| Basic Wired Analog | One entrance station and three indoor audio handsets using dedicated low-voltage cabling. | Dedicated wired audio path; normally no IP encryption. | Not applicable because the system does not normally use TLS or IP networking. | Usually limited to hardware replacement; no remotely delivered security patches. | None for core intercom operation. | Low cloud exposure, but conversations are not protected by modern network encryption. | US$650 | US$450 | US$0 | US$160 | US$1,260 | Basic |
| Local IP PoE with Secure Gateway | PoE entrance station, three network indoor endpoints, local controller, and a separate secure gateway. | Encrypted local signaling where supported; authenticated administration; VLAN or firewall separation recommended. | Preferred for web administration, mobile access, and gateway connections. Verify that TLS 1.3 is enabled by default. | Security patches should be available for at least five years, with signed firmware and published release notes. | Not required for local calling; remote access can be disabled. | Low to moderate exposure when cloud services are disabled and recordings remain on the local network. | US$1,450 | US$850 | US$300 | US$270 | US$2,870 | Strong |
| Cloud-Connected Hybrid | Network entrance station, indoor monitor, smartphone application, and vendor-hosted relay or account service. | Encrypted client-to-service connections; security depends on certificate validation, account protection, and cloud configuration. | Expected for current cloud connections, but the supplier should document the minimum supported TLS version and cipher policy. | Automatic updates are common; continued support depends on the service life of the cloud platform. | Internet access is normally required for remote notifications and smartphone calling. | Higher exposure because account data, device metadata, or event information may pass through a hosted service. | US$950 | US$650 | US$600 | US$225 | US$2,425 | Conditional |
| Premium Local IP Audio System | Multiple PoE entrance stations, four or more indoor endpoints, local recording or event storage, and redundant network power. | Authenticated and encrypted local sessions with managed certificates, network segmentation, and administrator role controls. | Should support TLS 1.3 for all web, API, and remote-administration interfaces; older TLS versions should be disabled where practical. | Longer support commitment, signed updates, rollback protection, vulnerability notices, and scheduled maintenance releases. | None for local operation; optional remote access can be routed through a user-controlled VPN. | Low external exposure when storage and remote access remain under homeowner control. | US$2,400 | US$1,100 | US$500 | US$370 | US$4,370 | Very strong |