How to Give a VA Account Access Safely

Your virtual assistant (VA) cannot work without access to some of your tools. The goal is to give them enough access to do the job and no more, in a way that you can remove in minutes. Sharing a password in a chat message is the opposite of that.

This guide walks through the safer way, step by step. It is general information; follow the rules that apply to your industry and country.

The principle: least privilege

Give each person only the access they need, for as long as they need it. That means:

View-only first, then edit access where needed
Separate logins for the VA, where the tool allows it
No access to bank accounts, payroll or sensitive data unless essential
Time-limited access for projects that end

If something goes wrong, least privilege limits the damage.

Step 1: Use a password manager

A password manager stores logins in an encrypted vault. You can share specific items with your VA without ever showing the password.

Create a shared vault or folder for the VA.
Add only the logins they need.
Use strong, unique passwords for every account.
Remove items when a task ends.

Never send passwords over chat or email, and never store them in a shared document. For tool suggestions, see tools for a VA setup.

Step 2: Turn on two-factor authentication

Two-factor authentication (2FA) adds a second check to login, such as a code. It protects accounts even if a password leaks.

Turn it on for email, banking, your CRM, store admin and cloud storage.
Prefer an authenticator app over text messages where possible.
Decide who holds the second factor. For sensitive accounts, you keep it and approve logins. For routine tools, your password manager may support shared one-time codes.
Save recovery codes in a safe place that only you control.

Step 3: Use delegated access, not shared logins

Many tools offer a built-in way to give access to someone else:

Email and calendar: delegate access to your mailbox or calendar instead of sharing your password.
Store and CRM platforms: create a staff or team user with limited permissions.
Cloud storage: share specific folders, not your whole drive.
Social media: use the platform’s roles for scheduling or posting.
Ad accounts: add them as a user with limited access, if at all.

Delegated access is logged under the VA’s name, can be removed in one click and does not disclose your password.

Step 4: Keep money controls with you

Do not give access to your main bank account.
Use approval-based roles in payment and accounting tools.
If the VA needs to buy things, use a virtual or prepaid card with a limit.
Keep payment approvals with you.
Review statements regularly.

Step 5: Protect the device and network

You cannot control a VA’s computer, but you can set expectations:

Up-to-date operating system and security software
A screen lock, and no shared computers
Secure Wi-Fi, not public networks
No saving your passwords in the browser
Prompt reporting of lost devices or suspicious messages

Put these rules in writing in your agreement. See the contract checklist.

Step 6: Start small and build trust

Week 1: minimum access for two or three small tasks.
Week 2 to 4: add tools as needed.
After 30 days: review what is being used and remove the rest.

Never share access before a signed agreement and basic checks. See scams and red flags.

Step 7: Keep an access list

Create a simple sheet:

Tool	Access level	Granted on	Granted by	Review date
Email	Delegated	[date]	You	[date]
CRM	Staff user	[date]	You	[date]
Shared vault	View	[date]	You	[date]

Review it every few months, and during every offboarding.

Step 8: Watch for unusual activity

Turn on login alerts for key accounts.
Check activity logs after the first weeks.
Ask your VA to report anything odd.

You are not spying; you are protecting the business, and your VA, from mistakes.

Offboarding: remove access fast

When a VA leaves, or a task ends:

Remove them from every tool on your access list
Remove them from the password manager and rotate any shared passwords
Revoke delegated access to email, calendar and storage
Change recovery details if shared
Check activity logs
Collect files and documentation
Confirm that the VA deletes any local copies, as agreed in the contract

The onboarding checklist has the other half.

Data protection rules

If you handle personal data about customers in the EU, UK, California or elsewhere, privacy laws may apply to how a VA accesses and handles it. Common points include limiting access, keeping records and having an agreement. Ask a qualified professional what applies to you.

Frequently asked questions

Avoid it. A temporary delegated or staff account takes minutes to set up and keeps you in control.

What if a tool has no team access feature?

Share it through the password manager, enable 2FA that you control and change the password after the task ends.

Should I tell my VA I am watching logs?

Yes. Transparency builds trust and is often required by privacy rules.

How often should I review access?

Every few months, and every time the VA’s role changes.

Sources

Sources were checked in October 2026. They support specific facts in this guide; the advice and wording are our own. Rules change, so confirm details on the official sites.