Giving a VA access without giving away the store

The default is usually too much

Hiring a virtual assistant is one of the highest-leverage moves a small store makes. The access conversation that comes with it is one of the least planned.

What normally happens: the VA needs to do one job, the fastest way to unblock them is broad access, and that access is never revisited. Six months later a person you have never met can read every customer record you hold.

This is not about trust. It is about limiting the blast radius of an account compromise you will not hear about.

Start from the task, not the tool

Write down what the VA actually does. Be specific, at the level of “replies to shipping-status emails” rather than “customer service”. Then grant only what those tasks require. It is slower for one afternoon and saves an unpleasant conversation later.

Four rules that hold up

1. Never share a login. Shared credentials mean no audit trail and no way to revoke one person. If your VA is using your account, you cannot tell their actions from yours.
2. Scope to a room, not the workspace. A VA handling returns needs the returns conversation. They do not need the conversation about supplier pricing or staffing.
3. Time-box the review. Put a recurring reminder to re-check access quarterly. Most over-permissioning is drift, not decision.
4. Offboard the same day. Not at the end of the month. The day the engagement ends.

The question is not whether you trust the person. It is what happens if their laptop is stolen on a Tuesday.

The audit trail question

When a VA leaves, can you answer three questions? What did they have access to, when did it start, and when did it end. If the answer involves searching your memory, that is the gap worth closing.

Store Huddle keeps removed access visible rather than deleting it, so the record of who could see what survives the person leaving. Roles decide which rooms someone sees, and private categories stay invisible to anyone outside them. The roles guide covers the built-in ones.

If you work with an agency

The same logic applies with an extra wrinkle: agency staff turn over, and you may not be told. Scope the agency to what it needs and re-check when the engagement changes shape. If you are on the agency side of this, our Shopify app affiliate program and giving clients visibility cover the other direction.

Start from the tasks, not the permissions

The usual approach is to open the permissions screen and decide what looks reasonable. That produces over-permissioning every time, because each individual toggle seems harmless.

Work the other way. Write down the five things the VA will actually do this month. Then grant only what those five require, and nothing on the basis that it might be useful later. Later is a request you can approve in thirty seconds; standing access is a permanent exposure.

Most VA task lists turn out to need less than expected. Answering customer emails needs order lookup. Updating listings needs products. Scheduling social posts needs neither, though the account it was set up on often has both.

What order access actually exposes

Worth being concrete, because "access to orders" sounds narrower than it is.

Order records generally carry customer names, addresses, contact details and purchase history. Granting order access is granting access to your customer list, and that carries data-protection obligations that are yours rather than the contractor's.

That does not mean refusing. It means knowing what you granted, recording it, and being able to remove it. The practical difference between a store that handles this well and one that does not is almost never the permission model; it is whether anyone wrote down what was given.

Separating store access from workspace access

The distinction that removes most of the risk, and the one most stores never make.

Doing things in the store, such as issuing refunds or editing products, requires a Shopify staff account, scoped narrowly. Knowing things, such as what is launching, what is low on stock, or what needs doing today, does not.

A VA still needs a Shopify staff account, because the workspace opens inside your admin, but it can be a very small one. In Store Huddle the role is the second decision: it sets which rooms they see, and it is independent of what their Shopify permissions let them change. So being fully part of the conversation does not require being able to issue a refund.

Splitting the two means the admin account, if they need one at all, can be much smaller. The full distinction is in where the line sits between staff accounts and roles.

The three habits that matter more than the permissions

Write down what you granted, when you grant it. A line per item. Reconstructing this six months later is the single hardest part of offboarding and the reason access lingers.

Agree the end date at the start. One sentence in the engagement: access runs to the end of the work and is removed as standard. It converts revocation from a judgement about a person into a policy, and removes the awkward conversation entirely.

Never share a login. Individual accounts only. A shared password cannot be revoked without disrupting everyone else, which is precisely why it never gets revoked.

Closing it out properly is covered in offboarding contractors without leaving doors open.

Reviewing access you have already granted

Most stores reading this already have a VA with more access than they would grant today. The audit takes twenty minutes and needs no tooling.

List everyone with a staff account. For each, answer two questions: what do they change in admin, and when did they last do it? Anybody who cannot be given a specific answer to the first does not need the account. Anybody whose answer to the second is measured in months probably does not either.

Then check the things that are not staff accounts, which is where most lingering access actually lives: shared documents, courier portals, email platforms, ad accounts, and anything set up on their email address during a project.

What a good arrangement looks like

Concretely, for a VA handling customer email on a small store.

A Shopify staff account limited to orders, because looking up an order is genuinely required. No product editing, no settings, no apps, no financial reports.

A workspace role that includes the customer-facing rooms and the tasks assigned to them, and excludes the rooms where suppliers, pay and internal decisions are discussed. They are fully part of the working conversation without being inside everything.

An end date agreed at the start, a written note of what was granted, and both reviewed when the engagement changes shape. None of that is difficult; all of it is easier before it is needed than after.

The trust question, addressed directly

Store owners often hesitate here because scoping access feels like signalling distrust, particularly with someone who has worked with them for a while.

It is worth separating two things. Trust is about intent, and scoping is not about intent. Most access incidents involve compromised credentials rather than deliberate misuse, and a narrowly scoped account limits the damage regardless of whose fault it was.

Framed that way, the conversation is easy and most professionals expect it. A VA handling several clients generally prefers working with people who scope properly, because it protects them too: they cannot be blamed for something they could not have touched.

Reviewing it when the work changes

Access is usually set once at the start and never revisited, but engagements change shape. A VA hired for customer email who now also updates listings has accumulated permissions by request, one at a time, with nobody looking at the total.

The trigger to review is a change in what they do, not a date. Whenever the scope of the work changes, spend five minutes checking whether the access still matches, and remove anything the old scope needed and the new one does not.

This is much easier than an annual audit, because the change is already prompting a conversation and adding one question to it costs nothing.

Common questions