I watched a guy who worked for me pull up an inspection recording on his phone at a taco place. He was not doing anything sinister. He was showing another salesperson a wild example of storm damage, the way anybody would show a coworker something interesting. The address was in the file name. That was the afternoon inspection recording access control stopped being a settings screen to me and started being a decision about how I want to run a company.
I did not yell at him. He had access, so as far as he knew he was allowed. That is the whole problem with default-everybody access. It never fails loudly. It just erodes.
The four groups
Everybody who might want to watch falls into one of four buckets, and they do not deserve the same answer.
The homeowner. It is her house. She should be able to get to her own recording without asking permission from a company she hired once. This is the easy one and it is the only group where the answer is basically yes.
The inspector who was there. Also easy. He was on the roof, he narrated it, he needs to be able to pull it up when he writes it up.
The office. Harder than it looks. Somebody has to attach the recording to the job, answer the phone when the customer calls about it, and find it in eighteen months. That is real work and it needs real access. It is not a reason for six people to be able to browse every property the company has ever visited.
Everybody else in the company. The salesperson who never went to that address. The new hire. The owner's nephew who helps with marketing and wants clips for the website. Each one of them has a reason that sounds fine in isolation, and none of those reasons is need.
Default deny is not paranoia
The instinct in a small company is to give everybody everything, because the alternative feels like distrust and because you have twelve other problems. I ran it that way for a while. Here is what changed my mind.
An access list is not a statement about whether you trust your people. It is a statement about what you can honestly tell a customer. If a homeowner asks me who at my company can watch the video of her back yard, I want a short, specific, true answer. Everybody with a login is not that answer.
There is also the boring operational version. People leave. A guy who worked for you for four months in 2023 should not still be able to open footage of a customer's property, and if your access model is everybody-by-default, the offboarding step nobody does is exactly the one that matters here.
And there is the marketing version, which trips up more companies than the other two. Somebody wants a clip for a website or a social post. That is a genuinely useful thing to want. It is also somebody's house, and the answer is you ask her, in words, before you use anything. Access to footage for doing the job is not permission to publish it.
Inspection recording access control in practice
What I settled on is not complicated and does not require a compliance department.
Access follows the job, not the person's title. If you are on the job you can see the job. If you were never on it, you need a reason and somebody to give it to you.
The office role is defined by task, not by seniority. Attach, retrieve, send to the customer. That covers ninety-five percent of what anybody in the office actually needs.
Nothing is browsable. There is no wall of thumbnails of every property the company has visited, because a wall of thumbnails is an invitation. You get to a recording through the job it belongs to.
Every retrieval issues a fresh short-lived signed URL rather than a permanent address, which means access is a thing that happens each time rather than a key somebody keeps in a drawer. That mechanism is the same one behind expiring viewer links, and I walked through the whole model in what secure inspection video sharing means.
Good inspection recording access control mostly comes down to this: make the default no, make the yes easy for the people doing the work, and make sure nobody has to share a login to get their job done. Shared logins are where all of this dies. If two people use one account, you no longer know who watched anything, and every other control you set up is decoration.
What access control does not solve
It does not stop the person who is allowed to watch from screen recording. Nothing does. A homeowner who wants a permanent copy of her own inspection will have one, and that is fine.
It does not decide what is in the frame. If you swing the camera through a bedroom window on the way to the ridge, restricting who can watch is a poor substitute for not filming it. Point at the roof, narrate the roof.
It does not answer the outside-the-company question either, which is a different animal with different rules. Once footage leaves your account it is gone in a way internal permissions cannot reach, and I went through how I handle that in sharing inspection video with a third party.
And it does not touch anything on the insurance side. I document condition. I do not talk about coverage, claim value, or whether anybody should file, because I am a contractor and not a licensed public adjuster. If a homeowner is dealing with an insurer, that is her business and her relationship, and what she has from me is a record of what her property looked like on a specific day.
The test I use
When I am unsure whether somebody should have access, I imagine explaining it to the customer in her driveway.
My office manager can pull this up so she can send it to you and find it later. That sounds normal. She would nod.
A salesperson who has never been to your house can browse it because he might want an example someday. That sounds like something I would not want to say out loud, which is how I know the answer.
It is not a sophisticated test. It has been right every time.
The security model page lists what each role can actually do, which is worth reading before you hand out logins, and pricing is per job rather than per seat, specifically so nobody on your team has a financial reason to share an account.
InspectStream records what an inspector observed. It is not a public adjusting service and does not prepare, negotiate, or advise on insurance claims.