Ordering a replacement apartment key should not require you to send sensitive personal and payment details through an outdated process.

Many apartment buildings, property managers and locksmiths still rely on PDF forms, email attachments, scanned documents, basic web forms and manual payment handling for restricted key orders.

These processes may be familiar, but that does not make them ideal.

An apartment key order can ask for your full name, residential address, apartment number, phone number, email address, key details, approval details, signature and sometimes full credit card information.

That is a lot of personal information.

If the process asks you to download a form, print it, sign it, write down card details and email it to an address like keys@, admin@, workshop@ or orders@, it is reasonable to ask whether there is a safer and more professional way to order the key.

This article is general information only and is not legal, privacy or compliance advice.

Why apartment key order details are sensitive

An apartment key order is not just a basic enquiry.

It may include information about:

  • your full name
  • your residential address
  • your apartment, unit or lot number
  • your mobile number
  • your email address
  • your signature
  • the type of key or access device you need
  • whether a key has been lost
  • who can approve the order
  • who will collect or receive the key
  • payment details

Individually, some of these details may seem ordinary.

Together, they can become highly valuable personal information.

A completed key order form can identify where you live, how to contact you, what building access you are requesting, who may approve that access, and in some cases your full card details and signature.

That is too much information to treat casually.

If the form is emailed around, downloaded by staff, forwarded to an approver or stored in multiple inboxes, you may have little visibility over where your information goes or how long it remains there.

For general privacy context, the OAIC APP 11 guidance explains that organisations covered by the Privacy Act must take reasonable steps to protect personal information they hold and to destroy or de-identify it when it is no longer needed.

For more background on the ordering process, see how to order an apartment key.

Red flag 1: You have to download, print, sign and email a PDF

One of the clearest signs of an outdated key order process is a PDF form that must be downloaded, printed, signed, scanned and emailed back.

This is inconvenient for tenants and residents.

Many people no longer have a printer or scanner at home. Filling out a PDF on a phone can also be awkward, especially if the form was designed for printing rather than online use.

But convenience is only part of the issue.

A completed PDF may contain your name, address, apartment number, phone number, key details, signature and payment information. Once you email it, that form may now exist in several places:

  • your downloads folder
  • your email sent folder
  • the recipient’s inbox
  • a shared mailbox
  • staff downloads folders
  • printed copies
  • forwarded email chains
  • backups or archives

A PDF form is not automatically unsafe. But a process that relies on emailing completed key order forms is not the standard most people expect from an online transaction today.

You would not normally order a product online by downloading a PDF, writing your details, signing it, typing in card details and emailing it to a business.

Apartment key orders should be handled with at least the same level of care.

It is also worth understanding what “encrypted email” usually means. Many email systems encrypt messages while they are travelling between mail servers, but that is not the same as end-to-end encryption. Once the email arrives, the completed form may sit in mailboxes, archives and synced devices where people with mailbox access, administrators, compromised accounts or local devices may be able to access it.

Some mail providers encrypt stored data at rest, but that does not usually mean the message is protected from everyone except the sender and recipient. A PDF sitting in an inbox is still a copied document that can be opened, forwarded, searched, downloaded or retained.

Red flag 2: The form asks for full credit card details

A key order form asking for full card details should be treated as a major warning sign.

Be especially cautious if a PDF or paper form asks for:

  • card number
  • expiry date
  • cardholder name
  • CCV, CVV or security code
  • signature

This is very different from paying through a proper payment gateway, payment link or other secure payment process.

When card details are written into a PDF and emailed, you may not know:

  • who receives the form
  • who can open the attachment
  • whether it is forwarded internally
  • whether it is printed
  • whether it is downloaded
  • how long it is retained
  • whether the card details are removed after processing
  • whether the business has clearly explained how the information is handled

This is not how people expect online payments to work.

For most online orders, card details are entered into a payment system designed for that purpose. They are not typed into a PDF and emailed to an inbox.

Payment details make this concern much more serious. Even if the email connection was encrypted while the message was sent, card details inside a PDF can still remain in the sender’s sent folder, the recipient’s mailbox, local mail apps, shared inboxes, backups or forwarded messages after delivery.

Payment warning: A key order process should not ask tenants to email full card details in a PDF or attachment. Ask whether there is a secure payment link, invoice, account process or another safer payment option.

If a key order form asks for card details, ask whether there is another payment option, such as a secure payment link, invoice, account billing where appropriate, in-person payment, or payment through a purpose-built order system.

For more detail on payment handling, see online payments for restricted key orders.

Red flag 3: Your completed form is emailed to a shared inbox

Many locksmiths and building-related businesses use shared email addresses such as:

  • keys@
  • workshop@
  • admin@
  • orders@
  • service@
  • sales@
  • reception@

Shared inboxes are common in business, and they can be useful for normal enquiries.

But a completed apartment key order form is not just a normal enquiry.

It may include your residential address, contact details, signature, key details, payment details and approval information.

If that form goes to a shared inbox, it may be unclear:

  • who can access the inbox
  • who opens the attachment
  • whether it is downloaded
  • whether it is forwarded to other staff
  • whether it is sent to an approver
  • whether old emails are deleted
  • how long attachments are retained
  • whether payment details are removed after processing

For a restricted key order, information should only be available to the people who need it to process, approve or fulfil the order.

A purpose-built ordering system can handle this more cleanly than an inbox-based process.

Red flag 4: Your details may be forwarded to an approver

Apartment key orders often need approval.

That approval may come from a building manager, owners corporation manager, strata manager, property manager, landlord, lot owner or other authorised person.

In a PDF or basic email-based process, this can create a privacy issue.

If your completed form is emailed to the locksmith, and the order then needs approval, does the locksmith forward your full form to the approver?

If so, your name, address, phone number, apartment details, key details, signature and possibly payment information may be sent to another inbox.

That email may then sit in the approver’s inbox, sent folder, email archive and backups.

A better approach is for the approval process to notify the approver without unnecessarily emailing your full details back and forth.

For example, a purpose-built ordering system could allow an approver to review the request through a secure, time-limited link or by logging into a system, rather than receiving your completed form as an attachment.

The point is simple: your personal details should not need to be passed around in email chains just to order a replacement apartment key.

Red flag 5: The confirmation email includes your completed form as an attachment

Some basic online forms send a confirmation email with a copy of the completed submission attached.

That may seem helpful, but it can create unnecessary copies of your information.

If the attached PDF includes your name, apartment number, address, phone number, key details, approver details, signature or payment information, that file may now sit in:

  • your inbox
  • your sent folder
  • the locksmith’s inbox
  • a shared staff inbox
  • any forwarded approval email
  • email backups and archives

This is especially concerning if the attachment includes full card details.

A better process should avoid creating unnecessary email copies of sensitive order information.

The order record should sit in a system designed to manage the order, not be duplicated across inboxes.

This is one reason confirmation emails should be careful about what they include. A confirmation that says an order was received is different from sending a full copy of the completed form back to everyone involved.

Red flag 6: The form asks for more information than necessary

A key order does need certain information.

The locksmith or building manager may need to know who you are, where the key is for, what key is being requested, who can approve it and how it will be collected or delivered.

But some forms ask for too much.

Be cautious if a form asks for information that does not seem relevant, such as:

  • unnecessary identity documents
  • excessive personal information
  • full card details
  • CCV/CVV security codes
  • information about unrelated occupants
  • a signature where it is not clear why one is needed

A better process should collect the information needed to process the order, confirm approval, handle payment and arrange collection or delivery.

It should not collect extra information simply because the old paper form always did.

Red flag 7: The approval process is unclear

Apartment keys often need approval because they can affect building access.

The key may open more than your own apartment door. It may also open:

  • building entrances
  • lifts
  • car parks
  • garages
  • common areas
  • storage areas
  • service areas

A good process should make it clear:

  • who can request the key
  • who needs to approve it
  • how approval is recorded
  • whether payment is required before or after approval
  • who can collect or receive the key
  • what happens next

If the process is just “email this completed form to us”, it may not explain any of this.

That often leads to delays, repeated emails and unnecessary follow-up.

For more detail, see why restricted keys need approval.

Red flag 8: The form is just a basic website form with no clear process behind it

A basic online form can be better than a downloadable PDF.

It may be easier to complete and may reduce some handwriting or scanning issues.

But a basic form is still not necessarily a proper restricted key ordering system.

A simple form may only send an email to the locksmith.

That means the business may still need to manage the rest of the process manually, including:

  • checking the site or key system
  • asking for missing information
  • emailing the approver
  • handling payment separately
  • matching payment to the request
  • updating order status
  • recording who collected or received the key
  • answering customer follow-up emails

From the tenant’s perspective, the form may look “online”.

Behind the scenes, it may still just be an email-based workflow.

A better solution is a system designed for restricted key orders, where request details, approval, payment status, fulfilment and order records are managed together.

For more detail, see Can locksmiths use Jotform, Snapforms or Google Forms for restricted key orders?.

Red flag 9: You are not told how your information will be handled

When a form asks for sensitive information, the process should give you confidence that the information is being handled appropriately.

It should be clear:

  • who receives the information
  • why the information is needed
  • whether it will be sent to an approver
  • how payment is handled
  • whether card details are stored
  • how you will be updated
  • who to contact if something changes

If the process does not explain any of this, you are being asked to trust that everything behind the scenes is handled properly.

For a key order involving your home address and access to your building, that is not ideal.

What should a better apartment key ordering process look like?

A better process should feel more like a professional online order and less like office paperwork moved onto the internet.

It should ideally:

  • collect the required details through a purpose-built order process
  • avoid asking for full card details on a PDF
  • avoid unnecessary email attachments
  • explain why information is needed
  • show who needs to approve the order
  • allow payment to be handled through an appropriate payment process
  • keep approval separate from unnecessary email forwarding
  • track order status
  • record approval, payment and fulfilment details
  • make collection or delivery requirements clear

This does not mean every building needs a complex system.

But tenants should be able to expect more than a PDF download, a signature box, card details and an email address.

What can tenants ask before submitting a form?

If you are uncomfortable with a key order process, you can ask practical questions.

For example:

  • Is there an online ordering portal instead of emailing a PDF?
  • Do I need to include full card details on this form?
  • Can I pay using a payment link or another secure payment method?
  • Who receives the completed form?
  • Will my form be forwarded to an approver?
  • Will my card details be removed after payment is processed?
  • Who can see my order details?
  • How will I know when the key is approved?
  • How will I know when the key is ready?
  • Is there a better way to submit this information?

These questions are reasonable.

A tenant should not need to guess what happens to their personal, payment and building access information.

What should you avoid doing?

Avoid sending more information than necessary.

In particular, be careful about:

  • emailing full credit card details
  • emailing CCV, CVV or security codes
  • emailing a signed form with unnecessary personal details
  • forwarding completed forms to unnecessary recipients
  • sending key order details to someone who does not manage the property or key system
  • leaving completed key order PDFs in your sent folder indefinitely

If you have already emailed a completed form containing extensive personal or payment details, consider whether you should remove it from your sent items once it is no longer needed.

That does not control what happens in the recipient’s systems, but it may reduce the amount of sensitive information sitting in your own email account.

If you are unsure, ask the property manager, building manager or locksmith what information is actually required and whether there is a safer process.

Why this matters for locksmiths too

This issue is not only a tenant concern.

Locksmiths are in the business of security.

If a locksmith’s restricted key process relies on downloadable PDFs, emailed forms, shared inboxes and manual card handling, customers may start to question whether the ordering process matches the security purpose of the product.

That does not mean the locksmith is acting carelessly.

Many businesses have used these processes for years because they were simple and familiar.

But customer expectations have changed.

People now expect online ordering, payments and sensitive requests to be handled through systems designed for that purpose.

For locksmiths, improving the restricted key order process can reduce manual admin, reduce payment handling issues and provide a more professional experience for tenants, property managers, building managers and authorised approvers. For the locksmith-side view, see why locksmiths should offer online restricted key ordering and how locksmiths can reduce admin time on restricted key orders.

Why secure ordering matters for building safety

Restricted key systems are used to improve building and site security by controlling and recording who can receive keys.

The order process should support that goal.

If key orders are handled through scattered PDFs, emails and manual notes, records can become harder to manage and personal information can be copied into places it does not need to be.

A clearer ordering process helps protect:

  • tenants
  • apartment owners
  • residents
  • building managers
  • property managers
  • owners corporations
  • locksmiths
  • the security of the building itself

For more detail, see what is a restricted key?.

Where KeyOrders fits

KeyOrders is being developed to help locksmith businesses manage restricted key requests through a structured online ordering and approval workflow.

It is designed for the parts of restricted key ordering that basic forms and PDFs do not handle well: request details, approval, payment status, fulfilment information and order records.

For tenants and residents, this can reduce the need to email sensitive information through PDF forms.

For locksmiths, it can provide a more professional way to handle restricted key orders while reducing manual follow-up.

KeyOrders is not designed to remove approval from restricted key ordering. It is designed to make the authorised process easier to follow and manage.

Summary

If your apartment key order process asks you to download a PDF, print it, sign it, add personal details, write card information and email it back, treat that as a red flag.

If a basic online form simply sends your details to a shared inbox, that may also be worth questioning.

A better key order process should collect only the required information, avoid unnecessary email attachments, handle payment appropriately, explain approval clearly and keep order status easier to track.

Apartment key orders involve both personal information and building access.

Tenants should be able to expect a professional ordering process. Locksmiths and building managers should be able to provide one.