Chinese security cameras: who owns them, where the video goes

Do Chinese security cameras send data to China?

Mostly not in the way people fear. The big brands store data for Western customers outside China. Xiaomi's privacy policy names hosting in India, the Netherlands, Russia and Singapore. It also says data "may also be remotely accessed from the Chinese Mainland" for troubleshooting and after-sales service. EZVIZ, Hikvision's consumer brand, lists data centers in the US, Singapore, Brazil, Ireland and Frankfurt.

China does appear in some policies, and they say so plainly. EZVIZ's customer-service notice stores support data on servers "located in China, Ireland and other jurisdictions". Tuya, the platform behind many Smart Life cameras, runs seven data centers, one of them in Shanghai, and stores data in the one the customer chooses. In 2021 Tuya told US senators it isolates each region's data and has never been asked to hand another country's data to a government. No outside audit backs that yet.

The worry is less about a server's address than about company law. When five US states sued TP-Link in 2026, they argued its apps' data could be exposed under a 2017 Chinese intelligence law. CE Pro notes the suits do not allege that the Chinese government actually obtained customer data; they describe a risk. TP-Link says it does not and will not share customer network data with foreign governments.

So ask three things: who owns the company, where its servers are, and what your camera sends. The table answers the first two, with the dated record.

Checked October 28, 2026, from each company's own policy, regulators and the reporting in the sources. A lawsuit is an allegation until a court rules.

Headquarters, servers, and what actually leaves your home

• The owner's country decides which governments can lean on the company. That is the core of the US case against Hikvision and Dahua, and of the state suits against TP-Link and Lorex.
• The server's country is where your data sits. A Chinese brand can host in Singapore or Frankfurt.
• What is sent matters most. A camera that checks the time and looks for updates sends little; one that uploads thumbnails sends your nursery. Thumbnails are what leaked at eufy and Wyze.

Even a camera you only watch locally keeps calling home. A Tapo C200 owner on TP-Link's forum logged lookups for tplinknbu.com about every six seconds. He blocked them with Pi-hole and kept using the camera in Home Assistant.

Who runs the cloud of a no-name camera?

Often not the brand on the box. Cheap cameras and many baby monitors are built on a handful of shared platforms: one company writes the app and runs the servers, and dozens of brands put their logo on it. A flaw in the platform hits every brand at once. The app you were told to install gives the platform away.

From CISA, Which?, SEC Consult, Bitdefender and the reporting in the sources, checked October 28, 2026.

If your camera came with CloudEdge, CamHi or Yoosee, the brand's own support cannot fix the platform. Update it, give it a new password, and keep it off the internet if it works locally.

Is deleted video really gone?

Not always, and not at once. In February 2026 the FBI said video in a missing-person case near Tucson was recovered from "residual data located in backend systems". The Nest camera had been disconnected and had no paid plan, and police had first said no video existed. Experts told CBS News that cloud deletion can be lazy, so files may linger for days.

What a company may do with uploaded data is in its policy, not its ads. Owlet's policy (July 2026) says this "may include using data to develop and train artificial intelligence and machine learning models", with de-identified data where possible. Video that never leaves your home has no backend to linger in.

Forum stories: which ones held up?

Some did. The Xiaomi case began as a Reddit post with screenshots of strangers' homes. Soon after, Google confirmed it and cut Xiaomi off. Others did not. In June 2024 Nanit owners reported a voice from their cameras; two security firms found no breach, and the cause was an audio bug.

Some stay open. A Wyze owner posted in 2020 that his cameras talked to a server in China; the thread has screenshots but no answer from Wyze. Researchers at New America found a monitor regularly contacting a Beijing server that did not belong to its maker. The data was small and may only have helped the app find the camera.

A quick test for any story: is there a company statement, a regulator's document or a researcher's write-up? A screenshot of an IP address is a lead, not proof.

How to check what your camera sends

1. Open your router's device list. Most router apps show each device's traffic. A camera that uploads all day while nobody watches is sending video or thumbnails.
2. Log its lookups. A Pi-hole or your router's DNS log shows which names the camera calls. Look the names up: the maker's cloud, a time server, an update server.
3. Block its internet and see what still works. Use the router's parental controls or a firewall rule for the camera's address. Check live view on your Wi-Fi, alerts, and the view from outside.
4. Read the policy's transfer section. Search the privacy policy for "transfer" and "hosting": the countries are named there.
5. Let updates through now and then. A blocked camera gets no firmware fixes. Unblock it once a month, update, block again.

The local-only route

The way out is a camera that streams on your own network. Cameras with RTSP or ONVIF send the picture to an app on your Wi-Fi that asks with the right password. Tapo, Imou, Hikvision, Dahua and Reolink do; Ring, Nest, current Wyze and most Xiaomi models don't. The camera checker answers for your model.

Set the camera up with its own app, then block its internet on the router. TP-Link says Tapo cameras need the internet for setup, remote viewing and clock sync, and work locally once set up. You lose the maker's alerts and remote view; the picture stays in your home. Setup is in the IP camera guide and the Tapo guide; the Xiaomi model table shows which of those can stream locally.

Where Mamoon fits

Mamoon reads a Tapo, Imou, Hikvision or Dahua camera over RTSP on your home Wi-Fi, with no cloud and no account. It recognizes crying on your phone, so the camera's sound stays in the house. It does not block the camera's own calls to its maker; that is a router setting. Sound and cry alerts are free; the picture is $29.99 once or $3.99 a month after 14 days free. For the hacking side, see can baby monitors be hacked.

Frequently asked questions

How these pages are made: an AI model drafts them from our own tests, real app screens and the sources listed, and Jan Drábek checks every page before it goes live.