
Authorize the recipient before sending the file
File encryption can protect content in transit or at rest, but it cannot determine whether the recipient is entitled to see a release. Confirm identity, role, purpose and minimum scope first. Use an authenticated transfer channel and share any secret through a separate approved path.
An agency asks for every release from a multi-model shoot. The photographer checks the contract and learns the agency needs only the final releases for three selected images. The package excludes unused models and unnecessary identity attachments, and the receipt records who accepted it.
Use a controlled sequence
- 01Verify the requester through a known contact or authenticated business channel.
- 02Confirm the exact job, models, purpose and minimum records required.
- 03Create a clean delivery package separate from the retained archive.
- 04Use authenticated transfer and provide any secret through a different approved channel.
- 05Obtain receipt, set an expiry when supported and close temporary access after delivery.
Record the decision without copying the risk
Log requester identity, authorization source, package contents, exclusions, transfer method, protection method, delivery time, receipt and access-expiry action. Keep the log descriptive rather than embedding the documents.
Stop and investigate when
- A new email address requests the complete archive urgently.
- A public link has no expiry, authentication or recipient restriction.
- The same password travels in the same message as the encrypted file.
Storage protection is not legal authorization
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Model-release requirements vary by intended use, platform, contract and jurisdiction. Obtain qualified advice for legal conclusions.
Questions commercial photographers ask
Does a password-protected archive prove authorization?
No. It restricts opening but does not prove the recipient should receive the record.
Can I email a release to a client?
Use the method required by the agreement and risk assessment. Minimize the package and authenticate the recipient.
Evidence for this decision
These sources support specific handling decisions. They do not provide universal legal advice or imply endorsement.