How we score devices
Last updated
The Local-First Score (0–100) measures how much of a device keeps working, and how much of your video stays home, without the manufacturer's cloud. 85 of the 100 points are about the device itself. The last 15 points are about the company: what its privacy policy says, how it handles police requests, and its recent incident record. It is a transparent rubric, not a lab test.
| Criterion | Max | Points awarded |
|---|---|---|
| Works without internet | 20 | Yes: 20 · Partial: 8; anything else or Unverified: 0 |
| Local video storage | 15 | Yes: 15 · Hub only: 9; anything else or Unverified: 0 |
| Home Assistant, locally | 15 | Local push: 15 · Local polling: 15 · Community only: 6 · Cloud: 3; anything else or Unverified: 0 |
| Open protocol (RTSP / ONVIF / Matter) | 10 | Yes: 10; anything else or Unverified: 0 |
| No cloud account required | 10 | Not required: 10; anything else or Unverified: 0 |
| No subscription for core recording | 8 | Not needed: 8 · Partly: 4; anything else or Unverified: 0 |
| End-to-end encryption | 7 | Yes: 7 · Optional: 4; anything else or Unverified: 0 |
| Privacy policy: does not sell your data (brand) | 5 | Says no sale: 5 · Qualified: 2; anything else or Unverified: 0 |
| Police requests: warrant or no access (brand) | 5 | No access to video: 5 · Warrant: 5 · Warrant + emergency: 3 · Legal process: 2; anything else or Unverified: 0 |
| No incidents in our tracker, last 5 years (brand) | 5 | None tracked: 5; anything else or Unverified: 0 |
| Total | 100 |
Rules
- Unverified scores 0. If a fact can't be sourced, it earns no points until we can confirm it.
- Sources first. We prefer manufacturer documentation, privacy policies and home-assistant.io; community reports are labeled as such.
- End-to-end encryption: 7 points if it is on for everyone (as the vendor documents it), 4 if it is an opt-in mode. A vendor claim we can't confirm scores 0.
- Privacy policy (brand): 5 points for a plain statement that the company does not sell your personal information (and doesn't disclose ad "sharing"). 2 points for a qualified statement ("in general", "except as described", or a no-sale app policy alongside ad sharing on the website). 0 if the policy discloses selling or targeted-ad sharing, or has no such statement.
- Police requests (brand): 5 points if the company requires a search warrant for video, or says it cannot access your video at all. 3 for a warrant requirement with an emergency exception. 2 if it requires legal process (subpoena, court order or warrant). 0 if disclosure is at the company's discretion ("permitted by law", "if so requested", "good faith belief") or no policy was found.
- Incidents (brand): 5 points if our incident tracker has no qualifying entry for the brand in the last 5 years (currently October 2021 onward). One qualifying entry removes all 5 points; more entries do not remove more. The inclusion rule is below. Our tracker is not exhaustive, so treat these points as "nothing we have found", not a clean bill of health.
- Brand-level criteria apply to every device from that brand.
- Affiliate relationships never change a score.
- Prices are manufacturer list prices on the date checked and change often.
Incident inclusion rule
An entry is added to the tracker, and scored, only if it is dated October 2021 or later, is documented by a primary source (the company, a regulator, a court, CISA/NVD or the researcher who found it) or reputable reporting, and fits one of these four categories:
- Confirmed data exposure. The company, a regulator or a court confirms that customer video, images or account data were exposed to, or accessed by, people who should not have had it (leaks, cross-account bugs, employee access).
- Regulator action. A complaint, order, settlement or fine from the FTC, a state attorney general or a national data-protection authority about the brand's cameras or doorbells, or the customer data they collect. Actions about other product lines (for example routers or phone location tracking) do not count.
- Serious vulnerability. A CVE in the brand's camera, doorbell, camera-hub or NVR/console line, or in the cloud and app services they depend on, that is either in CISA's Known Exploited Vulnerabilities catalog, or is rated critical (CVSS 9.0 or higher by NVD, or by the issuing CNA/CISA when NVD has not scored it) and has a public proof of concept or detailed technical write-up. Patched CVEs still count, because they show the product's track record; we note when a fix exists. A batch of CVEs disclosed together is one entry, dated by public disclosure (or by the KEV listing, if a pre-window flaw was added to KEV inside the window).
- Confirmed undisclosed sharing or retention. The company or an official statement confirms video was shared without the owner's consent, or kept or recoverable beyond what the company documents to users.
Not counted: class actions and allegations without a finding or settlement, letters from lawmakers, debates over opt-in features, CVEs below the threshold above, securities lawsuits, and anything before October 2021 (listed for context but not scored). Items we considered and excluded are listed on the tracker page.
Firmware & phoning home (not scored). Some device pages carry a note where a source documents a required cloud check-in, cloud uploads despite local storage, or firmware that limits or removes local features. These notes do not affect the score for now.