Guide · Security
Access management for teams: passwords, accounts and offboarding
Many security incidents in small businesses start with access, not with sophisticated hacking: a shared password in a chat, a former employee who still logs in, an ad account owned by a contractor's personal profile, an admin panel protected by "admin123". Managing access is unglamorous, but it is the single most effective security measure most companies can take.
[ 01 ]
In short
In short
- 01
Critical accounts — domain, hosting, website admin, email, ad platforms, CRM, payment provider — should be owned by the company.
- 02
Each person gets their own account with the access they need; no shared logins.
- 03
Use a company password manager and two-factor authentication everywhere it is available.
- 04
Keep a register of who has access to what, and review it regularly.
- 05
Remove access promptly when people leave or contractors finish.
[ 02 ]
Guide
Company ownership
- Domains registered to the company, with registrar accounts on a company email.
- Hosting, cloud and CDN accounts in the company's name.
- Google Analytics, Search Console, Google Ads and Meta business assets owned by company accounts, with people added as users.
- Messenger business accounts, app store developer accounts and payment provider accounts in the company's name.
When a contractor or employee needs access, add them as a user — do not give them ownership. See what to get at website handover.
Individual accounts
Shared accounts make it impossible to know who did what and to remove one person's access without disrupting everyone. Give each person their own account, with roles that match their tasks. See designing roles and permissions.
Passwords
- A company password manager with shared vaults for teams, instead of spreadsheets and chats.
- Long, unique passwords generated by the manager.
- No reuse of passwords across services.
- Default passwords changed immediately on new systems.
Two-factor authentication
Enable two-factor authentication on every critical account: email, domain registrar, hosting, admin panels, ad platforms, CRM, payment dashboards. Prefer authenticator apps or security keys over SMS where available. See two-factor authentication.
Access register
A simple register lists each system, who owns it, who has access and at what level. Review it quarterly and after organisational changes.
Onboarding and offboarding
- Onboarding: create accounts with the minimum needed access; share credentials through the password manager.
- Offboarding: on the last day, disable accounts, remove from shared vaults, revoke API keys and tokens, change shared credentials that cannot be individualised, transfer ownership of files and assets.
Offboarding contractors deserves the same care — especially agencies with access to ad accounts and websites.
Service accounts and API keys
Integrations use API keys and tokens. Store them in secure configuration, not in code repositories or documents; give them only the permissions they need; rotate them when people with access leave.
Monitoring
- Login alerts for critical systems.
- Review of admin activity logs.
- Alerts for new admin users or permission changes.
[ 03 ]
FAQ
Frequently asked questions
Is a password manager safe?
Reputable password managers encrypt data so that the provider cannot read it. They are much safer than spreadsheets, chats or reused passwords.
What if our agency set up our accounts?
Check who owns them. Ask the agency to transfer ownership to company accounts and remain as users.
How often should passwords be changed?
Current guidance favours strong unique passwords and two-factor authentication over frequent forced changes — but change passwords immediately if there is any suspicion of compromise or when someone with access leaves.