Who this suits: Businesses viewing cameras from phones, tablets, computers or multiple sites.
Direct answer: use a supported path and individual access
Remote viewing should use an access method supported for the exact system, with appropriate authentication, limited permissions and a documented owner. Do not give every viewer the administrator login or expose camera interfaces to the internet simply because that is the fastest way to make an app work. A convenient connection is not evidence that the design is suitably protected or maintainable.
The right approach depends on the platform, network, users and required functions. A supported vendor service, a properly managed VPN or another professionally designed method may be appropriate. This guide is a planning checklist, not universal configuration instructions. Use competent technical support and the current guidance for the actual devices and firmware.
Define who needs which function
Separate live viewing, playback, export, notifications, configuration and user administration. An office manager who checks an entrance may not need authority to delete recordings or add users. A contractor may need temporary diagnostic access, not permanent visibility. Use individual accounts or supported delegated access so permissions and removal can be managed.
List normal devices and locations, including personal phones, home computers and shared tablets. Decide how device loss and staff departure affect access. Keep the owner account and recovery methods under business control. A shared owner login can create a difficult offboarding problem because changing it may disrupt every authorised viewer and leave uncertainty about existing sessions.
Understand the connection method
Ask the installer to draw how a remote device reaches the recorder or cameras. Identify any vendor account, cloud relay, peer-to-peer service, VPN gateway or forwarded inbound port involved. Different systems use different arrangements, and their trust, update and availability dependencies differ. Do not assume the words cloud or peer-to-peer alone settle security.
Axis documents its own secure remote-access mechanism and publishes hardening guidance for its devices. These are examples of a manufacturer-supported design, not instructions for another brand. Ask the relevant vendor or competent integrator for its current recommended method. Retain the answer and the configuration record so a later technician does not reopen unnecessary exposure to solve an unrelated fault.
Avoid unnecessary public exposure
Publicly reachable administration and streaming services expand the opportunities for unauthorised access. Have a qualified person review router rules, automatic port mapping, old remote-support tools and unused services. Remove what is not required through a controlled process that preserves legitimate operation. Do not scan or alter networks you do not own or have authority to manage.
Network separation can reduce unnecessary communication between cameras, staff devices and guests, but it must be configured and tested. A separate subnet or VLAN name is not automatically a complete boundary. Document which systems may connect and why. Keep access rules proportionate and supported, rather than collecting complex settings nobody is willing to maintain.
Protect accounts and recovery
Use strong unique credentials and MFA where the actual service supports it. Confirm enforcement, not just enrolment. Keep a secure recovery process available to authorised deputies and avoid making one employee's personal phone the only route back into the system. Do not store secret recovery codes in a general camera schedule or browser checklist.
Record what happens when a viewer loses a phone, a staff member leaves or an installer relationship ends. Revoke sessions and delegated access using the platform's supported controls. Changing one password may not terminate every token or linked service. Include remote camera access in the offboarding process instead of assuming the main email account controls everything.
Worked permissions example
Assume a shop has an owner, a manager, a weekend supervisor and an external installer. The owner administers the system and has a recovery deputy. The manager needs live view, playback and authorised export. The supervisor needs only the entrance view during their role. The installer receives time-limited maintenance access through the supported arrangement.
That is an illustrative role design, not a guaranteed feature set of any app. Check whether the platform can express those permissions. If it cannot, decide whether the limitation is acceptable or whether another design is needed. Do not quietly substitute full administrator access for a limited role just to complete setup. Document the compromise and its owner before acceptance.
Keep updates and privacy in the operating plan
Record device models, firmware, update source, support status and who reviews vendor advisories. Test important functions after changes and maintain a suitable rollback or recovery approach. A camera system is not a one-time purchase that can be left unchanged indefinitely while remaining exposed and dependable.
Remote footage is still potentially sensitive information. Consider who can view screens, save clips and share exports, particularly on personal devices. The OAIC's camera guidance addresses covered organisations' handling of surveillance information. Get appropriate advice on privacy and workplace obligations where needed. An app permission setting does not by itself establish a lawful purpose or an adequate disclosure process.
Test the failure cases, not only first login
Test a normal remote connection, a revoked viewer, a lost-device procedure, an administrator recovery exercise and an internet outage. Check what continues locally when the external service is unavailable. Confirm whether alerts, playback and live view behave differently, and how the business learns that recording has stopped.
Use a controlled test plan so you do not disrupt alarms, access control or other dependencies. Record the results and unresolved limitations. A successful app demonstration on the installer's phone does not show that the owner's account, delegated roles and recovery methods work correctly. Have the intended operator perform the actions through their own authorised access.
Keep a short access review record
Review the viewer list against current roles and confirm that recovery details still belong to authorised people. Record the date, reviewer and actions without copying passwords or secret codes into the list. Include installer and temporary support access, not only staff accounts. A routine review can expose forgotten permissions before the next urgent offboarding event makes them harder to unwind.
Frequently asked questions
Is a VPN always safer than a vendor app? Not automatically. A VPN must itself be supported, updated, configured and administered. Compare the actual design and operational responsibility, not just the label. An unmanaged VPN with shared credentials can create a different serious exposure.
Can several staff share one login? It may be technically possible, but it makes individual permissions, audit and removal harder. Prefer supported individual or delegated access where available. If the product cannot provide the required control, treat that as a buying limitation rather than hiding it in the setup instructions.
Request a clear remote-access handover
Ask for the connection diagram, business-owned accounts, role list, MFA and recovery approach, update responsibility, support contacts and access-removal steps. Keep secrets in controlled storage separately. Confirm any subscriptions, data routing considerations and availability limitations in the proposed service. Review access after changes in staff, devices or suppliers.
Use the account security checklist to track actions without entering passwords. See multi-site planning for a broader operating model, or request equipment options against your access requirements. BoxFreeIT and Security Wholesalers share ownership. Related commercial suggestions do not replace a system-specific security review or independent assessment where the business needs one.
Sources and review notes
Official references used for this guide. Product features and terms can change. Examples are illustrative unless explicitly described otherwise.