The first week with a new Virtual Assistant usually starts with a long list of logins. Email, calendar, the CRM, QuickBooks, Canva, the scheduling tool, your website and maybe a bank portal or two. Most business owners handle it by pasting usernames and passwords into an email and hoping for the best. I understand why. It’s fast, and you want your Virtual Assistant working on day one.
It’s also the part of hiring help that should get the most thought. After running Virtual Assist USA since 2008, I can tell you the businesses that set up access carefully at the start have far fewer problems later, whether that’s a locked account, a missed security code or a mess to clean up when the work ends. Secure Virtual Assistant services start with how access is set up, and most of it takes less than an hour.
Why Sharing Your Password Is the Wrong Starting Point
When you share your password, a few things happen. Your assistant logs in as you, so any record of what was done shows your name. If you use two-factor authentication, which you should, the code goes to your phone, and your assistant has to text you at 7 a.m. to get in. And when you eventually change assistants or end the arrangement, you have to change that password everywhere it’s used.
Most of the tools small businesses use have a better option built in. It’s usually called delegate access, a shared vault or an additional user, and it lets your assistant do the work under a separate login.
Email and Calendar: Use Delegate Access
Gmail and Outlook both let you grant another person access to your inbox without giving them your password. In Gmail, it’s in Settings under “Accounts,” where you can add a delegate who can read, send and organize your email. Messages they send show that they were sent by your assistant on your behalf. Microsoft 365 has a similar delegate setting, usually set up through Outlook or by your IT administrator.
For your calendar, share it directly with your assistant and choose the permission level that lets them make changes to events. That’s enough for them to schedule meetings, move appointments and add Zoom links without ever signing in as you.
If your assistant manages email for a shared address like info@ or billing@, give them a separate login to that mailbox instead of sharing the password to yours.
Passwords: Use a Password Manager With Shared Folders
For accounts that don’t support delegate access, use a password manager like 1Password, LastPass or Bitwarden. Create a shared folder or vault for your assistant and move only the logins they need into it. When a password changes, it updates for both of you automatically. Some password managers also let you share a login without displaying the password itself, which is useful for accounts you want them to use but not see.
The rule I give clients is simple: if a password would have to be typed into an email, text or document, it belongs in the password manager instead. Our post on how to trust your Virtual Assistant covers the bigger picture of building that trust over time.
Business Software: Give Your Assistant a Separate User
Most business tools let you add users with specific roles. QuickBooks Online, HubSpot, Canva, Asana, Shopify and most CRMs let you invite your assistant as a separate user and choose what they can see and change. A separate user costs a little more on some plans, and it’s worth it. You’ll see what was changed and by whom, and you can remove one person without disrupting anyone else.
Give access in stages. Start with the tools your assistant needs for the first few tasks, then add more as the work expands. Our guide on onboarding a Virtual Assistant in seven days lays out how to pace that first week.
Decide What Stays With You
A few things should stay in your hands, even with an assistant you trust completely:
- The administrator login for your domain, website hosting and Google Workspace or Microsoft 365 account
- The ability to move money out of your bank accounts (your assistant can prepare payments for you to approve)
- Recovery email addresses and phone numbers on your most important accounts
- The main login for your password manager
None of this slows your assistant down. They can still draft the payroll, prepare the bill payments and update the website content. You just stay the person who approves the final step.
If you work in healthcare or handle patient information, there are additional rules about who can access what. Our post on HIPAA compliant Virtual Assistants explains what to look for.
Removing Access When the Work Ends
If you ever change your support, removing access should follow a checklist, and you should write that checklist the day your assistant starts. Remove them as a delegate on your email and calendar. Remove them from the shared vault in your password manager, and change any password they could have seen. Deactivate their user in each business tool. Move any files they created into a folder you control before their account is closed.
If you set up access the way I’ve described, this takes about fifteen minutes. If you shared passwords by email, it can take days, and you’ll never be completely sure you got them all.
What to Ask a Virtual Assistant Company About Security
If you’re hiring through a company, ask how their people are employed, how they protect logins and who reviews access. At Virtual Assist USA, our assistants are U.S.-based W-2 employees bound by confidentiality agreements and trained in secure data handling. We protect system logins with authenticator-app multi-factor authentication, keep access role-based, logged and limited to approved team members, and run routine permission and security reviews. Those are the kinds of specifics you should hear from any company you’re considering.
FAQs
What makes a Virtual Assistant service secure?
Look for U.S.-based assistants who are employees rather than contractors, confidentiality agreements, multi-factor authentication on company systems and regular reviews of who has access to what. Ask the company to describe these practices in writing.
How do I give a Virtual Assistant access to my email?
Use the delegate feature in Gmail or Outlook so your assistant can read and send email on your behalf without your password. For shared mailboxes like info@, give them a separate login.
Should a Virtual Assistant have access to my bank account?
Your assistant can usually do the bookkeeping and prepare payments with view-only or limited access. Keep the ability to send money yourself, and approve payments before they go out.
Are U.S.-based Virtual Assistants more secure?
Location is one factor. It also matters whether the assistant is an employee with a confidentiality agreement, whether the company enforces security practices and whether you have clear legal recourse under U.S. law if something goes wrong.
What should I do when I stop working with a Virtual Assistant?
Remove them as a delegate on email and calendar, take them out of your shared password vault, change any passwords they could have seen and deactivate their users in each business tool. A written checklist makes this a fifteen-minute job.
Want to See How We Protect Your Data?
If security is what’s keeping you from getting help, start by reading our security and data protection practices. If you have questions about how we’d set up access for your business, send us a note and we’ll walk you through it.
