# How to answer a prospect who asks whether their accounts are safe with your agency

Answer three questions per access method: do staff know the password, is each use recorded by person, what happens at a staff change. Cite your account list.

Updated: October 16, 2026

A prospect asks in a pitch whether their accounts will be safe with your agency. The honest answer is a description of how your team works. You can give it as answers to three questions, one set for each way your staff get into client accounts. Those ways are defined in [What are agency-run client accounts?](/guides/agency-accounts/what-are-agency-run-client-accounts)

## The three questions behind the question

A client asks because your staff will post, spend and sell under its name. "Is it safe?" is vague. Broken down, it becomes three questions.

1. Do your staff know the password? If they do, it stays in their memory after they leave, and no one can take it back.
2. Is each person's use recorded? That decides whether a wrong post or setting can be traced to a person.
3. What happens when your staff change? That decides whether someone who left can still get in, and what the client will be asked to do.

Some clients also have a legal reason to check your answers. Your work may involve consumers' personal information for a client that is a "business" under the California Consumer Privacy Act (CCPA). If so, the client's contract with you must let it take "reasonable and appropriate steps" to help ensure you use that information properly (Cal. Civ. Code 1798.100(d)(3)). Under the CCPA regulations, whether a business checks its service providers bears on whether it had reason to believe one was misusing the information (11 CCR 7051(c)). So treat the pitch as the first of several checks. What you say now may be compared with what you write and show later.

## Answers by access method

Your answers depend on how staff get into each account. If you know which method each account uses, you can read the answers from this table.

| Question | Delegated access | Shared login | Access tool |
| --- | --- | --- | --- |
| Do staff know the password? | No. Each person signs in as themselves | Yes. Everyone who shares it knows it | No. An admin stores it in the tool, and staff sign in through the tool |
| Is each person's use recorded? | Yes, on the platform, as far as it keeps history | Only per login on the platform. You work out the person from your own work logs | Yes, in the tool. The platform still shows one login |
| What happens when staff change? | The client, or your manager account, removes the person. No password change | You ask the client to change the password, then share it again with the rest of the team | You stop the person's access in the tool. Nothing for the client to do |

Only with a shared login does every staff change mean a new password from the client.

Shared logins can remain for reasons outside your agency's control. Some platforms have no way to invite people, and some settings open only to the owner's login. Even so, some things are in your hands: who knows each password, how it gets changed, and how you record use. Say what you've decided on each point when you give your answers.

## Back your answers with your account list

Your answers need something behind them. That is the list of every client account your staff work in, described in [Managing client accounts at an agency](/guides/agency-accounts). With it, you can show in writing that each account has a known access method, named staff and a known record.

The list matters because your answers get checked again. A security questionnaire may follow the pitch, and an audit may follow that ([How an agency should answer a client's security questionnaire](/guides/agency-accounts/answering-security-questionnaires)). If what you say in the pitch, write in the questionnaire and show in the audit all come from one list, they will match.

Show the prospect the list's columns, not other clients' rows. Showing how you handle another client's accounts may break your confidentiality terms with that client.

## Answers to avoid

### "We don't share logins" when some remain

A later questionnaire or audit will turn up the shared logins, and your pitch answer won't match. Instead, explain why the platform leaves you a shared login and what you've decided about it.

### Stating how a platform works as a fixed fact

Platforms change their features. Say "according to Google Ads Help" or name the help page your answer rests on. Also keep the platform's feature apart from the client's part in it. Delegated access starts with an invitation from the owner, so say what the client will need to do.

### "Mistakes won't happen"

How your staff get in decides two things: whether you can trace who did something, and whether people who leave are locked out. It does nothing to stop a wrong post. Say instead what you can report after a mistake and what you do at a staff change.


## Frequently asked questions

**How much of our own setup should we describe in a pitch?**

Enough to answer the three questions for each way your staff get in. Don't name other clients or show their accounts.

**Should we mention accounts that still use a shared login?**

Yes, along with how you manage them. Say who knows the password, how it gets changed and how you record use. A later questionnaire or audit will find them anyway.

**Should we show a prospect our list of client accounts?**

Show its columns, not other clients' rows. The columns show what you track for each account: access method, staff and record.

**Can we tell a prospect that mistakes won't happen?**

No. How staff get in decides whether you can trace a mistake and lock out people who leave. It doesn't stop a wrong post, so promise what you will report and do.

## Sources

- [California Consumer Privacy Act of 2018, Cal. Civ. Code 1798.100 and 1798.140 (text posted by the California Privacy Protection Agency)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [California Consumer Privacy Act Regulations, 11 CCR 7051 (effective January 1, 2026)](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** If you change the password at setup, with the client, so only Junify holds it, your three answers are short. Staff never see the password. Each use is recorded under the person's name. When someone rotates off, you remove their access in Junify, with nothing for the client to do. Those answers stay the same on platforms that have no way to invite your staff.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=explaining-account-handling-in-sales)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Account clauses an agency should propose in its client contract](/guides/agency-accounts/account-clauses-for-service-providers): Propose five: account handover, who may use accounts, records, incident notice, and offboarding. Keep your own promises apart from what the client must do.
- [How to write client account handling into your agency's security policy](/guides/agency-accounts/agency-security-policy-for-clients): Write a short public policy, an internal policy for staff, and an access summary for each client. Rewrite template rules for logins the client owns.
- [Amazon Seller Central user permissions, and how to give an agency access](/guides/agency-accounts/amazon-seller-central-user-permissions): Seller Central Help says not to share logins. On a Professional plan, the seller invites staff as employees and authorizes your agency as a Service Provider.