Author:
Vincent Mijares
Nearly 90% of former employees and contractors retain access to at least one corporate system after they leave, and roughly 20% of data breaches involve a former team member within six months of departure. The fix isn’t avoiding delegation, it’s layered access control: share credentials by reference through a password manager rather than by value, keep two-factor codes on your own device for high-stakes accounts, grant the minimum access each role actually needs, and run the same offboarding checklist every time a relationship ends, regardless of how it ends.
Most operators think about VA security as a hiring-stage question: is this person trustworthy. The bigger, more overlooked risk sits at the other end of the relationship.
Osterman Research found that 89% of former employees were able to access sensitive corporate applications well after their departure. Gartner’s data shows only 44% of companies revoke all access within 24 hours of someone leaving. Per the Ponemon Institute, roughly 20% of data breaches involve a former employee or contractor within six months of their exit. And Verizon’s 2025 Data Breach Investigations Report attributes about 22% of breaches globally to stolen or compromised credentials.
None of this is specific to virtual assistants. It’s what happens whenever access control isn’t treated as a standing operational process. But it applies directly to VA relationships, since remote, contractor-based access is exactly the kind of arrangement that tends to get set up quickly and revisited rarely, the same pattern behind most of the operational bottlenecks that eventually force a founder to bring on support in the first place.
Most VA security problems trace back to one habit: sharing the actual password rather than sharing access to the account. A password manager built for teams, not a personal one, fixes this directly. You share a login by reference, the assistant clicks through and gets logged in automatically, and the actual credential is never displayed, copied, or pasted into a chat log or email.
This single change eliminates the riskiest and most common failure mode: a password sitting in a searchable, forwardable Slack thread or email chain indefinitely.
A practical note on tool choice: 1Password and Bitwarden both support hidden-password sharing through team or business plans, letting an assistant use a login without ever seeing the credential, and both support instant, centralized revocation. LastPass offers similar functionality, but it’s worth knowing LastPass disclosed a significant security incident in 2022 in which an attacker accessed source code and later customer vault data, worth factoring in if you’re choosing between providers today. Whichever tool you use, the “hide password” feature is a strong deterrent, not an unbreakable seal, a sufficiently determined, technical person could still extract a password the browser has to fill in somewhere. Treat it as one layer among several, not the whole defense.
Not every account needs the same level of lockdown. Sorting systems into tiers up front tells you exactly which controls to apply where, rather than defaulting to either “share everything” or “share nothing.”
|
Tier
|
Examples
|
Recommended access
|
|---|---|---|
|
Tier 1: Restricted
|
Banking, payment processors, domain registrar, primary email
|
Owner-only, or read-only if genuinely needed for a task
|
|
Tier 2: Sensitive
|
CRM, PMS, social and ad accounts, customer data
|
Named individual account, role-scoped permissions, 2FA retained by owner for irreversible actions
|
|
Tier 3: Operational
|
Scheduling, project boards, shared inboxes
|
Vault-based shared access, standard credential hygiene
|
Running your own accounts through this framework before delegating anything usually reveals that the genuinely critical logins, Tier 1, should rarely if ever leave your hands. This matters especially for financial systems: the same discipline that keeps property management books accurate depends on clear ownership of who can actually touch the numbers, not just who can view them. Most of a VA’s actual day-to-day work, meanwhile, lives comfortably in Tiers 2 and 3, and the same tiered thinking applies directly to how documentation and SOPs should be structured so access levels and process documentation stay aligned rather than drifting apart over time.
Two-factor authentication requires a second proof of identity on top of the password, a rotating code or a device tap. Even if a credential leaked somewhere, an attacker without that second factor generally can’t get in.
For delegated access specifically, 2FA does something more useful than just blocking attackers: it lets you delegate day-to-day work while keeping a hand on anything irreversible. If the authenticator lives on your own device for high-stakes accounts, banking, domain registrars, ad accounts, any sensitive action that re-prompts for a code, changing a password, adding an admin, moving money, routes back through you automatically.
A few practical notes: prefer an authenticator app over SMS codes, since SMS is vulnerable to SIM-swap attacks in a way app-based codes aren’t. Store backup recovery codes in your own vault, not a shared one, so you’re never locked out if a device is lost. And for lower-sensitivity, frequently-used operational logins, it’s reasonable to let a password manager store the second factor alongside the credential, reserve keeping codes strictly on your own device for the genuinely high-stakes accounts.
Here’s a risk that has nothing to do with hackers and rarely gets mentioned in security guides. Social and advertising platforms actively watch for logins from geographically distant locations in a short window. If an operator logs in from one country and a VA logs into the same account from another country minutes later, the platform can interpret that as account compromise, and lock, flag, or checkpoint the account entirely.
A shared-region VPN solves this quietly: both the operator and the VA appear to log in from the same general location, which stops the platform from flagging the pattern. This is worth setting up specifically for location-sensitive accounts, social platforms, ad managers, and some payment dashboards, but it’s not necessary for tools that already support proper multi-user access through role-based permissions, where least privilege already covers the risk.
Access controls limit what a VA can technically do. A signed NDA or confidentiality clause creates accountability for what they’re contractually obligated to do, and gives real recourse if that obligation is broken. A workable confidentiality agreement should cover what counts as confidential (logins, customer data, financials, internal strategy), how that data may be used (only for agreed tasks, never on shared or unsecured devices), the security practices expected of the assistant, and what happens to access and any local copies of data when the engagement ends.
This is exactly the kind of thing worth confirming directly during vetting, before a placement starts, not after. Asking a provider specifically how they handle confidentiality, data access, and offboarding as part of the vetting conversation tends to reveal a lot about how seriously security is actually built into their process versus bolted on afterward.
If your business handles data covered by a specific regulatory framework, HIPAA for healthcare-adjacent work, GDPR for EU resident data, this isn’t optional. GDPR’s Article 32 requires reasonable technical and organizational measures to protect personal data, and an account still active after someone’s departure is a direct exposure under that requirement, regardless of intent. HIPAA guidance consistently points toward same-day revocation as the practical standard covered entities are expected to meet. Neither framework transfers this responsibility to a VA simply because the work was outsourced, it remains yours.
Within 1 hour
Revoke vault, disable SSO
Same day
Remove accounts, rotate password
Within 24 hours
Reset 2FA, revoke API tokens
Within the week
Audit logs, document revocation
HIPAA and SOC 2 auditors both treat same-day revocation as the practical standard
This is the stage most operators improvise, and the data above says it’s the one that matters most.
Within the first hour:
Same day:
Within 24 hours:
Within the week:
Pasting a password into chat “just this once.” That message is permanent and searchable. Use the vault every time, no exceptions.
Sharing one master login across an entire team. This removes attribution and the ability to revoke one person’s access without disrupting everyone else’s. Use named, individual accounts.
Storing 2FA codes for critical accounts in a shared vault. This removes your ability to catch and approve irreversible changes. Keep high-stakes second factors on your own device specifically.
Forgetting offboarding entirely. Old, unrevoked access is the most common quiet exposure, and it’s also the easiest one to prevent with a checklist that runs the same way every time.
Trusting a “hide password” toggle as the whole solution. It’s a strong deterrent, not an unbreakable wall. Combine it with least privilege, 2FA, and a properly vetted, contractually bound assistant. If access and security concerns are the reason a founder has hesitated to bring on support at all, a structured process like this one is usually enough to close that gap without requiring a security background to implement it.
Offboarding checklists work best when they’re not being invented under time pressure. The same documentation discipline that makes onboarding smooth should include a mirror-image offboarding plan from the start, a running list of every system granted access, updated as the relationship evolves, rather than reconstructed from memory when someone leaves.
A managed agency relationship typically builds this structure in, limiting exactly what access an assistant needs for the task in front of them rather than granting broad account access by default. Delegate specifically vets from what the company describes as the top 1% of applicants before placement, and structures access around this same layered model rather than leaving each operator to build their own security setup from scratch. That’s a meaningfully different starting posture than a direct hire relationship, where access decisions tend to get made ad hoc as tasks come up, and revoked the same ad hoc way when the relationship ends, a distinction worth understanding fully before choosing between the two models.
As close to immediately as possible. Gartner’s research found only 44% of companies revoke all access within 24 hours of departure, and that gap is exactly where risk accumulates. HIPAA guidance and SOC 2 audit practice both point toward same-day revocation as the practical standard, even outside regulated industries, that’s the bar worth aiming for.
It’s workable but riskier than the alternative. Direct sharing means the assistant sees the actual credential, and revoking access later means changing that password everywhere it was used. A shared credential manager avoids both problems entirely.
Full financial account access and core admin panel access are the clearest lines. If a task genuinely requires financial visibility, a read-only or reporting-level permission usually covers it without granting the ability to move money or change account settings.
Yes. It’s the contractual layer underneath every technical control, and in regulated contexts it’s part of meeting your actual compliance obligations, not just good practice. Sign it before granting any access, not after.
The underlying principles are identical. What differs is who’s responsible for building and maintaining the process. With a direct hire, that responsibility sits entirely with the operator. With a managed agency, access structure and offboarding discipline are typically built into the placement itself, one of the more practical, underrated differences between the two models.
Delegate places dedicated virtual assistants with access scoped to what the role actually requires, and a structured process for what happens when a placement changes or ends.
Book a strategy call to see how that structure actually works.
© 2026 Delegate BPO LLC All Rights Reserved | Privacy Policy
For Clients
For Top Talents
