Recording at the Edge, the Rack or the Cloud: A UK Storage Specification Framework

Storage architecture is often sold as a religious argument. Edge recording is presented as resilient, on-premise NVRs as secure and cloud services as effortless. In reality, each option solves a different commercial problem, and the correct choice depends on the service level the client has actually bought. In 2026, with higher camera bitrates, on-board analytics and more distributed sites, UK trade buyers need a specification framework rather than a favourite architecture.

Storage decisions are also control-room decisions. They determine what an operator can retrieve, how quickly evidence can be exported and how long the organisation can stand behind its recordings. That makes storage a service-level question, not a hardware category.

Define the service level before the product

Before comparing an SD card with an NVR or a cloud subscription, calculate the raw requirement. Take the camera bitrate in Mbps, multiply by 10.8 to estimate GB per day, then multiply by the retention period. A 4 Mbps camera produces roughly 43 GB per day. Over 30 days, that is about 1.3 TB per camera before overhead. Add at least 20% for motion variation and file system overhead.

Then ask the questions that shape the architecture: how many days of retention are required, how quickly must footage be retrieved, who needs access, what evidence export is needed, what happens during a broadband outage and what cyber controls are mandatory? A client who wants 90 days of 4K footage at full frame rate is buying a different system from one who needs 14 days of event-triggered clips.

Edge recording: useful, but not a strategy

Edge SD-card recording is valuable when the network is unreliable or when a local buffer is needed. If the WAN drops, the camera keeps recording. If the NVR fails, the card may still hold recent footage. For small retail sites, edge recording can provide a short forensic buffer and reduce the impact of a single point of failure.

It is not a substitute for a retention strategy. A 128 GB card at 4 Mbps holds roughly three days of continuous recording, not 30. Cards wear out, can be stolen with the camera and require health monitoring. Edge recording also creates a cyber and data-management problem: how are cards encrypted, how is footage collected and how is firmware patched? Edge is a useful layer, but it is not a complete answer.

On-premise NVR: control and cost, with a lifecycle

An on-premise NVR gives the site control over bandwidth, retention and physical access. It is well suited to multi-site logistics operations where upload capacity is limited and full-cloud recording is impractical. It can also provide predictable retrieval times for a control room or security office.

But the NVR is not a one-off purchase. Drives need replacement, usually every three to five years. The unit needs UPS protection, physical security, firmware updates and a hardened network segment. RAID improves availability but is not a backup. Licensing, service contracts and operator training all form part of the lifecycle cost. The cheapest NVR in a quotation may be the most expensive over five years if it lacks remote health monitoring or requires frequent site visits.

Cloud and hybrid: convenience with recurring cost

Cloud storage offers remote access, vendor-managed patching and no on-site drive replacement. Hybrid designs keep primary recording local and use the cloud for indexing, event clips, backup or central monitoring. For multi-site operators, hybrid can be a sensible compromise: local retention for bandwidth-heavy footage, cloud visibility for head office.

Vendor claims need decoding. Unlimited cloud storage is rarely unlimited in a commercial sense; retention, resolution and upload bandwidth all impose limits. A site with 16 cameras at 4 Mbps needs about 64 Mbps of sustained upload for full-stream cloud recording. Many UK sites do not have that, especially on FTTC or contended business broadband. Sub-streams, event-only recording or local primary storage may be necessary. Cloud does not fix a poor WAN; it makes the WAN part of the recording design.

Cyber risk follows the architecture

Edge, core and cloud all carry cyber risk. An internet-exposed NVR is a liability. A camera with default credentials is a liability. An unencrypted SD card is a liability when the device is stolen. The UK Product Security and Telecommunications Infrastructure regime has raised the baseline for connected devices, but installation practice still matters: unique credentials, firmware registers, VLAN separation, multi-factor access where available and a clear patching owner.

Cloud providers operate a shared-responsibility model. The vendor may secure the platform, but the installer and client still own account hygiene, user permissions and retention settings. Ask who can export footage, who can delete it and how access is reviewed. These are commercial questions as much as technical ones.

Decision scenarios

Small retail: four to eight cameras, 30 days retention, a single site and limited IT support. A small on-premise NVR with edge recording as a short buffer is often the most practical design. Cloud can add remote alerts and event clips, but full-cloud recording may be constrained by upload speed. The installer should document drive replacement and remote health checks in the maintenance plan.

Multi-site logistics: 40 sites, 20 to 60 cameras each, central monitoring and limited upload. A hybrid model is usually appropriate: local NVRs for 30-day primary retention, cloud indexing and event upload for head office. Central health monitoring is essential because truck rolls to replace a failed drive are expensive. The specification should include a standard build, a firmware baseline and a clear escalation path.

Smart building: mixed CCTV, access control and building management, with 90-day retention for critical areas. A core redundant storage design with VLAN separation and cyber hardening is likely to be required. Cloud analytics may be useful, but data sovereignty and integration risk need review. The client should understand which recordings are operational and which are evidential.

A specification framework

First, calculate bitrate and retention. Second, define primary and secondary storage. Third, map WAN upload and failover. Fourth, specify cyber controls and patching responsibility. Fifth, model five-year total cost of ownership, including drives, licences, cloud egress and labour. Sixth, document retrieval and export procedures. Seventh, test failover before handover.

The commercial argument is straightforward: storage is not a product; it is an evidence-retention service. The cheapest sticker price often loses on lifecycle cost, and the most fashionable architecture often loses on site conditions. Specify the service level, then select the architecture that can actually deliver it.