Third-Party Access Requests for Security Sites

A police officer rings about an incident at one of your sites and wants the report. Or a solicitor emails asking for footage tied to a claim. Right now that probably means someone digging through folders, deciding what's safe to send, and emailing a PDF with no record of who saw what.

What most firms do today

An email attachment, sent from whichever manager picked up the phone. Nobody else at the company necessarily knows the request happened, what was sent, or whether the person asking was who they said they were. If it turns up again in a dispute, there's nothing to point to beyond a sent-items folder.

How TacDesk's access request system works

A manager starts a request against a specific report group (the reports and any linked footage for an incident or a site period), and TacDesk generates a secure link with its own access token.

The requester justifies the request before they see anything. Whoever gets the link has to fill in who they are, their organisation, a badge or reference ID, the legal basis for asking (police powers, an FOI request, a court order), a case reference and what they need. Nothing is released at this point: the form only records the request and puts it into a pending queue.

A manager decides, on the record. The request lands with your senior managers and admins, who see the justification and approve or deny it. An approval sets an expiry date and generates a one-time passcode; the requester needs both the link and the passcode to get in. A denial closes it with your review notes attached. Either way, the requester gets a notification.

Access is time-limited and read-only. Once approved, the link opens the named report group in a view-only screen for the requester, with no navigation to anything else in your account. It stops working the moment it expires, and a manager can revoke it earlier if the situation changes.

Every step is logged. Link created, form viewed, form submitted, approved or denied, the view being opened, individual reports and footage being viewed, expiry, revocation: each is a timestamped entry against that request, with the requester's IP address recorded. The access requests screen lists every request with its status and lets you filter by it, so you can see at a glance what's pending, what's live, and what's already closed, without opening each one to check.

Expired requests close themselves. An hourly check runs in the background and marks any request past its expiry date as expired, so an approved link doesn't sit there looking live after the date a manager set has passed. Senior managers and admins are the only ones who can open the access requests screen at all, so who gets to grant access is controlled the same way the access itself is.

Why it matters

It answers "who saw this and when" without you having to remember. If a case comes back months later, the log is still there: who asked, what they were told they needed it for, who approved it, and what they actually opened.

It takes the judgement call out of one person's inbox. The requester has to state their legal basis before a manager signs off, so the decision is made against something written down, not a rushed phone call.

It stops a link outliving its purpose. Expiry and revocation mean a request granted for one enquiry doesn't quietly stay open for the requester to come back to later.

Where it sits

Third-Party Access Requests is included from TacPro upwards: TacPro and TacCommand. On TacStarter it's a paid add-on, and it isn't available on TacFree. See the pricing page for the current add-on price.

If footage is part of what you're releasing, it works alongside Footage Management, and the same evidence often started life on a guard's incident report.

Start free on TacFree to get your guards and sites set up, or book a demo to see how access requests fit into a live account.