← IoT Privacy Database

SimpliSafe Home Security System

SimpliSafe, Inc. · Camera / Doorbell

Staff Reviewed — a person at DeSpy reviewed this rating.

2.9Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesB

SimpliSafe is a DIY alarm system with add-on indoor/outdoor cameras and video doorbells. The base station monitors sensors (via cellular/Wi-Fi) and cameras stream and record audio/video to SimpliSafe's cloud under a required account, collecting account, payment, event and device telemetry. Its privacy policy reserves the right to disclose footage to law enforcement in life-threatening emergencies without a warrant or consent, though the company says it does not do so in practice absent legal compulsion or user consent. SimpliSafe is subject to FTC enforcement authority and generally rates better on privacy than most rivals.

Why this rating

Policy: audio/video capture (-15), indefinite retention (-8), a warrant-less emergency law-enforcement disclosure clause (-5), unilateral-change and forced-arbitration terms; offset slightly by a comparatively narrow, no-sale-for-marketing stance. Evidence: IOActive showed in 2016 that SimpliSafe's unencrypted 433MHz keypad signals allow a replay attack that silently disarms the alarm, with legacy hardware not field-patchable (dated, so reduced weight); Consumer Reports (2022) documented that SimpliSafe's policy permits sharing footage with police without a warrant or consent in emergencies.

What it is

Manufacturer
SimpliSafe, Inc.
Category
Camera / Doorbell
Model years
2018-present
Market status
Current
Companion app
SimpliSafe

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. Major breach · SecurityWeek · 2016-02

    IOActive researcher Andrew Zonenberg showed SimpliSafe's unencrypted keypad-to-base radio traffic could be captured and replayed to disarm the alarm without the PIN, with then-shipping one-time-programmable hardware not field-upgradeable.

    Why it matters here: Device-specific cryptographic weakness in SimpliSafe's own hardware undermining the security the product is sold to provide.

  2. Journalism · Consumer Reports · 2022-07

    Consumer Reports found SimpliSafe's privacy policy reserves the right to disclose video to law enforcement in emergencies without a warrant or user consent, though SimpliSafe said it had not exercised it.

    Why it matters here: Independent review of this device's law-enforcement footage-disclosure terms.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database