Leo · 2026-10
In a hypothetical tender, a 30-bed clinic in Bavaria asked four integrators to quote 16 cameras and got four different answers to one question: how many days of footage the system should keep. Surveillance storage retention policy NAS planning exists to settle that before hardware is ordered, along with the second question those quotes dodged, namely where the footage physically lives. For European installers and system houses, local on-premises hardware keeps recordings inside the customer’s building, under the customer’s own access controls, rather than on a foreign cloud subscription. Below you will find retention tiers, a capacity formula, and the supplier questions worth putting in the tender file.
A retention policy is not just a number of days. It is a short written statement covering four points. How long each camera stream is kept. Who can review footage, and whether access is logged. How footage is deleted when the period ends. And which storage architecture holds it all.
Settle these points at quotation stage. When retention is left until after installation, the usual remedies are extra disks, more bays or camera re-recording, and each of those is cheaper to plan for on paper than to buy in a hurry.
If you are the IT manager at a 40-person firm tendering its first camera system, write the four points down as acceptance criteria. The winning bidder should answer each one from the equipment datasheet, not from a sales conversation.
There is no single EU statutory retention figure for private CCTV. The correct duration follows from the purpose of the system and the storage-limitation principle in GDPR, Regulation (EU) 2016/679, Article 5(1)(e): personal data is kept no longer than necessary for its purpose. In practice, projects typically land on short tiers.
| Retention tier | Typical use | Storage demand at 16 × 4 Mbps (formula estimate) | Notes |
|---|---|---|---|
| 7 days | Retail shrinkage review, small offices | ≈ 4.8 TB | Lowest cost; incidents usually surface fast |
| 14 days | Clinics and practices, logistics yards | ≈ 9.7 TB | Common middle tier for SME sites |
| 30 days | Public buildings, warehouses, car parks | ≈ 20.7 TB | Matches many tender templates |
| 90 days or more | Specific contractual or insurance duties | ≈ 62 TB | Justify the duration in writing, per purpose |
The storage demand column above assumes 4 Mbps streams and is a formula estimate, not a measured figure; recalculate it for your own bitrate before shortlisting drives. Before that, ask the vendor to confirm in writing which durations the firmware enforces natively; longer horizons remain possible on multi-bay hardware with larger drives.
The GDPR angle matters here in a specific way. Keeping footage for 90 days “just in case” is hard to defend when the stated purpose is intrusion detection. Keep the duration proportionate, and write the justification down. Where national supervisory guidance exists, for example the opinions collected by the European Data Protection Board, quote it in the tender file rather than paraphrasing it.
The storage demand column above comes from one formula, and it is simple enough to run in a tender meeting. Storage (GB) = cameras × bitrate (Mbps) × 86,400 × days ÷ 8 ÷ 1,000.
Take a hypothetical 16-camera site at 4 Mbps per stream with a 30-day policy. Per camera: 4 × 86,400 × 30 ÷ 8 = 1,296,000 MB, so 1,296 GB per camera per month. Across 16 cameras that is 20,736 GB, roughly 20.7 TB of live recording capacity. Any surveillance storage retention policy NAS you specify should absorb these numbers with margin.
The margin comes from two allowances most first-time buyers forget. RAID overhead: a 4-bay unit running RAID 5 gives roughly (n−1) drives of usable space: with four 8 TB drives as an illustrative choice, that is about 24 TB usable (3 × 8 TB), sitting above the 20.7 TB figure with roughly 3 TB of headroom. Growth headroom: if two more cameras are likely next year, price the third and fourth bays now rather than replacing the unit later. When the maths points to more than one tier of storage, our enterprise-nas-cold-data-storage“>enterprise cold data storage article shows how to separate recent footage from archive copies, and the sizing guide to nas-video-surveillance-retention-storage-sizing“>NAS for video surveillance retention covers the capacity side in more depth.
GDPR does not certify hardware, and no vendor badge changes that. What the regulation touches is where footage is processed and who can be compelled to hand it over. Under the US CLOUD Act (Public Law 115-141), data held by a US-jurisdiction provider can be demanded by US authorities wherever the servers sit. Footage that never leaves an appliance in the customer’s own server room is, in practical terms, data that a third party cannot surrender because it does not hold it.
For a clinic, a law practice, or a municipal building, that structural difference is often the deciding line in the tender. It also matters who can see the recordings day to day. One practical check to write into the specification: add an acceptance line asking the bidder to confirm per-account storage isolation in writing, so no single operator account can browse another’s footage. Whether that separation lives on shared hardware or separate volumes matters less than having it confirmed in the delivery documents.
Be precise in what you write into the contract. The defensible wording is “on-premises processing with audited local access”, not any claim of certification.
Consider a hypothetical 12-camera yard near Rotterdam shooting 6 Mbps streams at 14 days of retention. Option A is a per-camera monthly cloud subscription; footage sits in a foreign data centre, costs recur every year, and the data-processing agreement needs a lawyer’s review. Option B is a local appliance: one purchase, footage on-site, retention handled locally (confirm the exact behaviour in writing with the vendor).
Run the formula first: 12 × 6 × 86,400 × 14 ÷ 8 ÷ 1,000 gives roughly 10.9 TB of live recording, which two 8 TB drives in RAID 1 would not cover and four in RAID 5 would. Weighing the two options depends on what the operator values. Make the call checkable: take any quoted per-camera monthly fee, multiply by 12 cameras and by a 36-month horizon, and set that figure against the appliance quotation. Which side wins depends on the quotes in front of you; the structural points in Option B’s favour are the flat cost curve and footage staying inside the building, while recurring-cost sensitivity varies by organisation.
Every camera-side claim you intend to rely on should appear in the quotation documents, and the products/s1-security-kit“>woCyber S1 page is one place to start reading.
For the wider context on why local-first architectures are being specified in European tenders, our article on the eu-data-sovereignty-storage-appliance“>EU data sovereignty storage appliance goes deeper.
The network path comes first in most audits: cameras that connect over PoE to the recorder avoid Wi-Fi reliability problems and simplify the audit story, since footage lands on one device, and ONVIF support keeps the door open for any compliant camera later.
Drive resilience sits just behind. Mirroring (RAID 1) or single-parity RAID (RAID 5) keeps an array recording after one disk fails, which is the property the retention tiers rely on; it is array behaviour, not a vendor feature. Run the formula with your own drive size: for the 30-day tier above, four 8 TB drives in RAID 5 give roughly 24 TB usable (3 × 8 TB), an illustrative drive choice that sits about 3 TB above the 20.7 TB figure.
Enforcement is the part bidders dodge. Ask how retention is enforced: does the recorder overwrite the oldest footage automatically once the configured boundary is reached, or does someone have to run a cleanup? Get the answer in writing, because that difference decides whether the policy holds without a staff member remembering to act.
On the chassis itself, the bay count follows from the tier you picked. Run the formula both ways: at 4 Mbps and 16 cameras, a 7-day tier needs about 4.8 TB, which two mirrored 8 TB drives would cover as an illustrative choice, while a 30-day tier needs about 20.7 TB, which four 8 TB drives in RAID 5 would cover. Change the bitrate or the drive size and both answers move, so decide the tier before you decide the chassis.
Verification closes the loop. Ask for an access log that shows who reviewed footage and when. An audit trail you can export is worth more than one you can only screenshot.
Before signing, put these questions to the vendor and keep the answers with the tender file. They map directly onto the four-point policy statement from the opening section.
| Question for the vendor | Why it matters |
|---|---|
| Which retention durations does the firmware enforce, and is overwrite automatic? | Confirms the surveillance storage retention policy NAS runs without manual cleanup |
| Can access to exported footage be logged per user account? | Supports the audit requirement in the policy statement |
| Which RAID levels are supported, and what usable capacity results at my drive size? | Turns the formula’s RAID allowance into a concrete figure |
| Ask which conformity documents ship with the goods. | Paperwork that arrives with delivery is worth more than paperwork promised afterwards |
| Where is the equipment manufactured, and can we audit the line? | Supply-chain transparency is increasingly part of public tenders |
| What is the minimum order quantity for a private-label deployment? | Relevant for channel and system-house programmes |
Order quantities and commercial terms belong in that same written file. The published MOQ is 100 units per SKU, rising to 1,000 units where a new PCB respin or new tooling is required, and payment terms are confirmed in writing at order confirmation. The engineering base is Beijing and mass-production manufacturing runs in Shenzhen.
If retention is the piece you are still uncertain about, start from our european-nas-manufacturer“>European NAS manufacturer sourcing guide, then browse the products“>current product range to match a chassis to the tier you chose. The Bavaria clinic from the opening got four different answers because nobody had written the policy down first. Once the four points, the tier and the arithmetic are on paper, the chassis is the easy part.
The reporting obligations of the Cyber Resilience Act have applied since 11 September 2026: manufacturers of products with digital elements placed on the EU market must report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours, through the ENISA single reporting platform. The main obligations of the Act apply from 11 December 2027, so it is reasonable to ask any storage supplier to confirm in writing how CRA obligations are handled for the exact model you buy; the related EU audit-logging requirements also belong in that conversation.
Ask for the supplier’s CVE patch policy and the security support window for the exact model, as covered in this CVE patch policy buyer’s guide. The topic is current: in October 2026 attackers actively exploited two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against internet-exposed NAS devices, and the PHP project released patches on 21 October 2026. Restricting management ports to the local network and putting the patch process in the purchase order both reduce exposure.
Yes, when the inference runs on the appliance. An AI NAS performs person, vehicle and pet detection on the box itself, so recorded footage and detection events stay on the local volume and no per-camera cloud plan is required. Ask the supplier which retention window the analytics index covers, because detection events are usually kept longer than the clips they point to; the 30-day retention sizing note shows how that choice changes drive counts.
S1 combines an edge AI NVR and private-cloud NAS in one appliance: person, vehicle and pet detection with a false-alarm rate below 3%, 100% local computation and no subscription.
Key takeaways An FCC-recognized lab must hold the right scope for your device's rule part, not just any accreditation. A 2-bay NAS…
November 3, 2026Shared storage for deskside AI clusters refers to a storage appliance on the office LAN that holds datasets, checkpoints and embeddings for…
November 3, 2026A cloud storage subscription cost is the recurring fee a business pays to keep its files on a provider's servers, billed per…
Ask our export team for the OEM/ODM cooperation guide and a written quotation.
