The principles
- Your business owns the accounts. CRM, email, connector platform, domain, hosting — all registered to your business with an address you control.
- People get their own logins. Invite contractors as named users rather than sharing yours.
- Least access. Give the role needed for the job, not "admin" by default.
- Multi-factor authentication on every account that supports it. CISA's guidance on MFA explains why it matters.
- Write it down. Keep a simple access record, without passwords.
US small-business security guidance from NIST and CISA's Cyber Essentials covers these basics in more depth.
Before the project starts
- Confirm which systems the contractor needs and why.
- Create or confirm business-owned accounts for each, using a shared business address rather than one employee's.
- Invite the contractor as a user with an appropriate role.
- Turn on MFA for your own admin accounts.
- Agree in writing that the contractor won't create accounts in their own name on your behalf, or if they must, that they'll transfer ownership.
API keys and integration tokens
Automations often connect using API keys or authorised connections rather than user logins.
- Create keys under a business-owned account or a dedicated integration user, not a contractor's personal account.
- Give each key only the permissions the integration needs.
- Store keys in the platform's secure settings or a password manager — never in emails, chat messages or documents. CISA's password guidance recommends a password manager for this.
- Note in the access record which key is used by which workflow, so revoking one doesn't break something unexpected.
The access record
A simple table is enough:
| System | Who has access | Role | Added | Purpose | Remove by |
|---|---|---|---|---|---|
| CRM | Contractor A | Standard user | 3 Mar | Build lead routing | End of project |
| Connector platform | Contractor A | Editor | 3 Mar | Build workflows | Handover |
| CRM API key | "Routing workflow" | Contacts read/write | 10 Mar | Form-to-CRM sync | Keep; owned by business |
Keep it next to the runbook. Never record the passwords or key values themselves.
When the project ends
- Confirm the handover: runbooks, test cases and any code are in your hands.
- Transfer ownership of anything the contractor created in their own name.
- Remove or downgrade the contractor's user accounts.
- Rotate any keys the contractor could see, and update the workflows that use them.
- Check connected apps in each system for authorisations you don't recognise.
- Test that workflows still run after the changes.
If something goes wrong
If you suspect a credential has been misused, revoke it first, then investigate. CISA's ransomware resources include guidance for small organisations on responding to incidents.
Questions
Is it OK to share my admin password with a trusted contractor?
It's better not to. Shared passwords can't be revoked without changing them everywhere, and actions can't be traced to a person. Invite the contractor as their own user wherever the app allows it.
Who should own the connector platform account?
Your business, under a business email address you control. The contractor can be invited as a user. That way the workflows stay with you if the relationship ends.
Sources and further reading
- guidance on MFA cisa.gov
- NIST nist.gov
- Cyber Essentials cisa.gov
- password guidance cisa.gov
- ransomware resources cisa.gov
Official documentation changes. Check the current version before you rely on a rule, limit or setting.
Next step
Start with one workflow worth fixing.
Bring the real steps, the tools you already use and the place the handoff gets stuck. We review feasibility, access and approval points before quoting — no instant integration promise.
See Business Automations for what we scope, or prepare a custom quote brief.