How to Share Unreleased Campaign Photos With a Client Securely

Individual proof image URLs are public and do not expire. The password stops the gallery page from handing those URLs out, but an image URL that has already been copied or forwarded still opens.

That is the fact that matters most for pre-release material, so it belongs at the top of the page rather than in a footnote. The gallery password is a gate on the door, not a lock on every photo behind it. Someone who was legitimately let in, who right-clicked one frame and copied its address, holds something that keeps working after you change the password.

Read the rest of this guide with that in mind. Everything below reduces the chance of an accident. Nothing below stops a person who decides to leak.

On confidential work the contract is the control, and the software is the convenience. Write the terms down before anyone lifts a camera, because after the images exist you have lost your leverage to ask for them.

Put these in the agreement, in plain language:

• Who may see the images. Name roles, not just the company. A client contact, an art director, one internal approver. Anyone outside that list needs your written consent.
• The embargo date. The day the material stops being confidential, in writing, so nobody has to interpret it later.
• No forwarding of links or files. State that the review link is for the named recipients only, and that circulating it is a breach.
• What happens on a leak. Notification duty, and who carries the cost. This is the clause that changes behaviour.
• Deletion expectations on the client side. If a file lands on an agency server, your gallery settings have no reach over it at all.

Also say the quiet part out loud in your own planning: a link-based workflow assumes links leak. Design your delivery so that a forwarded link is embarrassing rather than catastrophic, because at some point one will be forwarded.

Four settings do the work. Each one is a real, server-enforced behaviour, and each one has a boundary worth knowing.

Password on. It is per gallery and off by default, so you have to set it deliberately. A section link inside the gallery resolves to its parent, so one password covers every section. If you publish from Lightroom Classic, the plugin can set the password from the Export dialog, which means the gallery is never live and open even for a minute.

Face search off. It is off by default and it should stay off here. Confidential material and a feature that helps people find themselves in a set are a bad combination, whatever the privacy design behind it.

The short-lived handoff instead of a standing download. Upload the full-resolution ZIP when the client is ready to receive it, not weeks earlier. It stays live for 3 days and then closes on its own. For embargoed work this is the genuinely useful part, because the window shuts without anyone remembering to shut it. You can re-upload later if the client needs another pass. Hosted galleries themselves do not expire, so keep that distinction straight: the ZIP is the thing with a clock on it.

Most pre-release leaks are not hacks. They are a link pasted into a group chat by someone who was excited, or a screenshot in a channel with forty people in it.

Reduce the surface area:

• One named recipient. Send the link to the person who is accountable for approvals, not to a distribution list.
• The password in a separate message. Different channel from the link. It is a small friction that stops one forwarded email from carrying everything.
• Say the terms in the email. One sentence naming the embargo date and asking them not to forward. People behave differently when the expectation is written next to the link.
• Send only what needs approving. The tightest selection you can live with. Frames you never send cannot leak.

If several teams need to look, a parent gallery with one section per stage keeps the review organised under your own subdomain. Nothing here gives the client an account or a login, so the link plus the password is the whole access model. Treat it that way.

Revoking a gallery kills the page, the ZIP and the full-resolution link. Do it the moment the review is over. Two dates are worth putting in your calendar the day you send the link: the approval deadline, and the day you revoke regardless.

Revoke when any of these happen:

• The client has approved and downloaded what they needed.
• The campaign launched, and the review gallery has no job left.
• The project was cancelled and the images will never run.
• Your contact leaves the client, and you do not know who now holds the link.

Be honest with yourself about what revocation reaches. It closes the routes this platform serves. It does not reach a file that was downloaded, a screenshot taken during the review, or an individual image URL that was copied while the gallery was open. This page makes no claim about copies or backups beyond that, because that is the boundary of what is verified.

Said plainly, because vendors usually do not: a gallery cannot stop a recipient from screenshotting an image, re-sharing it, or keeping a file they downloaded. No gallery product can. The moment a photo renders on someone's screen, the screen is a copy device, and nothing served over a web link changes that.

A gallery password, an unlisted address and an expiring handoff are accident reduction. They stop the wrong link landing in a search result, they stop a forwarded address opening a full set, and they close the download window on schedule. That is a real improvement over emailing a folder link that lives forever. It is not confidentiality enforcement.

If your material genuinely cannot leak, you need three things this workflow does not provide: visible or forensic watermarking so a leaked frame identifies who leaked it, a controlled viewing environment such as an in-person or screen-shared review where no file is ever transferred, and a contract with teeth that makes a breach expensive. Those are the controls that actually deter a determined person.

There is a difference between a client who would prefer the images stay quiet and a client who has signed an agreement that says they will. If you are carrying a contractual or regulatory obligation, be clear with yourself about what you are buying.

This workflow reduces accidents. It does not prevent a determined leak. If you have told a brand that their pre-release material is protected, make sure the sentence you used matches what the tool does: the gallery page, the whole-gallery ZIP, the full-resolution ZIP, comments and face search are gated by the password on the server, and the full-resolution handoff closes after 3 days. That is the claim you can make and defend.

For most commercial work that is enough, because the real risk is an enthusiastic colleague rather than an adversary. For work where the downside is a lawsuit, put the money into watermarking, a controlled review, and legal language, and treat the gallery as the convenience layer it is.

1. Agree the named recipients, the embargo date and the leak clause in writing.
2. Build the gallery with the tightest selection that lets the client decide.
3. Set the gallery password. Leave face search off.
4. Send the link to one named person. Send the password separately.
5. State the embargo date and the no-forwarding expectation in the email.
6. Upload the full-resolution ZIP only when the client is ready to take delivery. It closes after 3 days.
7. Put the revoke date in your calendar the same day you send the link.
8. Revoke when the review is done, the campaign runs, or the project dies.

Eight steps, none of which require a security specialist. Run them the same way every time and the accidental leak, which is the one that actually happens, stops being likely.