Cybersecurity for Web and Marketing Agencies: Client Access

A 14-person agency in Griffintown with about sixty clients. The team runs their Facebook and Instagram pages, their Google Ads campaigns, their WordPress sites and, for some, their DNS. One Friday afternoon, an account manager gets a notice from Meta: copyright violation, the page will be suspended within 24 hours. She signs in to appeal.

By Monday, several clients' pages are running ads for a fake crypto investment, paid for with the clients' credit cards. The notice was fake, and the account manager's profile was an admin on 40 pages.

An agency never gets hacked alone: it takes its clients down with it. Here's how to reduce that risk without slowing your team down.

Why agencies are a prime target

An agency is a lucrative target because a single compromised account can unlock the assets of dozens of clients: it's a supply chain attack on a small scale. In its National Cyber Threat Assessment 2025-2026, the Canadian Centre for Cyber Security notes that threat actors continue to launch digital supply chain attacks, including "double" supply chain attacks where one compromise enables another.

Three habits common in the industry make things worse: everyone is an admin "to save time," freelancers keep their access from one project to the next, and a steady stream of fake platform notices that nobody dares to ignore.

The fake platform notice is the classic way in. Train the team on one reflex: never sign in from a link in an email or a direct message, however urgent it looks. Open the app or type the address yourself, and check whether the alert shows up in the account itself. If someone did enter their password, they should tell their team lead right away. Changing the password, ending active sessions and checking which client assets that account could reach takes minutes; the damage grows by the hour.

Take stock of the access you hold

Before securing anything, list every access your agency holds, client by client, with the privilege level and who uses it. The table below shows what's at stake.

Least privilege in practice

Least privilege means each person at the agency has only the access their work requires, for as long as it requires, through their own account. The major platforms are built for this.

• Meta. The client adds your agency as a partner from its business portfolio and chooses which assets to share. You then assign each asset to the right employees, one by one. Our guide to securing business social media accounts covers these settings.
• Google Ads. Link the client's account to your manager account. Google offers several access levels (Admin, Standard, Read only, Billing, Email only); only Admin can manage access and unlink a manager account. Standard is usually enough to run campaigns.
• Quarterly review. In Google Ads, an admin can see each user's authentication method and last sign-in. Use it to remove dormant accounts.
• Multi-factor authentication required on every personal account that reaches client assets, ideally with passkeys or security keys, which resist phishing better.

Shared vaults, when delegation doesn't exist

When a platform offers no delegation, store the credential in a business password manager, in a separate vault for each client, never in a spreadsheet, a chat or an email. Only the team assigned to that client gets access.

Think about multi-factor authentication on those shared accounts too. If the code goes to one employee's personal phone, her departure locks everyone out. Store the code in the vault instead, or use a security key managed by the agency. Our article on deploying a business password manager explains how to structure vaults.

Client onboarding and offboarding: the checklist

The end of a mandate is when forgotten access piles up; a written onboarding and offboarding procedure solves the problem.

When a client comes on board:

• Inventory of its assets and their real owner: domain, pages, ad accounts, website.
• Delegated access created for the agency, without the client's credentials.
• A written contract covering access, security measures and the incident notification deadline.

When a client leaves:

• Partner access and manager account links removed.
• Ownership of any asset created in the agency's name transferred to the client.
• The client's vault deleted and shared passwords changed.
• The list of removed access confirmed to the client in writing.

When an employee or freelancer leaves, remove their access to every client the same day.

For Quebec clients, Law 25 adds an obligation as soon as you process personal information on their behalf: newsletter lists, website forms, campaign data. The client may share it with you without consent if it's necessary for the mandate, but the contract must be in writing and set out the protection measures. You must also notify the client's privacy officer without delay of any breach or attempted breach (s. 18.3). Have your standard contract reviewed by your legal advisor; clients elsewhere in Canada fall under PIPEDA or provincial law instead.

What your clients will ask you

Expect your clients to assess your security: an agency that holds their access is a critical supplier. The Canadian Centre for Cyber Security recommends that small and medium organizations assess their suppliers on an ongoing basis and require, by contract, a specific deadline for reporting security incidents.

Prepare a one-page answer to the usual questions: multi-factor authentication, password manager, offboarding procedure, incident notification deadline, cyber insurance. They closely mirror the questions we suggest asking to evaluate an IT provider's security, so read them from your clients' point of view.

Our team can review your access, vaults and procedures as part of a cybersecurity audit. To talk it through first, book a free consultation with one of our experts.