The default is usually too much
Hiring a virtual assistant is one of the highest-leverage moves a small store makes. The access conversation that comes with it is one of the least planned.
What normally happens: the VA needs to do one job, the fastest way to unblock them is broad access, and that access is never revisited. Six months later a person you have never met can read every customer record you hold.
This is not about trust. It is about limiting the blast radius of an account compromise you will not hear about.
Start from the task, not the tool
Write down what the VA actually does. Be specific, at the level of “replies to shipping-status emails” rather than “customer service”. Then grant only what those tasks require. It is slower for one afternoon and saves an unpleasant conversation later.
Four rules that hold up
- Never share a login. Shared credentials mean no audit trail and no way to revoke one person. If your VA is using your account, you cannot tell their actions from yours.
- Scope to a room, not the workspace. A VA handling returns needs the returns conversation. They do not need the conversation about supplier pricing or staffing.
- Time-box the review. Put a recurring reminder to re-check access quarterly. Most over-permissioning is drift, not decision.
- Offboard the same day. Not at the end of the month. The day the engagement ends.
The question is not whether you trust the person. It is what happens if their laptop is stolen on a Tuesday.
The audit trail question
When a VA leaves, can you answer three questions? What did they have access to, when did it start, and when did it end. If the answer involves searching your memory, that is the gap worth closing.
Store Huddle keeps removed access visible rather than deleting it, so the record of who could see what survives the person leaving. Roles decide which rooms someone sees, and private categories stay invisible to anyone outside them. The roles guide covers the built-in ones.
If you work with an agency
The same logic applies with an extra wrinkle: agency staff turn over, and you may not be told. Scope the agency to what it needs and re-check when the engagement changes shape. If you are on the agency side of this, our partner program and giving clients visibility cover the other direction.