Sourcing Smart Home Devices from China: Apps, Hubs and the Lock-In Nobody Warns You About
The first time I sourced smart home gear, I thought I was buying hardware. I was actually buying an app, a cloud server, and a commitment to whoever runs that server. The plugs were $4 each, the app was free, and eighteen months later half the SKUs were dead because the vendor stopped paying their cloud bill. That lesson cost less than a thousand dollars and saved me from repeating it on a much bigger order.
Smart home is one of those categories where the physical product looks identical across ten factories and the actual difference lives entirely in software. Anyone can mold a plastic plug and put a relay inside. What separates a supplier you can build a business on from one you cannot is what happens after the customer scans the QR code.
Ask which app, and who owns it
Three answers are possible and they mean very different things. First, the factory has its own app. That is a real platform investment, and it usually means they will support it, but it also means you are locked to that factory forever. Second, they resell a white-label app from a platform like Tuya or a similar IoT backend. This is the most common answer and it is not bad, but understand that the app brand is rented and the data lives on someone else's servers. Third, they will connect your product to an existing ecosystem like Amazon Alexa, Google Home, or Apple HomeKit. This is the best outcome for the end customer and the hardest to get right, because it requires certification you have to pay for.
If a supplier says "we can make any app you want," ask to see two live apps they actually shipped. A factory that has shipped an app can show you the App Store listing. A factory that has not will show you a demo video.
The protocol question decides everything downstream
Wi-Fi only devices are the cheapest and the most fragile. They depend on a 2.4GHz network, they choke when the router is crowded, and they lose their pairing when the customer changes their Wi-Fi password. Zigbee and Thread devices need a hub, cost more, and are dramatically more reliable because they form a mesh. Bluetooth-only is fine for a single device near a phone and useless for anything you want to control from another room.
Know which one you are buying before you sign the PO. The unit price difference between Wi-Fi and Zigbee is often under $1, while the return rate difference can be three to five times. If you are selling bundles, a hub-based system costs more up front and generates far fewer angry support emails.
Cloud dependency and what happens when it dies
Ask the supplier directly: if your company stops operating tomorrow, does my product still work? The honest answer for most cheap Wi-Fi devices is no. For Matter-certified devices, the answer is usually yes, because local control is part of the specification. Matter is still messy in practice, but it is the only answer that protects you from a vendor going under.
Get it in writing in the contract. Not a marketing claim, an actual clause: local control fallback, no mandatory cloud account for core functions, and a defined data retention policy. If they push back, that tells you the architecture cannot do it.
Certification is not optional here
Anything that transmits radio needs certification for every market you sell into. FCC for the US, CE and RED for Europe, and for anything with a camera or microphone you add GDPR and often local privacy rules on top. Ask for the test reports, not just the certificates. A certificate says the product passed; the report shows what was tested and against which version. Radio modules often carry the certification, which means your final product may need its own re-test if the antenna or enclosure changes.
Security is the other half. Cheap devices ship with default passwords and unencrypted cloud endpoints. Ask whether the firmware supports OTA updates, because a device you cannot patch is a device you will have to recall. Budget for a firmware update path even if the first version ships clean.
What I would put in the first order
- Two or three representative SKUs, not the whole catalog. Get the app and pairing experience right before scaling.
- Explicit app ownership or white-label terms in writing, including what happens if the platform changes pricing.
- FCC and CE test reports on file, with the radio module part number matched to what is actually on the board.
- A stated OTA update mechanism and a commitment to at least two years of security patches.
- A sample of the packaging and QR onboarding flow, because that is where most support tickets are born.
Smart home gear is a great margin category if you treat it as a software product with a hardware attachment. Treat it as a plastic part and you will be back here in a year wondering why your return rate is 9 percent and your reviews are full of one-star pairing complaints.