Security and access for remote staff

Four principles

1. Accounts you own: the person works in accounts your company controls, never in their personal ones.
2. Least privilege: the smallest permissions that let them do the work, widened when needed.
3. No passwords in chat or email: credentials live in a password manager.
4. Everything reversible: you can remove every access within minutes on the last day.

These matter more than any single tool, and they cost little to set up on day one. Adding them later, after access has spread, is much harder.

Passwords and two-factor login

• Use a business password manager such as 1Password, Bitwarden or Dashlane, with a shared vault for the logins the person needs.
• Share access from the vault rather than copying passwords into messages.
• Turn on two-factor login for every account, with an authenticator app on the person's own device rather than codes sent to your phone.
• For accounts that allow only one login, such as some supplier portals, keep the second factor in the shared vault so that nobody is locked out when people change.

Ask the person to use a separate browser profile for your work. It keeps your sessions apart from their personal accounts and from other clients.

Least privilege, tool by tool

• Email and calendar: delegate access to your mailbox and calendar instead of sharing your login; Google Workspace and Microsoft 365 both support delegation.
• Help desk: an agent role, not an admin role; admin rights stay with you.
• Accounting and banking: a role that can prepare and categorise but not approve payments, and view-only bank access where your bank offers it.
• Files: share the folders the work needs, not the whole drive.
• Cards: a separate virtual card with a limit for bookings and purchases, never your main card.

Keep a simple access register, so you know exactly what to remove later:

Rules against payment fraud

Assistants and bookkeepers are frequent targets of invoice and impersonation fraud: fake supplier emails with new bank details, or an urgent message that seems to come from the founder asking for a payment today. Write two rules down and repeat them:

• A change of a supplier's bank details is confirmed by a phone call to a number you already have, never to one given in the email.
• No payment, gift card purchase or transfer is made on an email or chat request alone, however urgent or senior it sounds.

A good assistant follows these rules even when you are the one in a hurry. Thank them for it.

Devices and the working environment

Remote contractors usually work on their own computer. You cannot manage it like a company laptop, but you can agree basics in writing:

• Operating system and browser kept up to date.
• Disk encryption and an automatic screen lock.
• The work browser profile used only by the person, not by family members.
• Public Wi-Fi only with a VPN, or not at all for finance work.
• Company files kept in your cloud storage, not downloaded and kept locally.

For finance roles or very sensitive data, consider providing a company laptop that you manage.

Offboarding on the last day

1. Remove the person from the password manager and change the passwords of shared logins they could see.
2. Remove mailbox and calendar delegation, help desk and accounting roles, and file sharing.
3. Cancel or freeze the virtual card.
4. Move ownership of the documents they created to a company account.
5. Sign them out of connected apps and active sessions in your main accounts.
6. Ask them to confirm in writing that company files are deleted from their devices.
7. Close the entries in the access register with the date.

Do it on the last working day, whatever the reason for leaving. It is routine, not a sign of mistrust, and saying so in advance keeps it friendly. Our onboarding checklist covers the other end, and EU companies should also read about GDPR and remote staff access.