Cloud VMS without the per-camera NAS license tax.

Synology offers C2 Surveillance / C2 Backup for Surveillance as a cloud overlay on top of Surveillance Station. It is a backup product - the NAS is still the recording layer; the cloud holds an off-site copy. Pricing ranges US$8.99 - US$199.99 per camera per year depending on retention and resolution.

TetherX is cloud-native from the start: cloud recording is an optional per-camera service that records directly to the cloud, with optional TetherBox edge-recording for sites with patchy connectivity. The same platform handles single-site, multi-site, multi-tenant - one architecture, not "NAS plus backup overlay".

The product itself is reasonably hardened. A search of cve.org for "Synology Surveillance" returned 25 records (May 2026); all 25 require an authenticated user. The procurement-relevant exposure is the DSM host operating system, not Surveillance Station: Synology DSM has been picked at Pwn2Own for pre-authenticated remote code execution chains in successive years (2024 DSM Photos chain is the most-cited example). If the NAS is compromised, the recordings on it are too.

Historical NAS-level events: SynoLocker (2014) ransomware mass-encrypted DiskStation drives; CVE-2025-13392 (DSM SSO bypass, disclosed May 2026) sat on the DSM host side. None of these are Surveillance Station bugs - they are reasons the recording surface should not be the only copy. TetherX cloud retention is the off-site, off-NAS layer that survives a local DSM compromise. See NDAA Section 889 for the broader compliance ringfence pattern.

Out of the box DS cam (the Synology mobile app for Surveillance Station) connects to the NAS through Synology QuickConnect, a vendor-hosted relay service. Synology's own support reply in their community forum is verbatim: "QuickConnect usually involves a relay service that can cause potential latency. On the other hand, port forwarding would build a direct connection between DS cam and Surveillance Station which may be better for latency-concerned environments." Field reports on r/synology describe 20-30 second buffer / connect times on live view through QuickConnect. The product is built with the assumption that the customer (or installer) will set up DDNS plus inbound port forwarding on the customer router so DS cam reaches the NAS directly, with QuickConnect as the temporary fallback while that is being configured.

The problem is that in many real environments port forwarding is not available - either technically or by policy:

CGNAT. Starlink, mobile broadband, most ISP-managed routers, and many corporate WANs share a single public IPv4 address across many customers (Carrier-Grade NAT). There is no public IP to forward a port to. Verbatim r/synology user: "I cannot figure out how to get DDNS to work because I have Starlink which uses CGNAT and doesn't have an accessible external IP address."

Corporate IT policy. Most managed network environments operating under PCI-DSS, ISO 27001, NIS2, NIST 800-53, IRAP / Essential Eight or equivalent will forbid an inbound port forward on the perimeter firewall as part of "default deny inbound" baseline controls. The integrator can explain QuickConnect is slow until port forwarding is set up; the IT director can equally explain port forwarding is never going to be set up.

Net result: in a meaningful share of real deployments, the QuickConnect vendor-relay is not a temporary state until port forwarding is configured - it is the permanent state, and the 20-30 second buffer is the permanent live-view experience.

TetherX uses an outbound-only connection from the customer site to TetherX cloud (the customer's router initiates the connection, no inbound port needed), which works through CGNAT and inside default-deny corporate firewalls without an exception, and live view does not depend on a vendor relay queue.