Glossary

Incident video management glossary

Definitions of the common terms that come up in security video and incident management — from chain of custody to HLS to subrogation.

Access code: A short, recipient-specific code that gates access to a shared video package. The recipient enters the code in addition to opening the link — meaning a leaked URL alone does not grant access. Distinct from a Google Drive or Dropbox link, which is typically the only credential required to view the file.
Audit log: A timestamped record of every interaction with a video package — creation, derivative produced, share issued, recipient open, download, revocation. In a chain of custody context, the audit log is the document that demonstrates the footage is what it claims to be. The log should be produced automatically by the sharing tool, not reconstructed manually.
Chain of custody: A continuous, documented record of who had access to original footage and any derivatives, what they did with it, and when. The goal is to demonstrate to a court that the footage presented as evidence is the same footage that was recorded — unaltered and accounted for at every step.
Derivative: Any file produced from an original recording — a trimmed clip, a transcoded MP4, a still frame, a redacted version. In evidence handling, each derivative must be traceable back to the original it was produced from, with operator and timestamp.
H.264 (AVC): The most widely supported video codec, used inside MP4 and other containers. Plays on essentially every phone, tablet, browser, and laptop without additional software. The default codec choice for delivering incident video to law enforcement and insurance.
H.265 (HEVC): A more efficient video codec than H.264 — roughly half the storage for similar quality. Playback compatibility is broader than it once was but still lags H.264, particularly on older Windows machines and some browsers. Useful where storage matters and the recipient's playback environment is known to support it.
HLS (HTTP Live Streaming): An adaptive streaming protocol that segments video into short chunks and delivers them over standard HTTP. Allows a recipient to start watching immediately and adjust quality based on connection — a police officer on a tablet over LTE streams rather than downloading the full file. Widely supported across browsers and mobile devices.
Incident package: A bundle containing the clip, any related still frames, an incident summary, and metadata about source cameras and time ranges — delivered together via a single shareable link. The package, rather than individual files, is the unit that gets shared, audited, and revoked.
Incident video management: The workflow of pulling clips out of a Video Management System (VMS), packaging them as evidence, and delivering them to customers, police, and insurance — with controls over who can see them and for how long. Distinct from a VMS (which records and stores) and from general file sharing (which lacks the workflow, audit, and packaging features).
Litigation hold: A directive — formal or anticipated — to preserve evidence relevant to pending or reasonably foreseeable litigation. When a litigation hold applies, footage tied to the matter must be excluded from normal retention sweeps until the hold is lifted, even if the standard retention window has passed.
Per-tenant isolation: An architecture where each customer's data — sites, footage, packages, audit logs — is partitioned from other customers'. In an incident video management tool used by a security monitoring company, per-tenant isolation prevents one operator from inadvertently sharing Customer A's footage in Customer B's portal.
Proprietary VMS export: A VMS-specific file format produced by an export tool — examples include .dav (Dahua), .cam (Lorex, some Hikvision), .bsf, and various .exe-wrapped self-playing exports. These formats often preserve original metadata and hashing but cannot be opened without the VMS's playback software, so they are usually accompanied by an MP4 copy when delivered to a recipient outside the operation.
Retention window: The length of time security camera footage is kept before scheduled deletion. Set by the strictest of three constraints — applicable regulation, customer or insurance contract, and operational need to look back when an incident surfaces. Common windows range from 30 days for general commercial sites to a year or more for regulated industries.
Still frame: A single frame extracted from a video clip, typically used for BOLOs, claim forms, court exhibits, and tenant communications. Stills should be pulled from the same source clip being delivered, at the highest available resolution, with timestamp preserved both in the filename and as a visible burn-in.
Subpoena hold: A legal requirement to preserve specific footage in response to a subpoena. The footage covered by the subpoena must be tagged and excluded from retention sweeps until the order is satisfied or rescinded. Failure to preserve subpoenaed footage can result in sanctions or adverse inference instructions in subsequent litigation.
Subrogation: The process by which an insurance carrier seeks to recover paid claim amounts from a third party determined to be responsible. Subrogation requests routinely arrive 6 to 12 months after an incident and often require the original VMS export, full chain of custody, and footage that may have already passed the standard retention window — making early preservation important.
Timestamp burn-in: A timestamp rendered directly into the frame at recording or export time, rather than stored only as metadata. Burned-in timestamps are visible regardless of container or codec and survive transcoding, making them the most reliable way to anchor a clip in time for an officer or adjuster viewing it later.
VMS (Video Management System): Software that records, indexes, and provides live and recorded playback of camera footage. Examples include Milestone XProtect, Genetec Security Center, Avigilon ACC, Hanwha Wisenet WAVE, Exacq, and Eagle Eye Networks. The VMS is the recorder; incident video management software is the layer on top that handles delivery and audit.
White-label viewer: A customer-facing playback experience presented under your brand rather than the underlying tool's brand — your colors, your logo, often a custom domain (e.g. clips.yourco.com). For security monitoring companies servicing non-technical customers, the viewer is the moment the customer interacts with your product directly.

New to incident video management? Start with the practical guide, or see how Incident Clips fits.