Virtual Assistant Data Security Checklist

The Checklist

• Create a separate user for the assistant in every tool.

• Share logins through a password manager only.

• Turn on two-factor authentication for email, banking, and customer data.

• Grant the minimum access the job needs; upgrade later.

• Use view-only or approval workflows for payments.

• Keep customer data inside your systems, not in downloads.

• Set a rule about personal devices and public Wi-Fi.

• Require screen lock and updated software.

• Sign a confidentiality clause in the agreement.

• Log who has access to what, and review it every quarter.

• Plan the offboarding order now: email and banking first.

• Ask providers about their own security practices.

The Two Most Common Mistakes

Sharing your own login, and giving payment authority on day one. Both are easy to avoid and both cause most of the horror stories.

Regulated Industries

If you handle health, financial, or legal data, ask your accountant or attorney whether a data processing agreement or specific training is required. Many providers will sign one.

Setting Up A Password Manager In An Hour

Create a business account, add your assistant as a user, and share only the vaults they need. Never paste passwords into chat again. When the arrangement ends, remove the user and rotate anything they could have seen.

Working With A Provider

Ask the provider for its security policy, whether assistants work on company-managed devices, and whether it will sign your confidentiality or data processing agreement. Managed providers with office-based staff often have the strongest controls.

What This Looks Like In Practice

A bookkeeper receives view access to the bank feed and can prepare payments, but only the owner approves them. Six months later the owner adds approval rights up to a small limit.

A Quick Checklist Before You Start

• Every tool has a separate user for the assistant.

• Password manager in place.

• Two-factor on critical systems.

• Access log created.

Questions Owners Ask

Is it safe to give inbox access?

Yes, with a separate user or delegated access rather than your password, and clear rules on what they may send.

Should I use monitoring software?

For hourly billing, tracking hours is normal. Screen monitoring signals distrust; use it deliberately or not at all.