Sharing Access Safely: A Data-Security Checklist for Working with a VA

The fear that stops owners delegating

The single biggest reason people keep doing admin themselves is simple: they don't want to hand over passwords. It's a reasonable instinct. The good news is that modern tools let you share access without sharing passwords — and this checklist shows you how.

1. Use a password manager with shared vaults

A password manager (1Password, Bitwarden, Dashlane and others) lets you share a login without ever revealing the password itself. The assistant uses the credential; you can revoke it in one click. Benefits:

• The assistant never sees or stores the password
• You can withdraw access the moment the work ends
• Everything is logged

This is the foundation. If you do nothing else, do this.

2. Prefer delegated access where it exists

Many platforms support delegated access without sharing the master login:

• Email — Gmail and Microsoft 365 let you grant delegate access to another mailbox
• Accounting — Xero and QuickBooks allow advisor or invited-user access
• Calendars — share a calendar with edit rights, not the account itself
• Social — most schedulers let you add a team member

Delegated access is cleaner than shared passwords because it scopes what the assistant can do.

3. Agree a confidentiality agreement before sharing

Before access goes anywhere, sign a simple NDA or confidentiality agreement. It doesn't need to be elaborate — it needs to say what's confidential, how it's handled, and that it ends when the work ends.

4. Keep a record of what you've shared

Maintain a short list: which accounts, which level of access, and when it was granted. When an engagement ends, work down the list and revoke everything. A password manager makes this trivial.

5. What to avoid

• Emailing passwords — even once, even to someone you trust
• Reusing one password across accounts
• Sharing your master banking login — use a read-only or delegated role if your bank offers one
• Giving full admin access when a lower role would do

6. Data you should handle yourself

Some things rarely need to leave your hands: signing contracts, authorising payments above an agreed amount, and anything subject to a specific regulatory obligation. A good assistant will tell you to keep these.

Want this set up for you?

Secure access setup is part of onboarding. On a free consultation we'll agree which accounts to share and how — using a password manager, not email.