The Hardware Outlives the Cloud

Every few years, a consumer-tech vendor turns off a cloud and bricks somebody’s hardware. Wink went paid-subscription in May 2020 and locked out users who didn’t pay. Insteon shut its servers off in April 2022 with no warning — devices stopped working that morning. “Works with Nest” was sunset in 2019 and took a generation of integrations with it. Belkin’s WeMo NetCam line was discontinued with no replacement path. The list runs longer every year.

The pattern is reliable enough to plan around: the hardware outlives the cloud.

A physical device is designed for a 7–10 year service life. The cloud it depends on has, empirically, a 4–6 year half-life. The mismatch is the load-bearing failure mode of every consumer-IoT category, and it is the constraint that shapes every architectural decision we make at this studio.

Why the math doesn’t work for the vendor

A smart-home device sells for a one-time fee. The cloud backing it costs real money every month, forever. That is a margin problem dressed up as a feature, and it resolves in one of three ways:

1. The cloud goes paid. Free becomes a teaser; the customer pays an indefinite monthly fee or walks away from a device they already own.
2. The cloud gets cost-engineered down. Retention windows shrink. Resolution caps drop. Push alerts get rate-limited. The product decays in place.
3. The cloud gets shut down entirely. The vendor exits the category, gets acquired by someone who doesn’t want recurring infrastructure cost, or quietly stops paying the bill.

None of these are surprises. They are the steady state of the business model. Hardware-with-mandatory-cloud is the consumer-tech equivalent of a shipping container with a battery in it — eventually the battery dies, and the container is just a container.

How the rule shapes our companion apps

ViewPane sits on top of Frigate. DockPilot sits on top of Docker and Portainer. Cradlebird (in planning) sits on top of an off-the-shelf RTSP camera. Three different products, three different problem domains — but the same architectural rule applies to all of them:

No CampbellSoft cloud. If we ran a backend, we would be the exact failure mode this post is about. Our apps talk directly to the user’s own hardware. There is no “ViewPane service” or “DockPilot service” to shut down because there is no service. We are an app vendor, not a cloud vendor.

No account system. Account systems exist to be retired. We have none — not in any of our companion apps, not on any roadmap.

Push notifications via a self-hosted relay. This is the part of the architecture that took the most design effort. Most companion apps in adjacent categories route notifications through a vendor cloud, which means the day the vendor stops paying that AWS bill, the alerts stop firing. We ship a tiny MIT-licensed Docker container that runs on the user’s own hardware. The day we disappear, the relay keeps running. The day the upstream tool refactors its MQTT or webhook schema, the relay is open source and the user — or the next maintainer — patches it.

Stable, documented upstream APIs only. Our apps integrate against open protocols and stable APIs — never against scraped HTML, never against a private endpoint that could break in a vendor-side refactor with no warning. Anything we depend on has to be the kind of contract that survives a maintainer change.

The trade we are asking the customer to accept

The trade is real. The user has to be the kind of person who runs Frigate, or runs Docker, or buys an ONVIF camera. The browser-tab simplicity of a vendor’s first-party cloud app is gone, replaced by a self-hosted stack that takes an evening to set up and a few small ongoing maintenance touches.

What they get back is the only thing that matters at year seven: the system still works. No abrupt email about “exciting changes to your service.” No app-store update that pulls a feature behind a paywall. No quarterly business review at someone else’s company that decides their hardware is now scrap.

Why we wrote this down

This blog is meant to be a record of the constraints that actually shape the work, not just the work itself. This is the most load-bearing one. Every product decision flows from it: the pricing model ($9.99/year, on purpose), the privacy posture, the choice not to chase venture capital that would force a recurring-revenue cloud play, the decision to build companion apps for self-hosted infrastructure rather than building the infrastructure ourselves.

The companion-app market is full of well-designed apps that depend on backends nobody is promising will be around in 2030. We do not want to be one of those apps. The architecture is the promise.