Secluso: Private DIY Home Security on a Raspberry Pi 4

Short answer: Secluso is a self-hosted, privacy-first home security stack that runs comfortably on a Raspberry Pi 4 8GB. It uses local motion detection, encrypted video storage, and no cloud dependencies. You get always-on recording, mobile notifications, and E2E encryption for under $150 in parts — no monthly fee, no vendor lockout, no data brokerage.

Why self-hosted security is having a moment

Every subscription camera vendor has had a data-privacy incident in the last three years. Ring, Nest, Wyze — each had one flavor of the same problem: cloud-first storage with weak per-device access controls. Meanwhile the tooling to run a private security stack has genuinely improved: SBCs are cheap, motion detection is fast, encrypted transport is standard.

Secluso is one of several open-source stacks that let you run a full security system with all storage and processing local to your network. Motion sits behind it as the classic camera daemon; Secluso layers on encrypted E2E delivery, mobile app support, and multi-camera coordination.

Key takeaways

• Runs on Pi 4 8GB — no need for a Pi 5 unless you want multi-stream 4K.
• E2E encryption — video encrypted on-camera, decrypted only in the mobile app.
• No cloud dependency — Tailscale or WireGuard for remote access.
• Storage: 24-72 hours per camera on a 256GB SD card; more with USB SSD.
• Setup time: ~90 minutes for one camera; ~3 hours for a full 4-camera install.

Hardware bill of materials

Per-camera setup:

Shared per-house:

• Router with VLAN support (or a mini switch)
• Tailscale account (free)
• Mobile phone (BYOP)

For an existing home lab, you probably already have most of the network side.

Software architecture

Secluso stacks on Motion (or MotionEye) for camera capture and pushes encrypted video to a lightweight web API. Mobile app decrypts locally.

Camera → Motion capture (per-frame) → Motion-detected clips
 ↓
 AES-256 encryption (per-camera key)
 ↓
 Local storage (USB SSD)
 ↓
 Tailscale/WireGuard → Mobile app decrypt + view

Key points:

• Motion runs constantly, evaluates every frame.
• Encryption happens at write-time — clips on disk are ciphertext.
• Mobile app pulls encrypted clips over Tailscale; decrypts client-side.
• No cloud, no third-party server, no telemetry.

Motion detection strategy

Motion has been the gold standard camera daemon for two decades. Configuration lives in /etc/motion/motion.conf. Key knobs:

• threshold — number of changed pixels to trigger an event
• event_gap — seconds between events before considering separate
• pre_capture / post_capture — extra seconds recorded around the event

Tune for your scene. Outdoor cameras need higher threshold (moving foliage) and shorter event_gap. Indoor cameras can use tighter thresholds.

Modern Motion also supports mask files — a PNG that marks areas to ignore. Useful for masking a street or a driveway that goes to a neighbor.

Encryption

Secluso uses AES-256-GCM per-camera keys, generated on first setup. The private key stays on the SBC; the public key is distributed to authorized mobile devices via QR-code pairing.

The encryption path is intentionally simple: each 4-second video clip is a single AES-256-GCM ciphertext block with an authenticated header. A compromised SBC leaks encrypted blobs but not decryption keys unless the attacker also compromises the mobile devices.

Compare to cloud-first vendors: your video is decrypted server-side for "smart features" (facial recognition, motion classification), which means any server compromise leaks decrypted video. Secluso's tradeoff is fewer smart features but no server-side plaintext.

Storage math

At 720p 24fps H.264 at ~2 Mbps:

• Constant recording: ~21 GB/day per camera
• Motion-only (typical urban scene): ~4-6 GB/day per camera

A 256GB USB SSD holds 40-60 days of motion-only clips for one camera. A 1TB SSD holds ~5 months. For 4 cameras, plan on 512GB-1TB per SBC or centralize storage on a NAS.

Remote access via Tailscale

Tailscale is the friction-remover. Install the client on the Pi and on your phone; both join the same tailnet; the mobile app talks to the Pi over the tailnet's WireGuard mesh. No port forwarding, no dynamic DNS, no reverse proxy.

Free tier covers 20 devices — plenty for a family security setup. Enterprise features (SSH, ACLs) are available if you want to lock down which family members see which cameras.

Multi-camera scaling

For 2-4 cameras, one Pi 4 8GB per camera is the safest architecture. For 4+, a hub-and-spoke pattern with a beefier SBC or a small x86 mini-PC as the central storage/coordinator scales better. The Pi handles capture; the hub handles retention and encryption.

Some tips:

• Wire cameras with PoE (Power over Ethernet) — one cable per camera, no wall wart per location.
• Segment cameras onto their own VLAN — reduces attack surface.
• Update Motion + Secluso monthly. Both are actively maintained.

Mobile app UX

The mobile app (iOS + Android) mimics a standard security app: live view, per-camera event feed, share-with-family features. All backed by client-side decryption. Playback is smooth because clips are pulled directly from your SBC over Tailscale — no CDN, no rate-limiting.

Common pitfalls

1. Running Motion on the microSD card only. The card will wear out fast. Move video storage to USB SSD.
2. Skipping Tailscale. Manual port forwarding is a security hazard. Just use the tailnet.
3. Under-cooling the Pi. 24×7 Motion capture pushes the SoC to 80°C+ in a warm case. Add a heatsink and a small fan.
4. Wide-angle lenses with default Motion settings. Whole-frame motion detection triggers on tree branches. Use a mask file.
5. Ignoring firmware updates. Pi OS + camera firmware need periodic updates. Do it monthly.

When Secluso is not the right answer

• HOA / rental property where you cannot mount cameras or drill through walls. Vendor kits with wireless mount are easier.
• You want facial recognition + package alerts. Those "smart" features assume cloud-side inference. You can add local inference (see below), but it is more work.
• Multi-user family with non-technical members. Vendor apps have polished UX that Secluso does not fully match.

For everyone else, the "no monthly fee, no cloud, no data brokerage" story is worth 90 minutes of setup.

Extensions

• Local inference for smart alerts. Add a Coral USB Accelerator or run llama.cpp on a beefier Pi 4 for on-device motion classification and human/vehicle detection.
• Cross-house redundancy. Two households run each other's off-site backup — encrypted, of course.
• Alexa / Google Home integration. Skip. That defeats the privacy story.

Companion parts

• SBC: Raspberry Pi 4 Model B 8GB — plenty of headroom
• Alternate lower-power SBC for single-camera builds: Raspberry Pi Zero W Basic Starter Kit
• USB SSD: any TLC drive with USB 3.2 Gen1 — see our NVMe picks for local model storage for the underlying storage picks
• IDE-to-USB adapter for salvaging old drives: Unitek IDE/SATA to USB 3.0

Bottom line

Secluso on a Raspberry Pi 4 8GB is the pragmatic self-hosted security path for anyone tired of subscription fees and cloud data risk. Setup is a weekend project; ongoing maintenance is monthly firmware updates. If you value privacy over one-tap smart features, this is genuinely the right answer in 2026.

Related guides

• Revive an Old Payphone with a Raspberry Pi Zero 2W
• Cyberdeck Raspberry Pi 4/5 mini music workstation
• Best NVMe SSD for local LLM model storage
• ComfyUI on RTX 3060 12GB

Citations and sources

• Motion project — GitHub repository
• Tailscale — documentation
• Raspberry Pi Foundation — Pi 4 Model B product page

This piece is editorial synthesis based on publicly available information. No independent first-party benchmarking is reported.