player? Can you export the configuration (cameras, users, layouts) in a readable format? Does the vendor charge for either? A product that is hard to leave is hard to negotiate with.
10. What does support actually look like?
Hours, channel, response time, and whether support staff need remote access to your server. Ask who writes the software and whether you can talk to them. Ask for the security contact and how vulnerabilities are disclosed. Ask what the last three releases fixed.
Putting it together
Score each answer as clear, vague or missing. Vague on data residency or audit logging is a no; everything else is a negotiation. Request a pilot on your own hardware with your own cameras before a purchase order, because a demo on the vendor’s laptop answers none of the ten.
Where Supervision fits
Supervision’s answers, briefly: footage stays on your server and we cannot see it; HTTPS on port 8443 for console and video, with a self-signed certificate the desktop app pins on first connect, and nothing opened to the internet; an audit log of camera changes, exports and user changes; SAML 2.0, LDAP and Microsoft Entra ID sign-in with roles from owner to viewer; a single Go binary you replace to upgrade; full offline operation; any ONVIF or RTSP camera; pricing quoted per deployment; MP4 export of incidents; and pilots on your hardware. The detail is on the security page and the procurement section of the enterprise page.
Supervision is self-hosted video management software for any camera brand. If this is the kind of problem you're solving, tell us about your cameras and we'll talk it through, or email hello@bipolarfactory.com.