How is the media stored and secured?

All uploads travel over TLS 1.3. Files are stored with AES-256 encryption at rest in region-pinned buckets — US, EU, and Canada regions are available for data residency requirements.

Media is never served from a public URL. Every fetch uses a short-lived signed URL scoped to the requesting user.

Role-based access controls scope every action to the right team member: who can view media, who can export, who can share externally, who can administer billing.

Enterprise plans add SAML SSO and SCIM directory sync so access is revoked the moment someone leaves your directory.

Sharing an inspection outside the workspace issues a signed, expiring link rather than a copy of the file. Links can be revoked at any time, and each open is logged.

Every view, download, share, and export is logged with user, timestamp, and IP address. Audit logs are exportable for compliance reviews and retained on your policy.

Backups are encrypted and tested, access to production is least-privilege and logged, and dependencies are scanned continuously.

Virtual Inspection Pro protects media with TLS 1.3 encryption in transit and AES-256 encryption at rest. These controls address different exposure points: transmission between systems and stored media. NIST’s TLS guidelines and Advanced Encryption Standard provide background on these technologies; they do not certify this product or establish that an agency’s entire workflow is secure.

For inspection data security, treat encryption as one layer rather than permission to collect everything visible. Before recording, ask participants to move identity documents, payment information, and unrelated personal items out of frame. Use organization-managed devices where required, and avoid downloading media onto shared computers. Encryption does not prevent an authorized recipient from mishandling a downloaded file, and it does not prove that the recorded condition is complete or accurate. Sensitive or disputed footage should receive human review before it supports a decision.

Virtual Inspection Pro uses region-pinned storage. For agencies, insurers, and lenders evaluating data residency for inspections, the practical next step is to confirm the applicable region and document it in procurement and records-management requirements. Do not infer from region pinning alone where every backup, operational record, support interaction, or processing activity occurs; request written clarification for any location requirement that matters to your organization.

Before rollout, identify the records owner, classify the media, and establish a retention schedule through your organization’s approved process. Ask how retention, deletion, recovery, and contract termination are handled rather than assuming those controls are included. If an inspection involves occupied housing or sensitive facilities, involve privacy and security staff before capture. Storage location is a technical consideration, not a standalone legal conclusion. Have the responsible reviewer assess applicable obligations and unresolved questions before approving the workflow.

Virtual Inspection Pro provides role-scoped access, with SSO on Enterprise, and an audit log entry for every view, download, share, and export. Translate those controls into an access plan: identify who needs to review media, who needs to distribute records, and who administers access. Map those needs to available roles and verify the resulting permissions before staff begin handling sensitive cases.

For example, a municipal inspection team can document access needs for assigned inspectors and supervisors, then check whether the configured roles match that plan. When a contractor leaves the project, review and remove access through the applicable administrative process. Investigate unexpected downloads or shares by comparing audit entries with assignments and approved requests. NIST’s forensic guidance supports disciplined handling of digital records during investigations. An activity log helps explain access events; it should not be treated as proof of tamper resistance, completeness of the inspection, or acceptable downstream use.

Consider an insurer reviewing water-damage footage from an occupied property. The adjuster needs relevant images, but an export may also expose family photographs or documents visible in the room. Before distributing it, have a designated reviewer check the content, confirm the intended recipients, and use an organization-approved transfer and storage process. Once media is downloaded or exported, do not assume the destination inherits the platform’s access controls or storage-region restrictions.

If someone disputes the footage, preserve the relevant records under your organization’s procedures and request human review of the media and associated activity history. Record what remains uncertain rather than treating secure storage as validation of the scene. Arrange an in-person visit when visibility is inadequate, physical testing is necessary, site conditions appear unsafe, or the responsible inspector cannot make a supported determination remotely. Secure media handling protects the record; it does not replace professional judgment.