Letting a vendor use your company's accounts

No US law tells you how to hand your company’s logins to a vendor. But when the vendor will touch customer, patient or consumer data, US sector and state rules require you to oversee it. The FTC Safeguards Rule spells out three steps: choose a capable vendor, bind it by contract, and keep checking on it. How you hand over access then decides two things. One is whether your records show which person did the work. The other is how much it takes to shut access off when the contract ends.

What letting a vendor use your accounts means

A vendor here is an outside firm you hire to do work inside your systems. You stay the account holder for the order system, the support inbox, the bookkeeping software, the applicant tracking system or the company’s ad and social media accounts. The vendor’s staff sign in and work within the scope you agreed on.

The contract sets the scope of the work. How the vendor’s staff get into your accounts is a separate decision. This guide covers outside firms. Staffing-agency temps who work under your own supervision count as your own workforce; Giving company accounts to employees, contractors and temps explains the difference. If you’re the firm working in a client’s accounts, see Managing client accounts at an agency.

What US rules require of the company that hires the vendor

The US has no single privacy law that covers vendor oversight across every business. The duty comes from rules for particular sectors and states, and the one that applies depends on what data the vendor touches and who you are. What is vendor oversight? defines the term.

The CCPA once excluded data about job applicants and employees, but that exemption expired: it “shall become inoperative on January 1, 2023” (Civil Code 1798.145(m)(4)). So an HR or recruiting vendor can fall under these contract terms too. New York’s law also lets a small business use safeguards suited to its size (899-bb(2)(c)). A business counts as small with fewer than 50 employees, under $3 million in revenue in each of the last three years, or under $5 million in year-end assets.

None of these rules says how a vendor’s staff should sign in. But the rules that cover your own systems keep applying when a vendor’s staff use them. For covered financial institutions, the FTC Safeguards Rule requires access controls that “Authenticate and permit access only to authorized users” (314.4(c)(1)(i)). It also requires you to monitor and log what authorized users do (314.4(c)(8)). HIPAA’s Security Rule lists “Unique user identification” as required (164.312(a)(2)(i)). Nothing in these texts exempts logins used by a vendor’s staff.

Three ways to hand over access

There are three ways a vendor’s staff can get into your accounts.

1. Create a user for each person. You add or invite each member of the vendor’s team as their own user in your system (sometimes called delegated access), and each signs in as themselves.
2. Hand over a shared login. You give the vendor the username and password of one of your accounts, and its staff use it together.
3. Put an access management tool in between. You store the username and password in a tool, and the vendor’s staff sign in through it. They never see the password, and the tool records each person’s use. A tool that only stores and hands out passwords counts as the second way.

You can mix the three. A practical setup is one user per person wherever the app allows it. Use a shared login or a tool only for accounts that exist once, such as a company social media profile or a shared support address.

What goes in the contract and what you decide yourself

The contract covers the scope of the work and how the vendor protects your data. The rules above add specific terms: safeguards under the FTC rule, the business associate terms under HIPAA, and the CCPA’s list in 11 CCR 7051(a). New York’s law lists contract safeguards among the elements of one way to comply. The account terms that follow from them are covered in What your vendor contract should say about accounts.

How you hand over the accounts is not something the vendor can settle. You decide five things: who gets a user, which logins are shared, who holds the passwords, how each use is tied to a person, and what happens at the end. A clause that bans shared logins does not help if the only thing you gave the vendor is one shared login. Its staff have no way to comply.

Where to start

Start with a list of your accounts that the vendor uses. Give each account one row, with the vendor, the app, the account, the handover method, and the people who use it. Add who receives the two-step verification codes (the one-time codes some apps send at sign-in). Without this list, you won’t know what to shut off when the contract ends. That step is covered in the checklist for taking back access when a vendor contract ends.

Next, mark the rows you can move to one user per person, starting with apps that let you add users. When you switch, change the old shared password, so the people who knew it can no longer use it.

Then decide how to run the shared logins that remain. Settle four things for each: the account, who knows the password, how it changes when someone leaves, and how each use gets tied to a person. You can tie use to a person with an access management tool, or by asking the vendor for a work log. If a vendor tells you its team works from one shared login, use the four questions in What to check when a vendor says its team uses one shared login.