Before You Hand Over the Passwords: Who Should Own Your Social Media Accounts When You Outsource

You have decided to outsource your social media. The freelancer or agency is ready to start, and the first thing they ask for is your login. It feels like the quickest way to get going, so you send the password in a WhatsApp message and think no more about it.

That message is how a lot of small businesses end up not owning their own Facebook page. When you outsource, the question of social media account access deserves ten minutes before anyone starts work, because it is much harder to sort out afterwards. This article is the checklist we would want a client to run on any provider, us included.

Why the password is the wrong thing to share

A shared password causes four problems, and none of them shows up on day one:

• You cannot see who did what. If a post goes out that should not have, or a reply to a customer is rude, everyone logged in as the same person.
• Two-step verification breaks. Either the codes go to one person’s phone, which locks everyone else out, or it gets switched off so the team can work, which leaves the account exposed.
• Logins from another country can trigger the platform’s security checks. That is sensible behaviour from the platform, and it tends to happen on the day you most need to publish.
• You cannot remove one person without changing the password for everyone. So in practice nobody ever gets removed.

The platforms know all this, which is why the main ones have built a proper way to give other people and other businesses access without sharing a login. Use it.

The principle: your business owns the account, people get roles

The rule is simple. The account belongs to your business, and at least two people inside your business have full control of it. Everyone else, including any agency or outsourced team, gets a role that lets them do their job and nothing more. When they stop working for you, you remove the role. Nothing else has to change.

Facebook and Instagram: the business portfolio

Meta handles this through what it now calls a business portfolio, the thing formerly known as Business Manager, which you reach through Meta Business Suite. Your Facebook page and Instagram account sit inside your portfolio. According to Meta’s own help pages, it works like this:

• Only people with full control of your business portfolio can share its assets with a partner. That should be you, plus one other person in your business.
• The agency needs its own business portfolio and gives you its portfolio ID. You add them as a partner. You never need to add their staff to your portfolio one by one.
• You choose the level of access for each asset: full control, or partial access for specific tasks such as creating content, managing ads or responding to messages.
• A partner with full control can manage the asset, but cannot share it onward with another business. Only the business that owns the asset can do that.

For most small businesses, partial access covering content, messages and, if they run your ads, ad management is enough. Keep full control inside your own company. If a provider insists they need to own the page or the ad account, ask why, and do not accept “it is easier for us” as the answer.

Meta Business Help Center: give a partner access to business assets in your business portfolio

LinkedIn: Page admin roles

LinkedIn company pages have three admin roles, set out in LinkedIn’s help pages. A super admin can do everything, including adding and removing admins, editing the page information and deactivating the page. A content admin can create and manage the page’s posts and events. An analyst can only see the analytics.

The setup that works: you and one colleague are super admins. The person making your content is a content admin. Nobody outside your business is ever a super admin, however convenient it might be.

LinkedIn Help: Page admin roles

Everything else

Most other platforms and scheduling tools now have some form of team access too, and the same principle applies to all of them: your business owns the account, the outside team gets its own login with a role. Where a platform has no way to give access without a shared password, use a password manager that lets you share one login without revealing it, and keep the two-step verification on a phone that belongs to your business, not to the agency.

What to agree before the work starts

Access is only half of it. Three things belong in writing before the first post goes out.

Who owns the work

The posts on your page are obviously yours. Less obvious are the things behind them: the design templates, the source files for the graphics, the photo library, the content calendar and the list of hashtags that took a month to build. Agree in writing that these belong to you and that you get them when the relationship ends, in a format you can open without the agency’s tools.

Who sees your customers’ data

Anyone answering your messages and comments will see your customers’ names and whatever they write to you. Under the GDPR, that makes your provider a processor of personal data on your behalf, and Article 28 requires a contract that says how they handle it: a Data Processing Agreement. If the team sits outside the EU, that agreement matters even more. Ask for it before you give access, not after. At Swiftly Marketing every client relationship is governed by one, with us as processor and you as the controller.

How it ends

Nobody likes planning the end of something at the start, but it is the cheapest time to do it. Agree the notice period, what gets handed over and who removes whose access. Our own arrangement is month to month with 30 days’ written notice, and we would suggest that any provider asking for a long lock-in explain what you get in return.

The offboarding checklist

When a provider or a freelancer stops working for you, keep this list and work through it on their last day:

1. Remove their partner access in your Meta business portfolio.
2. Remove their admin role on your LinkedIn page.
3. Remove them from every scheduling, design and analytics tool, and check that none of those tools is billed to their card or registered to their email address.
4. Change any password that was ever shared, even once, even if you are sure it was not.
5. Collect the templates, source files and calendar you agreed you own.
6. Check who is still listed as an admin everywhere, including people who left your own company years ago.

That last step tends to be the one that surprises people. Many small business pages still list a former employee or a long-gone web designer as an admin. It takes five minutes to find out.

Questions to ask any provider, including us

• Will you work through partner access and admin roles, or do you need my password?
• Who on your side will have access, and where are they based?
• Will you sign a Data Processing Agreement before you see any customer messages?
• Who owns the templates and source files, and in what format do I get them at the end?
• What is the notice period, and what happens on the last day?

A good provider answers all five without hesitating, because they have been asked before. If you are still weighing whether to outsource at all, we covered the signs that it is time, and the practical side of working with a team in the Philippines, in two earlier articles.

7 signs it is time to outsource your marketing

Working with a Filipino marketing team: timezones, English and quality

And if you would like to put these questions to us directly, that is what the free intro call is for. Or start with the €1 a day offer, one post a day on one platform, and see how we handle access from the first day.

See the €1 a day offer and our packages