The privacy-first studio checklist

Every client record stores a safe channel and safe hours before the first reply.

A message arriving on the wrong device at the wrong moment is the most common avoidable harm in boudoir work.

Outgoing messages use neutral previews and a studio name the client agreed to.

Lock-screen previews are read by people who were never part of the booking.

Service agreement, session boundaries, and publication permission are recorded separately.

One signature cannot answer three different questions later.

Every publication permission names a channel, a crop rule, and an expiry date.

Open-ended permission drifts into uses the client never pictured.

Clients are told how to withdraw permission and the request has an owner.

A withdrawal with no owner becomes a message nobody actions.

Team members see client material only for work they are assigned to.

Broad internal visibility is the quiet default that causes the loudest incidents.

External editors, labs, and contractors receive access that expires on its own.

Access granted once and never revoked outlives the relationship.

Screens in shared studio spaces default to discreet display.

Reveal sessions and edits are often visible to whoever walks past.

Cards and devices are offloaded to studio storage the same day and cleared.

Original files on a camera bag card are the least protected copy you hold.

Each material type has a written review window and a default action.

Material you no longer need is risk you are still carrying.

Deletions are recorded, including what was removed and by whom.

An undocumented deletion cannot be confirmed to a client who asks.

A written first hour exists for a suspected exposure of client material.

Decisions made in the first hour of an incident set the tone for everything after.