Data security for property and building data
Floor plans, point clouds, 360° tours and as-built data are not ordinary image files. They reveal access points, technical rooms and internal processes. That is why every capture comes with clear access rights, protected transfer routes and explicit approvals.
- Limit access per project
- Transfer data securely
- Approve outputs explicitly
ISO/IEC 27001: certification in progress
FotoEstate is in the process of certifying its information security management system to ISO/IEC 27001:2022. Independent audit and certification are still pending.
This notice is updated whenever the certification status changes. A label is not a certificate.
Security that works inside the project workflow
- GDPR-compliant processing
Personal data in footage, such as faces or licence plates, is blurred before publication. Data processing agreements are in place with service providers.
- Storage on German servers
Images and project data are held on secured servers in Germany. Transfers are TLS-encrypted.
- Controlled transfer routes
Large data sets such as CAD, Revit or raw files travel over agreed, protected routes rather than private messengers.
- Approval before publication
Tours, digital twins and media only go live after your approval. Sensitive areas can be hidden.
- Data minimisation
Only what the project purpose requires is captured and delivered. Critical views can be handled separately.
- Retention and deletion
Hosting term, handover and deletion are set per project and confirmed on request.
Not every property needs the same data route
- 01 · Public
Approved photos, tours and listing content that are meant to be public.
- 02 · Internal
Work-in-progress and building data used only within a defined project group.
- 03 · Confidential
Restricted access roles, protected transfer and documented approval, for example for bank assets.
- 04 · Strictly confidential
Per-project security concept, minimal access rights and agreement before capture and delivery.
A consistent security process
- 01 · Clarify protection needs
Property, data types, recipients and publication are assessed before the project starts.
- 02 · Capture in a controlled way
Capture areas and handling of visible sensitive information are agreed.
- 03 · Process securely
Data stays in a defined project structure with separate access.
- 04 · Release deliberately
Output, access rights, term and deletion follow the agreed approval.
Suited to sensitive properties
- Commercial, industrial and logistics properties
- Bank assets and portfolios for financing
- Asset holders and facility management
- Care, clinic and administration buildings
- Construction and as-built documentation
- Tours with protected access
Frequently asked questions about data security
Is FotoEstate ISO 27001 certified?
The current status is stated at the top of this page. Certifications held by data centres and infrastructure providers apply to those providers and do not replace our own certification.
Where is my data stored?
On secured servers in Germany. For special cases we agree storage location and access with you in advance.
Are people and licence plates blurred?
Yes. Personal data is blurred before publication.
Can sensitive areas be excluded from a tour?
Yes. We define capture areas and omissions before the appointment. The tour only goes live after your approval.
What happens to the data after the project?
Hosting term, handover and deletion are agreed per project. On request we confirm deletion.
What protection level do your building data need?
We align capture, delivery and deletion with your property.