Virtual Assistant Security: How to Protect Your Business Data

Giving a remote person access to your inbox, CRM, and bank feeds can feel risky. With the right setup, it’s safer than how most small businesses already operate. Here’s the checklist.

1. Never share passwords directly

Use a password manager (1Password, Bitwarden, LastPass Teams). Share credentials through shared vaults; the VA can log in without seeing the password, and you can revoke access instantly.

2. Turn on multi-factor authentication everywhere

MFA on email, CRM, accounting, banking, and the password manager. For shared accounts, use an authenticator that can be shared through the password manager rather than texting codes.

3. Give the VA their own accounts

Wherever possible, create a separate user (Google Workspace, CRM, QuickBooks, LOS) with permissions matched to the job. Benefits:

• Audit trail of who did what
• Easy to revoke
• Least-privilege access

4. Least privilege

Ask of every permission: does the VA need this to do the job? Examples:

• Bookkeeping VA: can enter and categorize, cannot approve or send payments
• Email VA: delegate access, not your password
• CRM VA: no data export permission unless needed

5. Use a VPN for sensitive work

For finance, mortgage, insurance, legal, and health-adjacent roles, require a business VPN so access comes from a controlled connection.

6. Device rules

• Dedicated work device or user profile
• Updated operating system and antivirus
• Screen lock
• No downloading sensitive files to personal storage
• Private workspace (no shared screens in public places)

7. Contracts

Signed confidentiality and data-handling agreements, including return or deletion of data at the end of the engagement.

8. AI tool rules

Specify which AI tools are approved and what data may never be pasted into them (customer financial data, SSNs, health info, client files).

9. Offboarding checklist

The same day the engagement ends:

• Remove from password manager vaults
• Disable or delete all user accounts
• Revoke email delegation
• Rotate any credentials they could see
• Remove from Slack, drives, and project tools
• Confirm return/deletion of data

10. Regulated industries

Mortgage, accounting, insurance, legal, and healthcare have specific privacy obligations (for example, GLBA for financial institutions and HIPAA for covered health entities). Make sure your VA setup fits your written information security program, and ask your compliance advisor.

GrowthToro Managed includes VPN, password manager setup, NDAs, and offboarding. See plans.