Where India's smart-camera apps point: a client-side infrastructure study

This began as a practical build. We set up a camera to watch a construction site at a village property and, once it was working, wanted to know where its video went. The deeper we looked, the less the answer matched the label on the box, so we widened the question from one camera to the market. This map is what came back.

Buy a home camera in India and the box tells you a brand. The brand tells you almost nothing about where the app's servers are. We took 27 camera and smart-home apps sold in India, read the backend hosts each one references, and looked up where those hosts resolved. Then we kept three facts apart that usually get collapsed into one: who owns the brand, who owns the cloud, and which infrastructure the host resolved to on the day we looked.

Those three facts diverge more than the label suggests. Five of the brands are Indian. Their backends showed five materially different infrastructure patterns, from a telecom operator's own network to OEM and platform hostnames that resolved to Alibaba Cloud infrastructure. The brand on the box and the cloud behind the app are two separate questions, and this is a map of the second one.

How we did it, and what that does not cover

The set is 21 companies and 27 apps. We selected a set covering major globally distributed apps, Indian consumer brands, telecom-operator camera services, and the common white-label ecosystems available to Indian buyers, including the white-label apps that ship with inexpensive cameras sold through Indian resellers. Wyze is in the set as a United States reference point despite thin official India retail, so that a reader can compare an American brand's hosting against the rest. Enterprise video-management systems and apps with no India availability are out.

What we examined was the publicly distributed Android application package for each app, hashed and kept. We read the hostnames, SDKs and network configuration present in the package as static text, then resolved those hostnames over DNS, followed CNAME chains, and looked up the answering address against published address ranges: AWS publishes its ranges, and Indian telecom operators have their own registered network numbers, so a host that answers from those is attributable with confidence. For one app, CP Plus ezyKam+, we also ran it and observed its first-party hosts at runtime; that is the only app in the set where the evidence is runtime rather than static or DNS-level.

The limits matter as much as the method. No vendor backend was scanned, fuzzed, enumerated, or accessed with unauthorized credentials, and no technical protection measure was circumvented. The one runtime observation, of CP Plus, was ordinary use of our own device and our own account. Several large clouds, including Microsoft Azure, Alibaba Cloud and Huawei Cloud, do not publish consumable address ranges the way AWS does, so hosts that sit there are marked as belonging to that provider by network registration but with their serving region left unmapped. The picture is point-in-time: a hostname that resolved one way on 18 September 2026 can be moved. And the Google Play install bands are a blunt instrument. They count global installs, not India, not active users, not cameras, and not current sales. We use them only to order the set by rough reach, never as a market figure.

What the map shows

Six things stood out, each recorded in the study's dataset.

1. Across the 27 apps we attributed 276 first-party hosts. The single largest home for them is Amazon Web Services, which answered for 103 of the 276. Alibaba Cloud is next at 43, then China Telecom's network at 25, Huawei Cloud at 13, and Microsoft Azure at 10. A further 26 hosts mapped to smaller providers, and 56 could not be mapped to a named provider.
2. Of the 21 companies, 14 are Chinese by origin, 5 are Indian, one is American and one is Taiwanese. The count of Chinese-origin brands is not the interesting part. Which infrastructure their hosts resolve to is.
3. One of the five Indian brands keeps every mapped first-party host on addresses announced by its own Indian operator: JioSecure. Its eight hosts all answered from addresses announced by Reliance Jio's own network, with an Akamai edge in front, and it is the one brand in the set with no foreign-registered first-party host at all.
4. One Indian brand, Godrej's SeeThru line, has none of its mapped hosts attributed to an Indian operator or the AWS India region. Its apps reference original-equipment clouds, including GooLink hosts that resolved to Alibaba Cloud infrastructure.
5. Several Chinese-origin brands run India-facing hosts in the AWS India region while other first-party hosts stayed on Chinese networks. EZVIZ is the clearest case: an India account host resolved to the AWS India region, while its ys7.com hosts stayed on networks registered in China.
6. Four original-equipment platforms are referenced by brands that look unrelated on the shelf. The same Tuya, Xiongmai, EZVIZ/Hikvision and GooLink platform hostnames appear in several different apps.

Five Indian brands, five different answers

One line is the shortest way to say the finding: an Indian brand is not an Indian cloud. Here are the five Indian brands ordered by the share of their mapped first-party hosts attributed to Indian-operator networks or the AWS India region, highest at the top. Each bar shows that ratio; the figures beside it are the counts behind it.

For JioSecure, from Reliance Jio, all eight mapped first-party hosts were attributed to addresses announced by Reliance Jio's own network. For CP Plus, from Aditya Infotech, and Qubo, from Hero Group, most mapped first-party hosts were attributed to AWS, including hosts in AWS's India region: an India-region cloud owned by an American company, which is a different thing from a host on an Indian operator's own network, and a different thing again from a host on a Chinese network. CP Plus builds on the Tuya platform; during ordinary use of our own account, its app connected to first-party hosts that resolved in AWS's India region. Airtel Xsafe, from Bharti Airtel, is mixed: it runs its own hosts on Airtel's Indian network, and its app package also contains EZVIZ and Hikvision open-platform hostnames. Godrej's SeeThru apps reference original-equipment clouds registered outside India, GooLink among them, whose hosts were attributed to Alibaba Cloud infrastructure.

None of that is a verdict on any of these companies. An India-region AWS host and an Indian-operator host are both reasonable engineering choices. The point is narrower: five brands that a shopper would read as equally Indian show five materially different infrastructure patterns, and the box does not say which.

Where the hosts sit

Read across the whole set and the concentration is clear. Most first-party hosts sit on a small number of large clouds, and the two biggest are on opposite sides of the map: Amazon Web Services and Alibaba Cloud together account for more than half of everything we attributed.

Provider ownership and serving region are separate facts, and the chart is about ownership. A host on AWS can answer from India, Dublin or Northern Virginia; a host registered to China Telecom is a Chinese network wherever it answers. Where a provider does not publish consumable address ranges, we could attribute the provider but not the region, which is why the Azure, Alibaba and Huawei totals carry no region breakdown here.

The same brand, split across borders

Origin, cloud provider and serving region are three separate columns, and five brands in the set show why keeping them separate matters. For each, we state the brand's origin, the provider its hosts sit on, and where those hosts resolved, without merging the three into a single label.

• EZVIZ is a Chinese-origin brand. Its India account host resolved to AWS's India region, while its ys7.com hosts stayed on Chinese networks. One application ecosystem, across multiple infrastructure regions.
• Hik-Connect, also Chinese-origin, spread its 46 first-party hosts across AWS and CloudFront globally, three hosts in AWS's India region, and China Telecom and China Unicom networks.
• Tuya is a Chinese-origin platform whose region-built hosts include a first-party host that resolved in AWS's India region.
• Airtel Xsafe is an Indian telecom brand. Its own hosts sit on Airtel's Indian network, and its app package also contains EZVIZ and Hikvision open-platform hostnames; both brands are headquartered in China.
• Godrej SeeThru is an Indian brand whose apps reference GooLink and StarVision original-equipment hosts that resolved to Alibaba Cloud.

In every case the brand's nationality and the cloud's nationality are answers to different questions. A Chinese brand can serve India from within India. An Indian brand can reference a Chinese cloud. Neither fact follows from the label.

Four backends, many names

Some of the brands that look independent on a shelf reference common platform infrastructure. We found four original-equipment platforms referenced by more than one brand each, and in every case the shared hostnames are present in the app packages.

• CP Plus and realme reference the Tuya platform, alongside Tuya's own SmartLife app.
• XMEye and iCSee both reference the same xmeye.net and bcloud365.net hosts, consistent with a shared Xiongmai platform.
• The EZVIZ and Hikvision open platform is referenced by EZVIZ, Hik-Connect, and Airtel Xsafe, whose app package contains the open-platform hostnames.
• Godrej's SeeThru apps reference the GooLink, Provision-ISR and StarVision original-equipment clouds.

This is the part a shopper cannot see. Two cameras from two brands, at two price points, can reference the same company's platform infrastructure.

The full set

Table 1 lists all 21 companies with their recorded owner, their origin, the count of first-party hosts we analyzed, and where those hosts sit. Table 2 orders the 27 apps by Google Play install band, which is a global Play-download threshold used as a rough reach proxy and nothing more.

The install bands below are a proxy for reach, read once more with the caveat attached: global installs, not India, not active users, not cameras, not current sales.

Why this is worth knowing now

Backend architecture and infrastructure geography are live subjects of public interest in India right now, across two Indian rules and one American one. None of these rules is a verdict on any brand in this study. Together they are why where a backend sits, and who owns it, is a question worth asking.

The first is India's certification requirement for cameras. Under the Electronics and IT Goods (Requirements for Compulsory Registration) Order, CCTV cameras were notified for compliance with the Ministry of Electronics and Information Technology's Essential Requirements for Security by gazette notification dated 9 April 2024, and that requirement came into force on 9 April 2025. A transitional relaxation that had allowed sale of earlier stock was then withdrawn with effect from 1 April 2026. The security test report is issued by STQC, and STQC's IoT System Certification Scheme covers CCTV cameras as one product category. These Essential Requirements are about camera security, not about where a consumer camera's cloud sits; a separate MeitY advisory on storing footage inside India is specific to government and public-place CCTV, not consumer smart cameras. We state the requirements and the dates; we say nothing about which brands in this study pass or fail. STQC publishes the applicable certification scheme and security-testing information, and current CRO registration and compliance should be verified through the applicable STQC and BIS mechanisms rather than by treating the historical Network Camera product list, which STQC now retains only for reference, as exhaustive.

The second is India's data-transfer framework. Section 16 of the Digital Personal Data Protection Act, 2023 and rule 15 of the Digital Personal Data Protection Rules, 2025 concern cross-border transfers of personal data. Neither provision had commenced on the study date; both fall within the eighteen-month commencement tranche running from the 13 November 2025 publication. This study does not establish that any personal data was transferred outside India. A hostname inside an app is a reference, not a data flow.

The third is for readers outside India. The United States Federal Communications Commission maintains a Covered List of communications equipment and services it has determined pose an unacceptable risk under the Secure and Trusted Communications Networks Act. Since 12 March 2021 the list has included "video surveillance and telecommunications equipment" produced by Hikvision and by Dahua, to the extent it is used for public safety, the security of government facilities, physical-security surveillance of critical infrastructure, and other national-security purposes. A November 2022 order barred new equipment authorizations for listed equipment; a later 2025 order created a procedure under which previously granted authorizations for covered equipment can be limited to prohibit further importation or marketing, while continued use of already-installed equipment is not necessarily prohibited. Several brands in this study belong to those corporate families. We state what the list and the orders say and do not predict what any regulator will do next.

These three regimes are distinct, and this study does not merge them. India's camera-certification requirement is a product-registration rule; the FCC's is an equipment-authorization rule; the DPDP provisions, once in force, concern the processing and transfer of personal data and can apply to services tied to cameras already installed. They provide broader regulatory context for examining the supply chains, service dependencies and data paths behind connected cameras. The installed base also outlives any single distribution decision: a brand can stop selling in a market, or lose the right to authorize new units, and the devices already on walls do not disappear. Their apps still reference the same backend hosts this map records, and those hosts still resolved when we looked.

The primary sources for each of these rules are linked below.

What to do with this

If you are buying a camera, the useful habit is to separate the two questions the box merges. The brand is one question. The cloud and service infrastructure the app references is another, and you can ask the seller or the brand where the service is hosted and whether footage is stored in India. A brand being Indian does not put its cloud in India, and this map is a set of worked examples of that gap.

If you run security or procurement for an organization, the same method applies to your own estate. The backends your staff's apps reference are part of the external dependency surface worth inventorying and may form part of the application's data-flow surface, and most teams have never listed them. Reading the hosts out of an app package and resolving them, as we did here, is a short exercise that tells you where your dependencies sit.

If you are a brand named here and a fact is wrong, tell us. Corrections go to hello@kahulabs.com and are published as a new, dated version of this page with the change noted. We would rather be corrected than be wrong.

This map is a first pass at the surface: which backends the apps reference and where those hosts sit. It is the opening piece of a hardware-research series, and later studies go a layer deeper into individual devices, their firmware, and the software running on the camera itself. Kahu Labs maps app and infrastructure dependencies for organizations.

Corrections

Material technical claims are based on the analyzed app packages and public network records; regulatory and corporate statements are supported by the cited public sources. Nothing here imputes motive. If any company named here disputes a fact, we will review the evidence and publish a corrected, dated version. The correction channel is hello@kahulabs.com.

Provenance

Article version 1.4; dataset observation date 18 September 2026. Kahu Labs' text, original figures and original research dataset and annotations are licensed under CC BY 4.0. Third-party applications, code and other source materials are not relicensed and remain subject to their respective rights. Version 1.4 (18 September 2026) replaced the qualitative Indian-infrastructure ladder with data-derived host ratios, tightened infrastructure-attribution and location language, and expanded the primary regulatory references; no underlying dataset observations changed. Copyright Shokunin Technology Inc. (Kahu Labs). To cite: Kahu Labs (2026). Where India's smart-camera apps point: a client-side infrastructure study. Version 1.4, 18 September 2026. https://research.kahulabs.com/indian-brand-not-indian-cloud/. The research data archive, its SHA-256 checksums and the report PDF are available on request.