Growing online means more tools and more people touching your business accounts: your Google Business Profile, your website, your social media pages, your CRM, and the automations that connect them. Each connection is useful. Each one is also a door.
You don’t need to be a security expert to keep those doors under control. Run through this checklist before connecting a new tool or giving anyone, including an agency like us, access to your accounts.
1. Keep ownership, share access
Most platforms separate owners from managers. Google Business Profile, Facebook and Instagram business accounts, Google Analytics and most website platforms let you invite someone as a manager, editor or collaborator.
- Stay the primary owner of every account yourself.
- Give others the lowest role that lets them do the job.
- Never share your own login so someone can “just get in”.
2. Turn on two-step verification
Two-step verification means a stolen password on its own is not enough to get into your account. Turn it on for your Google account, your business email, your social media accounts and your website admin. It is the single most effective step on this list.
3. Know where your passwords and keys live
Automations often connect tools using API keys or app passwords. Treat them like the keys to your premises.
- Keep passwords and keys in a password manager, not in emails, chats or spreadsheets.
- Give each tool its own key where possible, so one can be switched off without breaking everything else.
- Change them when someone who knew them moves on.
4. Check what each connection can see
When you connect a new app, it asks for permissions. Read them. A booking tool needs your calendar; it probably does not need access to all of your email. If an app asks for more than its job requires, look for a narrower permission or a different app.
5. Decide where customer data may go
Customer names, phone numbers and messages are personal data. Before an automation sends them anywhere, whether to a CRM, a spreadsheet or an AI assistant, be clear about:
- Which tools are allowed to hold customer details.
- How long you keep enquiries that never became customers.
- Who on your team can see them.
6. Keep a simple access list
Write down every tool, who has access, and at what level. A single shared document is enough. When a staff member or supplier moves on, you can remove their access in minutes instead of guessing.
7. Review access regularly
Every few months, open your access list and check each platform’s user settings. Remove anyone who no longer needs access. It takes a few minutes and closes the doors you forgot were open.
How we handle access
When we work on a client’s Google Business Profile, website, listings, social media or automations, we ask for manager or collaborator access rather than ownership wherever the platform allows it. You stay the owner, and you can remove our access at any time.
“Security for a local business isn’t about expensive software. It’s about knowing who has the keys.”
