How to build a private creative workstation on Mac, Windows, or Linux

Begin with the loss scenario

Ask what happens if the laptop is stolen while powered off. Full-disk encryption is designed for that moment. FileVault on macOS, BitLocker or Device Encryption on supported Windows systems, and LUKS on Linux can protect data at rest when configured correctly. Encryption is far less helpful against malware or a person using an already-unlocked session.

Use a strong login secret, enable the screen lock, and keep recovery material somewhere separate. A PIN can be a convenient local unlock mechanism, but its strength depends on hardware protections and rate limits. Do not reuse the workstation password for an online account.

Give creative tools the permissions they need—and no more

Video calls need a camera. A design editor usually does not. Review camera, microphone, screen recording, accessibility, contacts, and full-disk permissions after installation and after major updates. Remove grants that no longer have a clear purpose.

Prefer importing a chosen file to granting permanent access to an entire photo library or home directory. Keep client work in a dedicated folder. This makes backups, sharing, and eventual deletion more deliberate.

Use a three-copy backup without creating three exposures

Keep the working copy, a local backup, and an encrypted off-site copy. The local backup provides fast recovery from a failed disk or bad edit. The off-site copy protects against fire, theft, and damage affecting the whole room. Automate both, but preserve some history so ransomware or accidental deletion does not immediately overwrite every good copy.

A cloud backup can be compatible with this plan if files are encrypted before upload and the recovery keys remain yours. A rotated physical drive stored elsewhere is another option. Test a full project restore, including linked media and fonts, at least once.

• Turn on operating-system and browser security updates.
• Enable full-disk encryption and record the recovery path.
• Use a standard account for daily work where practical.
• Review sensitive permissions every few months.
• Keep source projects and common-format exports.
• Verify backups by restoring a representative project.

Create a deliberate sharing lane

Do not send the only editable project. Export a client proof, inspect its metadata, and share that copy through a method appropriate to the sensitivity. Passwords should travel through a different channel from the link they protect. Set expiration where the service supports it.

For highly sensitive work, disconnecting the editor from the network reduces accidental disclosure but does not solve every risk. USB devices, malicious fonts or media, clipboard managers, screen capture, and compromised operating systems remain possible paths. Privacy is strongest when the threat model is specific enough to be useful.