And here there is a sixth, which is about the company and not about the product.
Where the recordings live: the video in the camera; the index, the users, the permissions and whatever is archived, in the supplier's cloud — which by design has an administration route in. What you should demand is the same as with the others: minimum permissions, compulsory two-factor, a visible access log and, in writing, who can see what from the supplier's side.
If the line goes down the camera carries on recording and what goes down is the live view from outside, the alerts and the search. When it comes back, the cloud catches up. It works for nearly everything except live monitoring.
The cost of uploading video: low and steady while nobody watches. The peak turns up when somebody watches and when archiving to the cloud — if a lot is archived and from a lot of cameras, the sustained flow stops being small. It is worked out with the list of what is going to be archived in front of you.
RGPD and international transfers: a supplier from outside the EU, with everything that drags along —a processor contract, guarantees for the transfer, the region in writing, a prior assessment where it applies, information given to the staff—. And a question that with young platforms gets asked plainly: which region you get, with your contract, and what happens if the supplier changes it.
The dependency, and the sixth question. Its own cameras are not reused with another system, so leaving means changing hardware; third-party ones stay. And the one that is not technical: it is a younger and smaller manufacturer than the big names on this list, which brings good things —they develop fast, you can get through to support— and makes you ask about support and replacements in your country, about the references in Europe and about what would happen if the company is sold.