How to give a virtual assistant access without risking your accounts

Security is the part of hiring an assistant that owners worry about most and plan for least. The worry is reasonable. You are giving someone you have not met in person access to the systems that run your business. The good news is that the safe way is also the simplest, and most of it takes an afternoon.

The core principle

Every person gets their own login with only the access they need. That one rule solves most of the risk. When each person has their own account, you can see who did what, change one person's access without affecting anyone else and remove someone completely without resetting passwords for the whole company.

Shared logins break all of that. They are also the most common mistake we see.

Step one, an inventory

Before the assistant starts, list every tool they will touch and what they need to do in it. A simple table in a doc is enough, with columns for tool, purpose, access level and who set it up. This list becomes your onboarding checklist and your offboarding checklist later. If you have not chosen tools yet, our guide to virtual assistant tools covers a lean stack.

Step two, separate accounts

Email

Give the assistant their own company mailbox. If they need to work in your inbox, use the delegation features built into Gmail and Microsoft 365. Delegation lets them read, send and organize mail on your behalf without ever knowing your password, and you can remove it at any time.

Calendar

Share your calendar with edit rights from your own account settings. No password needed.

Accounting

QuickBooks Online and Xero both support separate users with limited roles. Give bookkeeping access without admin rights unless there is a clear reason. Our guide to hiring a Filipino bookkeeper goes into the right roles for finance work.

Banking

Never share your own banking login. Most business banks offer additional users with view only access or limited permissions such as preparing payments that you then approve. Use that.

Social media and ads

Meta, Google, LinkedIn and most other platforms have business managers that add people with specific roles. Use those instead of logging in as yourself.

Step three, a password manager

Some tools still do not support multiple users, or charge too much per seat. For those, use a business password manager. 1Password, Bitwarden, Dashlane and Keeper all let you share a login into a specific vault so the assistant can sign in without seeing the password. When access ends, you remove them from the vault and change the password.

Set up a separate vault for the assistant. Put only the logins they need in it.

Step four, two factor authentication

Turn on two factor authentication for every account that supports it. For shared logins where the code goes to your phone, this creates friction. A few options help.

• Use an authenticator that stores codes in the password manager, so the assistant can generate them without your phone
• For critical accounts, keep the code on your phone and accept that the assistant will ask you when needed
• Avoid text message codes where possible, since they are weaker than app based codes

Step five, devices and connections

Ask how the assistant works. Is the computer theirs alone? Is the operating system up to date? Do they use antivirus? You are not trying to audit their home. You want to know about obvious gaps.

For sensitive work, a few extra measures help.

• Require a screen lock and full disk encryption on the device
• Keep files in cloud storage instead of downloads
• Use a VPN or a virtual desktop if your industry calls for it

Agencies often handle device standards for you. Ask what they require.

What not to share

Some things should stay with you no matter how much you trust someone. Your primary personal email password. Recovery codes for your main accounts. Owner level admin rights for your domain or Microsoft 365 or Google Workspace. The ability to add new bank payees without your approval.

If a task truly needs one of these, do that step yourself or set up an approval flow.

A risk ladder for handing over access

Not all access carries the same risk. Hand it over in stages as trust builds.

1. Calendar, task board and shared drive folders
2. Email delegation and CRM
3. Social media and marketing tools with limited roles
4. Accounting with bookkeeper rights and no payments
5. Preparing payments that you approve
6. Anything with owner or admin rights, which usually stays with you

Most assistants reach stage three or four within the first month. Many never need stage five. Pair this ladder with your onboarding checklist so access arrives on time without arriving all at once.

Red flags around access

If a candidate or new assistant asks for your password, suggests sharing one account to save money, or wants to work from a public computer, slow down and ask why. Our guide to red flags when hiring a virtual assistant covers more of these signs.

Offboarding checklist

When an assistant leaves, do this the same day.

1. Remove them from every tool on your inventory list
2. Remove them from password manager vaults
3. Change passwords for any shared logins they used
4. Revoke email and calendar delegation
5. Transfer ownership of any files they created
6. Remove their devices from any accounts that list trusted devices
7. Archive or forward their company mailbox

With an inventory and a password manager, this takes under an hour.

Phishing and payment fraud

The most common way small businesses lose money is a convincing email, not a hacked laptop. Someone poses as a vendor with new bank details, or as you asking for an urgent gift card purchase. An assistant who handles email and payments is a natural target for these messages.

Set two rules on day one and put them in writing.

1. Any change to a vendor's bank details gets confirmed by phone using a number already on file, never a number from the email
2. You will never ask for gift cards, wire transfers or password resets by email or text alone

Then make it easy for the assistant to check with you. A quick "is this really you?" message should always be welcome. Praise it when it happens, even if the request was genuine.

A short security agreement

Alongside the main contract, a one page security agreement helps set expectations. Keep it plain. It can cover keeping work files in company cloud storage, not installing unknown software on the work device, reporting a lost device or suspicious email the same day and returning or deleting all company data when the engagement ends. Have the assistant read it and sign it during onboarding, and walk through it on a call so it does not feel like a formality.

How delegateit helps

When you hire through us, we discuss access needs during setup and recommend a structure based on the role. You keep control of your systems and decide what each assistant can reach. An Assistant starts at $1,500 a month full time or $900 part time and a Specialist starts at $2,200 a month. See our pricing page for detail.

Security questions

Is it safe to give a virtual assistant access to my email?

Yes, if you use the delegation features in Gmail or Microsoft 365 rather than sharing your password. You can remove delegation at any time.

Should a virtual assistant have access to my bank account?

Only through a separate user with limited permissions. Many owners keep payments for their own approval.

What password manager should I use?

Any reputable business password manager with shared vaults will work. Pick one that supports removing access easily.

What should I do when a virtual assistant leaves?

Follow an offboarding checklist that removes their accounts, revokes delegation and changes any shared passwords on the same day.