Can this agreement be signed electronically?

Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided the signing meets intent, consent, attribution, and retention requirements.

Do I need a notary or witnesses?

Usually no for confidentiality provisions; notarization or witnesses are only required when a particular state statute or evidentiary need mandates it. Check state rules for notarization or witness requirements.

When is a HIPAA addendum required?

If media contains protected health information, include a Business Associate Agreement (BAA) and HIPAA-specific security obligations. HIPAA requires retention and breach notification provisions under 45 CFR §164.530(j).

How long should executed agreements be retained?

Retain executed Media Security Agreements for the contract term plus a prudent post-termination period—commonly 3 to 7 years—and longer if federal law or industry rules require it.

What authentication level is sufficient for signing?

Match signer authentication to risk. Email link or SMS may suffice for low risk; use multi-factor or identity-proofing for high-value transfers or regulated records.

What if a party's name is entered incorrectly?

A mismatch can create enforceability issues. Correcting may require an amendment and re-execution. Verify legal names and signatory authority before sending for signature.

Electronic Signature
Templates
Miscellaneous
Media Security Agreement

Media Security Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

MEDIA SECURITY AGREEMENT

This Media Security Agreement ("Agreement") is entered into as of Date: by and between:

Service Provider Service Provider Address Client Client Address

RECITALS

WHEREAS, Service Provider maintains physical and electronic media handling capabilities and provides secure media transport, storage, and destruction services for audio, video, photographic, digital, and analog media and related assets; and

WHEREAS, Client requires protection of confidential information contained on or embodied in media, and wishes to engage Service Provider to apply and maintain security controls consistent with the terms of this Agreement; and

NOW, THEREFORE, in consideration of the mutual covenants and promises set forth herein, the parties agree as follows:

SCOPE OF WORK

Description of Services

SECURITY OBLIGATIONS

Service Provider shall implement and maintain administrative, physical and technical safeguards appropriate to the sensitivity of the media and the information contained therein, including but not limited to controlled access, logged chain-of-custody, tamper-evident packaging, and encryption of electronic media at rest and in transit where applicable. Service Provider shall ensure that personnel with access to Client media are subject to background checks and confidentiality obligations no less protective than those contained in this Agreement.

Media types covered (check all that apply): Physical (film, tape, printed) Digital storage devices Cloud-hosted media Other

PAYMENT TERMS

Total Fee: $

Payment Schedule

Payment Due Within: days of invoice.

Late Fee: on overdue balances, plus collection costs.

TERM AND TERMINATION

Term Commencement Date: . Term Expiration Date: .

Either party may terminate this Agreement for convenience upon written notice to the other party: days prior to termination. Termination for material breach is permitted where the breaching party fails to cure the breach within thirty (30) days of written notice, or immediately where a material breach involves unauthorized disclosure of Client confidential information.

CONFIDENTIALITY

Each party shall hold confidential all non-public information disclosed by the other party in connection with this Agreement ("Confidential Information") and will not use or disclose such Confidential Information except as necessary to perform its obligations hereunder or as required by law. Confidential Information does not include information that is publicly known through no fault of the receiving party or independently developed without reference to the disclosing party's Confidential Information. Service Provider shall use at least the same degree of care to protect Client Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care.

MEDIA HANDLING, RETENTION AND DESTRUCTION

Destruction/Return Procedures

Service Provider shall maintain records of retention and destruction and provide, upon request, a written certificate of destruction signed by an authorized representative describing the media destroyed, date of destruction, and method used.

BREACH NOTIFICATION

In the event of an actual or suspected unauthorized access to or disclosure of Client media or Confidential Information, Service Provider shall notify Client without undue delay and not later than calendar days after discovery. Notification shall include the nature of the incident, media or records affected, corrective actions taken, and any recommended mitigations.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify and hold harmless the other from claims, liabilities, losses, and expenses arising from the indemnifying party's negligence or willful misconduct in performing its obligations under this Agreement. Except for breaches of confidentiality, willful misconduct, or indemnification obligations, neither party shall be liable for consequential, incidental, punitive, or special damages. The aggregate liability of Service Provider for direct damages arising under this Agreement shall not exceed the total fees paid by Client to Service Provider during the twelve (12) months preceding the event giving rise to the claim.

INSURANCE

Service Provider shall maintain, at its expense, commercial general liability insurance and professional liability insurance in amounts sufficient to cover its liabilities under this Agreement. Minimum coverage required: $ per occurrence.

AUDITS AND SUBCONTRACTORS

Client may, upon reasonable prior notice and during normal business hours, audit Service Provider's security procedures as they relate to Client media. Service Provider shall obtain Client's prior written consent before subcontracting any material media handling or destruction services; any approved subcontractor shall be bound by obligations no less protective than those in this Agreement.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Agreement, including any exhibits or attachments executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether oral or written. Any amendment or modification shall be in writing and signed by authorized representatives of both parties.

NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the contact information below for each party.

Service Provider Contact Name and Title Service Provider Contact Address Client Contact Name and Title Client Contact Address

Service Provider — Printed Name:

By:

Date:

Client — Printed Name:

By:

Date:

What a Media Security Agreement is and when it applies

A Media Security Agreement is a legal contract that sets terms for handling, storing, transferring, and protecting media assets and related metadata. It commonly addresses confidentiality, access controls, permitted uses, chain of custody, and incident reporting. The agreement can apply to digital files, physical media, recorded interviews, raw footage, photographs, and metadata produced or exchanged between producers, distributors, vendors, and clients. Organizations use this document to assign responsibility for secure storage, to define acceptable encryption or redaction standards, and to specify remedies for unauthorized disclosure or loss of media assets.

Why a clear Media Security Agreement matters for risk management

A well-drafted Media Security Agreement reduces legal and operational risk by defining roles, technical safeguards, and response duties. It supports compliance with federal rules where applicable, such as HIPAA for health-related recordings and ESIGN/UETA for electronic consent and signatures (15 U.S.C. ch. 96; UETA).

Step-by-step: completing a Media Security Agreement

Follow these sequential steps to prepare and execute a Media Security Agreement accurately and consistently.

01

Gather parties: Identify all legal entities and signatories before drafting.
02

List assets: Enumerate media types, file formats, and storage locations.
03

Specify controls: Define encryption, access rules, retention, and redaction processes.
04

Sign and archive: Execute via compliant eSignature and store the executed copy.

Essential information fields to include

Parties: Legal names

Effective Date: MM/DD/YYYY

Asset List: File types

Security Measures: Encryption level

Retention: Duration

Signatures: Authorized parties

Core clauses to include in a professional Media Security Agreement

Include clauses that allocate responsibility, define technical standards, and set remedial measures for breaches or loss.

Confidentiality

Define what is confidential, exceptions, and permitted disclosures. Include requirements for vendors, subcontractors, and subcontractor flow-down obligations.

Security Standards

Specify technical controls such as encryption algorithms (AES-256 at rest), transport security (TLS 1.2/1.3), access control, and logging requirements for auditability.

Access and Use

Describe who may access media, for which purposes, and under what approvals or role-based permissions access is granted.

Chain of Custody

Set procedures for tracking transfers, handling original media, and documenting custody to preserve evidentiary integrity.

Breach Response

Outline notification timelines, remediation steps, investigation responsibilities, and cooperation obligations for security incidents.

Indemnity & Limits

Allocate liability and define indemnity, consequential damages waivers where allowed, and insurance minimums if required.

Typical organizations and roles that prepare or sign this agreement

The document also suits freelance producers, marketing agencies, and public organizations that need consistent handling rules and audit trails.

In-house legal and compliance teams that need to define obligations for vendors and distribution partners.
Production and post-production teams that control raw footage and need chain-of-custody assurances.
Vendors and cloud storage providers that receive or host media under contractual safeguards.

Who signs and why: representative signer profiles

General Counsel

In-house counsel or external law firm partner who reviews legal terms, confirms indemnity and compliance obligations, and signs on behalf of the corporate entity with delegated authority.

Production Manager

Operational lead responsible for chain of custody, ensuring technical controls are implemented, and attesting that the team will follow retention and access procedures described in the agreement.

How to configure an online Media Security Agreement workflow

Map fields and authentication to match the agreement's control requirements before sending for signatures.

Field	Configuration
Signature Type	Choose eSignature (email/SMS auth) or digital signature (PKI) if required
Authentication	Use email link for low risk; SMS or KBA for higher assurance
Required Fields	Make party names, dates, and security controls mandatory
Audit Trail	Enable full audit capture: IP, timestamps, and event log

Typical e-signature and e-submission flow for this agreement

Online execution follows predictable steps; ensure each step preserves intent, attribution, and retention to meet ESIGN/UETA tests.

Upload Document: Sender uploads final PDF or DOCX with embedded fields.
Place Fields: Add signature, initials, date, and required checkbox fields.
Authenticate Signers: Select email link, SMS code, or higher-assurance option.
Capture Audit: Platform records timestamps, IP, and completion certificate.

Technical requirements for secure eSigning and storage

For healthcare workflows verify HIPAA-compliant handling and a signed BAA; for regulated evidence chains confirm long-term tamper-evident storage and robust access controls.

Encryption: TLS 1.2/1.3 in transit and AES-256 at rest meet common security expectations.
Audit Trail: Detailed event logs, signer metadata, and tamper-evident records are required for evidentiary use.
Integrations: Confirm integrations with cloud storage and CMS systems (Salesforce, Google Workspace, NetSuite) for automated archiving.

Comparing eSignature vendors for executing Media Security Agreements

Vendor pricing and features differ; signNow is listed first. Verify vendor plans and HIPAA options before selecting an execution platform.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
Envelope Cap	No cap	100 envelopes/user/yr	Varies by plan	Varies by plan	Varies by plan

Common deadlines and timing expectations for execution and notices

Set clear dates in the agreement for when obligations begin, for delivery of copies, and for security incident notices.

Effective Date:

Date when obligations commence; use MM/DD/YYYY format

Execution Deadline:

Specify when all parties must sign, e.g., within 30 days of counterparty receipt

Delivery of Copies:

Require executed copies to be delivered within a set number of days, commonly 5–10 days

Breach Notice:

Specify incident notification timeframe, commonly 72 hours for serious breaches

Retention Trigger:

Define events that start retention clocks, such as project close or final payment

Common mistakes to avoid when preparing this agreement

Using vague security language that fails to specify encryption, access controls, or logging requirements.
Failing to identify authorized signers or to confirm corporate authority before execution.
Neglecting industry-specific addenda such as a HIPAA BAA for health-related recordings.
Not preserving a verifiable audit trail during electronic signing, which weakens evidentiary value.

Potential penalties and risks of an incorrect or incomplete agreement

Contract Liability: Breach damages

Regulatory Fines: HIPAA civil penalties possible

Evidence Loss: Chain-of-custody gaps

Insurance Issues: Claim denials for poor controls

Reputational Harm: Public disclosure risk

Operational Disruption: Project delays or data loss

Practical tips for accurate and efficient completion

Adopt consistent templates and verification steps to reduce errors and accelerate execution.

Use a master template

Maintain a controlled master Media Security Agreement template that includes standardized security clauses, approved BAA text for healthcare, and a designated signature block so each executed copy is consistent and audit-ready.

Record signatory authority

Confirm and document each signer's authority to bind their organization, including title and delegation evidence; this reduces later disputes about whether the agreement was validly executed.

Align technical specs

Coordinate the agreement's technical security requirements with IT and vendors to ensure specified encryption, access control, and logging are implementable and tested prior to granting access to sensitive media.

Preserve audit evidence

Use an eSignature platform that captures a durable audit trail, stores executed PDFs with embedded metadata, and retains event logs to support compliance and evidentiary needs.

Real-world examples of how organizations apply Media Security Agreements

Below are two concise examples that illustrate typical organizational use of media protection terms and workflows.

Optica Ventures LLC — COO

Optica adopted electronic agreements to standardize handling of client recordings and file transfers.

The team enforced AES-256 storage and role-based access.
The result was consistent procedures across projects and clearer contractual responsibility for vendors and subcontractors, helping streamline audits and vendor onboarding.

Martin Properties — Founder

A mid-size firm used digital agreements for property media and inspection recordings.

They required signed chain-of-custody clauses and retention schedules.
This approach reduced delays when delivering media to third parties and improved confidence in evidence integrity during tenant or vendor disputes.

Frequently asked questions about Media Security Agreements

Answers to common execution, compliance, and storage questions that arise when using Media Security Agreements.

Need help? Contact support

Can this agreement be signed electronically?
Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided the signing meets intent, consent, attribution, and retention requirements.
Do I need a notary or witnesses?
Usually no for confidentiality provisions; notarization or witnesses are only required when a particular state statute or evidentiary need mandates it. Check state rules for notarization or witness requirements.
When is a HIPAA addendum required?
If media contains protected health information, include a Business Associate Agreement (BAA) and HIPAA-specific security obligations. HIPAA requires retention and breach notification provisions under 45 CFR §164.530(j).
How long should executed agreements be retained?
Retain executed Media Security Agreements for the contract term plus a prudent post-termination period—commonly 3 to 7 years—and longer if federal law or industry rules require it.
What authentication level is sufficient for signing?
Match signer authentication to risk. Email link or SMS may suffice for low risk; use multi-factor or identity-proofing for high-value transfers or regulated records.
What if a party's name is entered incorrectly?
A mismatch can create enforceability issues. Correcting may require an amendment and re-execution. Verify legal names and signatory authority before sending for signature.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now