A real estate photography company can accumulate a surprising amount of sensitive information without thinking of itself as a data business.
You may have:
Property addresses.
Gate codes.
Lockbox instructions.
Alarm notes.
Seller names.
Agent phone numbers.
Email addresses.
Private listing information.
Unpublished photographs.
Floor plans.
Drone footage.
Builder plans.
Client invoices.
Payment records.
Employee information.
Passwords.
Cloud-storage access.
Thousands of archived property files.
Most of that information enters the company because it helps somebody complete an ordinary job.
The photographer needs the lockbox code.
The editor needs the RAW files.
The office needs the agent’s email address.
The accounting system needs the invoice.
The client portal needs the final gallery.
The problem appears when useful information quietly becomes information everybody can access forever.
A gate code is copied into a group text.
A photographer leaves the company but still has access to Google Drive.
A shared gallery link remains publicly reachable years later.
A builder sends unreleased plans through email.
The office keeps a spreadsheet containing every company password.
Someone uploads a screenshot containing a lockbox code into an AI tool while asking for help drafting client instructions.
An old laptop containing client files is sold without being properly erased.
Nothing about those examples requires a sophisticated cyberattack.
Most security failures begin with ordinary convenience.
For a real estate media company, the practical security goal is to know:
What information do we have?
Why do we have it?
Who needs access?
How long should we keep it?
How do we protect it?
What happens when somebody leaves?
What happens when something goes wrong?
NIST’s Cybersecurity Framework 2.0 organizes cybersecurity risk around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. NIST also publishes a Small Business Quick-Start Guide specifically for organizations with modest or developing cybersecurity programs.
That structure works extremely well for a real estate media company.
You do not need an enterprise security department.
You need a repeatable system proportionate to the information and access your company actually handles.
Table of Contents
• Security and Privacy Are Different
• Why Real Estate Media Companies Carry Unusual Risk
• Begin With a Data Inventory
• Classify Information by Sensitivity
• Property-Access Information Deserves Special Treatment
• Lockbox Codes, Gate Codes, and Alarm Information
• Showing Instructions and Occupancy Information
• Seller and Occupant Information
• Unpublished Property Media
• Floor Plans and Spatial Information
• Builder Plans and Pre-Release Projects
• Raw Files, Final Files, and Archives
• Client Contact Information
• Payment and Financial Information
• Employee and Contractor Records
• Apply the Principle of Least Privilege
• Give Photographers Only the Access They Need
• Editors Need Different Access
• Managers and Administrators
• Shared Accounts Are a Problem
• Build Individual User Accounts
• Require Multifactor Authentication
• Choose Strong MFA Methods
• Password Managers and Unique Passwords
• Secure Business Email First
• Protect the Company Domain
• Phishing and Fake Client Messages
• Business Email Compromise
• Verify Payment Changes Out of Band
• Keep Software Updated
• Protect Phones and Laptops
• Encrypt Business Devices
• Lost and Stolen Equipment
• Public Wi-Fi and Remote Work
• Cloud Storage Is Part of the Security Perimeter
• Shared Links and Public Galleries
• Folder Permissions
• Google Drive, Dropbox, and Similar Platforms
• Photo-Delivery Platforms
• Scheduling and CRM Platforms
• Payment Processors
• Vendors Need Security Review Too
• AI Tools Are Vendors
• What Not to Paste Into an AI Tool
• AI Image Editing and Client Files
• Establish an AI Data Policy
• File Retention
• Delete What You No Longer Need
• Archive vs. Retention
• Secure Deletion
• Offboarding Employees and Contractors
• Build an Offboarding Checklist
• Logging and Account History
• Monitor Suspicious Activity
• Backups Are a Security Control
• Ransomware
• Separate Backups From Production Systems
• Incident Response
• What to Do When an Account Is Compromised
• What to Do When a Device Is Lost
• What to Do After a Data Breach
• Notification Requirements Vary
• Communicating With Clients After an Incident
• Build a Security Contact Sheet
• Create a Vendor Inventory
• Write a Small Security Policy
• A Practical REPT Security Standard
• A 60-Minute Security Audit
• Common Security Mistakes
• Frequently Asked Questions
Security and Privacy Are Different
These two ideas overlap, but I find it useful to separate them.
Security
Security asks:
How do we prevent unauthorized access, loss, theft, alteration, or destruction?
Examples:
Passwords.
MFA.
Encryption.
Backups.
Device security.
Access permissions.
Privacy
Privacy asks:
What information are we collecting, why are we collecting it, how are we using it, who are we sharing it with, and how long are we keeping it?
A company can have strong technical security while collecting far more information than it needs.
It can also have a sensible privacy policy while protecting the actual files poorly.
A mature operation addresses both.
Why Real Estate Media Companies Carry Unusual Risk
Photography companies often think about their files as creative assets.
Some files are also operational or security-sensitive.
Consider a normal Tuesday schedule.
A photographer may receive:
8:30 AM — 142 Oak Ridge
Vacant.
Lockbox: rear door.
Code provided in appointment notes.
10:00 AM — 711 County Road 214
Seller occupied.
Call before entry.
Dog in laundry room.
1:00 PM — Unreleased Builder Model
Do not publish before Friday.
Gate access provided.
Those instructions contain information somebody could misuse.
The business therefore has more responsibility than:
Keep the JPEGs backed up.
Begin With a Data Inventory
You cannot protect information you do not know you have.
List the systems your company uses.
For example:
• Scheduling platform
• CRM
• Cloud storage
• Gallery delivery
• Accounting
• Payment processor
• Calendar
• Team messaging
• Editing platform
• AI tools
• Website
• Password manager
• Drone records
• HR records
• Local computers
• Phones
• Backup storage
Then identify what data exists in each system.
This is the Identify portion of the NIST framework in practical form.
NIST’s small-business guidance recommends understanding cybersecurity risks, assets, systems, services, people, and dependencies before choosing safeguards.
Classify Information by Sensitivity
You do not need a complicated government classification system.
Use three or four levels.
For example:
Classification Examples Handling
Public Published portfolio images, public listing information Normal use
Internal Schedules, standard operating procedures, pricing Employees / contractors as needed
Confidential Client contacts, invoices, unpublished media, builder plans Restricted
Restricted Lockbox codes, alarm codes, account credentials, sensitive employee records Minimum necessary access
The terminology matters less than the behavior.
A photographer should immediately understand:
Portfolio image
and:
alarm disarm code
do not belong in the same security category.
Property-Access Information Deserves Special Treatment
Real estate media has one security category most creative businesses do not:
Access to physical properties.
A compromised password at a typical marketing agency may expose files.
A compromised real estate photography account may expose information that helps somebody enter a home.
Treat that accordingly.
Lockbox Codes, Gate Codes, and Alarm Information
I would classify these as restricted operational information.
Rules should include:
• Share only with people who need access for the assignment.
• Keep the information inside the scheduling system where possible.
• Avoid copying codes into large group chats.
• Avoid placing codes in filenames.
• Avoid storing codes permanently in photographer notes.
• Remove access after the assignment when the platform allows it.
• Do not include access details in client-facing galleries.
The easiest standard is:
Access information follows the appointment, not the photographer.
Showing Instructions and Occupancy Information
Instructions may reveal:
Vacant property.
Seller out of town.
Children present.
Pets present.
Weapons in home.
Security system status.
Hidden key location.
Construction-site access.
Those details should stay within the operational workflow.
Do not treat the appointment notes as casual marketing information.
Seller and Occupant Information
Photographers may encounter sensitive information during a shoot.
Mail on the counter.
Medication.
School names.
Family photographs.
Financial papers.
Alarm panels.
Computer screens.
Vehicle plates.
Personal calendars.
Legal documents.
A good field workflow includes basic visual privacy awareness.
If something sensitive appears prominently in an image:
Move it where appropriate and permitted.
Frame around it.
Blur it during editing when necessary.
Tell the client when the issue needs their decision.
Do not upload a sensitive document into a public gallery because:
The agent can decide later.
Unpublished Property Media
A luxury listing may be confidential before launch.
A builder may be preparing an unreleased model.
A developer may be planning an unannounced community.
A celebrity or high-profile client may request additional discretion.
Treat unpublished media according to the client’s actual sensitivity.
That may mean:
• No portfolio posting
• No behind-the-scenes social post
• No editor using images for personal promotion
• Restricted gallery access
• Delayed public release
• Limited vendor sharing
The photographer’s camera roll should not become an accidental press release.
Floor Plans and Spatial Information
Floor plans are useful marketing assets.
They can also reveal:
Room arrangement.
Entrances.
Garage connections.
Utility spaces.
Interior circulation.
For ordinary listings, that information is intended to become public.
For certain clients or pre-release projects, it may not be.
Apply the same question:
Has the client approved this information for public distribution yet?
Builder Plans and Pre-Release Projects
Builders and architects may send:
PDF plans.
Elevation drawings.
Community maps.
Pricing sheets.
Interior-selection documents.
Construction schedules.
Those files may contain information that never belongs in a public client gallery.
Separate working documentation from public deliverables.
Do not dump every project attachment into one shareable property folder.
Raw Files, Final Files, and Archives
The RAW files matter for privacy too.
They may contain:
Images later excluded from delivery.
Personal information removed during editing.
License plates.
Family photographs.
Security hardware.
Children.
Occupants.
Documents.
The final JPEG gallery may be clean.
The RAW archive may still contain sensitive visual information.
Treat archive access accordingly.
Client Contact Information
Client data may include:
Names.
Phone numbers.
Email addresses.
Billing addresses.
Company information.
Order history.
Pricing.
Preferences.
Notes.
You need some of it to operate.
That does not mean every photographer needs the full client database.
Payment and Financial Information
Whenever possible, let a reputable payment processor handle card information rather than storing card details yourself.
A media company may need:
Invoice amount.
Payment status.
Transaction ID.
Accounting record.
It usually does not need employees copying credit card information into notes, email, or spreadsheets.
Reduce unnecessary exposure.
Employee and Contractor Records
The business may hold:
Addresses.
Phone numbers.
Tax forms.
Banking information.
Compensation.
Performance documentation.
Emergency contacts.
Those records deserve stricter access than a production schedule.
A lead photographer does not automatically need access to another photographer’s tax forms because both people work for the same company.
Apply the Principle of Least Privilege
The security principle is straightforward:
Give each person the access required to perform their role.
No more than necessary.
The FTC currently recommends limiting access to sensitive information to employees and vendors who need it. Its current small-business cybersecurity guidance likewise recommends controls on sensitive databases and need-to-know vendor access.
This becomes increasingly important as the company grows.
Give Photographers Only the Access They Need
A field photographer may need:
Today’s schedule.
Property address.
Access instructions.
Client contact when required.
Capture standards.
They may not need:
Company bank information.
Payroll.
Every client’s pricing.
Entire historical archive.
Admin password to the website.
Design the account around the job.
Editors Need Different Access
An editor may need:
RAW files.
Project instructions.
Brand presets.
Export destination.
They may not need:
Lockbox codes.
Seller phone numbers.
Payment information.
Complete CRM access.
If the editor never needs property access, do not send property-access credentials along with the RAW files.
Managers and Administrators
Managers naturally need broader access.
Broader access deserves stronger security.
An operations manager with:
Scheduling.
Client data.
Refund authority.
Employee information.
Vendor accounts.
has a more valuable account to an attacker than a photographer with a daily route.
Protect privileged accounts accordingly.
Shared Accounts Are a Problem
A team eventually develops shortcuts.
Everyone logs into:
office@company.com
Password:
Known by eight people.
One person leaves.
Nobody knows whether they saved it.
Someone changes the password.
Three automations break.
This is difficult to audit.
Individual accounts are much better where the platform supports them.
Build Individual User Accounts
Individual accounts let you:
See who logged in.
Revoke one person.
Assign roles.
Restrict permissions.
Require MFA.
Review suspicious activity.
Offboard cleanly.
They also reduce the habit of sharing credentials through text messages.
Require Multifactor Authentication
CISA currently recommends requiring MFA wherever possible, particularly for systems such as email, file storage, remote access, privileged accounts, and accounts handling sensitive information. CISA also recommends using stronger, phishing-resistant methods when available.
For a real estate media company, I would prioritize MFA on:
Business email
Password manager
Cloud storage
Scheduling / CRM
Accounting
Payment processor
Website administration
Domain registrar
Social media
Backup system
AI or automation systems with business access
Start with the account that can reset all the others:
email.
Choose Strong MFA Methods
CISA currently ranks stronger MFA options above SMS and email codes.
Its small-business guidance recommends phishing-resistant options such as security keys where practical, followed by authenticator-based methods, while identifying text or email codes as weaker options when stronger methods are unavailable.
You do not need hardware keys for every photographer on day one.
You should understand that all MFA methods are not equally strong.
Password Managers and Unique Passwords
The company should not rely on:
One memorable password.
with variations.
’s ransomware guidance recommends long, unique passwords and notes that password managers can help businesses generate and manage them securely.
A business password manager can also help with:
Employee provisioning.
Shared credentials where unavoidable.
Role-based vaults.
Offboarding.
Auditability.
Protect the password manager itself with strong MFA.
Secure Business Email First
Email often controls the business.
Through email, somebody may be able to reset:
Cloud storage.
Scheduling software.
Accounting.
Social media.
Website login.
Payment processor.
That makes the business email account one of the highest-value systems you own.
Require MFA.
Review forwarding rules.
Review recovery addresses.
Remove old users.
Watch for suspicious login alerts.
Protect the Company Domain
Your domain controls:
Website.
Email identity.
Sometimes DNS.
Client trust.
If somebody compromises the registrar account, the damage can become substantial.
Use:
Strong unique password.
MFA.
Restricted administrative access.
Accurate recovery information.
Do not leave the registrar account attached to the personal email of a former contractor who built the website five years ago.
Phishing and Fake Client Messages
Real estate media companies receive unusual messages every day.
New agents.
Unknown sellers.
Download links.
Dropbox requests.
Floor-plan files.
Builder plans.
Payment questions.
Property addresses.
That makes phishing difficult because opening unfamiliar files and links is part of the job.
Train staff to watch for:
Unexpected password-reset requests.
Fake shared-file notifications.
Urgent payment changes.
Strange domain names.
Login pages opened from unsolicited messages.
Requests for credentials.
Unexpected attachment types.
CISA and NIST continue to emphasize phishing awareness as a foundational small-business security practice.
Business Email Compromise
A particularly dangerous attack does not need ransomware.
Someone compromises a client or vendor email account.
Then they write:
We changed our payment information. Please send the transfer here.
The email may come from the real account.
The writing may sound normal.
Do not make significant payment-account changes based solely on an email thread.
Verify through another trusted channel.
Call the known contact.
Use the phone number already in your records rather than the number supplied inside the suspicious message.
Verify Payment Changes Out of Band
Create a company rule.
Example:
Any change to banking, ACH, payroll, or vendor-payment instructions requires independent verification.
That one policy can protect against an expensive category of fraud.
Keep Software Updated
Software vulnerabilities create unnecessary openings.
CISA’s basic cybersecurity guidance emphasizes installing updates, and the FTC currently recommends maintaining a schedule for updates to operating systems, applications, browsers, and related software.
That includes:
Editing workstation.
Laptop.
Phone.
Browser.
NAS.
Router.
Backup system.
Plugins where security matters.
Do not postpone security updates indefinitely because the editing machine is busy.
For production-critical software, test before broad deployment.
Then update.
Protect Phones and Laptops
A photographer’s phone may contain:
Calendar.
Client phone numbers.
Access instructions.
Email.
Cloud-storage login.
Messaging.
Payment apps.
A lost phone can therefore be a company incident.
Require:
Device PIN or biometric lock.
Auto-lock.
Encryption where supported.
Remote-device management or remote-wipe capability when practical.
Updated operating system.
No casual account sharing.
Encrypt Business Devices
FTC guidance currently recommends encrypting devices, media, and data containing sensitive personal information, including laptops, smartphones, removable drives, backups, and cloud-storage solutions.
Modern operating systems make full-device encryption practical.
Use it.
A stolen encrypted laptop is a very different security situation from a stolen unencrypted drive containing years of client data.
Lost and Stolen Equipment
Create a procedure before the first loss.
If a company laptop disappears:
Report immediately.
Identify which accounts were logged in.
Remote-lock or wipe if available.
Revoke sessions.
Change high-risk credentials when necessary.
Review what data was stored locally.
Document the incident.
Do not wait three days hoping it turns up before telling anybody.
Public Wi-Fi and Remote Work
Photographers may work from:
Coffee shops.
Hotels.
Airports.
Job trailers.
Client offices.
Avoid treating every network as trusted.
Use encrypted websites and applications.
Do not expose shared folders or administrative interfaces unnecessarily.
For sensitive remote access, use the secure method provided by your IT environment.
The larger point is simple:
A laptop leaving the office should not leave the security policy behind.
Cloud Storage Is Part of the Security Perimeter
Cloud storage feels less tangible than a server.
It still contains your data.
Treat:
Google Drive.
Dropbox.
OneDrive.
Frame.io.
Gallery providers.
Editing-transfer systems.
as business infrastructure.
Review:
Who has access?
Who can share?
Which links are public?
Can former employees still log in?
How long are deleted files retained?
Which devices are connected?
Shared Links and Public Galleries
A convenient share link can create accidental long-term exposure.
Ask:
Does the link require login?
Is it indexed publicly?
Does it expire?
Can the recipient download?
Can they reshare?
Is the property already public?
Does the gallery contain anything beyond the approved deliverables?
The correct setting depends on the client and purpose.
Use intentional sharing.
Folder Permissions
A common problem grows slowly.
New employee joins.
Gets access to:
Company Drive
which includes:
Every project.
Every client.
Every contract.
Every employee folder.
That is convenient.
It is also unnecessary.
Organize storage into areas such as:
Production
Client Delivery
Finance
HR
Management
Archive
Then assign access appropriately.
Google Drive, Dropbox, and Similar Platforms
The specific platform matters less than configuration.
A well-configured cloud environment with:
Individual accounts.
MFA.
Appropriate sharing.
Role control.
Backups.
Access review.
can be much safer than a random pile of local drives.
A badly configured cloud environment can expose information broadly.
Security is partly the tool.
Configuration is equally important.
Photo-Delivery Platforms
Your gallery platform may contain:
Property address.
Agent identity.
Listing images.
Floor plans.
Video.
Invoices.
Usage history.
Client login.
Review its security and privacy settings.
Know:
What is public?
What requires authentication?
Who can download?
What happens when the subscription ends?
Can you export client data?
Can you revoke access?
Scheduling and CRM Platforms
These systems may contain the highest concentration of operational information in the company.
They can hold:
Client directory.
Upcoming vacant homes.
Access instructions.
Photographer locations.
Pricing.
Invoices.
Internal notes.
Protect administrator accounts carefully.
Use employee roles.
Remove accounts immediately when people leave.
Payment Processors
Let the payment processor do the work it was designed to do.
Do not create side systems containing payment information because somebody wanted to:
make checkout easier.
If the processor supports:
Hosted checkout.
Tokenization.
Invoices.
Saved customer payment methods under the processor’s own system.
use those tools appropriately rather than storing sensitive payment credentials yourself.
Vendors Need Security Review Too
Your company’s security depends partly on other companies.
FTC guidance currently recommends putting vendor security requirements in writing, considering how vendors may use, share, retain, and delete data, verifying compliance where appropriate, limiting vendor access, using encryption, and requiring MFA for vendor access to sensitive systems.
A vendor may include:
Editor.
Virtual assistant.
Bookkeeper.
CRM.
Photo-delivery platform.
AI editing service.
Web developer.
Marketing agency.
IT provider.
Offshore post-production company.
Ask:
What information does this vendor receive?
Then decide whether the access is reasonable.
AI Tools Are Vendors
AI introduces an especially easy security mistake.
Someone thinks:
I am only asking ChatGPT, Claude, Gemini, or another tool for help.
Then they paste:
An internal client email.
A builder pricing sheet.
A screenshot of the schedule.
A lockbox code.
Employee compensation.
A property-access note.
From a business-security standpoint, the relevant question is:
What data did we send to an outside service, under which account and terms?
Treat AI systems like any other external vendor.
Review the service, account type, privacy terms, retention behavior, permissions, and intended use before sending sensitive data.
What Not to Paste Into an AI Tool
Unless the company has deliberately approved the system for the information involved, I would keep the following out of general AI prompts:
Lockbox codes.
Gate codes.
Alarm codes.
Passwords.
API keys.
Payment credentials.
Tax information.
Employee banking information.
Private client identification.
Unannounced confidential plans.
Sensitive legal documents.
Anything you would be uncomfortable sending to an ordinary outside contractor without an agreement.
You can usually redact the sensitive parts and still get useful help.
AI Image Editing and Client Files
AI editing tools may process:
Interior photographs.
Exterior photographs.
RAW files.
Property addresses.
Client names.
Before connecting automated editing to the production pipeline, review:
What is uploaded?
How long is it stored?
Is the data used for model training?
Can it be deleted?
Who owns the resulting media?
Can employees access it?
Can the vendor subcontract processing?
These questions belong in vendor evaluation.
Do not assume every AI feature inside every product has identical data practices.
Establish an AI Data Policy
A basic policy can be short.
For example:
Allowed
Public marketing copy.
Generic workflow questions.
Published property information.
Non-sensitive editing tasks in approved tools.
Requires Approval
Unpublished client files.
Builder plans.
Confidential documents.
Bulk CRM data.
Employee information.
Prohibited
Passwords.
Access codes.
Payment credentials.
Highly sensitive personal information.
That is enough to remove ambiguity for most teams.
File Retention
Keeping everything forever feels safe.
It creates another risk:
The company accumulates information it no longer needs.
FTC guidance recommends keeping only the data the business needs and securely disposing of information that is no longer required.
Create retention categories.
For example:
Published final galleries
One policy.
RAW production files
Another.
Contracts
Another.
Tax records
Follow applicable legal requirements.
Lockbox codes
Remove when no longer operationally necessary.
Employee records
Follow applicable employment and tax obligations.
Different information deserves different timelines.
Delete What You No Longer Need
A surprising amount of risk disappears when the data disappears.
If a lockbox code no longer serves an operational purpose, you gain little by preserving it for seven years.
If a temporary editor no longer needs the project, remove the share.
If an old device is retired, erase it properly.
Data minimization is a security strategy.
Archive vs. Retention
Archive means:
We intentionally keep this.
Retention means:
We have decided how long.
Those are different from:
Nobody ever cleaned the drive.
A professional archive should contain what the company has chosen to preserve.
Secure Deletion
Dragging a file to the trash does not always mean the data is unrecoverable.
The FTC currently recommends using appropriate erasure methods for devices containing sensitive information rather than assuming a normal delete operation permanently removes the information.
When retiring:
Laptop.
Phone.
External drive.
NAS disk.
follow the device and storage provider’s secure-erasure process.
Offboarding Employees and Contractors
Offboarding is one of the most important security moments.
The photographer may have access to:
Email.
Scheduling.
Cloud storage.
Client portal.
Team chat.
Social media.
Password vault.
CRM.
Editing system.
Company device.
Do not rely on:
They probably deleted the app.
Remove the access centrally.
Build an Offboarding Checklist
When somebody leaves:
Disable business email.
Revoke active sessions.
Remove scheduling access.
Remove CRM access.
Remove storage access.
Remove password-vault access.
Remove social-media roles.
Transfer owned files.
Recover company equipment.
Remove API or automation credentials where necessary.
Change shared credentials the person knew.
Review forwarding rules.
Document completion.
The checklist should happen promptly.
Logging and Account History
You cannot investigate suspicious activity well if there is no record of activity.
’s current small-business logging guidance recommends collecting and reviewing system activity such as who accessed a system, when access occurred, and from where, because logs can help detect unusual or unauthorized behavior.
For a small media company, useful logs may already exist inside:
Google Workspace.
Microsoft 365.
Cloud storage.
Scheduling platform.
Website host.
Password manager.
Payment processor.
You do not need a security operations center to review a suspicious login.
You do need logs to exist.
Monitor Suspicious Activity
Enable alerts where useful.
Examples:
New admin login.
Password changed.
MFA disabled.
Large data export.
New forwarding rule.
New payment account.
New device.
Unusual geographic login.
You may never need the alert.
The one time it matters, speed is valuable.
Backups Are a Security Control
Backups are frequently discussed as storage.
They are also security.
Ransomware can:
Encrypt files.
Delete files.
Lock systems.
Destroy accessible backups.
CISA’s current ransomware guidance recommends maintaining offline or otherwise protected backups, using MFA, keeping software updated, and maintaining recovery plans.
The REPT Business Continuity chapter covers backup architecture in greater detail.
From a security perspective:
At least one recovery path should survive compromise of the normal production environment.
Ransomware
A ransomware incident can shut down:
Editing.
Scheduling.
Delivery.
Accounting.
Email.
Archive access.
It may also involve data theft rather than encryption alone.
Prepare before the incident.
MFA.
Updates.
Employee phishing awareness.
Protected backups.
Access control.
Incident plan.
Those basic controls provide much more value than an elaborate response document sitting beside poorly secured accounts.
Separate Backups From Production Systems
A backup permanently reachable from every production computer can become part of the same attack.
Build separation.
That may involve:
Protected cloud backup.
Offline storage.
Immutable or restricted backup configurations.
Another location.
The exact architecture depends on the business.
The security principle is:
One compromise should not be able to destroy every copy.
Incident Response
Incident response answers:
What do we do now?
Possible incidents include:
Compromised email.
Lost phone.
Stolen laptop.
Ransomware.
Publicly exposed folder.
Leaked access code.
Vendor breach.
Employee misuse.
Website compromise.
The procedure changes by incident.
The first questions are similar:
What happened?
What systems are affected?
Is the incident still active?
What information may have been exposed?
Who needs to be involved?
What access should be disabled?
What evidence should be preserved?
Who must be notified?
What to Do When an Account Is Compromised
A general first-response workflow might include:
Secure the account.
Change credentials through a clean device where appropriate.
Revoke existing sessions.
Restore or reset MFA.
Check recovery information.
Review recent login activity.
Check forwarding rules.
Review connected apps.
Determine what data was accessible.
Notify the appropriate internal person.
Document what occurred.
If the compromise is serious, bring in qualified IT or cybersecurity help.
What to Do When a Device Is Lost
Determine:
Who had the device?
Was it encrypted?
Was it locked?
Which accounts were active?
What information was stored locally?
Can it be remotely locked or erased?
Do any sessions need revocation?
Does the incident trigger client or legal obligations?
Then act promptly.
The answer may be much simpler when the device was encrypted and controlled through a company account.
That is why preparation matters.
What to Do After a Data Breach
The FTC’s current Data Breach Response: A Guide for Business recommends moving quickly to secure operations, stopping additional data loss, assembling appropriate technical and legal expertise, determining the scope of the incident, preserving relevant evidence, creating a communication plan, and notifying appropriate parties where required.
Do not improvise a serious breach alone because:
We are only a photography company.
The incident may involve obligations outside normal photography operations.
Notification Requirements Vary
Data-breach notification requirements can depend on:
Which information was compromised.
Where affected individuals live.
The type of company.
Contract obligations.
State law.
Federal law.
The circumstances of the incident.
FTC guidance explicitly recommends consulting appropriate legal counsel after a breach to determine applicable federal and state requirements.
This is an area for qualified legal advice.
Do not use a blog article as the company’s final legal determination.
Communicating With Clients After an Incident
Avoid two bad responses.
Silence
and:
Speculation.
Communicate known facts when appropriate.
Explain:
What happened.
What information was involved.
What the company has done.
What the client should do, if anything.
When another update will be provided.
Do not exaggerate certainty.
Do not minimize something before the facts are known.
FTC breach guidance similarly emphasizes accurate communication and warns against misleading statements or withholding information people need to protect themselves.
Build a Security Contact Sheet
Know who to contact before the incident.
Possible contacts:
Owner.
Operations leader.
IT provider.
Cybersecurity provider.
Insurance carrier.
Attorney.
Cloud provider.
Website host.
Payment processor.
Critical software vendor.
Major enterprise client contact.
Keep the list somewhere available even if the main business systems are inaccessible.
Create a Vendor Inventory
Build a simple table.
Vendor Data Access Admin Owner MFA Contract Last Review
Scheduling platform Client + property data Operations Yes Yes Date
Cloud storage Media files Production Yes Yes Date
Editor RAW files Production N/A / account Yes Date
Accounting Financial records Owner Yes Yes Date
AI editing service Property images Production Yes Yes Date
Now the company can see where information goes.
Write a Small Security Policy
A useful policy does not need fifty pages.
Start with:
Accounts
Individual accounts required where available.
Authentication
MFA required on critical systems.
Passwords
Unique business credentials managed securely.
Access
Need-to-know permissions.
Property Codes
Restricted to assigned personnel.
Cloud Sharing
Use approved platforms.
AI
Sensitive information only in approved systems.
Devices
Lock and encrypt company devices.
Updates
Maintain current supported software.
Offboarding
Remove access immediately.
Incidents
Report suspicious events promptly.
Ten rules people follow are better than eighty rules nobody reads.
A Practical REPT Security Standard
If I were building security for a small real estate media company from scratch, I would begin here.
1. Protect Business Email
Unique password.
MFA.
Recovery method controlled by company.
2. Use a Business Password Manager
No password spreadsheet.
No repeated credentials.
3. Require MFA on Critical Platforms
Scheduling.
Storage.
Accounting.
Website.
Social.
Payment.
4. Use Individual Accounts
Photographers.
Editors.
Managers.
5. Restrict Property Access Information
Only assigned people receive it.
6. Encrypt Company Devices
Especially laptops and phones that leave the office.
7. Keep Software Current
OS.
Browser.
Apps.
Infrastructure.
8. Maintain Protected Backups
Test recovery.
9. Review Vendors
Know where files and client information go.
10. Create an AI Policy
No casual sharing of confidential information.
11. Offboard Immediately
Accounts.
Devices.
Credentials.
12. Keep an Incident Plan
Know who owns the response.
That covers a large amount of practical risk.
A 60-Minute Security Audit
You can identify many weaknesses in one hour.
First 10 Minutes — Inventory
List:
Email.
Storage.
Scheduling.
Accounting.
Gallery.
Website.
Social media.
AI systems.
Next 10 Minutes — Accounts
Who has administrator access?
Former employee?
Old contractor?
Unknown account?
Remove what should not exist.
Next 10 Minutes — MFA
Check:
Email.
Storage.
Accounting.
Payment.
Website.
Password manager.
Turn it on where missing.
Next 10 Minutes — Property Access
Where do:
Lockbox codes.
Alarm instructions.
Gate codes.
live?
Who can see them?
How long do they remain?
Next 10 Minutes — Devices and Backups
Are computers encrypted?
Are phones locked?
When was the backup restored?
Final 10 Minutes — Offboarding and Vendors
Can you revoke every employee quickly?
Which outside vendors receive client information?
Write down the first three improvements.
Complete those before building a more complicated plan.
Common Security Mistakes
Lockbox Codes in Group Texts
People who no longer need the information still retain it.
Codes Stored Forever in CRM Notes
Temporary access information becomes permanent data.
One Password for the Whole Team
Offboarding becomes difficult and accountability disappears.
No MFA on Business Email
One compromised password can become a compromise of multiple connected systems.
MFA Only on Banking
Email, cloud storage, social media, and admin systems remain exposed.
Personal Email Accounts for Company Administration
The company cannot fully control account recovery or offboarding.
Former Employee Still Has Google Drive
Nobody completed the offboarding process.
Everyone Is an Administrator
Every account can make high-impact changes.
Editors Receive Full Appointment Notes
They receive property-access information they never needed.
Public Gallery Contains a Sensitive Document
Nobody reviewed the frame before delivery.
Unpublished Builder Project Posted Behind the Scenes
The production team publishes before the client does.
Password Spreadsheet in Shared Drive
The system protecting the passwords is accessible using one of those same passwords.
No Device Encryption
A stolen laptop becomes a data-loss event.
Old Computers Sold Without Proper Erasure
Deleting the project folders was considered enough.
Public Share Links Never Expire
Sensitive projects remain accessible long after the assignment.
Every Vendor Gets Every File
Access is built around convenience rather than need.
AI Prompt Contains a Lockbox Code
Sensitive operational information is sent to an external service unnecessarily.
Assuming Every AI Tool Uses Data the Same Way
Policies differ by product, account type, and vendor.
No Vendor Inventory
The company does not know where client data exists.
Keeping Everything Forever
Old information remains available to be exposed.
Backup Connected to Everything
One attack can reach production and recovery data.
Ignoring Suspicious Login Alerts
Detection exists but nobody responds.
No Incident Owner
Everybody assumes somebody else is handling the problem.
Waiting to Remove Access After Termination
Former credentials remain active during the most obvious offboarding window.
Common Mistake
A company buys better cybersecurity software but leaves every employee logged into one shared email account with the same password. Security improves fastest when identity, access, MFA, offboarding, and data handling are fixed before another tool is added.
Frequently Asked Questions
Does a real estate photography company really need a cybersecurity policy?
Yes. Even a solo photographer can hold property-access information, client contact data, cloud credentials, payment records, and unpublished media.
The policy can start small.
What is the biggest security risk for a real estate photographer?
There is no single universal answer. Common high-impact risks include compromised business email, weak passwords, no MFA, exposed access codes, stolen devices, poorly secured cloud storage, and former users retaining access.
Are lockbox codes sensitive information?
I would treat them as restricted operational information because they may provide physical access to a property.
Should photographers receive lockbox codes by text?
A dedicated scheduling platform with appropriate access controls is preferable. If text is necessary, limit the information to the people who need it and avoid unnecessary long-term retention.
Should editors receive property-access notes?
Usually no. Editors generally need files and editing instructions rather than lockbox, alarm, or entry information.
Should access codes be stored permanently?
Usually there is little operational reason to retain temporary property-access codes after they are no longer needed.
What information should photographers be careful about capturing?
Examples include:
• financial documents
• medication
• computer screens
• alarm information
• family photographs
• vehicle plates
• legal documents
• calendars
• other personally sensitive material
Should I blur license plates?
Use judgment and client requirements. For marketing imagery, blurring sensitive or unnecessary personal information can be appropriate when it contributes nothing to the property presentation.
Are RAW files more sensitive than final JPEGs?
They can be because RAW files may contain images or details later removed, excluded, blurred, or cropped from the final deliverables.
Should my real estate photography company use MFA?
Yes. recommends requiring MFA broadly for business systems and prioritizing strong MFA for email, cloud storage, remote access, privileged accounts, and sensitive systems.
Which accounts should get MFA first?
I would prioritize:
• Business email
• Password manager
• Cloud storage
• Payment and accounting systems
• Scheduling / CRM
• Website and domain registrar
• Social media
• Backup systems
Is SMS two-factor authentication enough?
It is better than relying only on a password, but currently recommends stronger phishing-resistant options where available and identifies SMS/email codes as weaker methods.
What is phishing-resistant MFA?
Authentication methods such as properly implemented security keys or other cryptographic authentication can prevent many attacks that trick users into entering codes into fake login pages.
Should I use a password manager?
For most businesses, yes. specifically notes that password managers can help create and manage long, unique credentials.
Should employees share passwords?
Avoid shared credentials where individual accounts are available.
What is least privilege?
It means each employee or vendor receives only the access needed to perform their work.
Should every photographer have administrator access to the scheduling software?
Usually no.
They need the information necessary to execute assignments.
Administrative settings can remain restricted.
Should everyone have access to the entire cloud drive?
Usually no.
Create folders and permissions around roles.
Should old employees retain access to past projects?
Only when there is a legitimate continuing business reason and an approved relationship. Normal offboarding should remove company access.
How quickly should employee access be removed after departure?
Promptly according to the company’s offboarding process.
For sensitive accounts, revocation should be part of the departure workflow rather than something remembered days later.
What should be on an offboarding checklist?
At minimum:
• scheduling
• CRM
• cloud storage
• password manager
• social media
• website access
• company devices
• shared credentials
• connected apps
Should laptops be encrypted?
Yes when they contain sensitive company or client information. FTC guidance recommends encrypting devices and media containing sensitive information.
What happens if a photographer loses a company laptop?
Report it immediately, determine what data and accounts were available, remotely lock or erase it where possible, revoke sessions, and evaluate whether sensitive information may have been exposed.
Is cloud storage secure?
Cloud storage can be secure when configured appropriately.
The company still needs:
• strong authentication
• appropriate permissions
• sharing controls
• backups
• offboarding
• vendor review
Is a public share link safe?
It depends on the data and intended audience.
Public listing photos may be appropriate for an open link.
Unpublished luxury projects or builder plans may need restricted access.
Do gallery links need passwords?
Not every gallery requires one.
Use access controls proportionate to the sensitivity of the material.
Should I delete old client files?
Create a retention policy.
Some media may have long-term value.
Temporary access information and unnecessary sensitive data often do not.
Is deleting a file enough when disposing of an old computer?
Not necessarily. FTC guidance recommends appropriate erasure methods when disposing of devices containing sensitive information.
Can I paste client emails into ChatGPT or another AI assistant?
Treat the AI system as an outside service.
Review the account and data terms first, and redact sensitive information unless the tool has been explicitly approved for that data.
Should I ever paste lockbox codes into AI tools?
I would avoid it.
There is rarely a legitimate need for a general AI model to receive a client’s property-access credential.
Can AI photo editors process client property images?
They can if the workflow and client expectations permit it, but review the vendor’s privacy, retention, training, security, ownership, and deletion policies before building it into production.
What should an AI policy include?
Define:
• approved tools
• allowed information
• restricted information
• prohibited data
• client approval when needed
• who can add new AI vendors
Should vendors sign security agreements?
Depending on the access and business relationship, contracts should address appropriate security and data-handling expectations. FTC guidance specifically recommends putting vendor security requirements and data-use expectations in writing.
Should I review editing vendors?
Yes.
Ask what data they receive, how they store it, who can access it, whether they subcontract processing, how long files remain, and how deletion works.
Are backups part of cybersecurity?
Yes. CISA’s ransomware guidance treats protected backups and recovery planning as important cybersecurity controls.
Can ransomware affect cloud storage?
Depending on the architecture and permissions, ransomware or compromised accounts can potentially alter or delete synchronized cloud files.
The backup system should include a recovery path that is protected from ordinary production access.
How often should I review access?
Regularly and whenever roles change.
Also review access when:
• hiring
• termination
• contractor completion
• promotion
• vendor change
• security incident
What is logging?
Logging records activity such as who accessed a system, when they accessed it, and sometimes where the access originated.
recommends logging and monitoring as ways to detect unusual or unauthorized behavior.
Do small companies need sophisticated security monitoring?
Not necessarily.
Start with the logs and alerts already provided by major business platforms.
What should I do if my email account is hacked?
Secure the account, reset credentials appropriately, revoke sessions, review MFA and recovery information, inspect forwarding rules and connected applications, determine what data may have been exposed, and bring in qualified technical help when necessary.
What should I do after a data breach?
FTC guidance recommends quickly securing operations, stopping further loss, determining scope, involving appropriate technical and legal experts, creating a communication plan, and notifying required parties.
Do I legally have to notify clients after a breach?
Requirements vary by the type of information, jurisdiction, contract, and circumstances.
Consult qualified counsel regarding the specific incident.
Should I hide a security incident until I know everything?
You should avoid speculation, but do not delay required response or notification simply because every detail is not yet known.
Follow legal and professional guidance appropriate to the incident.
What security framework should a small media company use?
Cybersecurity Framework 2.0 is a strong general structure. specifically publishes a Small Business Quick-Start Guide for smaller organizations with modest cybersecurity resources.
What are the six NIST CSF 2.0 functions?
They are:
Govern
Identify
Protect
Detect
Respond
Recover
Where should a solo photographer start?
Start with:
• MFA
• unique passwords
• password manager
• encrypted devices
• protected backups
• careful handling of property-access information
• software updates
• basic incident plan
That solves more practical risk than buying complicated enterprise-security software.
Recommended REPT Course Lessons
Episode 2 — Required Equipment and Software
Professional equipment includes the systems that hold client information and production files. Cameras matter, but so do encrypted computers, backups, secure storage, and reliable business accounts.
Episode 3 — Exterior Photography Workflow
Field security begins at the property. Access instructions, gate information, occupied homes, vehicles, neighboring properties, and client-sensitive details should be handled intentionally.
Episode 4 — Interior Photography Workflow
Interior photographers work inside private homes. Visual awareness matters when documents, personal information, medication, security equipment, family photographs, or other sensitive material appears in frame.
Episodes 5–8 — Editing Workflow
Editing moves client files between devices, editors, cloud services, AI tools, delivery systems, and archives. A professional workflow defines where files go and who can reach them.
Explore the complete training path:
Continue Your REPT Training
Client trust begins long before a company handles enterprise accounts or dozens of photographers.
A solo photographer who receives one lockbox code and one set of property photos already has information worth protecting.
Free REPT First Listing Starter Kit
If you are preparing for one of your first listing assignments, the Free REPT First Listing Starter Kit is the best next step for building a dependable field workflow around client communication, property access, capture, and delivery.
Complete Real Estate Photography Training
For the deeper path through equipment, interiors, exteriors, editing, video, professional workflow, and building a reliable real estate media business:
Explore the REPT Knowledge Base
Continue through the connected chapters covering operations, business continuity, file management, client reporting, campaign tracking, enterprise accounts, and growing a media team:
Visit Real Estate Photography Training
Explore current REPT training resources and industry analysis:
Follow Malachi on Instagram
See current real estate photography, video work, editing examples, workflow observations, and field notes:
REPT Training & Resources
Build a stronger real estate photography business with the complete professional guide:https://payhip.com/RealEstatePhotographyTraining
Explore the REPT Knowledge Base:https://payhip.com/RealEstatePhotographyTraining/blog/get-started-real-estate-photography
Download the Free First Listing Starter Kit:
https://payhip.com/b/VWSPH
Visit Real Estate Photography Training:
https://rephototraining.com/
Final Thoughts
Security can sound like a subject for banks, hospitals, and companies with server rooms.
Real estate media creates a different kind of security problem.
A photographer may know that a vacant home is unlocked through the side door until noon.
An editor may have unpublished photographs of a multimillion-dollar property.
A scheduling system may contain tomorrow’s addresses, gate codes, and client phone numbers.
A media company may have thousands of interior images showing how people live.
Most of that information is ordinary inside the workflow.
That does not make it harmless outside the workflow.
The useful security question is rarely:
How do we make this impossible to compromise?
No business can promise that.
A better set of questions is:
Who needs this?
Why do they need it?
Where should it live?
When should the access disappear?
What happens if the account gets compromised?
A lot of the strongest improvements are boring.
Turn on MFA.
Stop sharing passwords.
Remove old users.
Encrypt the laptop.
Do not text the whole team a lockbox code.
Keep payment data in the payment processor.
Give editors the files without the property-access notes.
Delete temporary information after it stops being useful.
Check the shared folders.
Know which AI tools the team is using.
Know which vendors receive your client files.
Keep a backup the normal computers cannot destroy.
None of that makes for an exciting cybersecurity commercial.
It creates a much harder business to compromise accidentally.
The biggest shift happens as the company grows.
A solo photographer can keep a lot of knowledge in one head.
A ten-person company cannot rely on everybody simply knowing what feels sensitive.
The rules need to become visible.
What can photographers see?
What can editors see?
Who is an administrator?
Which systems require MFA?
Where are passwords stored?
What happens when someone leaves?
Which files can be sent to AI?
Who owns a security incident?
Those decisions turn security into an operating system.
I would start with identity.
Know who has access.
Then protect the accounts.
Then control the information.
Then prepare for failure.
That sequence handles a surprising amount of real-world risk.
You do not need to transform the photography company into an IT company.
You do need to treat access to clients, homes, files, and business systems with the same professionalism you already apply to the images you deliver.
Sources
• National Institute of Standards and Technology — “NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide”
https://www.nist.gov/publications/nist-cybersecurity-framework-20-small-business-quick-start-guide
• National Institute of Standards and Technology — “Cybersecurity Framework 2.0 for Small Business”
https://www.nist.gov/itl/smallbusinesscyber/nist-cybersecurity-framework-0
• — “Cybersecurity for Small Business”
https://www.ftc.gov/business-guidance/small-businesses/cybersecurity
• — “Start with Security: A Guide for Business”
https://www.ftc.gov/business-guidance/resources/start-security-guide-business
• — “Data Breach Response: A Guide for Business”
https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
• Cybersecurity and Infrastructure Security Agency — “Require Multifactor Authentication”
https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication
• Cybersecurity and Infrastructure Security Agency — “#StopRansomware Guide”
https://www.cisa.gov/stopransomware/ransomware-guide
• Cybersecurity and Infrastructure Security Agency — “Use Logging on Business Systems”
https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/use-logging-on-business-systems
Comments ()