Invite users instead of sharing passwords
Use the platform's native user invitations, business roles or partner access. Give each person an individual login and only the permissions they need. Avoid shared passwords and enable multifactor authentication where supported. Do not place recovery codes, passwords, identity documents or payment-card details in an enquiry form.
Keep an owner and permissions record
Record the business owner, administrator contacts, billing owner and connected assets. Review account, page, pixel, catalogue and payment permissions separately. A partner may manage campaigns without owning the underlying account. Agree who can change access and how account activity will be reviewed.
Plan offboarding before work begins
Document what happens when agency work ends: who keeps the account, which users or partners are removed, what reporting is delivered and how billing is reconciled. Remove unnecessary access through the platform and verify that legitimate business administrators retain control. Follow official transfer procedures if ownership changes are supported.