Sooner or later somebody sends an inspection link to the wrong number. Usually it is autocomplete: two customers with the same first name, a thumb, a busy morning. The link goes out, and about four seconds later you realize the roof somebody is now looking at is not theirs.
What happens next depends almost entirely on decisions made before it happened.
Why expiring links are the whole answer
A shared file has no memory of who was supposed to open it. Once a permanent URL exists, it exists — forwarded, screenshotted, sitting in somebody''s messages a year later, indexed if it ever touched a public bucket. There is no recall.
Access that is granted rather than published behaves differently. It can be checked at open time, and it can stop being true. That is the entire argument for links that expire on their own, and the wrong-number case is where it stops being theoretical.
If a viewer link is short-lived and scoped to one session, a misdirected link is a small problem: a stranger may see some of one inspection, and then the link is dead whether you act or not. If it is a permanent share, you have no move at all. Same mistake, completely different day.
What you can actually undo
Be honest with yourself about the boundary here, because it decides what you tell the customer.
You can stop future access. Ending the session kills a live viewer link immediately, and revoking a recording share stops it resolving. That closes the door.
You cannot un-see what was already seen. If somebody opened the link and watched two minutes of a roof, those two minutes happened. No system claws that back, and any vendor implying otherwise is selling you something.
So the sequence is: close the door first, then find out how far it got opened.
- End or revoke immediately. Before you compose an apology, before you work out what happened. Seconds matter and nothing else in this list does.
- Check the access record. Who opened it, from where, for how long. Whether it was opened at all is the single fact everything else depends on.
- Re-send correctly, to the right person, as a fresh link rather than a forward of the old one.
- Write down what happened while it is fresh — time, wrong recipient, what they could have seen, what you did.
What to say, and to whom
If the link was never opened, the wrong recipient does not need a message. A text to a stranger explaining that they briefly had access to somebody''s house is worse than the thing you are apologizing for. Revoke, note it, move on.
If it was opened, both people hear from you. The wrong recipient gets one plain sentence: sent in error, access has been removed, please disregard. No detail about whose house it was.
Your customer gets the truth, unhedged and from you. "I sent your inspection link to the wrong number this morning. They opened it for about a minute. I revoked it as soon as I saw. Here is your correct link." What sinks people is not the mistake; it is the customer finding out later, from somebody else, that there was something to mention.
Prevention that survives a busy morning
The controls that hold up are the boring ones. Send from the job record rather than from your contacts list, so the recipient comes from the file instead of from memory. Confirm the last four digits out loud with the person standing in front of you. Give the session its own link per viewer rather than one link forwarded around, because a link that was only ever meant for one person is one you can reason about later.
And keep the exposure window small by default. Nothing you configure afterward makes up for a share that outlives the reason it existed — which is really the argument for treating who should be able to see a recording as a policy rather than a per-job decision made in a hurry.
The specifics of expiry, revocation, and what gets logged when somebody opens a link are on the security page. Worth reading before you need it rather than during.
InspectStream records what an inspector observed. It is not a public adjusting service and does not prepare, negotiate, or advise on insurance claims.