Creative teams hold things clients care about: unreleased campaigns, brand assets, customer lists and contracts. The most effective protections are also the most basic: multi-factor authentication on every account that supports it, access limited to the people who need each project, careful sharing settings, and a clear process for when people join, change roles or leave. Start there before buying anything.
Know what you are protecting
List the kinds of material your team handles, then rate how damaging a leak would be.
| Type of material | Example consequence of a leak |
|---|---|
| Unreleased campaigns and launch dates | Lost surprise, contract breach |
| Client brand assets and source files | Misuse of the client’s identity |
| Customer data supplied for campaigns | Privacy harm to individuals, legal exposure |
| Contracts, quotes and invoices | Commercial sensitivity, fraud risk |
| Your own credentials and admin access | Wider compromise |
Treat the top rows as confidential by default and tell the team which projects carry extra sensitivity. Many client agreements also contain confidentiality clauses, so read them.
Turn on multi-factor authentication
The US National Institute of Standards and Technology notes that passwords alone are not effective for securing your most sensitive business assets, because they can be obtained by threat actors, for example through a phishing email. Multi-factor authentication adds a second barrier by combining at least two of something you know, something you have and something you are. NIST also notes that not all MFA is equally strong: one-time passcodes and text message codes can be targeted by phishing, while authenticators based on the W3C Web Authentication standard are more phishing-resistant, and they matter most for administrator accounts and sensitive data (NIST, Multi-factor authentication for small business).
For a creative team, that means:
- Enable MFA on email, file storage, design tools, project management, social accounts and your domain registrar.
- Prefer app-based or hardware-based methods over text messages where you can, especially for admins.
- Use a password manager so every account has a long, unique password.
- Keep a record of which accounts exist and who administers them.
Shared logins make it impossible to say who did what. Where a tool forces a shared account, restrict who can use it and record the access.
Limit access to what each person needs
NIST’s guidance also recommends limiting access to what each role needs, removing access when roles change or employees leave, and restricting administrative privileges. In practice:
- Organise files by client and project, with permissions set at the folder level.
- Give freelancers and contractors access only to their project, ideally with an end date.
- Keep the number of administrators small.
- Separate work and personal accounts. Do not let client files move into personal storage.
Share files carefully
Google’s help documentation describes three roles for people you share a folder with: viewers can view but not edit, comment or share; commenters can add comments and suggestions; and editors can edit, delete and move files, and by default can change permissions and share. Files inside a shared folder inherit its permissions, and you cannot give someone less access to a single file than they have to its parent folder. For work or school accounts, an expiration date can be added to a person’s access, within one year, and for folders it applies to the viewer role only (Google Drive Help, Share folders in Google Drive). Other platforms behave differently, so check your own tools.
Habits that help:
- Share with named people, not “anyone with the link”, unless the material is intended to be public.
- Give the lowest role that does the job. Most reviewers need comment access, not edit.
- Put anything needing stricter access in a limited folder before sharing a parent folder.
- Review who has access at the end of each project and remove it.
- Use client-approved channels for sensitive files, and avoid sending them as email attachments.
Handle joiners, movers and leavers
A short checklist saves a lot of trouble:
- Joiners. Create individual accounts, enable MFA on day one, grant access to the specific projects they need.
- Movers. When someone changes projects, remove old access as you add new access.
- Leavers. Disable accounts the same day, transfer ownership of files, revoke shared logins and rotate any shared passwords or keys.
Be careful with AI tools
Pasting client material into an AI tool can send it to a third party. Check the tool’s terms, data handling and settings before using it for client work, get client agreement where required, and avoid uploading personal information or unreleased material without approval. Keep a person responsible for review of what goes in and what comes out, and read the IP risk overview for the ownership side.
Back up and prepare for problems
Keep copies of important files somewhere an attacker or accident cannot easily reach, and test restoring them. Write a one-page incident plan: who to tell, how to lock accounts, which clients to inform and who speaks to them. If personal information is involved, find out whether notification duties apply to you under Australian privacy law, and take advice. Being open with clients is also part of brand trust.
A starter checklist
- MFA on every account that supports it, with stronger methods for admins.
- Password manager in use by everyone.
- Folder-level permissions by client and project.
- Sharing set to named people with minimum roles.
- End-of-project access review.
- Joiner, mover and leaver steps written down.
- Rules for AI tools and personal devices.
- Backups tested and an incident plan agreed.
This is general information, not security or legal advice. A qualified IT security adviser can tailor it to your clients’ requirements.
Where Radiance Impact fits
Security is part of how we treat the work we handle for others, and we can discuss how information is managed on a project. Learn more about Radiance Impact or contact us to talk about your requirements.
Sources
- Multi-factor authentication, NIST Small Business Cybersecurity Corner
- Share folders in Google Drive, Google Drive Help
