Security Questions to Ask Before You Hand an Agency Your Logins
Sign with a social media agency and you hand over a set of keys: admin access to your accounts, sometimes the ad account, sometimes the shared inbox where customers write in. Most brands walk through that handoff without asking how those keys will be stored, who will hold them, or what happens when the relationship ends.
Why an agency is a vendor with keys to your business, not just a creative partner
A social media agency looks like a creative hire, someone who writes captions and posts on a schedule. But the access it typically receives goes further: admin roles on your social accounts, often ad account billing access, sometimes a shared inbox that receives customer messages, occasionally a CRM or ecommerce login. Each is a door into your business. The size of that access, not the agency’s headcount or portfolio, is what should set your diligence. See who owns your social accounts when an agency runs them for the ownership baseline this sits on top of.
The proportionality test: how much diligence a small retainer actually needs
Not every engagement needs the same scrutiny. A boutique agency that only schedules and posts content, with no billing or inbox access, carries limited exposure. An agency holding ad billing details, a shared customer inbox, or a live ecommerce integration carries much more. Diligence should scale with what the agency can touch. Asking a five-person agency for a SOC 2 report because a vendor security template told you to is a sign you copied a checklist built for enterprise software vendors, not that you did real diligence.
Credential storage: the one question that filters out the worst agencies
Ask how they store client credentials and the answer sorts them fast. A good answer sounds specific: credentials live in a shared password manager, each client has their own vault, and each staff member logs in with a named account rather than a shared master login. Nothing sits in plaintext. A bad answer sounds like improvisation: a spreadsheet, a shared personal email draft, a sticky note, or credentials sent over Slack or WhatsApp. That last category is disqualifying, regardless of how strong the agency’s creative work looks.
Who actually has access, and how you find out
“The agency has access” is not an answer.
- Ask for a named list of the individuals who will have access, not a department name or team title.
- Ask whether the agency subcontracts to freelancers or contractors, and whether those contractors get direct access to your credentials.
- Ask whether access is scoped specifically to your account, or granted blanket-style across the agency’s entire client book.
Offboarding: what happens to your access the day an employee leaves the agency
Agency employees leave, get let go, or move to other accounts, and each departure either cleans up your access or quietly doesn’t. Ask the agency to describe its offboarding process in concrete terms: how quickly access is revoked, whether that’s automatic or manual, and whether they can point to what happened the last time someone with access left. A confident answer names a process. A vague “we handle that” with no specifics is the flag. See what happens when your agency account manager quits for the relationship side of this.
Where a formal certification helps, and where it says nothing about a small agency
A SOC report, sometimes called SOC 1 or SOC 2, is an independent audit of a service organization’s internal controls, used to evaluate vendor risk. The AICPA describes the SOC suite of services the same way: an independent, third-party assessment of a service organization’s controls. Most social media agencies are small teams, and a SOC 2 audit is built for a different kind of vendor, so its absence should not disqualify an otherwise strong agency. What matters more is a specific, confident answer to the credential and offboarding questions above.
The five questions to ask before you send the first login
You need five questions, asked on the call where you discuss scope and price.
- Where and how are our credentials stored?
- Who, by name, will have access to our accounts?
- Do any subcontractors or freelancers get access, and if so, how?
- What happens when a staff member with access leaves the agency?
- What happens to our credentials and data when the contract ends?
The value is not in how reassuring the answers sound, it is in how specific they are. See the fuller list of questions to ask a social media agency for the rest of the vetting conversation.
What this review is not
This is a short pre-signing conversation, not a substitute for access control and termination language in the contract itself. The answers an agency gives you verbally should show up in the agreement: who holds your credentials, what happens to your access when it ends, and what the agency owes you if that fails. See what to have ready before you sign for where that belongs.
Get started
Run this review while you’re choosing an agency, not after you’ve picked a favorite. You can browse vetted agencies to start a shortlist, and if you run an agency, you can list your agency free.
FAQ
Should I ask a social media agency for a SOC 2 report?
You can ask, but treat the answer as informational, not pass or fail. A SOC 2 audit is built for vendors handling significant data infrastructure, and most social media agencies are small teams that haven’t pursued one, so its absence shouldn’t disqualify a strong agency. The more useful path is the credential and offboarding questions.
What is the biggest security mistake brands make when hiring a social media agency?
Skipping access diligence because the relationship feels like a marketing hire rather than a vendor relationship. Brands negotiate scope and price, then hand over admin access, ad billing, and inbox access without asking how it will be stored or revoked.
How do I know if an agency is storing my passwords insecurely?
Listen for vagueness: a spreadsheet, a shared email draft, or dodging the question without naming an actual system. A confident answer names a specific method, typically a password manager with a per-client vault, and explains how staff log in without ever needing the credential itself.
Should I revoke agency access immediately when I switch agencies?
Yes. Revoking access is a standard offboarding step every time an agency relationship ends, whether you’re leaving on good terms or firing them outright. The turnover side of that same handoff is covered above.
Sources
- AICPA: System and Organization Controls (SOC) Suite of Services, fetched 2026-09-23.
