# What are agency-run client accounts?

Accounts a client owns that your agency's staff work in for the client. What you may do in them and how your staff get in are two separate questions.

Updated: October 16, 2026

An agency-run client account is an account the client owns and your agency's staff work in on the client's behalf. Examples are a brand's social profiles, its ad accounts and its online store's seller dashboard. The client stays the owner, and your agency acts within the work the client asked for. The term covers every way your staff get in. That makes it wider than delegated access, which is one platform feature an owner can use to invite people ([What is delegated access?](/guides/agency-accounts/what-is-delegated-permission)).

## Which accounts does this cover?

It covers accounts where posts go out, ad money is spent, or orders are handled under the client's name. Running an account for a client doesn't move ownership. It means the client trusts your staff to operate it.

Your staff can get in three ways.

1. Delegated access. The client invites your staff through the platform's own sharing feature, and each person signs in as themselves.
2. A shared login. The client gives you its username and password, and your team uses them.
3. An access management tool (access tool for short). Your agency stores the login in a tool, and staff sign in through it without seeing the password.

In all three, people outside the client's company operate its account. What differs is who holds the password and what record each use leaves. [Managing client accounts at an agency](/guides/agency-accounts) compares the three side by side.

## Why are scope of work and access separate questions?

Scope of work is what your agency may do in the account: publish posts, upload ads, change budgets, process orders. The contract or statement of work sets it. Access is how your staff get into the account, who knows the password, and how each use is recorded. Setting the scope doesn't settle access.

The gap shows with a shared login. The contract may limit your agency to scheduling posts. But anyone who knows the owner's password can do whatever the owner can, because the platform sees the owner signing in. The platform's history also names the login, not the person who used it.

So agree on access separately from scope, for each account. Settle how staff get in, who knows the password, how each use is recorded, and what happens when staff change.

## What changes when the work involves personal information?

The California Consumer Privacy Act (CCPA) may cover some of your clients. A "business" under the CCPA is a for-profit company that does business in California and decides why and how consumers' personal information is processed. It must also meet at least one of three thresholds (Cal. Civ. Code 1798.140(d)):

1. More than $25 million in gross revenue in the previous calendar year, adjusted for inflation.
2. Buying, selling or sharing the personal information of 100,000 or more consumers or households a year.
3. Earning 50% or more of its annual revenue from selling or sharing consumers' personal information.

If your agency processes consumers' personal information for such a client, under a written contract, you may be its "service provider" (1798.140(ag)).

The business must then have an agreement with you (1798.100(d)). The agreement gives the client the right to take "reasonable and appropriate steps" to help ensure you use the information in line with its own obligations (1798.100(d)(3)). The regulations say those steps may include ongoing reviews and scans, and assessments or audits at least once every 12 months (11 CCR 7051(a)(6)). A questionnaire about who can get into which account is one way a client takes that step. [How an agency should answer a client's security questionnaire](/guides/agency-accounts/answering-security-questionnaires) covers the answers.

Whether this reaches your agency depends on the work. Drafting and scheduling posts may involve no consumer data. Answering direct messages, collecting contest entries, uploading customer lists for ad audiences or handling store orders does. Check the actual tasks with the client. Where the CCPA doesn't apply, the reason to explain your access comes from the contract and the relationship.


## Frequently asked questions

**Does the scope of work in our contract settle how staff use the accounts?**

No. The scope says what your agency may do. How staff get in, who knows the password and how each use is recorded are separate decisions, made account by account.

**Who owns an account our agency runs for a client?**

The client. Your agency works within the scope it was given. Inviting your staff, handing over a login or adding an access tool doesn't change the owner.

**Does the CCPA matter if we only post to a client's social accounts?**

It depends on whether the work touches consumers' personal information. Drafting and scheduling posts may not. Answering direct messages or handling contest entries or customer lists does.

## Sources

- [California Consumer Privacy Act of 2018, Cal. Civ. Code 1798.100 and 1798.140 (text posted by the California Privacy Protection Agency)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [California Consumer Privacy Act Regulations, 11 CCR 7051 (effective January 1, 2026)](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** Junify is for the client accounts your staff reach with a shared login. Your admin adds the client's username and password to Junify and picks which staff can use it. Staff sign in without seeing the password, and each use is recorded under the person's name. When someone rotates off, you remove their access in Junify.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=what-are-agency-run-client-accounts)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Account clauses an agency should propose in its client contract](/guides/agency-accounts/account-clauses-for-service-providers): Propose five: account handover, who may use accounts, records, incident notice, and offboarding. Keep your own promises apart from what the client must do.
- [How to write client account handling into your agency's security policy](/guides/agency-accounts/agency-security-policy-for-clients): Write a short public policy, an internal policy for staff, and an access summary for each client. Rewrite template rules for logins the client owns.
- [Amazon Seller Central user permissions, and how to give an agency access](/guides/agency-accounts/amazon-seller-central-user-permissions): Seller Central Help says not to share logins. On a Professional plan, the seller invites staff as employees and authorizes your agency as a Service Provider.