Who Can See Your Security Footage? An Access Audit

The Question a Council or School Board Will Ask You

A board member leans toward the microphone and asks who can see the footage from the cameras the district just paid for. It's a fair question, and one you now have about fifteen seconds to answer, with no answer in your notes.

Most administrators know part of it. They know who was given a login, because someone approved each one. But footage can also be seen by the people you've given accounts to, plus anyone with a link you sent, plus anyone holding a copy that's already been downloaded. This page covers four access paths, with a way to check each one, and ends on a single sheet you can read aloud in this kind of meeting.

One thing this page doesn't answer: what the law permits you to record. That belongs to what your state actually allows.

Your User List Is Not Your Access List

Who can access your security camera footage? Four groups: people with an account in the camera software, anyone who was sent a shared link, anyone with a downloaded copy of the video, and the administrators who can grant access to any of the other three. A user list only covers the first group. An access list covers all four.

The difference comes down to one fact. A user list answers who has an account. An access list tells you who can see the video, which doesn't need an account.

The paths, in the order this audit covers them:

1. People with accounts
2. Links that need no account
3. Copies already downloaded
4. The administrators who can grant any of the three

Who Has an Account, and How to Pull the Full List

The first path is the one most people already check, and it still might have two surprises in it.

A person who was given an account and has since left the organization keeps it until someone removes it. The list to review is the current one, pulled today, not the one from the last audit. In a city, the current staff list usually sits with human resources or the clerk's office. In a district, it sits with the business office or the technology department. The person running the audit rarely owns it.

The second surprise comes from outside the system. Where sign-on runs through the organization's single sign-on, the one log-in a workplace uses across its tools, part of the answer lives with whoever runs that directory, often IT. In Coram, Google and Okta sign-on are set up under Settings > User Provisioning and work by syncing users from that directory.

1. In Coram, open Settings > Users in the web app. The list shows each person's name, email, roles, locations, user groups and last login.
2. Coram doesn't document an export of the user list, so record it from that screen for the audit file, keeping the roles, locations and last-login dates with each name.
3. Compare every name on the list against the current staff list.
4. Mark each person who's left, changed jobs, or can't be placed, and look twice at anyone whose last login is months old. Send the marked names to whoever is allowed to remove accounts.
5. If sign-on runs through single sign-on, ask whoever runs that directory for its current list and compare the two.
6. Write the total number of accounts on the audit sheet at the end of this page.

What Each Access Level Can Actually Do With Video

An account is not one straightforward thing. Watching one lobby camera live is very different from downloading a month of recordings from the system, and the answer a board hears has to tell them apart.

Access Levels, in Plain English

In Coram, each person's camera access is set by one of four roles, plus a No Access option. A separate Organization Admin setting manages users, locations and organization settings, but gives no camera access on its own.

The Line That Matters Most: Who Can Download or Share

Remove an account and the account holder can't view anything anymore. But a downloaded copy can't be called back, and it can be passed along to anyone. Your board wants to know about this possibility too.

So the audit question here isn't how many people have access. It's how many people can send footage out into the world, irreversibly. Count them separately and put that number on the audit sheet beside the total. In Coram, that count is everyone with a Site Admin, Regular or Limited role: a Limited user can't download, but can share a clip, and the person who receives a clip can download it.

For downloads, Coram lists requests on the Video Vault > Downloads tab. Site Admins see every request in the organization for the last 30 days, with the person who made it; everyone else sees only their own. Two limits matter for an audit: requests drop off that list after 30 days, and downloads made from inside an archive go straight to the browser and don't appear there. So, check the tab on a schedule, and don't treat it as a full history.

Where Each Person's Access Stops

Access is scoped by the places a person works as well as by their level in the organization. A person can hold the right level at the wrong building, and an audit that doesn't ask this question won't find it.

In a school district, the places are buildings: each school, the administration office, the bus garage. In a city they're sites and departments: city hall, the library, the public works yard, a parking structure. For each person on the list, which of these places can that person see?

First, don't assume that a person set up for specific locations was carried into a location added afterward. A district that opened a new building last year or a city that opened a community center has two things to check: whether the people who should see the new place were added to it, and whether the people who shouldn't were left out. In Coram, a person given access to all locations picks up new ones automatically, but a person scoped to specific locations does not.

Second, a role at one site doesn't carry to the next. Someone who administers one building should be checked at the others as an ordinary user. Record each person's level once for every location because a job title a person holds might hide the difference. In Coram, a person can hold different roles at different locations, and the role that applies is the one held at that location, so a Site Admin at one school who is Regular at another has Regular rights there. Regular, Limited and Live Only access can also be narrowed to specific groups of cameras within a location.

The same question applies to who can open which door: scoping works the same way for doors, and a reader auditing cameras usually owns the doors too. Coram Access Control roles are also set per location.

The Shared Links You Forgot You Sent

This is the path no user list will ever show.

In a school district, someone sends a link to an insurance adjuster after a collision in the parking lot. Someone sends one to a parent who wants to see what happened at pickup. Someone sends one to a contractor who needs a look at the loading dock.

In a city, someone sends one to a contractor working at the public works yard. Someone sends one to a neighboring department that needs to watch a parking structure for a few days to measure traffic flow. Someone sends one to a resident asking about a car struck in a municipal lot.

Each is an ordinary favor, and each is a decision to let another person see a video.

In Coram, a shared link goes out by email or text message, and it can carry either a live view or a clip of past video. When a recipient opens it, the video plays in their browser, and no Coram account or sign-in is required. A clip can also be downloaded by whoever opens it. As a user, that's friction-free. But as an auditor, that requires caution. The recipient never appears in the user list, so there's no account to review, nothing to count, and nothing to remove. The link also works for anyone it's forwarded to.

The sender may not be the administrator who owns the audit. It might be the front office, a facilities manager or department head, or anyone else whose access level allows sharing, answering a phone call. In Coram, that's anyone with a Site Admin, Regular or Limited role. A link sent on a Tuesday to follow up on one call has no owner by the following spring.

The link keeps working until it expires. The person who creates the link sets the expiry at that moment, and it can be set as far as a year out. That makes live links a second list, separate from the accounts, and an audit built on user accounts won't contain it. The typical risk here is a link sent for a good reason in the moment, then forgotten, and still working months later.

Three questions to ask about each link: Who received it? Is there still a reason for that person to have it? When does it expire?

Take that link sent to the insurance adjuster as an example. Who received it? One person at the insurance company, and anyone they forwarded it to. Is there still a reason for that person to have it? Not once the claim is closed. When does it expire? On whatever date the sender chose that day, which may fall well past the claim closing. A link with those three answers is one you can now turn off, or one you'd have set a shorter expiry on.

The answer a board will want is short: how many links are live, who received each one, and the date each one ends.

Finding Links That Are Still Live

Coram doesn't offer a single organization-wide list of outstanding shared links, so this part of the audit has two sources.

1. Ask every person with a Site Admin, Regular or Limited role to list the links they have sent: who received each one and when it expires.
2. For archived video, open each archive in the Video Vault and check its Sharing With list, which shows every outside link and its expiry.
3. Check Settings > Access Logs, where every time an outside recipient opens a link appears as "External member, through public link." This shows links that have been used, not links that were sent and never opened.
4. For each live link, write down who received it, who sent it, and when it expires.
5. Mark every link with no current reason to exist, and every link whose expiry is further out than the reason for sharing it.

Turning a Link Off

1. Archive links: Open the archive in the Video Vault, select Share, and remove the person from the Sharing With list.
2. Archive and camera live links that have been opened: In Settings > Access Logs, find the entry and use Expire shared link.
3. Clip and live-view shares sent by email or text: These run until the expiry the sender set, and Coram doesn't document a way to end them early. Treat the expiry chosen at the moment of sharing as the control, and keep it short.
4. Open the link in a private browser window to confirm it no longer shows the video.

After a link ends, the recipient sees a message saying the video is no longer available.

Who Can Change Any of This

An audit is a photograph of access on the day it was taken. What matters next is who can change the picture afterward, and whether anyone has written that down.

Three things belong in the answer here: who can grant and remove access, where the record of those changes lives, and who can read that record. In Coram, Organization Admins manage users, locations and settings, and Site Admins manage camera settings at their locations. Changes to people's permissions are recorded in Settings > Access Logs, with each person's permissions before and after the change, and only Organization Admins can read that log or export it to CSV. Organization Admins can also turn on multi-factor authentication under Settings > Security, which then applies to every user through an authenticator app.

Then name a small number of people who hold the power to change access, and write their names on the audit sheet. Set a date to run the check again and write that on the sheet too.

The One-Page Answer You Can Hand to a Board

Copy this table, fill in the second column, and bring it to the meeting.

The board member asked who can see the footage, and this sheet is the answer: a count for each path, the places those counts cover, and the names of people who can change them. It includes a date so the board also knows when the answer will be checked again. And you can read it all aloud in fifteen seconds.

‍