TPN for Freelancers and Remote Editors: What Applies

The Short Answer

TPN is built around companies. A post house, VFX studio or agency joins TPN+, scopes its sites and applications, and gets assessed. TPN's FAQ does not address freelancers directly and points individuals to support@ttpn.org, so we will not claim there is a freelancer rule. What we can say with confidence comes from the Best Practices text: the studio or vendor that hires you is expected to control how freelancers and remote workers touch content. In practice you will be asked to follow that vendor's rules, and sometimes to prove you do.

What TPN Says About Individuals

Two facts from TPN's own published material are worth knowing.

• TPN's Quick Start Guide for service providers lists a Self-Employed membership level at the bottom of its fee table, so a one-person business can be a TPN member. The fee table is on TPN's membership page and we have left the amount out because it can change.
• The Best Practices name freelancers in several controls. Authentication, identity and access management, onboarding, offboarding and training all list freelancers and temporary workers next to employees.

TPN also says its Shields are not an approval, certification or pass or fail. Each content owner makes its own risk-based decision. That matters for you because a client can ask a freelancer for more than TPN requires, or less.

The Work From Home Control

The Best Practices have a dedicated control for work from home and remote workers (OP-2.0 in version 5.3.2). It tells the vendor to apply a list of other controls in a form that suits a remote worker:

• Authentication and authorization
• Background screening
• Endpoint protection
• Identity and access management
• Onboarding and offboarding
• Remote access
• Remote sites and locations
• Risk management and business continuity
• Training and awareness
• Wireless networks

The Additional Recommendations add details that read like a home-office checklist: keep a list of authorized remote users, disconnect wireless networks while accessing content locally, change default credentials on home networking equipment, train people on permissible working locations (private spaces, not rooms where others can see a screen), and get confidentiality agreements from other people at the remote location, such as a roommate or spouse, when the client requires it. For sensitive content, clients may also ask for alarm, camera and entry controls at the remote site.

What Probably Applies to You

These are the controls a vendor must be able to show for you, which is why they come up in a freelancer agreement.

1. 1Signed policies and training. You acknowledge the vendor's security policies and complete training at hire and each year. The vendor keeps a log.
2. 2Strong sign-in. Unique account, passphrase of at least 16 characters, and multi-factor authentication with an authenticator app or hardware key for internet-facing systems and admin access.
3. 3A managed or approved machine. The wider Best Practices set expectations for endpoint protection, no local administrator rights without need, screen lock within 15 minutes, and USB or external storage blocked on systems that hold content, and a vendor will usually apply the same to a remote machine. A recommendation also suggests using company-owned devices when content is stored locally.
4. 4Controlled remote access. VPN with no split tunneling, clipboard functions limited, strong encryption, and sessions that end after 15 minutes idle. Desktop streaming, where you only receive pixels and nothing is copied to your machine, is listed as a recommendation.
5. 5Encrypted drives. AES-256 for content at rest.
6. 6A clean offboarding. Access removed, assets returned and data ownership handed back at the end of the job.

What Probably Does Not Apply

• A personal TPN Shield. We found nothing in TPN's published materials describing an individual freelancer certification. Ask support@ttpn.org if a client insists.
• Facility controls on your spare room. Visitor logs, electronic access control and camera systems are facility controls. They reach a home office only when a client requires them for sensitive content.
• Ownership of the vendor's assessment. The vendor is assessed, with you in its scope. You do not pay for or manage that assessment.

What Clients Tend to Ask For

Requests differ by studio and by title, so ask early. Expect the vendor's list to follow the controls above: an NDA, a statement of where you will work, proof of disk encryption and updated software, a VPN or streaming setup supplied by the vendor, no local copies of footage, and deletion at the end. If you work on high-security titles, expect aliases instead of real names and extra limits on mobile devices.

A Freelancer's Own Checklist

• A separate user account for client work, with automatic updates on
• Full-disk encryption turned on (FileVault or BitLocker)
• A password manager and an authenticator app for every client system
• Router admin password changed from the default
• Work only in a room where nobody else can see the screen
• No client footage on personal cloud accounts, AirDrop or Bluetooth transfer
• A written note of who at each client approved your access

For the tooling side, see remote editing workflows and remote editing with Frame.io. For the vendor view, the cybersecurity guide for post studios covers why unmanaged laptops cause trouble.

Want a person to help?

A real person on our team helps studios write the remote worker policy, set up VPN or desktop streaming so freelancers never hold full-resolution files, and prepare the evidence an assessor will ask for. We help you get ready. The assessment is done by an independent TPN-accredited assessor, and nobody on our side certifies you. See remote collaboration setup and TPN certification consulting, or plug us in.