Encryption and your recovery key

What’s encrypted

Every clip, segment and snapshot that leaves your home is encrypted on the hub with AES-256-GCM before upload. Each file has its own random key, which is itself sealed with your hub’s footage key. Your cloud provider stores only ciphertext, and so would anyone who got into your cloud account.

Encryption is authenticated: a single flipped bit, or a cut-off file, fails to decrypt instead of producing garbage.

Camera passwords and cloud tokens on the hub are encrypted too.

Your recovery key

Your recovery key is the footage key, written out as grouped letters and numbers. Find it in Settings → Security → Recovery key.

Save it now, somewhere offline: a password manager, or printed and put away. You need it to read your cloud footage if:

• the hub’s disk dies or the hub is stolen,
• you move to a new hub,
• you stop using Unicam.

Unicam does not have a copy. Without the recovery key, nobody can decrypt your cloud footage, including us. That’s the point, but it means a lost key and a lost hub together mean lost cloud footage.

Decrypt without Unicam

The Unicam decrypt tool turns encrypted files back into standard MP4s using only your recovery key, offline. It works even without a subscription, so your footage is never held hostage.

What isn’t encrypted

• Local recordings on the hub itself rely on your operating system’s file permissions. Turn on FileVault (Mac), BitLocker (Windows) or disk encryption (Linux) for the hub’s disk. Encrypting local footage at rest is on the roadmap.
• Push notifications contain only the camera name and event type, never an image.

Encryption and share links

Because encrypted clips can only be opened with your key, cloud share links work only for destinations without encryption. For evidence, use a signed export pack instead.