Concepts

Media Privacy and Archive Reliability

Where your photos and footage go, how to keep them safe for decades, and how to give an AI agent access without giving up control.

Updated November 11, 2026 · 11 min read

A verified offload writes two copies and checks each file against its checksum; the third copy lives somewhere else. The offload window is a generic illustration. Illustrated UI.

Keep your originals on storage you control. Keep three copies of them, on two kinds of storage, with one copy somewhere else. And keep your catalog, the record of what you have and where it is, separate from the storage itself, so losing a drive never costs you the record of the other thirty.

The rest of this page refines those rules: what cloud services receive, why a catalog is not a backup, how to make copies you can trust, how to handle NDA footage, and how to give an AI agent access without handing it the keys.

Rule	Why it matters	Start today
Originals on storage you control	You decide who reads them, where they're processed and when they're deleted	List every drive, NAS volume and cloud folder that holds originals
Three copies, two kinds of storage, one elsewhere	Drives fail, bags get stolen, studios flood	Find the shoots that exist on only one drive
Catalog separate from storage	A catalog can outlive any one drive and tell you what was on it	Back up the catalog on its own schedule

"Storage you control" can be your own drives, a NAS, or a cloud account where you set the terms. What matters is knowing where the originals are and who else can read them.

What leaves your machine with a cloud library

When you put work into a cloud photo or video library, the provider stores a copy of your originals. It usually also holds data derived from them:

Previews and proxies of every file.
Embedded metadata, such as capture time, GPS location and camera details.
Filenames and folder names, which often carry client names, locations and project codenames.
Analysis results: face groupings, object and scene labels, transcripts and captions.

None of that is a problem in itself. Cloud libraries are good at sharing, review and access from anywhere. Just know what you've handed over before a client asks.

On-device and cloud AI features

"AI search" or "auto-tagging" can run on your computer, on the provider's servers, or partly on each. The feature name won't tell you which. On-device analysis keeps your files and the results on your machine. Server-side analysis needs the media, or something derived from it, sent first. The split can differ between features in the same app.

What to ask a vendor

Question	A clear answer
Where is analysis done?	Names which features run on your device and which need their servers
Is my media, or data derived from it, used to train models?	Says which kinds of models, whether you can opt out, and what the default is
Can people at the company see it?	Says when human review happens and under what safeguards
How long is it kept?	Gives retention for originals, derived data and backups, including after you delete
How do I delete it?	Covers derived data such as face groupings and transcripts, not only the files

Expect conditions. Adobe's content analysis FAQ, updated June 4, 2026, is a useful example. It says Adobe doesn't analyze content stored locally on your device for product improvement, but may analyze content processed or stored on its servers. Personal accounts can turn that off; business accounts are opted out automatically; and the opt-out doesn't cover programs you choose to join, such as betas or feedback submissions. It also says Adobe doesn't analyze your content to train generative AI models unless you submit it to Adobe Stock. Where the file sits, your account type and the programs you joined all change the answer.

For a step-by-step view of where each part of a job happens, from storage to sharing, see local vs. cloud for client work.

Why the catalog is not the backup

Storage holds your files. A catalog holds a record of them: locations, metadata, ratings, keywords, previews and analysis. Lightroom Classic, disk catalogs, DAMs and media libraries all work this way.

That record is valuable, but it is not a copy of your work. Previews are smaller than your RAW files and footage. If a drive dies, the catalog tells you what you lost, not how to get it back.

Two habits follow.

Back up the catalog as well as the files. It holds your selects, ratings and collections.
Keep the catalog off the storage it describes. If the catalog lives on archive drive 7 and drive 7 fails, you lose both.

Offline drives

A good catalog keeps previews and metadata for unplugged drives, so you can search the archive with the drives on a shelf and connect only the one you need. Index each drive fully while it's connected; the catalog only remembers what it read. Disk catalogs and their alternatives covers the options.

One example of a catalog that remembers: in Grain Photo, which we make, an unplugged drive's photos stay searchable from saved previews, marked with an orange dot. Illustrated UI.

Renaming and moving files

Catalogs point at file paths. Move or rename files behind the catalog's back and those links break. Adobe's help page on locating missing photos says that adding, deleting, moving or renaming files or folders in Finder or Explorer breaks the link with the Lightroom Classic catalog, and that an offline external drive or a changed drive letter on Windows can break it too. Lightroom Classic can relink a whole folder with Find Missing Folder, but relinking a large archive is slow.

Move and rename inside the catalog app when you can, or in one planned pass with a relink straight after. Give every drive a unique name and keep it.

Sidecars and catalog databases

	XMP sidecar	Catalog database
Where it lives	A small file next to each original	One database file for the whole library
Travels with the file	Yes, if your copy tool includes it	No
Readable by other apps	Often, for ratings, keywords and descriptions	Usually only by the app that made it
What it holds	Metadata and edit settings for one file	Everything: collections, previews, history, analysis
Main risk	Left behind when files are copied without it	One file to lose or corrupt

Lightroom Classic writes edits to its catalog. Turn on Automatically write changes into XMP in Catalog Settings → Metadata to keep sidecars up to date as well, according to Adobe's page on saving metadata to sidecar files. From version 15.0, it also writes an ACR sidecar for heavy edits, masks and AI settings such as Denoise.

If ratings and keywords must survive a change of software, write them to XMP too, and copy sidecars with their files every time.

Backups that actually restore

The 3-2-1 rule

The 3-2-1 rule, and where a catalog fits: it helps you find every copy, but it is not one of them.

The US government's Data Backup Options paper, written for US-CERT and now hosted by CISA, recommends the 3-2-1 rule: three copies of any important file (the original and two backups), on two different types of media, with one copy stored offsite. Backblaze describes it the same way.

For a photographer or filmmaker, that usually means:

The working copy on your main drive or NAS.
A second copy on separate local storage.
A third copy somewhere else: a drive at another address, or a cloud backup.

Some things look like copies and aren't. A RAID mirror survives one disk dying, but mirrors a deletion at once. Two drives in the same bag are one theft away from zero.

Verified copies at offload

The first copy is made from the camera card, and that's where errors start. A plain drag-and-drop copy doesn't compare checksums of the copy against the source. Offload tools do: they calculate a checksum, a short fingerprint of the file's contents, for the source and each copy, and flag any mismatch. Many also write an MHL (Media Hash List), a manifest of every file's checksum, so you can re-verify a drive years later.

OffShoot is the offload app formerly called Hedge. Every transfer is verified, with modes ranging from a file-size comparison to reading back source and destination and comparing checksums. It always records XXH64BE checksums in its logs and MHLs, with MD5, SHA1 and C4 as options.
ShotPut Pro, from Imagine Products, offers verified offloads and PDF reports, on Mac and Windows.
Silverstack, from Pomfort, makes checksum-verified copies (XXH64, MD5, SHA1, C4ID, XXH3 or XXH128) and keeps ASC MHL manifest histories as a chain of custody for each clip.

Keep the MHL or offload report with the copy. It proves the archive matches the card.

How long drives last

Every drive fails eventually, and you can't predict when. Backblaze publishes failure data from its data centers. Its Q2 2026 Drive Stats covered 354,415 hard drives, with an annualized failure rate of 1.73% for the quarter and 1.41% over the drives' lifetime. Two of the three models with the highest failure rates that quarter were nearly seven and nearly eight and a half years old.

Those are data-center drives running around the clock, not portable drives on a shelf, so treat the numbers as a reminder, not a forecast. In practice:

Power up shelved drives on a schedule, and re-verify them against their MHLs.
Replace a drive at the first sign of trouble, from the second copy, not the failing one.
Plan to move an archive to new drives every few years rather than waiting for the old ones to fail.

Cloud backup is not cloud sync

	Cloud sync	Cloud backup
Purpose	The same files everywhere, up to date	A separate copy you can restore
When you delete a file	The deletion spreads to every synced device	The backup keeps it, for the retention period
When a file is corrupted	The damaged version spreads	Earlier versions remain
Counts as a 3-2-1 copy	Only with version history long enough to recover from mistakes	Yes

Backblaze, which sells backup, makes the case in why backup beats sync: a sync service without version history can lose a deleted file for good, because it isn't keeping a separate copy. Whatever you use, check how long your plan keeps deleted files and earlier versions, and test a restore before you need one.

Client footage and NDAs

This section isn't legal advice. For what a specific contract permits, ask the client or a lawyer.

Read the contract for

Third-party processing. Does it allow cloud storage, review platforms, transcription services or AI providers to store or process the material?
AI use. Does it mention AI, machine learning or model training? Many older contracts don't, which means asking.
Location. Must the material stay in a country or on approved systems?
Retention. How long may you keep raw footage and selects? What happens at the end?
Access. Who may see it: assistants, editors, retouchers?

Put in writing

Where the material will be stored, and which services will process it, including transcription and any AI assistant.
How long you'll keep raw material and selects, and how you'll return or destroy them, backups and cloud copies included.
Whether you may use any of it in your portfolio, and when.

A short email the client answers "yes" beats an assumption. If the contract is silent on AI, ask before using an AI service on their material.

Keep client libraries separate

Put each confidential job on its own drive or volume, so you can disconnect, hand over or wipe it alone.
Encrypt drives that leave the studio.
Watch filenames and folder names. ACME_Launch_CONFIDENTIAL is visible to every service and assistant that reads your file paths.
Share cuts and selects for review through a service the client has agreed to, with expiring or protected links.
At the end, record what you returned, what you deleted and where, so you can answer the client's question in one line.

Safe agent permissions for a media library

AI agents can now search a library, read transcripts and gather selects through connectors such as MCP. If that's new, start with what MCP is. Grant access that matches the job, and make sure you can take it back.

Start read-only. Let the agent search and read metadata and transcripts before it can change anything.
Previews before originals. A preview is enough for an agent to judge what's in a shot. Grant access to originals only when a task needs them, such as an export.
Know what leaves. Unless the model runs on your own computer, whatever the agent reads, including filenames, metadata, transcript text and previews, goes to the model provider under its policies and your account settings.
Keep write actions behind approval. The MCP specification says there should always be a human in the loop with the ability to deny tool calls, and that clients should ask for confirmation on sensitive operations. Use those prompts. Don't auto-approve moves, renames or deletions.
Turn access off when you're done, and before restricted client work goes into the library. Telling an agent "only look at the Harbor folder" is an instruction, not a permission.
Keep a record of which agent had access, to what, and what it changed.

Our app, Grain Photo, works this way. Its built-in MCP server lets ChatGPT, Claude Desktop or your own agent on the same Mac search the library, read transcripts, find similar shots and gather results into collections. You choose whether the agent sees previews and originals, and you can turn its access off at any time.

A checklist

Storage and backups

Know every place originals live: drives, NAS volumes, cloud folders.
Three copies, two kinds of storage, one somewhere else.
Offload with a tool that verifies checksums, and keep the MHL or report with the copy.
Use cloud backup, not plain sync.
Re-verify shelved drives on a schedule, and test a restore.

Catalog

Back up the catalog separately from the storage it describes.
Move and rename inside the catalog app, or relink straight after.
Write ratings and keywords to XMP if they need to outlive the app, and copy sidecars with their files.

Cloud and AI

Ask every vendor where analysis runs, whether your media trains models, how long it's kept and how to delete it. Keep the answers, dated.

Client work

Read the contract for processing, AI, location, retention and access.
Get the client's yes in writing before using AI services on their material.
One drive or volume per confidential job, encrypted if it travels.
Record what was returned or destroyed.

Agents

Read-only first; previews before originals.
Approval required for every write action.
Access off when the job ends, or before restricted work arrives.

How we keep this current

Every source on this page was checked on November 11, 2026. Vendor policies, features and specifications change, so we recheck the linked sources and update the date at the top when something changes. If you spot something out of date or wrong, tell us through support and we'll correct it.