What actually makes a baby monitor secure

Every baby monitor sold today claims to be secure. The word appears on packaging for cameras with hard-coded admin passwords and on apps that keep a rolling month of your nursery footage in a bucket somewhere. It is not a claim you can evaluate, so it is worth replacing it with something you can.

Four questions decide it: what leaves the room, what is kept and for how long, who is allowed to join the stream, and what a breach of the vendor would expose. Encryption is part of the first question only. A monitor that encrypts everything in transit and then stores a month of footage on a server still has a month of your footage on a server.

Work through the four in order for any monitor you are considering, including this one.

1. What leaves the room

Something always leaves the room. The question is what.

At one end, a camera sends continuous video to the manufacturer's servers so that it can be analysed, indexed and played back later. At the other, a camera sends a live stream to one paired phone and keeps everything else local. Most products sit somewhere in between, and the difference is rarely advertised.

Analysis is the part people miss. If a monitor promises sleep insights, cry classification or breathing tracking, ask where the computation happens. A cloud classifier needs the audio or the video on a server to do its job. An on-device classifier needs neither. MonitorUltra runs cry detection on the baby unit itself using Apple's SoundAnalysis framework, so the sound is classified where it was recorded and only the resulting event crosses the network. I have written up the full argument for keeping that on the phone.

Notification content counts too. A push notification that carries a still image from the nursery has just put that image through Apple's or Google's delivery infrastructure and onto a lock screen that anyone near your phone can see. MonitorUltra's alerts carry the event type and a timestamp.

2. What is kept, and for how long

Retention is the single most useful thing to check, and it is usually buried in the privacy policy rather than the feature list.

Ask three specific things. Does the product record by default. Can recording be turned off completely, or only limited. How long is footage kept after you delete your account.

Anything stored is a thing that can be subpoenaed, sold in an acquisition, exposed by a misconfigured bucket, or accessed by an employee with a support tool. None of those are exotic scenarios. All of them have happened to camera companies.

MonitorUltra does not record. There is no clip history, no timeline to scroll back through, and no video or audio written to a server at any point. This is a real trade and I will not pretend otherwise: if you want to review what happened forty minutes ago, this is the wrong product for you. The case for a monitor that stores nothing goes into what you give up and what you get back.

3. Who is allowed to join the stream

Most consumer camera breaches happen here, at the credential layer, and no cryptography is involved in any of them.

The pattern is familiar. A camera has a web portal, the portal has an email-and-password login, the password was reused from a site that leaked in 2019, and somebody with a list runs it against every camera vendor's login page. No encryption anywhere in the product was defeated. Somebody simply logged in.

So the questions are practical ones. Is there a web portal at all, and can it be disabled. How do you add a second viewer: by scanning something in the room, or by sending a link to an email address. Is there two-factor authentication. What happens to access when a family member is removed.

MonitorUltra pairs by QR code. The baby unit generates a random secret on the device and displays it as a code. The parent unit scans it, in the room, and both devices keep the secret in the iOS Keychain. The server never receives the secret itself. There is no web viewer to log into and no public address a stream can be reached at. Access to a live session requires a credential issued to an attested copy of the app for a specific paired room, and that credential expires.

The credentials are also asymmetric by design. The one a parent device receives permits it to subscribe to the stream and does not permit it to publish. A parent device cannot push video or audio into the nursery even if the app were modified to try.

4. What a breach of the vendor would expose

Assume the company gets breached, because plenty do. Then ask what the attacker walks away with.

For a monitor that records to the cloud, the answer is footage from inside your home. For one that streams live and keeps nothing, the answer is account metadata. That still matters, and it sits at a different order of harm.

If MonitorUltra's backend were fully compromised, an attacker would find hashed room identifiers, push notification tokens, and, for people who created an optional account, an email address and subscription state. There is no video, no audio, no frames, no thumbnails and no transcripts, because none of those are ever written in the first place.

Why "encrypted" answers less than you think

Encryption in transit protects data as it crosses networks. It says nothing about what happens at either end of that journey. Video can be encrypted on the wire, decrypted on arrival at a server, analysed, and stored in plain form. That product is accurately described as encrypted.

The phrase that carries more weight is end-to-end, and it is used loosely enough that you should ask a follow-up: where do the keys live, and does the vendor hold a copy. If the vendor can show you your own footage in a web browser, it can decrypt it.

MonitorUltra's video and audio are encrypted in transit and relayed via LiveKit to the parent unit. That is the accurate description and I use it deliberately in preference to stronger phrasing.

What I am not going to claim

Some things get said about app-based monitors that are not true of this one.

It is not peer-to-peer. The stream is relayed through infrastructure. That is what lets it work when the parent unit is on cellular data and the baby unit is on home Wi-Fi.

It is not local-only. A monitor confined to one network cannot reach you in the garden, let alone at a neighbour's house. The relay is the price of that reach, and pretending otherwise would contradict the app's own privacy policy.

It does not track breathing or vital signs, and no camera alert should be treated as a substitute for supervision.

Family sharing involves a trade. If you add a second parent through an account rather than by handing them the phone to scan the QR code, the details needed to join are stored in your family's record, readable only by members of that family. Scanning the code in the room avoids that entirely. Both routes are described in the guide to watching one baby unit from several phones.

A checklist for any monitor

Seven things worth establishing before a camera goes into a nursery.

1. Does it record to a server by default, and can that be switched off completely.
2. Is there a web portal. If so, that login is the most likely way in.
3. How is a second viewer added, and how is access removed.
4. Where does any AI analysis run.
5. What does the privacy policy say about retention after account deletion.
6. Does the device still receive security updates, and for how long.
7. Does it ship with a default password you are allowed to keep.

If you already have a monitor running and something about it feels wrong, there is a separate piece on how to tell whether a monitor has been accessed.

Frequently asked questions

Can somebody watch my camera without my phone? Joining a session requires a credential issued by the backend to an attested copy of the app, tied to the room your two devices created when they paired. There is no public URL for a stream and no web viewer, so there is nothing to guess at or log into from a browser.

Is it end-to-end encrypted? Video and audio are encrypted in transit and relayed to the parent unit. I describe it that way rather than as end-to-end, because for a relayed stream the honest answer depends on where the keys live. Be sceptical of any monitor that uses the phrase without saying.

Do I need an account? No. QR pairing works without one. An account is only needed for family sharing and for managing a subscription bought on the web.

What happens to my data if I stop using the app? There is no footage to delete, because none was kept. Deleting an account removes the account record. Uninstalling removes the pairing secret with the app's Keychain entry.

Does any of this depend on my router being secure? Less than with a Wi-Fi camera, because the connection is outbound from both devices and there are no ports to forward. A compromised home network is still worth fixing on its own merits. MonitorUltra needs two iPhones or iPads running iOS 17 or later, and works over Wi-Fi and cellular.