How to give a supplier access to your accounts without sharing passwords.

Invite them, do not share a login

A shared password is the easy way, and it causes the trouble later. Sign-in codes go to the owner's phone, so the supplier rings at awkward times. You cannot tell who changed what. The password ends up in emails and chats you do not control. And when the supplier leaves, you have to change it everywhere and hope you remembered every place.

An invitation fixes all of that. The supplier signs in with their own account, the platform records what they do, and you remove them in one step. We ask our own clients for access the same way: as an invitation where the service allows it, and never a password by email, as our websites page says.

Four rules cover every account:

• The business is the owner. A supplier is a user.
• Give the lowest role that does the job, and raise it only when a task needs it.
• Invite named people, not a shared supplier login.
• Write down who has access to what, and remove them when the work ends.

Google Business Profile

This is the account suppliers ask for first, and the one to be most careful with. To add someone:

• Open your Business Profile and select More, then Business Profile settings, then People and access.
• Select Add, enter their email address and choose Owner or Manager.
• Select Invite. They can accept straight away, and you get an email when they do. Pending invitations show under Pending, where you can cancel them.

Choose Manager. Google says managers have mostly the same access as owners, except that they cannot add or remove people or remove the profile. That covers what a marketing agency or web designer needs, whether they post offers for a restaurant or reply to its reviews. A profile can have several owners but only one primary owner, and that should always be someone in the business. Google also stops an existing owner making a new owner the primary owner in their first seven days, so a supplier cannot be invited and promoted in one go.

To remove someone, go to the same People and access page, select the person and choose Remove person. Only owners can remove other users.

Google Search Console

Search Console shows how your site does in Google search. To add a supplier, open the property, go to Settings, then Users and permissions, select Add user, enter their Google Account email and choose a permission. Full gives them view access to all the data and some actions, which is enough for most search work. Restricted is mostly view-only.

Keep ownership with the business, ideally verified through your domain's DNS. If a supplier verifies the site themselves, for example by adding their own verification record or file, they become a verified owner, and removing them then means deleting that record or file too. Google warns that otherwise they can verify again and get back in.

Google Analytics

In Google Analytics, open Admin, choose Access management under Account or Property, select the plus button, then Add users. Enter their email address, choose a role and select Add.

Add a supplier to the property they work on, not to the whole account: someone added at account level gets the same access to every property in it. Give Editor to someone setting up tracking and Viewer to someone who only reads reports. Only an Administrator can add or change users, so keep that role in the business.

Google Ads

In Google Ads, open Admin, then Access and security, select the plus button, enter the person's email address, choose an access level and send the invitation. The levels, as Google describes them:

• Admin: full control, including users and account links.
• Standard: can edit campaigns and run reports, and can view and edit billing.
• Read only: can see campaigns, reports and billing but change nothing.
• Email only: receives notification emails and reports, nothing more.
• Billing: manages billing and payments.

An agency will often ask to link its own manager account to yours instead. Accept the link from your account, keep at least one Admin in the business and the payment method in the business's name, and unlink it when the agency leaves. If the ads are meant to bring enquiries, how to track leads from Google Ads covers what the agency should set up.

Meta: Facebook, Instagram and their ads

Meta works best with partner access, which gives the agency's own business portfolio access to your Page, Instagram account and ad account, without adding each of its staff to yours. To do it:

• Ask the agency for its business portfolio ID. They find it in their settings, under Business portfolio info.
• In Meta Business Suite, open Settings, then Partners, select Add and choose to give a partner access to your assets.
• Enter the ID, choose the assets and the level of access, and assign them.

Only someone with full control of your business portfolio can do this. A partner with full control can manage everything you shared with them but cannot share your assets with another business. When the agency's staff change, the agency manages its own people, and when it leaves, you remove one partner. If you want to see which ads bring enquiries, how to track leads from Meta ads covers the setup to agree with them.

Your domain registrar and DNS

The registrar account controls the domain, and with it the website and the email, so be stricter here than anywhere else. Some registrars let you invite a delegate. GoDaddy's delegate access, for example, has levels down to domains only, and a delegate cannot manage payment methods, invite others or see your password.

Many suppliers only need one or two DNS records changed, such as a verification record or the records that point the domain at a new site. If your registrar has no delegate feature, ask the supplier to send you the exact records and add them yourself, or move the DNS to a host that supports members. Cloudflare, for example, lets the account's super administrator invite members and limit them to particular domains.

Never let a supplier change the registrant or the contact email on the domain, and never let them move it into their own account. If one already has, get the domain back first, as the last section explains.

Your website and hosting

The common platforms each have their own way to add a person:

• WordPress: Users, then Add New, with a role. Administrator can change everything, Editor can manage everyone's content, and Author and Contributor work on their own posts. Give a developer Administrator for the project and remove it afterwards, and give a copywriter Editor.
• Shopify: collaborator accounts, made for Shopify Partners. You give the partner the four-digit request code from Settings, Users, Security, they request access, and you choose the permissions before you accept. Collaborators do not count towards your staff limit, and you remove them in Settings, Users.
• Wix: Roles & Permissions in the dashboard. Website Manager can edit and publish the site but cannot handle billing or transfer the site, which suits most suppliers. Admin (Co-Owner) has billing and domains too, so keep it for the business.
• Squarespace: Permissions & Ownership, where you invite a contributor and switch on only the permissions they need. An administrator can do almost everything the owner can except transfer ownership.

For hosting, look for team or collaborator access in the host's control panel. If there is none, ask the host for a separate login limited to the site, such as an SFTP account for its files, rather than handing over the main account.

Email: Google Workspace and Microsoft 365

Never give a supplier the top admin role on your email service, because it can reset every password in the business. Give them a limited role for the task instead. Microsoft's own advice is to assign the least permissive role that does the job, such as a password or helpdesk role for someone who only resets passwords, and to keep global administrators as few as possible.

A Microsoft partner can also ask to become a delegated administrator of your Microsoft 365. The partner sends you an email asking for permission, and you can remove the relationship later. Agree what role they need before you accept. How to keep the top admin role in the business is in how to set up a business email address.

Booking software, CRM and other tools

The same rule applies to the tools behind the website. Booking software, a CRM, a helpdesk or an accounting package usually lets you add staff or user accounts. Give a supplier one with the access their job needs, and where the tool offers a test account, use that for building and trying things before anything touches real customers. It is how we ask for access when we connect a chatbot to a client's booking software or CRM.

If the supplier needs a connection key, the code one tool uses to talk to another, create it in the business's own account, name it after the supplier and delete it when they leave.

When an account has no way to invite people

Some tools still have a single login: an older booking system, a supplier portal, a social account outside Meta's business tools. For those:

• Share the login through a password manager, never by email or text. 1Password, for example, can share a copy of one login through a link that expires, even with someone who does not use 1Password, and you can limit it to their email address.
• If the account uses two-step verification, agree how the sign-in code reaches them, so nobody reads codes out over the phone to whoever happens to call.
• Change the password when the work ends.

If a tool you pay for offers no user accounts at all, remember that when you next choose one. Our automation page makes the same point about the tools a workflow touches: each needs its own access, and never a password sent by email.

Keep a list of who has access

One page is enough, kept somewhere the business controls:

• Each account, with its owner and a second person from the business who can sign in.
• Every supplier with access, their role, the date you gave it and why.
• The date their work is due to end.

Look through it every few months. A physiotherapy clinic that has worked with a web designer, an ads agency and a booking software consultant over three years can easily find all three still listed as owners somewhere. The list is how you notice.

When a supplier leaves

Go through every account on the list on the day the work ends, even when you part on good terms:

• Business Profile: remove the person from People and access.
• Search Console: remove the user, and delete any verification record or file they added.
• Analytics: remove them from the property and from the account.
• Google Ads: remove the user, or unlink their manager account.
• Meta: remove the partner, or the people, from your business portfolio.
• Registrar and DNS host: remove the delegate or member.
• Website and hosting: remove their user. When WordPress asks what to do with their posts, give them to someone in the business.
• Email: remove their admin role and any mailbox or alias they used.
• Password manager: change every login they could see.
• Automations they built, such as a Zapier account that copies enquiries into your CRM: move them to an account the business owns, then check they still run.

Then check the places their email address may still sit: the website form's notification address, the domain's contact details and the recovery email on your accounts. If a supplier refuses to give access back, that is a different job, covered in how to get your website back from a web designer.