The customer should control the primary CCTV account after handover.

That sounds obvious. Yet many camera systems leave site attached to an installer’s personal email, a former employee’s phone or one shared password sent to everyone. The cameras work—until somebody changes jobs, loses a phone, cancels an email address or needs to remove access urgently.

Account ownership is part of the CCTV architecture. It decides who can recover the system, invite viewers, change settings, access cloud recordings and remove a person who should no longer be watching.

“Who can view?” is not the same as “Who owns?”

Modern CCTV apps commonly separate at least two roles:

  • the owner or primary account, which binds or administers the device; and
  • shared/invited users, who receive some level of access.

A person who can open live view may still be unable to recover the device, change its storage, manage a subscription or remove another user. Conversely, somebody with administrative access may be able to alter recording and privacy settings far beyond what they need for daily viewing.

The first handover question should therefore be:

Which person or organisation must retain control if the installer, managing agent, employee or tenant disappears tomorrow?

For a private Durban home, that is usually the property owner. For a business, it may be a role-controlled company account rather than any employee’s personal address. For a body corporate, school or managed property, the responsible party and authority chain should be documented before devices are bound.

We have seen this decision matter on real projects

In one anonymised commercial project linking two premises, account assignment was raised explicitly at handover: which customer-controlled email address would view and administer the completed system?

In a later wire-free residential retrofit, battery and solar cameras were prepared and added to the owner’s Tapo account before deployment. That was not a minor convenience. It meant the remote system was being built around the person who would ultimately own and use it.

These records support a practical lesson: account ownership should be decided and tested during commissioning, not discovered when remote access fails months later.

The installer should not quietly become the permanent owner

An installer may need temporary administrative access to activate equipment, configure events and prove remote viewing. That does not justify binding the customer’s system permanently to an employee’s personal login.

Leaving ownership with the installer creates avoidable risks:

  • the customer depends on one outside account for password recovery;
  • a staff change at the installer can orphan knowledge of the system;
  • support staff may have broader access than the customer expects;
  • cloud subscriptions or device bindings can become difficult to transfer;
  • the customer cannot confidently remove former users; and
  • responsibility becomes unclear during a privacy or security incident.

The better pattern is customer ownership with explicitly invited installer access where continuing support is required.

Do not solve sharing by giving everyone one password

A shared primary password feels simple. It removes accountability and makes offboarding dangerous.

If a gardener, tenant, security company, family member or employee knows the same owner password, removing one person means changing it everywhere. Devices may drop from phones, password managers may retain the old credential, and nobody can tell which person performed an action.

Invited users are preferable because access can be granted and revoked without changing the owner’s recovery channel. The available permission detail differs by ecosystem and exact version, so it must be tested rather than assumed.

Tapo: a simple owner-and-invitee model

TP-Link’s current South African sharing guide says the owner can invite another TP-Link ID and remove access later.

For Tapo cameras under the documented sharing model, an invitee can use live view, talk, pan/tilt and SD-card video. The invitee cannot access the owner’s Tapo Care cloud storage or change other camera settings.

That simplicity suits many homes. It also creates a boundary that must be explained. A shared family member may see local recordings but not cloud history, and may be unable to make a setting change the owner expects them to handle.

At handover, test the invitee’s phone—not only the owner’s sharing screen.

Hik-Connect: permissions need deliberate commissioning

Hikvision publishes workflows for registering and adding devices, receiving a shared device, sharing devices and setting permissions. It also documents web- based batch permission management.

That breadth is useful for a multi-camera home or business, but it means the installer should document what each user can actually do. “Shared successfully” does not show whether that user can play back, export, hear audio, receive alarms or change configuration.

Use the least privilege that allows the person’s real task, then verify it from their account. Permission names and screens can change by app/service version; the installed environment is the authority.

DMSS: test the exact sharing and service relationship

Dahua presents DMSS as an individual-user app for remote management, live view, replay, notifications and related security functions. It also positions DoLynk Care as a service-provider route for device-health support.

That separation reinforces an important principle: the owner experience and the service-provider relationship are not the same thing.

Before handover, test the exact current DMSS workflow for device sharing, role scope and removal. Do not copy a permission assumption from Hik-Connect or Tapo; the ecosystems differ, and interfaces can change.

Use a role account for a business—not a departing employee

A company CCTV system should not depend on person.name@company if a controlled functional account is available and appropriate under the organisation’s IT policy.

A role account can survive staff turnover, but it must not become an unmanaged shared inbox. Define:

  • who controls the mailbox and recovery factors;
  • which manager authorises new viewers;
  • who reviews access periodically;
  • where recovery codes are stored;
  • how departures trigger removal; and
  • who contacts the installer when device rebinding is required.

Individual users should still receive their own invited accounts wherever the platform supports them. The role account owns; people are granted access.

Multi-factor authentication and recovery belong to the owner

If the platform offers two-step or multi-factor verification, enrol it against a customer-controlled method. Do not use an installer’s phone number as the only second factor for a customer’s system.

Recovery should be tested before leaving site:

  1. Confirm the owner receives the verification message.
  2. Confirm the recovery address and phone are current.
  3. Record who holds backup/recovery codes, if provided.
  4. Confirm the owner can sign in on a second approved device.
  5. Confirm the installer cannot reset the account without customer involvement.

Do not place passwords or recovery codes in an ordinary commissioning report that is emailed widely. Store credentials through the customer’s approved secure method.

Access to cameras is access to personal information

CCTV footage can contain identifiable people, movements, routines and events. South Africa’s Protection of Personal Information Act places accountability and security-safeguard duties on responsible parties processing personal information.

That does not prescribe one universal CCTV account structure, but it supports a sound governance principle: access should be authorised, appropriate to purpose, protected and removable.

The owner should know:

  • which people and organisations can view live and recorded video;
  • whether audio is available;
  • whether anyone can download clips;
  • which cloud provider or subscription stores footage;
  • how access is withdrawn; and
  • who responds if an account is compromised.

This is operational guidance, not individual legal advice. Higher-risk sites may need a formal privacy and access-control review.

The handover test that catches most problems

Before the installer leaves, perform the following from the customer’s phone and account:

  1. Open every approved live view.
  2. Find a known test event from earlier that day.
  3. Play the context and export a short clip.
  4. Invite a temporary test user with the intended permission.
  5. Confirm what that user can and cannot access.
  6. Remove the test user and verify access is gone.
  7. Restart the app and prove the owner still has access.
  8. Confirm where local and cloud recordings live.
  9. Confirm account recovery reaches the owner.
  10. Record any continuing installer/service-provider access and its purpose.

A screenshot saying “device online” is not a handover test.

When an employee, tenant or contractor leaves

Offboarding should happen promptly and deliberately:

  • remove their invited account or permission;
  • change shared credentials if shared passwords were ever used;
  • review other logged-in devices/sessions where the platform exposes them;
  • rotate door, alarm and network access separately—CCTV removal does not remove those systems;
  • confirm recording and owner access continue; and
  • document who authorised the change.

Remember that revoking app access cannot retrieve a clip somebody already downloaded. Grant export permission only where the role needs it.

If the system is already owned by the wrong account

Do not factory-reset everything immediately. A reset can interrupt recording, erase configuration or create a coverage gap.

First establish:

  • the exact owner/binding account;
  • whether the existing owner is available and authorised to transfer or share;
  • whether local recording must be preserved;
  • whether cloud footage is tied to the old account;
  • whether the installer/distributor has a supported unbind or transfer process; and
  • how each camera/recorder will be verified after the change.

Plan the transition like a system change, including rollback and coverage during the work.

A practical account handover record

The final document should state, without exposing the password itself:

  • primary owner organisation/person and account identifier;
  • recovery method confirmed;
  • multi-factor verification status;
  • device/recorder names and ownership status;
  • invited users and permission purpose;
  • installer/service-provider access and review date;
  • local and cloud storage responsibility;
  • successful playback/export test;
  • offboarding contact; and
  • handover date and acceptance.

The verdict

The CCTV account should be owned by the person or organisation responsible for the property and footage—not left indefinitely on an installer’s personal login.

Hik-Connect, DMSS and Tapo expose different sharing and support workflows, but the governance principle is the same: customer-controlled recovery, individual invitations, least privilege, tested offboarding and documented support access.

A camera installation is not finished when the picture appears. It is finished when the customer can control, recover, review and safely share the system without depending on the person who happened to commission it.