The basics
On the sticker price, yes - perpetual looks like "pay once and own it". The hidden costs are why the maths flips over 5-7 years.
A perpetual licence on HikCentral, Milestone XProtect or Genetec Security Center normally comes with a Software Maintenance Agreement (SMA / Care Plus / Software Assurance) priced at roughly 18-25% of the original licence per year - mandatory for updates and security patches. Five years of SMA is around 100-125% of the original price again.
Then there is the Windows server hardware refresh every 3-5 years, separately-licensed add-on modules (LPR, ANPR, AI, access), licence churn when a site shrinks (the SKUs are stranded on the original server), and major version upgrades that frequently re-bill as new licences. The "ownership" is partly theoretical - skip the SMA and the software ages out of compatibility within 18-24 months.
The TetherX platform subscription is one line that includes updates, support, security patches and channel-count scale-up / scale-down; cloud recording, TetherX AI and ARC monitoring are optional per-camera services.
Across most 5-7 year horizons, subscription beats perpetual on TCO and gives the integrator the renewal RMR instead of handing it to the vendor.
Cameras & hardware
Yes. TetherX is designed as a drop-in replacement for the management layer. The existing cameras stay on their site network and connect through a TetherBox gateway - the TetherBox software running on an existing server or PC at the site, or a dedicated unit from the TetherBox hardware range (compact in-vehicle / lamp-post models through to rackmount servers).
The TetherBox is the only thing that talks to the cloud - the cameras themselves never get Internet access, which ringfences them from external attack. No re-cabling, no re-mounting, no downtime.
This is the foundation of the iVMS-4200 / DSS Express, HikCentral and NDAA migration page paths.
TetherBox is the on-site gateway that every site needs. Every camera, NVR or IP device sits on the site network behind the TetherBox; the TetherBox is the only thing that talks to the cloud, over an outbound-only encrypted tunnel. This ringfences vulnerable kit from the public Internet by design.
It also records locally, runs analytics at the edge, and stays operational if the Internet drops.
Two paths to the same architecture. Option A: TetherBox software running on an existing server or PC already at the site - the simplest route when there is spare capacity. Option B: a dedicated TetherBox unit from the TetherBox hardware range - compact models that fit in vehicles, lamp posts and remote cabinets, mid-size units for typical sites, and rackmount servers for sites recording hundreds of cameras with long local retention.
UK customers get TetherBox hardware shipped direct; outside the UK your integrator sources a compatible unit locally. See the recommended hardware spec. TetherBoxes from over a decade ago still run the latest software - no planned obsolescence.
Yes - every site needs a TetherBox. Likely runs as the TetherBox software on an existing server or PC you already own at the site. Or pick a dedicated unit from the TetherBox hardware range - compact models for vehicles, lamp posts and remote cabinets through to rackmount servers recording hundreds of cameras with long local retention.
Either way the cameras stay on the site network behind it and have no direct path to the Internet; the TetherBox is the only thing that talks to the cloud. The architecture is what lets us promise no port forwarding, ringfenced cameras, local recording when the link drops, and edge analytics without a separate box.
Security & compliance
Compliance is a shared-responsibility model.
What TetherX provides: regional data residency, encryption in transit and at rest, per-camera retention controls, role-based access, full audit logging, tamper-evident SHA-1 evidence hashes, time-stamped exports, safe time-bound footage sharing and the ringfencing architecture that isolates cameras from the public Internet. That tooling is what each framework expects to see in a system audit.
What the customer and integrator are responsible for: picking the right camera brand (some frameworks - NDAA migration page, UK government high-secure, AU PSPF - mandate specific approved manufacturers), setting retention to the regulator-required minimum or maximum, restricting admin access to named individuals, training operators on lawful viewing, posting CCTV-in-operation signage, running DSAR / FOI workflows, and not granting blanket access to people who should not see the footage.
TetherX cannot prevent an authorised admin from over-sharing, just as a lock cannot prevent the keyholder from opening the door. The platform gives you the audit trail to detect it and the controls to limit it - the policy and the people decisions sit with the operator.
TetherX is UK-built and hosts in UK / EU data centres so deployments stay inside scope.
Frameworks the platform is designed to support: UK GDPR and Data Protection Act 2018, EU GDPR, the ICO Video Surveillance code, the Surveillance Camera Code of Practice, BS 7958 (CCTV management), BS EN 62676 / EN 50132 (video surveillance systems), BS 8418 (detector-activated CCTV), BS 5979 (Alarm Receiving Centres), NIS2 for in-scope operators, Cyber Essentials / Cyber Essentials Plus, ISO 27001 and SOC 2 cloud infrastructure.
Retention is configurable per camera to meet ICO data-minimisation. Audit trails, role-based access and the SHA-1 evidence hash support DSAR and court-admissible export workflows.
Caveat: GDPR also requires the operator to limit admin access to a justified named list, train viewers on lawful purpose and act on subject-access requests within statutory time - tooling we provide, decisions you make.
TetherX hosts in Australian data centres (Sydney) so customer data stays onshore by default; on-demand local clouds are available for sovereignty-critical deployments.
Privacy and breach reporting: the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Notifiable Data Breaches (NDB) scheme.
Critical infrastructure and federal: the Security of Critical Infrastructure Act 2018 (SOCI, expanded 2022 SLACIP), the Protective Security Policy Framework (PSPF) for federal sites, the Hosting Certification Framework, IRAP-aligned controls.
Cyber controls: the ASD Essential Eight Maturity Model, the ASD Information Security Manual (ISM), AS/NZS ISO/IEC 27001.
CCTV-specific and state law: the AS 4806 CCTV management series (AS 4806.1-4), state Surveillance Devices and Workplace Surveillance Acts (NSW Workplace Surveillance Act 2005, ACT Workplaces Act 2016, plus Surveillance Devices Acts in NSW, VIC, WA, QLD, SA and TAS).
Caveat: SOCI and PSPF require named-personnel access controls, retention to the specific class of asset, and incident reporting to ASD ACSC inside statutory windows - TetherX provides the audit trail and the access controls, the operator runs the policy and the reporting.
Compliance applies to the security workflow around the camera estate, not the cameras themselves.
PCI DSS: audit trail, role-based access, retention and tamper-evident export support retail and hospitality assessments.
HIPAA (US healthcare): regional storage, audit logging and BAA-ready cloud regions.
CJIS (US law enforcement): encryption-in-transit and at-rest plus access controls align with the security policy.
UK CPNI / NPSA: high-secure-site guidance addressed via the ringfencing architecture - cameras isolated behind the TetherBox, outbound-only tunnel.
Aviation, transport, energy: sector compliance (CAA, Network Rail, DCMA, Ofgem) sits on top of the install - TetherX provides the evidence trail; vertical-specific rules on retention, camera approval and operator vetting remain the operator's responsibility.
For security integrators
AI, search & features
Operations & scale
Still have questions?
Book a 20-minute demo with the TetherX team or start a free trial directly. No sales pressure, just an honest walk-through of the platform.
About this comparison. Information about other vendors is drawn from their public product pages, datasheets, integrator forums (Reddit, vendor user groups), public CVE databases (NVD, CISA) and customer conversations - accurate to the best of our knowledge as of 21 May 2026. Pricing, features, security posture and policies change. A vendor may have shipped a fix, dropped a price, added a region or changed an architecture since this page was last reviewed.
If you believe anything here is inaccurate or out of date, please contact us and we will review and correct it. Trademarks and product names belong to their respective owners and are referenced here for identification only.