How to Secure Client Media and Freelancer Access Without Slowing Down Editors

Secure a small post house by scoping access to projects rather than to people: give every freelancer a named account that expires on the delivery date, set storage permissions at the project folder, and route large files through one sanctioned transfer tool. Built that way, security runs quietly in the background and editors barely notice it. The friction creatives complain about usually comes from the opposite setup, where one shared login and one flat storage volume force a scramble every time someone wraps.

Scope access to projects, not to people

Start from your identity system, whether that is Microsoft 365, Google Workspace, or something else. Every person gets one named account: no shared editor logins, no post1 / post1 on the NAS, no credential passed around in a group text.

Then create one access group per project. When the show wraps you remove the group, not twelve permissions you have to remember. Two habits make this work:

• Set an expiry at account creation. Put the expected delivery date on the account when you onboard the freelancer. Extending it later takes seconds, and if the gig does not extend, the account closes itself.
• Grant the narrowest useful access. An assistant pulling selects does not need write access to the finishing bay, and a sound mixer does not need the VFX plates.

Make offboarding a checklist, not a memory

This is where small Burbank shops lose the most ground, and the stories are mundane rather than cinematic. A colorist who wrapped in March still has working VPN credentials in June. A rough-cut link shared with “anyone with the link” never expired. None of that takes an attacker, only that nobody owned the cleanup. So write the list once, keep it with the project paperwork, and run it on delivery day.

1. Disable the identity account and revoke active sessions.
2. Remove the person from every project access group.
3. Revoke remote access: VPN account, certificates, remote-edit sessions.
4. Deactivate their seat on the transfer tool and the review platform.
5. Audit the shared links they created and expire any still open.
6. Collect and wipe loaner drives and laptops, logging the wipe.
7. Remove their access to any shared password vault.

Step five is the one people skip and the one that bites. Links outlive accounts.

Shared storage: permissions at the project, not the volume

Give your SAN or NAS a structure that mirrors how work moves, something like active, delivered, and archive. Set permissions on the project folder and let them inherit. Keep pre-release and finishing material on its own share, so read access to one client’s archive never implies read access to tonight’s cut. Then review it twice a year: print the list of who can read archive and remove what surprises you. On a volume that has run a few years, something will. Our entertainment, media, and production page covers the surrounding infrastructure.

Pick one sanctioned path for large files

Every unsanctioned transfer method in your shop exists because the sanctioned one was slower. If a 400 GB delivery through the approved tool is painful, an editor will put it on a personal cloud account at 11 p.m. and nobody will know.

So make the approved path the fast path. Pick one method, whether an accelerated transfer product, a client-approved cloud bucket, or a studio partner’s portal, then configure it properly: links expire by default, downloads are logged, public links are off, and a big delivery needs no help ticket to start.

Active-project backups are a different job from archiving

Archive keeps finished work for years. Active-project backup gets an editor working again this afternoon. RAID is not a backup for either: a mirror protects you from a dead disk, not from ransomware, a bad render script, or a deleted bin, because all three get faithfully mirrored.

Keep three copies on two kinds of media with one off the building, and make at least one immutable so it cannot be encrypted along with the original. Then test it: restore a real project folder, time it, write the number down. An untested restore is a plan, not a backup, a point we expand on in the importance of operational backup.

MFA and workstation hygiene editors will accept

Multi-factor authentication belongs on your identity provider, email, transfer tool, and review platform, using an authenticator app or hardware key rather than SMS codes. The trick is conditional access: require strong verification from new devices and off-network locations, and let a known workstation on the house network stay signed in.

Two smaller habits. Keep client credentials in a real password manager with separate vaults per client, not in the browser. And control which extensions can be installed on edit workstations, because an extension on a shared machine can read anything the browser touches. Researchers recently found 16 malicious Firefox extensions in Mozilla’s own add-on store, each claiming it collected no data while shipping credential-stealing code.

When a studio sends a content-security questionnaire

Sooner or later a distributor asks you to fill one out. The questions usually trace back to the content-security best practices the major content owners and their industry bodies maintain, and most of those frameworks are published openly, so read the sections that apply to a facility your size before you start answering.

Then answer honestly. Where you do not meet a control, say so and describe what you do instead. Reviewers see partial answers constantly and respond well to a named compensating control and a date. What they will not forgive is a claimed certification that does not exist. Keep the answers in one living document.

The short checklist

• Named accounts for everyone, with an expiry date on every freelancer account
• One access group per project, permissions inherited from the project folder
• Pre-release and finishing material on its own share
• A written offboarding checklist run on delivery day, including a shared-link audit
• One sanctioned large-file transfer path, logging on, public links off
• Three copies, two media types, one off-site, one immutable, one timed test restore per quarter
• MFA everywhere that matters, plus managed browser extensions on edit workstations
• A living answer document for studio security questionnaires

Frequently asked questions

How fast should we cut off a freelancer’s access?

On the last day of the engagement, as part of delivery. Re-enabling an account for a pickup day takes a minute; a forgotten credential stays open for years.

Is a NAS with RAID enough backup for an active project?

No. RAID protects against a failed drive and nothing else. Ransomware, deletion, and corruption all mirror across the array, so you need a separate copy that cannot be altered.

Do we need a formal security assessment to work with studios?

It depends on what the content owner requires, and that varies by partner and by how sensitive the material is. Many engagements start with a questionnaire rather than a formal assessment, so ask the partner directly.

Will MFA slow our editors down?

Without conditional access, noticeably. With it, most editors see a prompt when signing in from a new device or off the network, and rarely otherwise.

What is the cheapest improvement we could make this week?

Write the offboarding checklist and run it against the last three people who wrapped. It usually turns up an account or link that should have closed months ago.

If you want a second set of eyes

TVG Consulting works with creative and production businesses across Los Angeles from our Burbank office, and much of this work is unglamorous: tightening permissions, building the offboarding list, testing restores nobody has tested. If you want someone to walk your setup with you, see our entertainment IT services in Los Angeles or Burbank IT support pages, or get in touch.

Image by DC Studio on Magnific.