Who Has the Keys? Managing Staff Access to Business Accounts

In a small shop, it is easy to say, "Use my phone, the password is saved." Then a shop assistant manages your WhatsApp, your cousin posts on the page, and a freelancer has your email login. Months later, one of them leaves on bad terms, and you realise you do not know who can still get in. Managing access is less exciting than selling, but it protects your money, your records and your reputation.

Why access needs rules

Business accounts hold valuable things: customer lists, payment details, product prices, private chats and the trust you have built. When too many people share one login, three problems appear:

You cannot tell who did what, for example who deleted a post or changed a price
You cannot remove one person without changing everything for everyone
A single careless person can expose the whole business

A few simple rules solve most of this.

Rule 1: Do not share your own password

The safest approach is to avoid giving your personal password to anyone. Many platforms let you add other people with their own accounts and different roles, such as editor or viewer. Use this whenever you can. Then each person has their own login, and you can remove them without affecting anyone else.

If a tool only allows one login, consider who truly needs it, and change the password when that person leaves.

Rule 2: Give the lowest level of access needed

Think about what each person needs to do:

A cashier needs to record sales, not see all profits
A person posting photos needs to publish content, not manage payments
An accountant may need to view records, not edit them
A delivery rider needs to see orders, not customer lists

Giving less access is not about distrust. It limits the damage if a phone is lost or a mistake is made.

Rule 3: Keep a simple access list

Take a notebook or a spreadsheet and write down:

Each account, such as email, social media, cloud storage and shop apps
Who currently has access
What level of access they have
When it was given

Review it every few months. Fatuma, who owns a small clothing shop in Zanzibar, discovered during such a review that a seller who left two years earlier could still view her supplier chats. She removed the access in minutes.

Rule 4: Remove access immediately when people leave

When an employee, freelancer or helper stops working with you:

Remove them from accounts the same day
Change shared passwords, if any exist
Log out their devices where possible
Ask them to hand back any business phones or SIM cards
Check that no recovery email or number belongs to them

Do this even when the person left peacefully. It is a routine, not an accusation.

Rule 5: Protect shared phones and computers

Many small shops use one phone for orders. If that is your situation:

Use a screen lock and change it when staff change
Avoid saving personal accounts on the shared device
Keep business apps separate from private ones
Turn on automatic updates

Rule 6: Explain the basics to your team

Staff often cause problems not through bad intent, but through not knowing. Spend ten minutes teaching them:

Never share codes or passwords, even with managers who ask by message
Be careful with links from strangers
Tell you immediately if a phone is lost
Always log out on shared computers

Clear access rules are not about mistrust. They are about protecting the business and the people who work in it.

Your next step

This week, make your access list. Write down every account and everyone who can use it. Remove anyone who no longer needs access, and set up separate logins wherever you can. Doing this once puts you ahead of most small businesses and makes it much easier to grow your team with confidence.