Texas Self Storage Association has served its self-storage industry members since 1986.  Headquartered in Round Rock, Texas, TSSA is the leading expert in self storage in the state of Texas.  Whether you're an owner, operator, manager or employee,  TSSA's blog will provide you with the latest tips, advice and knowledge for running your self-storage business. 

Everything You Need to Know About Online Auctions
by Sarah Cole, Oakcrest Management

As technology continues to advance, the self-storage industry is advancing with it. One of the most recent changes is with online auctions. Thanks to the hard work of TSSA, Matz & Co. and Connie Heyer pushing new legislation through last year, online auctions are now part of the Texas Property Code. Many companies started making this switch over the last few years, but the rest have been watching the industry to find out what is going to benefit their facilities the most. One of the best ways to figure out what will work for your facility is to weigh the pros and cons of both in-person and online auctions.

The concept of online auctions has been around for quite some time. Online auctions started with individuals selling and auctioning personal items on sites such as eBay. Now we have the ability to utilize online platforms to auction off the contents of storage units.

Online auctions are not just another fad or trend.

When the TV show “Storage Wars” aired, self-storage auctions started get- ting some publicity and now the general public finally knows storage unit auctions are an actual thing. So why did the market start shifting to online auctions?

“Online auctions seem very interesting,” says Ashley Montessoro of Lockaway Self Storage. “It is something new, gets the property name out to a new group of people and seems like it may be easier on our managers.”

Lower attendance at more rural properties is the reason Ryan Rogers, managing partner at Store  Here Self Storage, started looking into online auctions. Online auctions open the door to more potential bidders, the bidders have more time to view the items in the unit and they have more time to bid.

Another reason is the amount of time it takes to conduct an in-person sale on auction day. “It is a disruption of the property’s normal business day,” says Rogers. “Especially if you have more than one location to visit, it takes up your entire day.”

April Young of Ultimate Properties says, “When traveling from property to property on auction day, the number of bidders dwindles and by the time you get to the last property, you’re lucky if you still have one or two people show up for the auction.”

Liability, liability, liability is what we hear at every legal session we go to when it comes to onsite auctions.

t is the overall liability of a group of people walking the property on auction day. What if someone trips and gets hurt?

“With online auctions,” Montessoro states, “There is also the bonus of not having a large crowd walking around the property once a month.”

Also, the worries we have about having to handle altercations are now gone when you use online auctions. “You also don’t have people coming onto the property and causing a stir with the customers,” notes Ann Parham of Joshua Management Corporation.

Buyer collusion can also be a problem with onsite auctions. “The people who follow the auctioneer know each other and they start to negotiate with one another before the unit is even up for auction. It causes price setting,” explains Parham.

Online auctions seem to solve a lot of potential concerns and issues we face every month, but still many of us are hesitant to make the switch.

“I’m not so sure it is hesitation that has kept us from switching as much as it is us wanting to keep those hands- on, face-to-face relationships with our bidders,” Young explains. “There is also a sort of comfort in knowing all of your paperwork is right and the auction was processed correctly.”

Even though they have only been doing online auctions a short time, Montesorro has noticed, “There is the potential to make simple mistakes when setting it up online. Your managers really need to pay close attention to detail or the auction may have to be cancelled.”

Some locations have a great auction crowd. Some of us like using an auctioneer who has their own following, which also gives us a second pair of eyes on our lien paperwork to ensure the sale is conducted properly. And some of us like to just get these auctions done and over with. Instead of waiting several days for online auctions to run, and then potentially another 24 to 48 hours for the highest bidder to come in and pay (unless they pay online); in-person auctions are all over in one day.

“Buyers not showing up to pay after bidding” is an issue Rogers has seen with online auctions. “With in-person auctions,” Rogers says, “We know right away if a buyer does not have the money and can sell it again quickly.”

Once you’ve weighed all the options and you’ve decided online auctions are the way to go, where do you begin to look to find the right online platform? When looking at all of the different options, put yourself in your customer’s shoes. What is most important to you? Is it price or customer service that is the deciding factor? You want to know that the platform you use will back you up if there is a mix up or any issue with the auction. Here are a few of the platforms available to you (some of this information is taken directly from the company’s website).


According to their site, iBid4Storage. com has managed self-storage locations and been involved in the self-storage auction process in Canada and the United States for the past 22 years. “We continue to be innovators and leaders in the self-storage industry and have created a marketplace where both sellers and buyers of storage auction units can benefit and prosper.

“If you’re a storage unit owner or manager who is looking to recover your losses, online storage auctions are a great way to find bidders and to advertise your auction without the crowds and inconvenience that come along with having a physical storage auction at your facility. Research has shown that owners get three to five times more for foreclosed storage unit contents with an online sale.”

“We chose iBid4storage because they were friendly, acted like they were interested in gaining our business, were willing to negotiate rates and followed up consistently, even after gaining our business,” says Rindge Leaphart, COO of Oakcrest Management, Inc.


From the founder of Storage Battles, SelfStorageAuction.com is ready to revolutionize the storage industry. From their site: This new website for online and live self-storage auction listings is built to “provide the most safe, manageable and efficient platform for online self-storage auctions to be held.”

Most self-storage auctions are now being held online. “Our site not only speeds up the sales process, it completely eliminates the need for live, on-site auctions. Facilities can easily prepare auctions in advance and increase profits by expanding their customer base.”


Owned by Lonnie Bickford, StorageAuctions.com is a robust online auction site for foreclosed units. According to the StorageAuctions.com site, you can find the best storage unit auctions as a bidder and reach a faithful audience of bidders as a seller.

Storage facilities can also streamline their auction process by listing their inventory in one place for both live auctions and online auctions. Storageauctions.com reduces the hassle and you can list with confidence knowing your unit will be viewed by a much larger bidder base than those who might show up in person for a live auction.


According to their site, StorageStuff.Bid is made up of a combination of self- storage owners, licensed and experienced storage auctioneers and a team of technology partners who specialize in internet marketing and web design. “Together, we have more than 50 years of experience in the self-storage industry.

“We understand the needs and goals of storage owners and operators. We understand the consequences of accounts receivable and bad debt. We also know that storage operators are in the business of renting storage units, not selling them. We offer storage operators a quick and easy way to empty units that have gone through the lien and foreclosure process.”


StorageTreasures is a free, social site to find live onsite storage auctions or online auctions at any self-storage facility across the United States and Canada.

StorageTreasures.com was founded by SSA members and self-storage professionals who have more than 60 years of experience in the self-storage industry.

StorageTreasures has revolutionized the way in which the contents of self- storage units are marketed and publicly auctioned after the tenant has failed to pay rent. The site fills the gap between the operational systems that the industry currently utilizes and the public buyer who may be interested in the contents of a unit going to auction. The tools StorageTreasures provides allow the storage industry not only to comply with, but also exceed the intent of state laws governing the self-storage industry, protecting tenants and bidders alike.

“We use storagetreasures.com,” says Montesorro. “Another branch of our company has been using them for a couple of years now. Plus the customer service response, we have received from them is really nice.”


You’ve decided to give online auctions a try. You did your research and picked the online platform that suits your business. Now you ask yourself, how am I going to transition this new process?

What procedures should I follow to make sure I don’t miss selling a unit? Since several of us have been doing them for a while now, we have some suggestions. Remember everything up to your notice of sale and auction ad are the same:

1. Seize the unit

2. Send out the Notice of Claim

3. Inventory the unit for the auction ad

Now this is where the changes come into play.

4. When you publish the Notice of Public Sale in the newspaper, it must contain the following:

  • Statement that property is being sold to satisfy a landlord’s lien
  • Address of the facility (where the unit is located)
  • Website address for the auction
  • Start date/time and the end date/ time for bidding (and any other terms of sale)
  • Tenant’s name
  • General description of the property

5. Mailing a printed Notice of Public Sale to the Tenant is optional and not required by statute.

Next, list your units on the auction website. Most people take additional photos for the online auction in addition to the standard lock cut photos. Some supervisors find it easier to wait approximately five to 10 days before the auction starts to go back to the facility to get the additional photos they need.

“This is a great time to thoroughly review the auction file and make sure all of the notices were sent correctly,” says North Texas district  manager for Storage Depot Jay Hoger.  “The week before the auction starts is a great spot in the timeline to take the additional photos and upload them to the auction site because there are a lot of tenants who pay between lock cut and auction. Therefore, the closer you wait to the auction date to take the photos, the fewer units you will need to photograph.” Uploading the photos to the site a week before the auction is supposed to start will give prospective bidders the opportunity to preview the unit.

Double check… no… triple check that the photos match the unit you are listing. You don’t want to have an upset buyer come in and pay for a unit and then open the door to find out it does not contain the items pictured. Nor do you want to have to pull a unit from auction because you didn’t upload the photos or forgot to schedule a unit online for the auction.

When the auction ends, the auction site will notify you as well as the highest bidder with all of the pertinent information on the sale.

We have found it is best to wait until the buyer comes in to pay before closing out the sale. There is the occasional no-show and most of the auction sites will give you the second-place bidder’s information, so you can contact them to purchase the unit. However, TSSA legal counsel  Connie Heyer’s opinion is that the bidder is not required to pay at the facility—they  can simply pay online. It is important for your auction rules to list all terms, including what will happen if the original bidder defaults on the sale. It is also important that the online auction site rules don’t conflict with your facility’s auction rules.

There are pros and cons with online auctions and a lot to consider when you are switching to a new procedure. As self-storage advances into the technological age, are you ready to advance with it by making the transition to online auctions?

Sarah Cole joined Storage Depot seven years ago as the audit manager. In addition to overseeing the audit process for the entire organization (32 stores and growing), she provides support to the management team regarding auctions, process improvements and general day-to-day operations. Sarah is also a degreed paralegal.

Everything You Need to Know About Online Auctions

Lease Essentials

The Great Benefits Provided by the TSSA Rental Agreement

by Connie N. Heyer, TSSA Legal Counsel

The lease contract. The single most important transaction between a landlord and tenant.

For the protection of both the landlord and the tenant, a written lease needs to be in place to outline exactly “the deal.” For this “Back to Basics” look, let’s focus on this single most important landlord/tenant transaction.

Tip #1: Use it!

Use the TSSA lease. The TSSA lease is tailored for Texas law, which is unlike self-storage law in any other state. The TSSA lease is updated to keep up with legal requirements as well as best practices and important protections.

Tip #2: Read it.

(Early and often!) Have your managers read through the lease in its entirety, ideally multiple times. It is very helpful to be able to answer tenant questions by referring directly to language in the lease. You can’t and should not answer legal questions and interpret a legal contract, but most questions can be answered by saying something like, “As to your question on late fees and when they are incurred, refer to paragraph 4…”

Tip #3: Understand it.

Come to TSSA seminars! Take advantage of the FAQs available in the TSSA Goldbook© and in the Ask the Experts online database. Managers should have a good understanding of the lease terms they work with every day. Among other things, the TSSA lease outlines insurance responsibility, caps the total dollar amount value of items tenants can store in a unit, prohibits storage of sentimental items, prohibits storage of certain items like flammable materials, prohibits sleeping/living in units, and much, much more.

Following are some of the more important provisions of the lease. I am hopeful this article can be a starting point for enhancing all owners and managers’ knowledge of important parts of the lease.


This paragraph literally lists who the legal tenant is. The tenant is the person or business named on the first line of TSSA lease paragraph 1 (tenant’s first and last name or business name). The tenant signs the lease. The tenant is the only person legally responsible for rent and other lease obligations. The tenant is the one to whom the facility must send any legal notice.

If the tenant is an individual rather than a business, do not allow anyone other than the person listed as the tenant to sign the lease. For example, the answer to “Can I rent this unit for my mom, who will come in and sign later?” is “No, but if she can’t sign now, you can be listed as the tenant and sign the lease. With your consent, when your mother comes in to sign a lease, we can void the existing lease.”

When leasing to a business, the legal name of the business should be listed in the first line in paragraph 1, and the business name should be listed at the signature line with the employee’s printed name and signature under it, as in “Main Street Widget Company, by Jane Doe, authorized agent (signed by Jane Doe).” A best practice in this scenario is to require authorization for this person from the company on letterhead. It can be short and sweet, but if you aren’t sure the individual is the company owner or authorized to store goods, a letter stating that this person is authorized to transact business and sign a rental agreement on behalf of the business is ideal.

Paragraph 1 also contains a blank for a Social Security number. It is difficult to perform a check on military status without one should you need to. That being said, there is no legal duty to collect a SSN from tenants and many facilities do not. If renting to a military tenant, you could obtain this information on a separate Tenant Information form that is kept safe.

Paragraph 1 also contains a blank space in which the tenant may list names of people to whom you may provide access. This access may be provided at your option; it is not mandatory.

Finally, paragraph 1 lists emergency contacts for the tenant. There are “default” emergency contacts (like spouses, siblings and adult children) to whom you may, at your option, provide access if the tenant dies, is jailed, is missing or incapacitated (the individual would sign an affidavit swearing one of these events has happened). The tenant may also list specific names and contact information for additional emergency contacts.


This paragraph lists all the dollar amounts involved in the transaction, both on the day of renting and anything that could apply in the future. Monthly rent (paragraph 4a), due date (par graph 4b), late charges, NSF charges, and all other fees you intend to charge the tenant should be listed in this para- graph. Something to remember is that you aren’t obligated to charge the fee just because it is listed (it can always be waived), but you should not try to charge the tenant any fee which both of you have not agreed to in advance.


This is the language at the bottom of the first page of the TSSA lease that really stands out—we have used bold, italicized and in some sections all-caps fonts, and that is intentional. This statement is comprehensive and packed with important liability language and it should be initialed by the tenant!

This is important information for both you and the tenant. This paragraph references late charges. It also makes clear that there are no representations of safety or security. It contains a negligence waiver and non-liability language related to bodily injury and property damage. It contains non- liability language for fire, smoke, dust, water, weather, insects, vermin, explosion, utility interruption and theft. Finally, it notes the tenant’s insurance and self-insurance duties. As mentioned, it is quite comprehensive and offers the facility owner a great deal of protection.


This paragraph outlines how both you and the tenant may part ways amicably. First, the tenant must comply with any minimum lease term per paragraph 3. If a tenant wants to move out, he must provide you with at least a 10-day written notice of lease termination/non- renewal via mail, hand delivery or email. If you want the tenant to move out, you must provide him with at least a 15-day written notice of lease termination/non- renewal via mail, email or hand delivery.

Regarding rent due at move-out, Paragraphs 28 and 38 outline how amounts due at termination and other termination-related provisions are calculated. For example, the tenant is liable for rent for the remainder of the month of move out, or for 10 days after move-out, whichever is longer. So, for example, if the tenant moves out July 10, the tenant owes full July rent. If the tenant moves out July 25, the tenant owes through August 4 (four days prorated for August). Of course, you can waive any part of that amount if you desire. But this language encourages tenants not to expect refunds of rent already paid if they did not give enough notice to allow you to rent the unit to another tenant.


This paragraph makes clear that your facility is not a warehouse and has no possessory duty of safekeeping (no bailor/bailee relationship). So, you are generally not liable for damages from vermin, leaks, etc.

This paragraph also binds the tenant to a $5,000 cap on the value of stored items. If the tenant stores items worth more than that in the unit without your permission, he is in breach of the lease. It also makes clear that tenants cannot store items of sentimental value. All of this is for both the tenant’s and your protection. Finally, the paragraph outlines the tenant’s duty to purchase insurance if he stores more than $1,000 in goods in the unit and notes that the tenant is considered to self-insure for all items not covered by his insurance.


This paragraph outlines your remedies in the event of a tenant default, such as failing to pay rent. You have many remedies, all outlined by this paragraph. You may lock an unlocked space. You may overlock, code out and wheel boot (if a vehicle or trailer) for any breaches of the lease. You may give notice to vacate and file with your local justice court for eviction. You may assess any charges due under paragraph 4. You may seize the unit (the steps that constitute seizure are defined in this paragraph so be sure you are following them). Finally, you may exercise your Chapter 59 right to foreclosure and auction.


This paragraph allows landlords to change provisions of the lease after providing appropriate notice to the tenants. Notice of a minimum of 30 days is required for increases in dollar amounts (like rent increases). Some provisions that do not involve increases to dollar amounts can be changed immediately after written notice is provided. This is a good way to handle gate hour changes and any other change desired.


As the name implies, this is something of a "catch-all" paragraph to address issues not addressed elsewhere.

Boilerplate but essential legal language, such as "time is of the essence" and "Texas law applies" are included for a reason. Additionally, the fact that managers can't make oral promises which override the executed lease is also clearly spelled out. This paragraph is also where you'll find the important stipulation that mediation is required when a lawsuit is filed, except for legal actions taken by a lessor (facility owner) for rent, foreclosure, eviction or charges spelled out in Paragraph 4.


Without a lease tailored to the self-storage industry, you are exposing yourself to liability, as self storage is different from other commercial real estate rentals and different laws apply. Use the TSSA lease. It’s one of the best benefits of your TSSA membership.

Read More Blog Posts » 


The Why's and How's of Online Auctions: Webinar Takeaways
by Taressa Dominguez, TSSA Director of Education & Marketing
June 15, 2020

You may be familiar with auctions, but there is still a lot to learn about online auctions.  Some of you may be practiced at using the new auction format, but for many there is still some mystery to the process and the results it can bring your self-storage business.   TSSA hosted a webinar with Lonnie Bickford, StorageAuctions.com; Cassie Dodgen, Pinnacle Storage Properties; Ann Parham, The Parham Group/Joshua Management; and Ross Pfiefer, Hixon Properties, to discuss the basics of online auctions and how they use it to benefit their businesses.  Here are a few key points we learned: 

  • More eyes on your auction.  On average in Texas, StorageAuctions.com reports that units will receive 150-500 online views. Units with more valuable contents can get much higher than 1,000 views. 
  •  Schedule online auctions in advance.  Having a clear, set schedule allows your managers to communicate clearly to tenants that the auction is on a predetermined date, and the unit will go to auction if payment is not made prior to that date.
  •  Use the power of photos.  Pictures of the unit are incredibly impactful in auctioning off units.  StorageAuctions.com recommends submitting at least seven photos—one main photo of the overall unit, a few closer-up images of the unit, and up-close shots of valuable items that will bring in bidders. 
  •  List out the contents of the unit.  Online auction platforms allow you to list the contents of your unit. With newspaper ads, you may be limited by space to only describing the unit contents as “household goods” but the online platform allows you to list “washer and dryer” or “sewing machine.” It helps bidders search and gives you the chance to highlight items you know will gather interest.
  •  Your auction, your way.  You can still set your own auction rules using online platforms.  If you want a 72-hour clean-up with a deposit and no dumpster privileges, then you can set those rules for your auction. 

To learn more about online auctions, visit the TSSA Resource Library  to watch our webinar recording. If you would like to post your auction on TSSA’s website, in addition to the legally mandated newspaper advertisement, visit here.

Read More Blog Posts » 

Why's and How's of Online Auctions

Cybersecurity Tune-Up

by Taressa Dominguez, TSSA Director of Education & Marketing
April 28, 2020

As more and more self-storage facilities conduct business online and are shifting to no-contact leasing due to the public health crisis, the need for cybersecurity is at an all-time high and only increasing.  According to Ponemon Institute’s 2019 Global State of Cybersecurity in Small & Medium-Sized Businesses study, 66 percent of small businesses experienced a cyber attack, while 63 percent experienced a data breach with significant financial consequences.  The cause for concern is warranted—more than half of small and medium-sized businesses suffered losses due to cyber attacks in 2019 alone.  Add that to the current situation where the health crisis has forced self storage to move as much business online as possible, and you have a dire need to assess your facility’s cybersecurity protection.

However alarming the headlines and data may be, you can protect your business from cyber attacks by being alert and proactive.  Precaution and planning today can go a long way tomorrow.

Create a Security Plan 
Start with identifying the information you want to protect—the information that you need to conduct your business.  Once you’ve identified the types of information you want to protect, you can better implement procedures and programs to do so.  It is likely that you will want to protect multiple types of informationfrom customer records and payment processing to basic business records—making it entirely appropriate to layer your security programs and procedures. 

Address Your Vulnerabilities
To keep your sensitive information safe and out of the hands of hackers, you will need to limit access points to your system, as well as safeguard information to which access could be gained. 
Use security software.  Make sure you are guarding against malware, including antivirus and antispyware, and updating regularly oreven better—automatically.
Protect your network.  Utilize firewalls and encryption, as well as password-protect your staff Wi-Fi network and keep it hidden.
Manage your passwords.  Make them long and hard to guess.  You might even consider using a password manager program to help keep track.
Opt for multifactor identification. Requiring an additional access code just adds a layer of protection.
Scrutinize your emails.  If an email is suspicious, or you don’t know the sender, or you do know the sender but don’t recognize the email address when you mouse over it, do not open or click on anything in that email. Viewing emails in preview mode helps with this.
Create a backup.  Consider backing up your system to the cloud, or to an external device as well as the cloud.  If anything happens to the physical backup, you’ll still have the cloud version.  Not only does this help protect you against ransomware attacks, it can also be a lifesaver if your computer ever crashes.

Train Your Employees
Human errors or negligence lead to most cybersecurity breaches.  The Ponemon study indicates that 70 percent of breaches in the United States were due to negligent employees or contractors.  Whether due to a weak employee password or an innocent click on an email, breaches are likely to happen if we do not keep training staff to be hyper-vigilant and informed of the evolving vulnerabilities your facility faces.  

As these attacks continue to grow and become more sophisticated, the self-storage response must remain at-the-ready and prepared to adapt to new threats.  It isn’t enough to put a security program in place and be done.  You must also regularly evaluate your success in thwarting cyber attacks and consider the evolving creativity of these hackers.  Stay up-to-date and continue to assess your vulnerabilities.  Your creativity in defending your business must also evolve with the threat.

What are you doing to strengthen your cybersecurity?  

Let us know.



Is Your Data Secure?

Finding Your Way Through the Maze of Cybersecurity

by Jennifer Jones

When it comes to data security, most self-storage owners believe that with basic firewall protection, their data and their tenants' data are secure. Some use third-party systems that have security protections in place when transmitting data. However, most owners believe that they will not be targeted by a cybersecurity attack. But that isn’t just self-storage owners; small-to-medium-sized businesses share the belief that they’re too small for cybercriminals to target them.

According to a study by Ponemon Institute and Keeper Security, “Fifty-eight percent of respondents believe ransomware is a serious financial threat and are concerned that negligent employees put their company at risk, but only half (50 percent) say prevention of such attacks is a priority. Many are not confident that their current anti-virus software will protect their company from ransomware.” The businesses in the study employ between 100 and 1,000 people. Most of the companies that participated in the study experienced a cyberattack or data breach with severe financial consequences losing an average of 9,350 individual records as a result of data breach.


 According to the study, cybercriminals varied their methods between 2016 and 2017. “Phishing/social engineering has replaced web-based attacks (48 percent and 43 percent of respondents, respectively) as the most frequent type of attack. Compromised/stolen devices and denial of services attacks increased from last year’s study (30 percent and 26 percent, respectively).”

Ransomware is one of the most common I’ve heard about hitting the self-storage industry. There are two types of ransomware attacks:

  • Encrypting ransomware, which incorporates advanced encryption algorithms. It’s designed to block system files and demand payment to provide the victim with the key that can decrypt the blocked content.
  • Locker ransomware locks the victim out of the operating system, making it impossible to access the desktop, applications or files. The files are not encrypted in this case, but the attackers still ask for a ransom to unlock the infected computer.

Ransomware can be unleashed in a variety of ways: phishing/social engineering, insecure or spoofed website, social media, malvertisements and more.

Cybercriminals typically encrypt your data and hold it ransom, leaving the self-storage owner to ask themselves, “Do I pay or not?”

Among the participants in the study, of those that didn’t have full backups, about 60 percent paid, with the aver- age ransom being $2,157. If they didn’t pay, it was because they had a full backup or didn’t trust that the criminals would release the data.


According to the study, “data breaches due to negligent employees or con- tractors (54 percent of respondents) increased significantly from 48 percent in 2016. This is followed by third-party mistakes (43 percent of respondents) and errors in system or operating processes (34 percent of respondents). However, almost one-third of respondents say their companies could not determine what caused the incident.”

The main points of vulnerabilities are mobile/Internet of Things (IoT) devices, laptops, smart phones, cloud systems, Intranet server, Web server, desktops, tablets, portable storage devices and routers.

IoT vulnerabilities include in-office wireless-based printers and other devices. Use of cell phones and tablets to access business-critical applications and IT infrastructure are also vulnerabilities.


Company information isn’t just vulnerable to cybercriminals; it’s also vulnerable to employees and anyone else walking into your facility. There are several things you can do that cost little to no money.

  • Have and enforce a password policy. It’s the easiest and most affordable security measure there is.
  • Ensure that everyone logs out of the computer and locks up any filing cabinets before walking away from the desk.
  • If you have multiple employees, ensure that they all have their own passwords.
  • Install a firewall.
  • Install anti-malware.
  • Back up everything to an external device or to the cloud.


If you use a third-party solution to take online payments, most have some sort of encryption protection before the sensitive tenant information is sent through the system.

Easy Storage Solutions co-founder Jimmy Sorenson says, “Credit card numbers and social security numbers (if collected by the facility) are encrypted before the data hits our servers.” The Storage Unit software servers have their own security and host through Amazon’s AWS, which is a cloud- based solution.

“Our software also allows for different people to have different access levels so a regional manager can have different access than a store manager.

“We also carry access control products and keypad entry, which integrates with our software. People get excited to be able to offer pay options where a tenant can swipe their credit card at the gate. However, we’ve never done that because people can install skimming devices and it’s another vulnerability, which would create a breach.”


  • Don’t write down credit card or social security numbers and store locally in filing cabinets or on a computer. (Against PCI regulations.)
  • If a lease asks for a credit card, don't include the card numbers on a lease.
  • Don’t store credit card numbers in random places (including in an email), even in your database, if the field isn’t encrypted.
  • Don’t use repeating numbers for gate entry codes (ex: 1111).
  • Don’t browse questionable web- sites. Some facilities provide tablets for employees to use for browsing.
  • Back up your data to something that is offsite at night. Backing up to a USB and leaving it in the computer isn’t a secure backup, or backing up to a hard drive and leaving it in the facility risks it being burned in the case of a fire, or stolen during a break-in. The most secure backup is with a third-party service such as Carbonite or Backblaze which back up your whole computer.
  • Educate employees about not opening questionable emails, clicking on links when they don’t know who an email is from, surfing unknown or questionable sites, or downloading things from unknown origins.
  • Install spamware.
  • Install a firewall.
  • Minimize the amount of personally identifiable information (PII) that is collected from customers to reduce the impact to customers in the event of a data breach (which reduces liability).
  • Use a web-based software to minimize the amount of customer information that is stored locally on a PC.
  • Work towards a paper-free office environment where all paper files are scanned and stored on a secure server.
  • Existing paper files should be kept in locking cabinets.
  • Conduct regular user audits of your systems to ensure that all user access levels are correct and that ex-employees have been removed in a timely manner.
  • Questions you should ask your third-party provider:
  • Are you PCI compliant?
  • Do you encrypt data?
  • Do you use tokenization?
  • Do you offer SSL certification (if the vendor provides your website)?

While some software is sold as Software as a Service (SaaS), some third- party software is installed on your computer. QuikStor Security & Software offers a one-time purchase PC version. “The whole database is password protected, so a criminal would have to hack into the database to capture the tenant information like address, date of birth, etc., but the credit card fields are encrypted,” says April Lee, business development consultant for QuikStor. “The encryption means that a tech agent who can get in and help trouble- shoot information on your database wouldn’t be able to see the encrypted information in those fields. We also don’t store credit card information. We use a tokenized system, which means that once the software sends the card number to the credit card processor, the credit card company responds with a token that is specific to that facility and uses that instead.”

While each company will have their own security measures in place, QuikStor has a hybrid of both onsite and cloud-based servers. Even though their physical servers are in an offsite server location, only two people at QuikStor have access to enter where their servers are stored. “Everything is backed up offsite,” says Lee. “We have one server for cloud and one for offsite backup.” The duplication strategies that many technology companies have is so they are able to retrieve data if it’s compromised or if something crashes. Multiple backups and being able to fully restore from a backup is critical for business continuity.

Lee says that during her time with QuikStor as a tech, she talked to customers who had their software on their own computers. However, they didn’t have a backup and didn’t always subscribe to a backup service and then lost the data.

“We do have a feature on our software that logs people out during overnight processing,” says Lee. “So if someone breaks in during the night, they won’t be able to walk over to the computer and easily have access to the data. Except with the basic version of our software, you’re able to create individual passwords so every employee has their own log in. We also have audit reports to monitor and pre- vent employee theft. You can set the software to rent the oldest unit first to keep employees from taking cash from friends and allowing them to rent units off the books. There are also extensive unit controls so your employees can’t see reports and can customize what an employee can and can’t do.”


Criminals continue to use ever-changing methods to make a quick buck. A survey of cybercriminals showed that they are looking for easy “typical” IT security that takes less than 24 hours to access. While we hear about the big data breaches of Uber, Yahoo, Marriott and others, most of the attacks are on regular businesses. But even basic security measures, policies and 
procedures can help protect your business and data from employee theft, a break-in, natural disaster and cyber- criminals.

Jennifer Jones is managing editor of Self- Storage News and owner of JKJ Marketing in Austin.






Is Your Data Secure?

LEGAL Q&A: Unit Access, Records Release, Employee Unit Rental, Online Auctions, Overlocking

by Connie Niemann Heyer, TSSA legal counsel

QUESTION 1: We have a tenant storing with us but he has gone AWOL. There is a person, call him Party B, listed in the blank in TSSA lease paragraph #1, whom the tenant has authorized us to speak with (at our discretion) about the lease and who can authorize lock-cutting. Party B has, from what we can tell, been the primary person paying the monthly rent. Neither we nor Party B can reach the tenant. Party B would like to change the lease to his own name. (The tenant was the fiancé of Party B’s daughter and subsequently broke it off, so now the tenant wants to have nothing to do with the family.) Party B has apparently always had, and still has, the access code and a key to the unit.

Party B doesn’t want to just move the things to another unit because he is in poor health, this is why he wants a new lease in the same unit. What can, or should, I do to help Party B?

ANSWER: As you noted, there is nothing to prevent Party B from renting another unit from you and moving all of the items in the original unit to the new unit. Any tenant who has given someone else his access code and key provided that person the ability to move/remove the tenant’s things. You need not and probably should not (to keep yourself out of the middle of any potential dispute between your tenant and Party B) get involved by helping Party B move. But there is certainly nothing wrong with renting Party B a unit.

The other alternative is for Party B to quit paying and take his chances that he will be able to buy the unit at auction. Perhaps when the tenant is informed that his unit is going to foreclosure (and nonpayment has the potential to result in legal proceedings that could affect his credit) he will cooperate by signing the Authorization and Release form to abandon the unit, thus allowing you to lease that same unit to Party B.

QUESTION 2: I had a tenant ask about charges to his account. As I was explaining the charges, I started referring to the notes I took when I spoke with him in a previous phone conversation. The tenant then demanded a copy of the notes. Am I required by law to supply a copy of those notes? (Sometimes I make notes as to whether the tenant was uncooperative, etc.)

ANSWER: No, unless you are in a lawsuit and your records are subpoenaed, and your notes are part of the records that are subpoenaed, you are not required to supply the tenant a copy of your notes.

QUESTION 3: If the owner of the storage facility where you work tells you that you can use a unit, does another employee have the legal right to open the unit and look inside of it, with or without a witness?

ANSWER: The answer to this question will depend entirely upon the terms of use the facility owner and manager came to. For any unit, whether a manager or a tenant uses it, you should have a written rental agreement (even if there is no rent). If you do not have a written agreement, then you have an oral agreement, and your right to exclusive or non-exclusive use will depend upon the terms of your oral agreement. If you did not address whether you had the exclusive right to use this unit, then the facility owner may have a good argument that he/she told you could use the unit, but never told you that no one else would have access to the unit or use of the unit. If you have not already,

I would suggest that you firm up the terms of use of the unit, preferably in writing via a rental agreement.

QUESTION 4: On the day of our auction, we received payment in full via mail for a unit that was previously delinquent. However, we didn’t receive the mail until after we had the auction, so the items were already sold.  The tenant is demanding their things back, or the address of the person who bought their unit. What should we do?

ANSWER: Unless you have an agreement with your buyers (in other words, unless this is in your sale rules or other agreement with your buyers), you may give the tenant, at your discretion, the contact information for the person who bought their unit. But that puts the buyers in an awkward situation. Many of our members provide the tenant’s contact information to the buyer and leave it to the buyer to arrange any buy-back deal. You have no legal duty to put the tenant and buyer in contact. However, it often works out well to give the buyer the tenant’s contact information. Often the ten- ant’s main goal is to get back items of sentimental value, which are not worth much to the buyer, so the buyer simply gives the items of sentimental value back to the tenant.

Regarding the attempt at payment, the tenant has the right to redeem his property “prior to its sale” according to Chapter 59, Section 59.008, of the Texas Property Code. If the mail was delivered by the mail carrier after your sale, then the tenant did not redeem the property “prior to its sale” and has no right of redemption.

It is a good idea during any auction to close off any payment lock box and direct people with a note to the physical (or online) auction site if they wish to pay/redeem. It is also a good idea to check the mail prior to any auction, and it sounds like you did.

QUESTION 5: We overlocked our tenant for nonpayment and he went to court and got a writ of re-entry. What is this? The judge let the tenant get back into the unit to get his things, but the tenant had not paid us. How can he do this?

ANSWER: Assuming you are using the TSSA lease, in my opinion the judge was incorrect in issuing a writ of re-entry. A writ of re-entry is something that a judge can issue upon request if the judge thinks a landlord has improperly locked out a tenant. Texas statutes allow for a writ of re-entry in these improper lockout situations. However, you did not improperly lock out a tenant if he was behind in rent because the TSSA lease expressly allows overlock if a tenant is behind in rent or other amounts. State law expressly states that language in a lease supersedes language in state law requiring advance notice of a lockout. Unfortunately, there is not a lot that can be done now, but next time, you might want to hire a lawyer to help the judge understand the intricacies of self-storage lien law.

QUESTION 6: We used an online auction service for a recent foreclosure, but the winning bidder hasn’t shown up to empty the unit. How do we handle this situation? Do we have to hold another auction, or can the unit be sold to the next highest bidder?

ANSWER: This will depend on your auction rules. Many online auction sites post auction rules that all bidders have to agree to in the course of signing up to bid. Check those rules and see if they address this issue. Most of these websites also allow facilities to add their own rules to any existing rules bidders must agree to as a condition of bidding. If you have added the TSSA sample auction rules (tailored to your specific needs for your facility), this situation is addressed in these rules, so you would have the right to sell to the second-highest bidder. In short, check the rules for your auctions, and if they don’t address this situation, revise them so you are covered.

Legal Q & A Legal Advice from Tenant Access to Requests for Auction Buy Backs