Virtual patrolling for compliance evidence
Virtual patrolling for compliance evidence is the use of scheduled camera rounds to produce the record a regulator, an insurer or a client contract requires: proof that a defined check was made, at a stated time, with the frame it was judged against. A cold store that must show its doors were closed, a data center that must show its cage was not entered, a licensed premises that must show its exits were clear, a vacant building whose policy requires weekly inspection. Camzify runs the round, answers each item from the camera, and files a timestamped PDF with a frame per item.
- A frame behind every answer
- Timestamped, filed, exportable by date
- Rounds that run whether or not anyone is in
The check was done; the evidence is a tick in a logbook
Most sites make the checks their obligations require. What they struggle to produce is evidence. The auditor asks for the record of the storage-room door checks for March, and the answer is a paper log with a tick and an initial per line, or a guard tour system that proves someone stood at a tag and nothing about what they saw.
The frameworks are specific about the record. FDA rules for food facilities require records to be created concurrently with the activity and to carry its date and time (21 CFR 117.305), and the FDA electronic-records rule asks for time-stamped audit trails (21 CFR 11.10). PCI DSS requires that access to sensitive areas be monitored on camera, and the data reviewed and retained. A SOC 2 examination tests that physical access to data center facilities is restricted to authorized personnel (AICPA Trust Services Criteria, CC6.4). Vacant-property insurers ask for inspections at least weekly and for proof they happened (Chubb).
A tick cannot be examined. A frame can.
Guard message sent. Re-checked and closed with the second frame attached.
The round is the check, and the report is the evidence
A patrol sequence lists the cameras that cover the things you must prove, and a checklist per camera asks the questions the obligation is about, in plain words: cold-room door closed, cage door shut, fire exit unobstructed, no person in the restricted bay.
- An automated round runs at the times the obligation names, hourly overnight, twice a shift, every Monday for a vacant building, and answers each item from the frame with its reasoning written down.
- Every answer is recorded with the frame it was judged against, and a failed item messages the designated person, whose fix captures the after frame.
- The round produces a timestamped PDF report with a compliance percentage, stored in the patrol log for as long as the account is active and exportable by date range for an audit.
- Compliance tracking shows the rounds that ran, the ones that were flagged and the ones that were overdue, so a missed round is a record of its own rather than a silence.
The evidence has the same shape whether the round was run by an operator or by the schedule: item, answer, time, frame, and who was told.
Patrol checklists
The questions the obligation asks, written per camera in plain words and answered from the frame at each stop.
DetectionPatrol reports
The PDF per round: every item, its status, its frame, the guard notified, and the compliance percentage.
DetectionZone intrusion detection
A person in the restricted bay or the cage between rounds, recorded with the frame as an event of its own.
DetectionCamera tampering detection
A covered or moved camera raised the same day, because a camera that was not looking produces no evidence.
- Cold room door closedCompliant
- Fire exit unobstructedCompliant
- No person in restricted bayCompliant
- Cage door securedNot compliant
A failed item is resolved as Fixed or Pending before the round can close.
What a compliance round checks
A compliance sequence is written from the obligation backwards. Take the clauses you must evidence, name the camera that can see each one, and write the item as the question an inspector would ask. Storage temperature is not a camera question; a door left open, a blocked exit, a person in a cage, a light left on and a gate standing open all are.
Set the schedule to the frequency the obligation names, and no tighter than the cameras can support. The report then answers the inspector's question in their own terms: was it checked, when, against what, and what did it show. Guard tour verification covers the same record for a manned round, and the security audit checklist lists what an audit usually asks for.
A check found Not Compliant captures a snapshot and messages the guard designated for that camera; on a manual round the operator chooses to send it, on an automated round it goes on its own. The item stays Pending until it is marked Fixed, which captures the after frame, and the report shows both.
What the frameworks require, in their own words
Quoted from the regulation, the standard and the insurance industry, with a link to each. Camzify publishes no figures of its own; it produces records that a site can put in front of its own auditor.
- 21 CFR 117.305
- FDA records for food facilities must "be created concurrently with performance of the activity documented" and include "the date and, when appropriate, the time of the activity documented" and "the signature or initials of the person performing the activity."
- Source: 21 CFR 117.305, Code of Federal Regulations
- 21 CFR 11.10(e)
- The FDA electronic-records rule requires "secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records."
- Source: 21 CFR 11.10, Code of Federal Regulations
- 3 months
- PCI DSS v4.0.1, Requirement 9.2.1.1: individual physical access to sensitive areas within the cardholder data environment is monitored with video cameras, physical access control mechanisms, or both; the collected data is reviewed and correlated with other entries and "stored for at least three months, unless otherwise restricted by law."
- Source: PCI Security Standards Council, PCI DSS v4.0.1
- Weekly
- Chubb's guidance for vacant assets: "Inspect vacant or unoccupied properties at least once a week to ensure safety and maintenance." The Insurance Information Institute puts the underwriting position plainly: "Insurers typically require proof that reasonable steps were taken to maintain the property" (June 2025).
- Source: Insurance Information Institute, 2025
What it will not do
A camera round evidences what a camera can see, and the frameworks above ask for more than that.
- It will not measure a temperature, a humidity or a pressure; a cold-room door is a camera question, and the cold room's temperature is a sensor question.
- It will not make a site compliant with any framework; it produces a record of checks, and the auditor judges whether that record meets the clause.
- It will not prove a check was made from a camera that was covered, dark or offline; that round is logged as failed or missed, which is itself a record.
- It will not sign a record on a person's behalf; the report says which guard was notified and who marked an item fixed.
Camzify's own SOC 2 Type II and ISO 27001 certifications are in progress and not held, and we publish no uptime or response-time figures. The trust page sets out both.
Industries where this applies
Frequently asked questions
Ready to patrol your site 24/7?
Book a 15-minute demo and see a live patrol run on your own cameras.