Blog · Data services

Is outsourced data entry safe? Security questions to ask first

AppraiseQ team · 5 min read · 31 October 2026

Handing data entry, comps research or photo uploads to an outside team can give you back hours every week. It also means someone else is looking at order details, property addresses, and sometimes your portal logins. That is a fair thing to worry about, and the honest answer to "is it safe?" is: it depends entirely on how the team handles access and data.

This post gives you the questions to ask, what a good answer sounds like, and a few things to check on your own side before you hand anything over. It is general guidance, not legal advice. If you have specific concerns about privacy law or your contracts, talk to a lawyer or your vendor.

Start with your own agreements

Before you ask a provider anything, look at what you have already signed. Your vendor and AMC agreements may say who is allowed to see order information and whether you may use assistants or subcontractors. Some are relaxed about it; others are strict, and some want only the licensed person on the account to act in the portal.

Check three things:

• Whether you may share order details with an assistant or outside service at all.
• Whether you may let someone else sign in to the portal, or whether the portal offers separate assistant accounts.
• Whether anything, such as the final signature or certification, must be done by you personally.

Appraisers should also keep their USPAP obligations in mind, including confidentiality and the rules about who provides significant assistance and how that is disclosed. Confirm the details with your state board or a qualified advisor. Outsourcing typing does not move responsibility for the report off your shoulders.

Questions about logins

Logins are the biggest risk, because a portal account usually gives access to far more than one order.

1. Do you need my login at all? Sometimes the work can be done from exported files or a shared folder, with you doing the final upload. That is the safest option when it fits.
2. Can you use a separate sub-account? If the portal supports assistant accounts, a good provider will prefer that over your main password.
3. How do you store logins I share? A good answer mentions encryption at rest and a short list of named people who can see them. A bad answer is "in our team spreadsheet" or "we email them around."
4. Who can see them? Ideally a small admin group, not every worker on the team.
5. How long do you keep them? Logins should be deleted when the work is done or after a fixed, short period, not kept forever.
6. What happens with two-factor codes? If your portal sends a code to your phone, agree on how that works. Never forward codes in a group chat.

Whatever they say, change your portal passwords after you stop working with a provider, and use a different password for each portal so one leak does not open everything.

Questions about people

• Who will actually do my work? A named person or small team is easier to trust and train than a rotating pool.
• Do staff sign confidentiality agreements? Ask whether every person touching your files has signed one.
• What happens when someone leaves? Their access to your files and logins should be removed the same day.
• Is any of the work passed to another subcontractor? You want to know if your data goes one step further than the company you hired.

Questions about devices and storage

• Where are files kept while they work on them? A company-controlled cloud folder is better than files scattered on personal laptops and phones.
• Are work devices protected? Screen locks, up-to-date software and disk encryption are reasonable basics.
• Do workers use personal email or chat apps for client files? They should not.
• Can you delete my data on request? Including photos, comps sheets and copies of reports, and can they confirm it is done?

Questions about what they never need

A good provider asks for the minimum. For most BPO and appraisal data entry, they need the order details, the inspection notes, photos and comps. They rarely need borrower phone numbers, loan numbers or anything beyond what the form requires. If a provider asks for more than the job needs, ask why.

A quick scoring table

Use this when you compare providers. You do not need a perfect score, but a lot of red answers is a warning.

As one example of what to look for: when customers share MLS or portal logins with an AppraiseQ services request, the logins are stored encrypted, visible only to AppraiseQ's admins, never emailed, and deleted after 30 days. Whoever you choose, ask for that kind of specific, written answer.

What you can do on your side

Security is not only the provider's job. A few habits on your end make a big difference:

• Share logins through one channel. Not by text, not in a group chat, and never in the same email as the username.
• Use unique passwords per portal. A password manager makes this painless.
• Turn on two-factor sign-in wherever your email and portals offer it.
• Share only the folders that are needed. One folder per order, not your whole drive.
• Keep a short list of what you have shared with whom, so you know what to change if you end the relationship.
• Review the first few jobs closely. Accuracy and care with data usually go together.

Start small

You do not have to hand over everything on day one. A sensible order is:

1. Start with work that needs no login, such as filling a form from your notes and photos and sending it back to you.
2. Move to comps research from a shared MLS export or search you set up.
3. Only then, if your vendor allows it, consider portal access for uploads or order acceptance.

Each step lets you see how the team handles your data before you trust them with more. For a closer look at which tasks are worth handing off in the first place, see our guide to outsourcing appraisal data entry.

The short answer

Outsourced data entry can be safe, but safety comes from specific practices, not from promises. Check your own agreements first, ask how logins, people, devices and deletion are handled, and get the answers in writing. Then start with the least sensitive work and expand only when the team has earned it.