Security Cameras

How to connect the security cameras at your properties — install a Seayora Bridge with one command, connect DW Spectrum or a camera that sends to Seayora — then watch them live, record and play back, act on what they see, and export footage as evidence.

Security Cameras puts the cameras at your properties next to the units, leases and work orders they watch over. You can see every camera live on one wall, play back what they recorded, get told when one sees something or goes offline, turn an event into a work order, and export footage for the police or an insurer with a fingerprint anybody can check. It lives under Operations → Smart building → Cameras on the website, and under Security Cameras in the Seayora app on iPhone and Android.

A beta, and the agreement you accept first

Security cameras and the Seayora Bridge are a beta. The first time you open them, Seayora shows a short beta agreement and asks you to check a box and accept it; until you do, the camera screens, their API and the assistant tools that read them wait. Cameras you already set up keep recording in the meantime. Each person who uses them accepts for themselves, and somebody accepting for a company confirms they are allowed to. If the wording ever changes, you are asked again.

What the agreement says, in short: the beta is provided as is; it can change, stop working or lose live video, recordings and events at any time; it is not a monitored alarm or security service and nobody at Seayora watches it; and to the fullest extent the law allows, Seayora takes no liability for any damage or loss connected with it — theft, break-ins, injury, damaged equipment, lost recordings or claims by anybody recorded. You stay responsible for safe installation, for notice and consent where the law requires them, for never recording inside a home, a bathroom or a changing area, and for keeping your own copy of any footage you need. The full text is Terms of Service § 18G and Privacy Policy § 10P. Residents who only watch the cameras their building shares are never asked.

Where a camera may be

Common areas and outside only: entrances, the lobby, corridors, stairwells, elevators, the mail and package room, laundry, parking, the garage, the roof, the trash area, amenity spaces, the office and equipment rooms. Seayora refuses a camera anywhere else, and says why in the words of the law.

• Never inside a home somebody lives in. Recording a private dwelling is unlawful surveillance in essentially every state, and California says in terms that being the landlord is no defense.
• Never in a bedroom, a bathroom or restroom, or a changing or locker room — recording a private space is a felony in most states.
• Point cameras away from windows and front doors of units, or black those areas out with a privacy mask (below).
• Local law may require signs, notice to residents or staff, or limits on where cameras may point. Seayora shows every resident where each camera is and what it keeps, but that does not replace a notice the law requires you to give.

Connecting cameras

• Through a Seayora Bridge (recommended): a computer at the property — a mini PC, a Windows PC, a Mac, a Raspberry Pi or a NAS — or the camera network’s own equipment (a Raspberry Pi powered by the PoE switch, an OpenWrt router, a MikroTik or a Cisco Catalyst — none of which needs Docker — or another device that runs Docker) finds the cameras on its network by itself, even behind a managed switch that filters the usual broadcast, and asks each one for its streams. Cameras that do not speak ONVIF — and recorders, including Hikvision, Dahua, Lorex and Amcrest NVRs and UniFi Protect — are added by their RTSP address; the bridge lists the ones it finds as “RTSP only”.
• From DW Spectrum, Nx Witness or Hanwha WAVE: connect the system and import its cameras. Seayora pulls each camera from the recorder, so nothing about the existing system changes. A recorder only reachable on the property’s network is imported through a bridge instead, and its password never leaves the property.
• A camera already on the internet: Seayora connects to it directly. Only for a camera published with a port forward — a bridge is safer for everything else.
• A camera that sends its video: many cameras can push to a server over RTMP or SRT, with nothing installed at the property — no bridge and no computer. Seayora gives you an address and a stream key to paste into the camera, and records it in the cloud. SRT copes better with cellular connections. Finding cameras on the network, watching them for motion and recording on the property need a bridge.
• Verkada, Eagle Eye, Rhombus and Avigilon Alta need a partner agreement Seayora does not have yet; cameras behind them can often still be added to a bridge by RTSP. Ring, Google Nest and Wyze cannot be connected to any other system, so Seayora says so rather than offering a button that fails.

The Seayora Bridge

The bridge is a small program that runs at the property, on the same network as the cameras: on a computer that stays on, on a Raspberry Pi powered by the PoE switch, or on a router or switch that can run programs. Nothing it needs is Docker: on every system it installs the way that system’s own software does — a Windows service, a Mac background service, a Linux service, a .deb for apt — and a NAS, whose way to add software is its container app, is the one place it runs in one. It needs no open ports: it only connects out to Seayora. It finds the cameras, keeps their passwords, records to its own disk, takes pictures, and forwards video to the cloud only while somebody is watching or a recording policy says to — so a building with twenty cameras is not uploading twenty streams all day. You download it from Seayora itself, and afterwards it keeps itself up to date with releases Seayora has signed.

Wired is steadier than Wi-Fi, and a computer that sleeps stops recording, so switch sleep off. The disk decides how much footage the bridge can keep at the property; recordings can go to a separate, larger disk.

Cameras on a PoE switch, a recorder or a doorbell

Most camera equipment — almost every PoE switch, and the PoE ports on a video recorder — runs closed software that cannot run any other program, so the bridge goes on something plugged into it: a computer, or a Raspberry Pi powered by the switch. Equipment that can run programs runs it itself, with no Docker — an OpenWrt router or switch, a MikroTik or a Cisco Catalyst. Where it goes depends on what the cameras are plugged into:

• Cameras on a PoE switch: A PoE switch powers the cameras and connects them. Most PoE switches — and the PoE ports on a video recorder — run closed software that cannot run any other program, so the bridge goes on something plugged into that switch or the router it connects to, which works with any PoE switch, managed or not. With no computer at the property, use a Raspberry Pi 3, 4 or 5 with a PoE HAT or a PoE splitter: it takes its power from the same switch, and the Raspberry Pi kit sets it up from a memory card with nothing to type on it. Equipment that can run programs runs the bridge itself, with no Docker: an OpenWrt router or switch on a 64-bit processor (one line over SSH), a MikroTik with RouterOS 7.21 or later (RouterOS's own container feature), and a Cisco Catalyst 9300 or 9400 with IOx (an image the kit makes on any computer). A managed switch that has SNMP can also be read by the bridge, port by port: which ports are powering something and how much power the switch is giving (seabridge switch help).
• A recorder (NVR or DVR): Put the bridge on a computer on the recorder’s network and add each channel by its RTSP address: one bridge brings in every camera the recorder holds. Hikvision, Dahua, Lorex, Amcrest and Reolink recorders publish an address for every channel, and UniFi Protect does once RTSP is turned on for a camera. Cameras plugged into the recorder’s own PoE ports are on a small network inside it, so they come in through its channels too.
• A video doorbell: A doorbell that offers RTSP or ONVIF — Reolink, Amcrest, Hikvision, Dahua and others — is added like any camera, and a press arrives as a doorbell event. Ring, Nest and Wyze doorbells send their video only to their own company, so no bridge can reach them.
• Cameras that send their own video: Many cameras can send their video straight to Seayora over RTMP or SRT, with nothing installed at the property — no bridge and no computer. Add the camera in Seayora as one that sends to Seayora and type the address and stream key it gives you into the camera's own settings. It records in Seayora's cloud. What only a bridge does: finding cameras on the network, watching them for motion, and recording on the property — so for more than a few cameras, a bridge is still the better choice.
• Which computers run it: Windows 10 (64- or 32-bit) and 11, macOS 13.5 or later, and Linux — Ubuntu, Debian, Raspberry Pi OS, Alpine, Fedora, RHEL, OpenWrt and most others, whether they run systemd, OpenRC, procd, SysV init or none of them (the bridge then brings its own small supervisor) — on a 64- or 32-bit PC, an Apple silicon or Intel Mac, ARM boards and every Raspberry Pi; Debian, Ubuntu and Raspberry Pi OS can also take it as a .deb package. A Raspberry Pi Zero or 1 handles one or two cameras and cannot recognize people or vehicles. A NAS runs it in its container app. Of routers and switches, OpenWrt on a 64-bit processor, a MikroTik (RouterOS 7.21 or later, ARM or x86) and a Cisco Catalyst 9300 or 9400 with IOx run it with no Docker, and anything else that runs Docker or Podman can run it in a container; most others, and recorders, cannot, because their software is closed.

Install the Seayora Bridge

A video shows every step, from the pairing code to the first camera: youtube.com/watch?v=Gu9cucvFRBw

In Seayora, open Cameras, then Bridges, and press “Add a bridge”. Choose the property, give the bridge a name you will recognize, and press “Make a pairing code”.

Before Seayora issues the code it shows you the bridge software license and asks you to accept it: the bridge is licensed to you for use with Seayora, it runs separate open-source programs under their own licenses, it installs the updates Seayora signs by itself, and when you ask it to look for cameras it searches the private networks that computer is on. You are responsible for that computer and for the right to record at that property. Seayora records the wording you accepted and when. A new pairing code — moving a bridge to new hardware, or re-installing it — asks again, because it is often a different person on a different computer.

Seayora then shows a pairing code and, for each kind of computer — and for a Raspberry Pi on the PoE switch, an OpenWrt router, a MikroTik, a Cisco Catalyst or another device with Docker — the one command that installs the bridge. The code works once, for thirty minutes, and Seayora keeps only a fingerprint of it.

Pick the bridge computer’s system and run its command on that computer, exactly as Seayora shows it — with your own code in place of the one below. The installer checks the computer, downloads the bridge from Seayora and the programs it runs — Node.js, MediaMTX and FFmpeg — from their publishers (or the same files from Seayora, where the network blocks a publisher; on Linux and a Mac, where FFmpeg’s publisher is blocked, it uses the computer’s own FFmpeg instead), checks every file against the fingerprint Seayora pinned, installs the bridge as a service that starts with the computer, and waits until it has paired. It takes a minute or two.

The pairing screen follows along: it says when the installer has started and when the bridge has paired, then offers “Look for cameras”. Is somebody else doing the install at the property? Press “Send the instructions” to share the code, the commands and this guide from your own phone or computer. The code works once, for thirty minutes, and Seayora never sends it anywhere itself.

The same commands are on a public page, seayora.com/download/bridge, which needs no sign-in — so the person at the property can download the bridge without a Seayora account — with a download for every kind of computer: the Windows installer for 64-bit, 32-bit and ARM Windows; a package for a 64-bit or 32-bit Linux PC, each kind of Raspberry Pi and Alpine; a .deb package for Debian, Ubuntu and Raspberry Pi OS; a package for an Apple silicon or Intel Mac; and the .zip a NAS builds from. Each file there shows its size and its SHA-256 fingerprint. Without a code, every command and every installer asks for one.

On Linux or a Raspberry Pi

Open a terminal, or connect to the computer over SSH, and run:

curl -fsSL https://seayora.com/bridge | sudo sh -s -- ABCD-2345

• Leave the code off — curl -fsSL https://seayora.com/bridge | sudo sh — and it asks for it.
• It needs sudo because it installs a service. The bridge itself runs as its own user, seayora-bridge, with no administrator rights.
• It installs into /opt/seayora-bridge, keeps its data in /var/lib/seayora-bridge and its settings in /etc/seayora-bridge/bridge.env, and adds the seabridge command (the older name, seayora-bridge, works too).
• The bridge and the programs it runs take about 300 MB. On a computer that already has FFmpeg, add --small to use it and save about 80 MB.
• To keep recordings on a larger disk, add --recordings and a folder on it: … | sudo sh -s -- ABCD-2345 --recordings /mnt/disk/seayora.
• On a 32-bit Raspberry Pi OS it uses the system’s own FFmpeg, and installs it with the package manager if it is missing. A Raspberry Pi 3, 4 or 5 running the 32-bit system is recognized as one, even though it reports a 64-bit processor.
• A Raspberry Pi Zero or 1 works too, for one or two cameras. It cannot recognize people, vehicles or animals, so it reports any movement.
• On Alpine, run it as root (with doas or su, or with sudo if it is installed). It adds the C++ runtime and FFmpeg with apk.
• A 32-bit PC works too, with the same command. On Debian and most others the bridge runs on Node.js 20, the newest Node.js built for 32-bit Linux, which no longer gets fixes from the Node.js project; on Alpine, on a 32-bit PC or ARM board, it installs Alpine’s own Node.js. Where the computer can run a 64-bit system, that is the better choice.
• It registers a systemd service. On a computer without systemd it registers an OpenRC service (Alpine, Gentoo), a procd service (OpenWrt) or a SysV init service (Devuan, MX Linux, antiX) instead, and the bridge keeps its own log in /var/lib/seayora-bridge/logs — sudo seabridge logs follows it either way.
• A Linux with none of those — a small embedded system, or a device whose own Linux you can sign in to — gets the bridge’s own small supervisor instead: it starts the bridge under its own user, starts it again if it ever stops, and is started by the system’s rc.local at boot. Where a system has no rc.local, the installer says the one line to add to its start-up script. Docker is never needed.
• To keep everything on another disk — a USB disk, a larger volume — add --dir and a folder on it: … | sudo sh -s -- ABCD-2345 --dir /mnt/usb/seayora. The bridge goes in its bridge folder and its data in its state folder. The disk must be formatted with a Linux file system such as ext4: a disk straight from a shop is usually FAT or exFAT, which keeps no owners, so the bridge’s key would be readable by anybody, and the installer refuses it and says so. It also refuses a disk mounted noexec, and a folder inside one that other accounts can change, because root runs the bridge’s programs from there.
• On Debian, Ubuntu or Raspberry Pi OS you can install the .deb from seayora.com/download/bridge instead: sudo apt install ./seayora-bridge_<version>_<arch>.deb, then sudo seabridge pair ABCD-2345. apt brings FFmpeg and anything else the bridge needs from the system’s own packages, and the bridge waits for its code. sudo apt remove keeps its data; sudo apt purge removes that too.
• Or download the package for that computer from seayora.com/download/bridge — a 64-bit or 32-bit PC, a Raspberry Pi 3, 4 or 5 on a 64-bit or a 32-bit system, a Pi Zero or 1, or Alpine — unpack it, and in its folder run sudo ./install ABCD-2345 (or sudo ./install --pair-later, then sudo seabridge pair ABCD-2345 later). The bridge, Node.js and MediaMTX are inside it; FFmpeg is not, so while it installs it downloads FFmpeg from its publisher or installs the computer’s own. It installs exactly what the command above installs.
• Not sure which package? On that computer, uname -m prints x86_64 for a 64-bit PC, i686 or i386 for a 32-bit PC, aarch64 for 64-bit ARM, armv7l for 32-bit ARM and armv6l for a Pi Zero or 1; on a Raspberry Pi, getconf LONG_BIT says whether the system is 64- or 32-bit. Pick the wrong one and the installer says which to download instead.

On Windows

Open PowerShell — right-click the Start button and choose Terminal or Windows PowerShell — and run the command below. It asks Windows for administrator rights by itself and carries on in a new window:

$env:SEAYORA_PAIRING_CODE='ABCD-2345'; irm https://seayora.com/bridge.ps1 | iex

From Command Prompt, the same in one line — it asks for the code:

powershell -ExecutionPolicy Bypass -c "irm https://seayora.com/bridge.ps1 | iex"

• Windows 10 version 1809 or later, Windows 11, or Windows Server 2019 or later. A 32-bit Windows 10 works with this command, with the installer for 32-bit Windows, with the .zip below and with the Microsoft Store app.
• It installs into C:\Program Files\Seayora Bridge and keeps its data in C:\ProgramData\Seayora Bridge. The bridge runs as the “Seayora Bridge” service under Windows’ built-in Local Service account, which has no administrator rights, and starts with Windows.
• It adds the seabridge command to every new terminal and, for a PC whose firewall blocks outgoing traffic, Windows Firewall rules that let the bridge’s own programs out. Nothing inbound is opened.
• It uses the proxy Windows is already set to use. To name another, run $env:SEAYORA_PROXY='http://proxy.example:3128' in the same window first.
• The code goes into a setting of that PowerShell window, never into the web address, so it does not end up in a log anywhere.
• Or download the Windows installer from seayora.com/download/bridge — for 64-bit Windows (almost every PC), Windows on ARM, or 32-bit Windows. Everything the bridge needs is inside it, so nothing is downloaded while it installs; it asks for the pairing code, or you can pair it later from Seayora Bridge in the Start menu. It is not code-signed — signing is a paid subscription and the bridge is free — so Windows may say “Windows protected your PC”: choose More info, then Run anyway. The installer still checks every program it installs against a release Seayora has signed. Where Smart App Control is switched on, Windows may block unsigned programs altogether — including the ones the bridge runs — so use a Mac, a Linux computer, a Raspberry Pi or a NAS there instead.
• Or, without PowerShell: download the .zip on the pairing screen, unpack it, and double-click Install Seayora Bridge. Windows asks whether to run it and for permission to make changes; then type the pairing code. Press Enter with no code to update a bridge that is already paired.
• To keep recordings on another disk, run $env:SEAYORA_RECORDINGS_DIR='D:\Seayora' in the same window first.

From the Microsoft Store

SeaBridge is in the Microsoft Store, free. Windows installs it and keeps it up to date, and nothing warns about an unsigned program. From a terminal, winget install 9PBC1BVBDQBL installs the same app. Open it after it installs and press Pair, then type the pairing code.

It is not the same as the ways above, and the difference decides whether it suits the computer in front of you. A Store app may not install a Windows service, so this one runs while somebody is signed in to that PC and stops when they sign out — including when the PC is locked and signed out overnight, or restarted and left at the sign-in screen. Cameras record nothing while it is stopped. Use it on a computer somebody is signed in to and using; for a mini PC left on by itself in a cupboard, which is what most bridges are, use the PowerShell command or the installer, which install a service that starts with Windows whether anybody signs in or not.

• One bridge per computer: the Store app will not start its own while the Seayora Bridge service is installed, and stops its own if you install that service afterwards. Pick one.
• The Store updates the app, so a new bridge release reaches it when Microsoft has certified that release rather than within hours. A service install picks one up by itself.
• Everything else is the same bridge: the same discovery, the same recording, the same connection out, and it shows in Seayora as installed from the Microsoft Store.

On a Mac

Open Terminal (in Applications, then Utilities) and run the same command as on Linux. It asks for your password, because it installs a background service:

curl -fsSL https://seayora.com/bridge | sudo sh -s -- ABCD-2345

• macOS 13.5 or later, on Apple silicon or Intel.
• It installs into /usr/local/seayora-bridge, keeps its data in /Library/Application Support/SeayoraBridge and its log in /Library/Logs/SeayoraBridge, and runs the bridge as a hidden user of its own. If the Mac’s firewall is on, it lets the bridge through.
• A Mac that sleeps stops the bridge. In System Settings, switch on “Prevent automatic sleeping when the display is off” (under Energy, or Battery, then Options, on a laptop) — or use a Mac mini.
• Or download the package for a Mac with Apple silicon or one with an Intel processor from seayora.com/download/bridge, double-click it to unpack it, and in Terminal run sudo ./install ABCD-2345 in its folder (type cd and a space, drag the folder into Terminal, press Return, then type the command). Node.js and MediaMTX are inside it; FFmpeg is downloaded from its publisher while it installs.

On a NAS or with Docker

On a NAS or any Linux computer with Docker Engine, connect over SSH and add --docker to the Linux command:

curl -fsSL https://seayora.com/bridge | sudo sh -s -- ABCD-2345 --docker

• The container uses host networking so it can see the cameras. Docker Desktop on a Mac or a Windows PC cannot — use the Mac or Windows installer there instead.
• It installs into /opt/seayora-bridge-docker, and the container starts again by itself after a reboot.
• Synology (Container Manager), QNAP (Container Station), Unraid and TrueNAS SCALE all run it once SSH is switched on. A container manager that runs Compose projects can also run it without SSH: download the .zip from seayora.com/download/bridge, unpack it into a folder on the NAS, and create a project from that folder’s docker-compose.yml with SEAYORA_PAIRING_CODE set to your code. It still needs host networking, which the file already asks for.
• Or, with Homebrew: brew install iziel4280/seayora/seabridge, then seabridge ABCD-2345. It installs the same package Seayora signed and asks for your password the first time. The bridge keeps itself up to date, so brew upgrade only matters for the next new install, and brew uninstall removes only the installer — remove the bridge itself with seabridge uninstall. Homebrew on 64-bit Linux works the same way.

With no computer: a Raspberry Pi on the PoE switch

A Raspberry Pi that takes its power from the camera switch runs the bridge with no outlet, no screen and no other computer at the property. The Raspberry Pi kit sets it up from the memory card: there is nothing to type on the Pi.

A video walks through this, and the OpenWrt, MikroTik, Cisco and Docker ways below: youtube.com/watch?v=UEEeRdlVwAI

• You need a Raspberry Pi 3, 4 or 5 with an Ethernet port; a PoE HAT made for that model, or a PoE splitter with a USB-C (Pi 4 and 5) or micro-USB (Pi 3) plug; a microSD card of 32 GB or more; and, once, a computer with a card reader. The switch port must supply PoE (802.3af) or PoE+ (802.3at); a Pi 5 with a HAT wants PoE+.
• Download the Raspberry Pi kit from the pairing screen (choose Raspberry Pi on the PoE switch) or from seayora.com/download/bridge.
• Install Raspberry Pi Imager from raspberrypi.com/software, choose your Pi, then Raspberry Pi OS (other), then Raspberry Pi OS Lite (64-bit), and write it to the card. When Imager offers to customize the settings, choose No — the kit does that.
• Open the card’s drive called bootfs on the computer, copy the kit’s user-data and seabridge.txt onto it (replacing user-data), and put your pairing code after SEAYORA_PAIRING_CODE= in seabridge.txt. The code works once, for thirty minutes, so make it when the card is ready to go in.
• Put the card in the Pi and plug the Pi into the switch. On its first start it installs the bridge as a service and pairs it; within about ten minutes it shows as online on the Bridges page. From then on it starts the bridge every time it is switched on, and takes the code out of seabridge.txt.
• If it does not appear, switch it off and open seabridge-status.txt on the card’s bootfs drive: it says what happened (most often, a code that expired before the Pi started — put in a new one and switch it on again). Nobody signs in to the Pi, and password sign-in is off; to be able to sign in over SSH, put your public key in user-data before the first start, where it says.
• Recordings kept on the Pi go on the memory card. For more than a little footage, record in the cloud or point the bridge at a USB drive.
• The Pi keeps itself patched: the bridge installs the releases Seayora signs, and once it has paired the Pi turns on Debian’s own nightly security updates for its system.

On an OpenWrt router or switch

A router or switch running OpenWrt 23.05 or later on a 64-bit processor — x86, or ARM64 — runs the bridge itself, as an ordinary OpenWrt service: no Docker, no container and no other computer. It needs at least 512 MB of memory and about 1 GB of storage, its own or a USB disk. Most small home routers are MIPS or 32-bit ARM with a few megabytes of flash, and cannot run it; a mini PC or an ARM64 board running OpenWrt can. Sign in to it over SSH as root and run what Seayora shows (choose OpenWrt router or switch):

wget -q -O - https://seayora.com/bridge.sh | sh -s -- ABCD-2345

• OpenWrt has no sudo and no curl to begin with, which is why the line uses its own wget and runs as root. The installer adds curl, FFmpeg and the libraries Node.js needs from OpenWrt’s own packages — with opkg up to OpenWrt 24.10, and apk from 25.12, which replaced it — so the router needs to reach downloads.openwrt.org.
• It installs the bridge as a procd service that starts with the router and starts the bridge again if it ever stops, under a user of its own. seabridge status shows how it is doing; seabridge logs follows its log.
• OpenWrt keeps /var in memory, so everything goes under /opt/seayora. To keep it on a USB disk instead, format the disk ext4 and add --dir and a folder on it: … | sh -s -- ABCD-2345 --dir /mnt/sda1/seayora. Recordings kept at the property go there too.
• To remove it: seabridge uninstall (add --purge to remove its data as well).

On a MikroTik router or switch

A MikroTik with RouterOS 7.21 or later can run the bridge itself, in a container on the bridge the cameras are on — RouterOS’s own container feature, free from MikroTik, not Docker. It needs an ARM, ARM64 or x86 processor (MikroTik’s MIPS models cannot run containers), the container package, and a USB or other disk formatted as ext4 — the bridge, its data and any recordings go there, never on the router’s own flash.

• Install the container package: download the extra packages for your RouterOS version and processor from mikrotik.com/download, drag container-<version>.npk onto Files (in WinBox or WebFig), and reboot. /system/package/print then lists container.
• Format the disk if it is new: /disk/format usb1 file-system=ext4 (this erases it; /disk print shows its name).
• Turn on container mode: /system/device-mode/update container=yes, then within five minutes press the reset button briefly, or power-cycle an x86 or a virtual router. RouterOS asks for this physical step so that nobody can turn containers on remotely.
• In Seayora, add a bridge and choose MikroTik. Paste its lines into the router’s Terminal (WinBox: New Terminal). Check the two names on its first line: the disk, and the bridge the cameras are on.

# Seayora Bridge on this MikroTik. Check the two names first: the disk (/disk print)
# and the bridge the cameras are on (/interface/bridge print).
{
:local disk "usb1"; :local lan "bridge"
/container/config/set registry-url=https://registry-1.docker.io tmpdir="$disk/seayora/pull"
:if ([:len [/interface/veth/find name=seayora-bridge]] = 0) do={ /interface/veth/add name=seayora-bridge dhcp=yes }
:if ([:len [/interface/bridge/port/find interface=seayora-bridge]] = 0) do={ /interface/bridge/port/add bridge=$lan interface=seayora-bridge }
/tool/fetch url="https://seayora.com/api/cameras/bridge/container.sh" dst-path="$disk/seayora/data/start.sh" check-certificate=yes
:if ([:len [/container/find name=seayora-bridge]] > 0) do={ /container/stop [find name=seayora-bridge]; :delay 5s; /container/remove [find name=seayora-bridge] }
/container/add name=seayora-bridge remote-image=library/alpine:3.22 interface=seayora-bridge root-dir="$disk/seayora/root" mount="$disk/seayora/data:/seayora" env="SEAYORA_PAIRING_CODE=ABCD-2345" entrypoint=/bin/sh cmd=/seayora/start.sh start-on-boot=yes logging=yes
:local n 0; :while (![/container/get [find name=seayora-bridge] stopped] && $n < 120) do={ :delay 5s; :set n ($n + 1) }
/container/start [find name=seayora-bridge]
}

• The router fetches Seayora’s start script over HTTPS with the certificate checked, pulls a small Alpine Linux image from Docker Hub, and starts it. On its first start the container installs the bridge onto the disk and pairs it; afterwards it starts the bridge at once, with nothing to download. It shows as online on the Bridges page within about ten minutes, and the router starts it again after a reboot.
• The container gets its own address on the cameras’ network from the network’s DHCP server, so it finds the cameras the way a computer plugged into that bridge would.
• Inside the container the bridge does not run as root: it runs as an account of its own (number 7400) that owns its data and cannot change its own program. RouterOS does not restart a container whose program has stopped, so the start script starts the bridge again itself, ten seconds after it stops, and at each start, at most once a week, it installs Alpine Linux’s own updates.
• Its messages are in the router’s log: /log print where topics~"container".
• If the code expired before the bridge paired, make a new one in Seayora and paste the lines again with it: they replace the container and keep the bridge’s data on the disk.

On a Cisco Catalyst switch

A Cisco Catalyst 9300 or 9400 with IOx application hosting (IOS XE 17), Network Advantage or DNA Advantage and Cisco’s SSD in the back USB port can run the bridge as an application on the cameras’ VLAN. The switch installs an image file rather than pulling one, so the image is made once, on any computer, from the container kit (choose Cisco Catalyst on the pairing screen, or download it from seayora.com/download/bridge). No Docker is needed: the kit’s make-image script downloads Alpine Linux’s minimal file system from Alpine itself, checks it against the fingerprint written in the script, adds Seayora’s start script and writes the two as the image file the switch installs. On Windows, in the kit’s folder:

powershell -ExecutionPolicy Bypass -File make-image.ps1

On a Mac or Linux, in the kit’s folder:

sh make-image.sh

Either writes seayora-bridge.tar, about 9 MB, beside the script. (With Docker, the kit’s Dockerfile makes the same image, if you prefer it.)

Copy seayora-bridge.tar to the switch’s SSD (usbflash1:), then paste the configuration Seayora shows — with your cameras’ VLAN in place of 10 and a free address, the mask, the gateway and a DNS server of that VLAN in place of the examples:

! Seayora Bridge on a Cisco Catalyst 9300 or 9400 with IOx. Copy seayora-bridge.tar,
! made with the container kit's make-image script, to usbflash1: first. Put the cameras' VLAN in place of 10,
! and a free address, the mask, the gateway and a DNS server of that VLAN in place of these.
configure terminal
iox
interface AppGigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10
app-hosting appid seayora
 app-vnic AppGigabitEthernet trunk
  vlan 10 guest-interface 0
   guest-ipaddress 192.168.10.250 netmask 255.255.255.0
 app-default-gateway 192.168.10.1 guest-interface 0
 name-server0 192.168.10.1
 app-resource profile custom
  cpu 7400
  memory 1024
 app-resource docker
  run-opts 1 "-e SEAYORA_PAIRING_CODE=ABCD-2345"
  run-opts 2 "-v $(APP_DATA):/seayora"
end
app-hosting install appid seayora package usbflash1:seayora-bridge.tar
app-hosting activate appid seayora
app-hosting start appid seayora

• The image holds only Alpine Linux and Seayora’s start script. On its first start it installs the bridge into the application’s own storage and pairs it; the bridge then keeps itself up to date, so the image never needs making again. As on a MikroTik, the bridge runs as an account of its own inside it rather than as root, is started again if it stops, and Alpine’s own updates are installed at most once a week.
• show app-hosting list shows it running; app-hosting connect appid seayora console shows what it is doing. On a 9400 the AppGigabitEthernet interface may have another number: show interfaces | include AppGig.
• The kit’s README has the same steps, and how to put in a new code if the first one expired.

On another router or switch with Docker

A router, switch or gateway whose way to add software is Docker or Podman can run the bridge in a small Alpine container, with host networking so it can see the cameras. A device running Linux that you can sign in to does not need this: the Linux command installs the bridge on it directly. Run what Seayora shows (choose Other device with Docker; for Podman, write podman in place of docker):

docker run -d --name seayora-bridge --restart unless-stopped --init --network host -e SEAYORA_PAIRING_CODE=ABCD-2345 -v seayora-bridge:/seayora alpine:3.22 sh -c '[ -f /seayora/start.sh ] || { wget -qO /seayora/start.sh.new https://seayora.com/api/cameras/bridge/container.sh && mv /seayora/start.sh.new /seayora/start.sh; }; exec sh /seayora/start.sh'

On its first start the container installs the bridge into the seayora-bridge volume and pairs it; afterwards it starts the bridge straight away, and Docker starts it again after a reboot. Inside it the bridge runs as an account of its own, not as root, and Alpine’s own updates are installed at most once a week. It needs about 1 GB of disk. docker logs seayora-bridge shows what it is doing.

Open-source programs the bridge runs

The bridge is Seayora’s own software. To do its job it runs these open-source programs, each under its own license, which governs your use of it; nothing in Seayora’s terms limits the rights those licenses give you. An installed bridge also keeps their license texts in its licenses folder. The FFmpeg that runs on Windows is built by Seayora, and its complete source — the unmodified FFmpeg release, its signature and the build script — is published beside it.

On Windows, that FFmpeg reads H.264 video but does not decode H.265 (HEVC). An H.265 camera still streams live and records as normal, and a clip with no privacy mask is copied as it is. Snapshots, motion detection, people and vehicle recognition, and clips with a privacy mask all need a picture decoded, so the bridge takes them from the camera’s H.264 sub-stream. If the camera has none, the camera’s page says so: switch its sub-stream, or its main stream, to H.264 in the camera’s own settings. Clip sound in AAC is copied as it is; G.711 sound is converted to AAC by Windows itself. A Linux or Mac bridge runs an FFmpeg downloaded from its publisher, or the computer’s own, and that decodes both.

Back in Seayora the bridge now shows as online, with the computer’s name, its address on the property’s network, its version and how it was installed.

Press “Look for cameras” — a bridge that has just paired is searched straight away. Check the cameras you want (or “Choose all”), choose where they are and their username and password, and press Add: each becomes its own camera, with the password sealed on your device to the bridge’s key. A camera with a different password can be changed afterwards from its own settings, and “Add” on a single row opens the full setup for one camera. The bridge asks its network, then tries every address on it, so a camera appears even when the network filters the usual broadcast — the screen says when that happened. A device with a video stream but no ONVIF is listed as “RTSP only” and added by its RTSP address.

Networks, switches and VLANs

• The bridge finds cameras three ways: it asks the network (ONVIF WS-Discovery and SSDP), then asks every address on it directly, then checks the ports cameras stream video on. A managed switch with IGMP snooping — most business switches — often drops the broadcast cameras are normally found by; the direct search finds them anyway, and nothing on the switch needs changing.
• It searches the private networks the computer is connected to. On a network larger than /22 it searches the /24 around its own address, and it never searches more than 4,096 addresses at once.
• Cameras on a separate network — a camera VLAN, a second building — are found once that network is added under “Other networks” on the discovery screen, for example 10.0.20.0/24, and the bridge computer has a route to it. Seayora accepts private networks only, none wider than /20, up to 16.
• A camera whose address changes — the router handed it a new one — is followed. The bridge recognizes it by its hardware address or its ONVIF identity, carries on at the new address, and Seayora updates the camera to match.
• Outgoing connections only, and HTTPS to seayora.com is all it needs — the list for IT, the proxy and certificate settings, and what it does when a firewall blocks the media port are just below.

For IT: what the bridge needs from the network

• Nothing inbound, ever: no port forward and no open port on the router or on the bridge computer. Its recorder listens on the computer itself (127.0.0.1) only.
• A network that lets out only web traffic still works: the bridge tries the media server’s own port, and when that is blocked it sends the same video inside an ordinary HTTPS connection to seayora.com, where it is still checked against the bridge’s token. Seayora says under the bridge which route it is using. To start on that route, set SEAYORA_MEDIA_ROUTE=tunnel before installing (auto is the default; direct never uses port 443 for video).
• Behind a proxy, add --proxy http://proxy.example:3128 to the Linux or Mac command (a user name and password can go in the address); on Windows the proxy the computer already uses is picked up by itself, or set SEAYORA_PROXY first. The proxy only relays the encrypted connection: the bridge checks Seayora’s own certificate through it. NO_PROXY is honored; SOCKS is not supported.
• A firewall that inspects HTTPS with its own certificate: the bridge trusts the computer’s own certificate store — where IT puts that certificate — as well as its own list, so this usually just works. Otherwise add --ca-file and the certificate in PEM form (SEAYORA_CA_FILE on Windows); the installer copies it beside the bridge so the service can read it. The bridge never stops checking certificates.
• A network that allows seayora.com and nothing else: add --via seayora to fetch every program through Seayora.
• sudo seabridge doctor, run on the bridge computer, checks every line of this — including both video routes and each camera — and says what to fix.

How the bridge keeps itself safe

• Every release is signed by Seayora (Ed25519). Each time the bridge starts it checks every one of its files against that signature; if anything differs, Seayora says so in red under the bridge, and the bridge keeps recording while you put it right with the update command.
• The installer checks the same signature before anything is installed, and refuses a copy that is not Seayora's — so a download altered on the way, by a firewall that inspects HTTPS or anything else between the computer and Seayora, is not installed and nothing on the computer is changed. It also refuses a download that did not arrive with Seayora's fingerprint at all.
• It runs as its own user with no administrator rights. On Linux the service is locked down further: the rest of the system is read-only to it, home folders are hidden from it, and it cannot gain privileges.
• Its private key and token live in its data folder, readable only by the bridge. Camera passwords are sealed to that key in your browser or on your phone before they are sent, so Seayora stores them in a form it cannot read.
• It checks the certificate of every server it connects to, never sends its token on to wherever a redirect points, and never runs a download it has not checked against its SHA-256 fingerprint.
• It searches private networks only, and only the ones it is connected to or you added.

Updates

• The bridge keeps itself up to date. Every six hours it asks Seayora for the latest release, downloads it and checks every file against Seayora’s signature, then switches over between 1 and 5 in the morning by its own clock, when nobody is watching live and no clip is being uploaded. It never moves to an older release.
• A new release is on trial until it has reached Seayora. If it cannot — it stops three times, or fifteen minutes pass — the bridge goes back to the version it had by itself, never tries that release again, and Seayora says so under the bridge.
• A release that needs a newer MediaMTX or FFmpeg is installed by the installer, not by the bridge: Seayora says so, and you run the update command below.
• To update at another time, set SEAYORA_UPDATE_WINDOW (for example 02-04, or any) before running the installer. To update only by hand, set SEAYORA_AUTO_UPDATE=0 and run the update command when you choose.

The update command installs the latest release and puts right anything that changed. The bridge keeps its pairing, so nothing is paired again and no camera password needs entering again:

sudo seabridge update

On Windows, run seabridge update in a terminal opened as Administrator. Both run the same installer as the commands below, which also update a bridge installed before the seabridge command existed:

curl -fsSL https://seayora.com/bridge | sudo sh -s -- --update

$env:SEAYORA_UPDATE='1'; irm https://seayora.com/bridge.ps1 | iex

In Docker, add --docker to the Linux command. To remove the bridge, run seabridge uninstall — or use --uninstall in place of --update (SEAYORA_UNINSTALL on Windows). Its data and recordings are kept unless you add --purge (SEAYORA_PURGE). Retire it in Seayora as well, so its token stops working.

• The data folder holds the bridge’s key and token. Back it up, never share it, and never delete it: a bridge that loses it has to be paired again, and every camera’s password entered again in Seayora.
• Camera passwords are sealed in your browser — or on your phone — to the bridge’s own key before they are sent, so Seayora stores them in a form it cannot read. If the bridge is paired again with a new key, the camera screens say which passwords need entering again.
• Moving to new hardware: use “Pair again” rather than adding a second bridge, and the cameras stay attached.

Installing from the file instead

If you would rather read what you are installing before you run anything, press “Download the bridge” on the pairing screen: a .tar.gz, or a .zip for Windows, of about 200 KB. It is the release the command installs; release/release.json inside it lists every file with its SHA-256 fingerprint, and Seayora signs that list. The installer inside is the same script the one-line command runs. From the unpacked folder:

tar -xzf seayora-bridge-1.4.0.tar.gz
cd seayora-bridge
sudo sh install.sh ABCD-2345

On Windows, unblock the .zip first (right-click it, then Properties, then Unblock), unpack it, and in PowerShell opened as Administrator in that folder:

$env:SEAYORA_PAIRING_CODE='ABCD-2345'
powershell -ExecutionPolicy Bypass -File .\install.ps1

Either way the installer still fetches the release from Seayora and checks it against the signature, so what runs is exactly what Seayora signed. To run it in Docker from the folder instead, run SEAYORA_PAIRING_CODE=ABCD-2345 docker compose up -d --build there; docker logs -f seayora-bridge shows it pair.

Checking on a bridge

On the bridge computer, seabridge status says what the bridge is doing, and seabridge doctor checks everything it depends on — the programs it runs, its files against Seayora’s signature, its data folder and disk, the networks it is on, the proxy, DNS, the computer’s clock, the connection to Seayora, both routes to the media server (its own port and port 443), whether the programs’ publishers can be reached, and whether each camera answers — and says what to fix:

sudo seabridge doctor
sudo seabridge status
sudo seabridge logs
sudo seabridge restart

On Windows, the same commands without sudo, in a terminal opened as Administrator. In Docker: docker exec seayora-bridge node launcher.js doctor. The older forms — seayora-bridge --doctor and --status — still work.

When something goes wrong on the bridge itself

From bridge 1.6.1, a bridge tells Seayora when something goes wrong in the bridge program — it crashes, it cannot start, it stops without shutting down cleanly (killed for memory, for example), its recorder or FFmpeg cannot run on that computer, or a camera answers in a way the bridge cannot use. It writes a report on the computer first and sends it the next time it can, so a crash is not lost because the bridge was down. Seayora uses these to find problems that only happen on one kind of machine — a Raspberry Pi, a particular NAS, a router, Windows or a Mac — and to fix them in the next release.

A report says what broke, the bridge’s version and what kind of computer it is. Passwords, the bridge’s token and the computer’s name are taken out first; it never contains a picture or a recording. A camera that is unplugged, or a wrong camera password, is not reported — that shows on the camera’s own page instead. seabridge status shows whether reports are on and how many are waiting to be sent. To switch them off, set SEAYORA_CRASH_REPORTS=off before running the installer (it is kept for the service), or in the bridge’s environment in Docker.

Watching live

The Live tab is a wall of every camera — 1, 4, 9 or 16 at a time, or one large with five or seven around it. Arrange a wall and save it as a layout, share it with your team, and set it to tour (move on by itself) for a screen at the front desk. The wall uses each camera’s smaller stream so a grid does not overwhelm a laptop; a single camera asks for the best the camera has. On a slow connection, switch the wall to Pictures. A tile scrolled off screen stops streaming.

Live video starts over WebRTC and falls back to HLS where a network blocks it. A camera behind a bridge starts streaming when somebody opens it, so the first picture can take a few seconds — the tile says “Starting the camera at the property” while it does.

Recordings and the timeline

• Each camera records always, when something happens (a few seconds before and after each event — the usual choice), on a weekly schedule in the property’s own time zone, or not at all (live only).
• Footage is kept on the bridge, in Seayora’s cloud, or both, for 1 to 365 days, then deleted automatically — unless the camera is on legal hold.
• Footage in Seayora’s cloud counts against your cloud storage allowance. When it is full, the oldest footage is deleted first or cloud recording pauses — you choose, under Cloud storage, where you also choose what goes first (the oldest, or footage in which nothing moved) and which cameras give up footage first. Footage on legal hold, in an export or a live share, and bookmarked moments are never deleted to make room. See Seayora Storage.
• Footage on a bridge loops: new footage keeps being saved, and when the bridge’s disk — or the space you gave recordings under Recording space on the bridge — runs out, the oldest goes first. You can choose quiet footage first instead (the most recent hours always stay), or stop recording when it is full. It always keeps part of the disk free, and never removes the piece being recorded, anything on legal hold or a bookmarked moment. The bridge’s card shows how much it keeps and about how many days of room are left.
• Open a camera and click its timeline to play from any moment. The timeline shows what is recorded in the cloud and on the bridge as separate rows, with every event and bookmark marked on it. A camera recording “when something happens” is supposed to have gaps.
• Rewind from live in one tap — 10 seconds, 30 seconds, a minute or five — on the website and in both apps. On a computer, the left arrow does the same.
• While a recording plays: skip back or forward 10 or 30 seconds, step a frame at a time, play at anything from a quarter speed to 16 times, and jump to the previous or next event — only of the kinds you picked on the timeline, if you picked some.
• Playback carries on by itself into the next recording, skipping any gap and saying so, until it catches up with now and goes back to live.
• The clock over the picture is the building’s. Cloud footage is played one unbroken stretch at a time, so its clock is exact; footage fetched from a bridge says “About”, because the bridge may have skipped a gap. Click a moment where nothing was recorded and it plays from where the footage picks up, and says so.
• Zoom the timeline from 15 minutes to 7 days, go straight to a date and time — typed in the property’s time zone — show only some kinds of event, and point at an event to see its picture before you play it.
• Keyboard shortcuts on the website: Space plays and pauses, the arrows skip 10 seconds (a minute with Shift), comma and full stop step a frame, minus and plus change the speed, [ and ] go to the previous and next event, F is full screen, M is sound, L goes back to live, and ? lists them all.
• In the apps, Recent events under the picture shows the latest events with their pictures; tap one to play it from a few seconds before.
• Footage kept on the bridge is fetched when you ask for it, so playing it can take a minute; cloud footage plays at once.
• Every time on these screens is the property’s local time, because footage is evidence about a place.

Events and rules

Cameras and recorders report motion, people, vehicles, animals, packages, a line crossed, somebody entering a zone or loitering, tampering, a doorbell, an alarm input, and going offline and back. They land in the Events tab with a picture where the camera sent one, until somebody acknowledges or dismisses them. A camera or recorder that can call a web address when it sees something — Hikvision, Axis, DW Spectrum’s “Do HTTP request” — can report to its own event address, found under the camera’s Connection settings.

• A rule watches a property (or some of its cameras) for some kinds of event, optionally inside hours and days you choose, and then alerts in the app, emails, raises a work order, bookmarks the timeline, or keeps a clip of the moment in the cloud.
• A rule waits between alerts (ten minutes unless you change it), so ten motion events in a minute page somebody once.
• Emails and alerts go only to people who run the property.
• AI descriptions are off unless you switch them on for a camera. When on, a short description of each event’s picture is written by a model, labeled as AI-written, and never identifies anybody.
• A rule can carry instructions — what whoever handles one of its events should do, like who to call. They are shown on every event the rule fires for, on the website and both apps.
• A rule can run only while the property is armed (see Security modes, below), so an after-hours rule does not page anybody during the day.
• Send to webhooks hands the event to your own integrations — Settings → Developer → Webhooks — as camera.event.raised, signed like every Seayora webhook. It carries the camera, the property, the kind of event and the time, never a picture or a link that opens one.

Handling an event: the alarm desk

Events stay on the Open list until somebody closes them. Open an event to take it (it is yours, and it shows as Being handled), give it to somebody else who runs the property (they are told), add notes, and close it as Resolved, a False alarm or Dismissed. Every step and every note is kept with the event, and notes cannot be edited or deleted — they are part of the record. The Mine view shows what you have taken. On the Rules tab each rule shows how its events were closed over the last 30 days, so a rule whose events are mostly false alarms is easy to spot and narrow.

Press "Issue the event report" on an event for a PDF of it as it stands — what was seen, the camera and the property, what the rules did and what they said to do, who handled it, every note exactly as written, the history and the bookmarked moments — to hand to the police, an insurer or a housing agency, or to keep on file. It goes in Documents for you and the camera’s account. It contains no picture or video: to hand footage to somebody, export a clip, which comes with its own certificate. Pressing it again with nothing new gives you the same report; after a new note or step the new report replaces the earlier one, which is kept and marked as replaced.

Buttons and "Report something"

A rule can run when somebody presses a button instead of when a camera reports something — a soft trigger. Choose "Somebody presses a button" when you write the rule and give the button its words, like "Trespasser" or "Call the guard company". The button then appears on each of the rule’s cameras for the people who run the property; pressing it records an event with the camera’s latest picture and does what the rule says — an alert, an email, a work order, a bookmark, a webhook. Pressing it twice inside the rule’s quiet period sends nothing twice, and Seayora says so. "Report something" on any camera does the same with your own words, and runs any rule that watches for reports.

Security modes: Normal, Armed and Incident

• Normal: every camera records the way it is set to and every rule runs on its own schedule.
• Armed: rules marked "only while armed" run too — for a building that is closed for the night or the holidays. You can choose when it disarms on its own, or leave it armed until somebody disarms it.
• Incident: something is happening now. Every camera at the property that records switches to recording all the time, the moment is bookmarked on every camera so it is kept even when a disk or the cloud allowance fills, and everybody who runs the property gets an alert and an email. It ends on its own after the hours you choose (1 to 72; 4 unless you change it), or when somebody ends it.
• A camera set to live only stays live only during an incident. Footage recorded in the cloud during an incident counts against the account’s storage like any other.
• Every change is written to the cameras access log with who made it and why. Change the mode from the Cameras page on the website, or Security modes on the cameras screen of either app.

The picture check: knocked, covered or out of focus

Switch on the picture check for a camera and Seayora compares each picture it keeps with the views it learned as normal. It tells you when the camera has been knocked or turned, when the lens is covered or the picture is blank, and when the picture has lost its detail (out of focus, or a lens that needs cleaning). It compares the shapes in the picture, not its brightness, so lights coming on and people walking past do not count, and it waits for three pictures in a row before saying anything. If a camera’s night view looks different, or you moved it on purpose, press "This view is normal too" — up to three normal views are kept. Parts of the picture under a privacy mask are left out.

Moving a camera

A pan-tilt-zoom camera behind a bridge shows a pad on its page: hold an arrow to move and let go to stop, zoom in and out, go home, go to a saved position, or save the current one.

Fisheye and 360° cameras

A fisheye camera shows a whole room as one round, curved picture. Tell Seayora a camera has a fisheye lens and its live view is flattened into a normal view you can look around in: drag to turn, pinch or scroll to zoom, and Reset view to go back. It works the same on the website and in both apps, and Dewarp off shows the round picture again.

• Set it under the camera’s Settings, then Lens: choose Fisheye, say how the camera is mounted (on the ceiling looking down, on a wall looking out, or on a floor or desk looking up) and the lens’s field of view — 180° for most, 360° for a panoramic camera — between 120° and 360°.
• If the round picture is not in the middle of the frame, move the circle’s center and change its size until the outline on the preview sits on the edge of the picture.
• Flattening happens on your own screen. Nothing about the recording changes, and pictures, clips and exports keep the round view.
• Privacy masks are drawn on the round picture, so they black out the same place in the flattened view — it is never left uncovered.

Privacy masks and motion zones

Draw black shapes over anything a camera should not show — a neighbor’s window, a unit’s front door, a keypad. Masks cover the live view, pictures and playback on every screen, and on a bridge they are burned into exports. Motion zones do the opposite job: they tell a bridge where movement counts, so trees and a busy street stop setting off events.

A mask can be marked Liftable. Somebody who runs the property can then uncover it for 15 minutes from the camera’s page — after giving a reason, which goes on the access log with their name before anything is uncovered. It comes back by itself. A lift only changes what that person’s live view and playback draw: pictures, clips and exports keep every mask, liftable or not, and Seayora staff, residents and share links can never lift one.

Motion detection and tracking

A Seayora Bridge can watch a camera for movement itself. It is off unless you switch it on for a camera: Settings, then Motion detection, on the website or in either app. The bridge compares each moment of the camera’s smaller stream with the last few seconds, on the bridge computer at the property, and follows each thing that moves; it never identifies anybody, and each camera it watches uses some of that computer’s processor. A camera connected to Seayora directly relies on its own motion events instead.

• Set the sensitivity (1 to 10) and a separate one for night, how much of the picture must move (0.1% to 50%, of the motion zones when there are any), the smallest thing that counts (0.05% to 10% of the picture), for how long (0 to 30 seconds), how long to wait before raising another motion event (5 to 600 seconds), and the detail it looks at — standard, or high for small or distant things.
• It is more than comparing pictures: each part of the picture learns its own noise, so a grainy night picture needs a bigger change than a clean daytime one; a change in the whole picture’s brightness — the camera adjusting, a cloud — is ignored; lone specks are dropped; and, unless you switch it off, swaying trees, flags and water are ignored while they sway.
• Each thing that moves is followed on its own. A motion event carries when it started and stopped, where in the picture it happened, how many things moved and, unless you switch it off, the path each one took — drawn over the event’s picture on the website and in both apps.
• Lines: draw up to four lines on the camera’s picture on the website. Something crossing one raises a “Line crossed” event — either way, only the way its arrow points, or only against it.
• Loitering: choose how long one thing may stay in view — 10 seconds to 5 minutes — before a “Loitering” event is raised.
• Schedule: raise motion events only during the hours and days you choose, in the property’s time zone. Movement is still measured around the clock for the timeline and search.
• People, vehicles and animals: switch recognition on and the bridge also says what moved. It is open source (ONNX Runtime and the YOLOX-Nano model), downloaded by the bridge once, the first time you switch it on, and run on the bridge — no picture leaves it for this, and it never says who anybody is. Each person, vehicle or animal is its own event, so a rule can alert on people only; choose what to recognize and how sure it must be. “Only alert when a person, vehicle or animal is seen” cuts alerts from shadows, rain and headlights — and while the detector is not running, any movement still alerts, so a problem never looks like a quiet night.
• While it is on, motion the camera reports itself is ignored so nothing is reported twice. People, vehicles and packages the camera recognizes still come through.
• The timeline shows a movement strip under the recordings: taller means more of the picture moved. Movement during the wait between events still shows there.
• Search motion: draw a box on the picture (on the website) or pick squares of a 3 × 3 grid (on the website and in both apps), choose how far back and how much must have moved, and Seayora lists the stretches of time and the motion events whose movement touched it, each with Play.
• A search finds only what the bridge measured while motion detection was on. That record, a movement level and the grid squares that moved for each minute, is kept for 35 days, separately from the footage.
• Anything under a privacy mask never counts as movement, and motion zones decide where movement counts.
• The camera’s page says whether the bridge is watching, starting, or could not start (with the reason), and whether the detector is ready, still downloading, or why it is not running.

Sound

Cameras record video only. Recording a conversation a camera is not part of can be unlawful interception under federal law wherever people expect privacy, and a number of states require the consent of everybody recorded. To switch sound on for a camera you type its name, confirm signs are posted, and accept a statement written for the state the property is in; it is stored word for word with your name and the time, and the owner is emailed if somebody else switched it on. We recommend leaving sound off.

Talking through a camera

A camera with a speaker can be talked through — to a delivery driver at the gate, or somebody at the door. It needs a Seayora Bridge at the property and a camera that offers its speaker over ONVIF (most door and gate cameras with a speaker do). Switch it on per camera in its Sound settings, typing the camera’s name to confirm. Then press Talk on the live picture, on the website or in either app, and press Stop talking when you are done.

• Only the people who manage the building can talk — never residents, and never Seayora staff — and only one person at a time on each camera, for up to two minutes at once.
• Nothing is recorded. The sound goes from your microphone, through Seayora and the bridge, to the camera’s speaker, and is not stored anywhere. Each time somebody talks is on the camera’s access log: who, when and for how long.
• Talking stops when you leave the camera, switch apps or lock the phone, so nobody is left talking into a lobby by accident.
• If the bridge finds the camera has no speaker, Seayora says so and stops offering Talk on it. Switching Talk off and on again asks the camera afresh — after a firmware update, for example.

Residents

Every resident sees, under My Home → Building cameras, where each camera in their building is, what it keeps and who can see it — whether or not they can watch it. You can let residents watch a particular camera live (the front door, the package room), and optionally play back the last few hours. A leasing or management office can never be shown to residents.

Who can watch, and the access log

• On a management company, “Security cameras” is a permission of its own: none, view or full. A view-only teammate can watch; downloading an export needs full access.
• A camera can be restricted to named people, which narrows who can watch it and never widens it.
• A management company can share a camera with the building’s owner, read-only.
• Seayora’s own support staff cannot open your footage.
• Every live view, playback, picture opened, export, share link made or opened, and change to a camera is written to the access log before it happens. Each entry carries the fingerprint of the one before it, so “Check the log” can tell you whether any entry was changed or removed. The log is kept for three years.

Evidence: exports, share links and legal requests

• Export up to an hour of footage at full quality, with a reason — the reason is part of the record. The file is fingerprinted (SHA-256) when it arrives and, where the server has a signing key, its manifest is signed. Exports are kept for 90 days, or until you release them if they are linked to a legal request.
• A share link hands an export, a clip or a live view to somebody outside — a detective, an adjuster, a lawyer — for up to a week (a day for live), with an optional passcode and a limit on how many times it can be opened. The link is shown once; every open is on the access log; you can withdraw it at any time.
• Every sealed export also gets a footage certificate — a PDF in Documents naming the camera, the property, the time covered, the reason and the file’s fingerprint — for an insurer, a lawyer or a court. Attach an export to an eviction case from the case’s record, and the certificate goes with it.
• From a door’s access log, a delivered package, or an event, “Watch this moment” opens the camera that saw it at that time.
• A legal hold stops a camera’s footage being deleted anywhere until you release it.
• Record subpoenas, warrants, police requests and insurance claims under Legal requests: who asked, by when, for which cameras and times, and which exports answered it. Seayora does not decide whether you must comply — that is a question for your lawyer.

Checking an export

Anybody can check a file at seayora.com/verify-footage. Their browser works out the file’s fingerprint — the file itself never leaves their computer — and Seayora says whether it is byte-for-byte an export it sealed, when, from which camera, and whether the signature still checks out. A file that was re-encoded, trimmed or converted will not match even though it shows the same footage.

AI assistants

An assistant connected to Seayora with the “Security camera status” permission can answer “is every camera recording?” and “did anything happen at the package room last night?” from the same data as this page. It never receives a picture, a recording or a live view, and it cannot acknowledge events, change a camera or share footage.

What Seayora does not do

• Seayora never identifies people by their face and does not offer license-plate recognition.
• Seayora is not a monitored security service. Nobody at Seayora watches your cameras or events, and Seayora will never dispatch a guard or contact emergency services. If a person or property is at risk, call the emergency number for your area.
• Seayora sells and installs no hardware. A camera, recorder or bridge that fails, or a recording that was never made, cannot be recovered by Seayora.

Related features and guides

• Doors, Intercoms & PoE Switches — Documentation. How to open and lock your buildings’ doors from Seayora, answer the doorbell with the live camera, send a guest pass to a cleaner or a contractor, lock a building down, read the record of every entry, and keep the PoE switch that powers your cameras and doorbells healthy.
• Seayora Storage: Messages Media and Camera Footage — Documentation. How the media you send in Messages and the footage your cameras record in Seayora’s cloud are stored, how much is included, what happens when it is full, and how plans and billing work for an account or a company.
• Compliance Alerts & Required Filings — Feature. Seayora watches your properties for new violations and works out which recurring filings each building owes, turns both into a dated checklist, and emails you when something new appears. Live violation data for New York City; rule-based filing obligations across the NYC metro.
• Voice Notes in Messaging — Feature. Record and send voice notes in any Seayora conversation. Transcoded server-side so they play on iPhone, Android, and desktop alike, stored with the thread, and searchable as part of the property record.
• Seayora on Apple Watch and Wear OS — Documentation. Connect an Apple Watch or a Wear OS watch, see what needs you and reply to messages from your wrist, put Seayora on your watch face — and why paying, signing and approving stay on your phone.
• Security Cameras at Rental Properties: Placement and Audio Laws — Guide. Where landlords may and may not put cameras, why audio recording is the bigger legal risk, and the all-party consent rules in California and Washington.

Explore Seayora

• All documentation
• Everything Seayora does
• Help center