The short answer
Arrow’s public surveillance page does not state where footage is stored, who may access it, or how long it is retained. These details depend on the current equipment, software, service package, and client agreement, so they must be confirmed before deployment and before this FAQ is published as company policy.
What to know
A sound footage policy identifies whether storage is local, cloud-based, or both; recording quality and schedule; normal retention period; authorized users; authentication and audit logs; export procedures; encryption; legal holds; and secure deletion. It should also explain what occurs when storage fills, a tower loses connectivity, or a client requests footage. Access should follow least-privilege principles, and shared links or exported files should be protected. FTC business guidance emphasizes limiting retained data, securing remote access, testing known vulnerabilities, and making sure advertised privacy and security features work as represented.
Clients should define who owns the recordings, who handles law-enforcement requests, what fees or time limits apply to retrieval, and whether audio is captured. Retention should be long enough for legitimate security and legal needs without keeping personal data indefinitely. Counsel should review Arizona and any sector-specific privacy obligations. All dates, times, and camera locations should be accurate so relevant footage can be found and authenticated.