By Nicolas Avila · October 9, 2026

Who has access to what: a year-end review

Photo: Avila Ops Tecnologia

An access review is a two-column list: every account the business uses and every person who can sign in to it. Done once a year in one afternoon, it answers questions no one asks until something goes wrong: can the employee who left in March still access Instagram? Is the nephew who built the website the domain owner? Is the Mercado Pago password in the 2023 WhatsApp group?

By December, the year’s arrivals and departures have happened, and operations slow after Christmas. January usually brings new people, and it is better to grant access when everything is in order.

How do you build the list without forgetting an account?

Start with accounts that move money or communicate with customers, then work down to those that only store data. For each, record who has access, their role, and the account owner (the email address or CPF that owns it).

To find missing accounts, use the same method as for forgotten subscriptions: check card statements and search email for “welcome,” “your account,” and “invitation.” Anything appearing there but missing from the list is a forgotten account with forgotten access.

The owner column brings the most surprises. It is common for the domain to be registered under the agency’s CNPJ, Instagram to be linked to a former partner’s personal email, and Ads Manager to belong to a freelancer’s profile. While everything is fine, no one notices. When the relationship ends, the account goes with it.

What should you do with what the list reveals?

In order:

1. Remove people who left. In each account, revoke access for anyone no longer with the business. This is not about distrust; they should not carry that responsibility after leaving.
2. Change shared passwords. Every account accessed with “the password everyone knows” gets a new password generated by a password manager, and sharing moves to the manager’s folder rather than the group chat.
3. Correct ownership. Put the domain, Instagram, Ads Manager, and Google Business Profile under the business or owner’s name, with the business email as the contact. This involves paperwork and sometimes takes days; start now.
4. Enable two-step verification on financial, email, and WhatsApp accounts, with recovery codes stored safely.

What to avoid: giving everyone administrator access for convenience. Customer service staff need to reply on WhatsApp, not change its password. People posting on Instagram need to publish, not remove the owner. Most services offer less powerful roles; use them.

How do you keep this current without repeating the whole afternoon?

The December list becomes your onboarding and offboarding document. Someone joins in February: the list says which accounts they receive and with which role. Someone leaves in August: the list says where to remove access that same day. Without it, offboarding removes what someone remembers, and the rest remains.

Keep the list in the password manager or a document accessible only to the owner and one other trusted person. By definition, an access list is a map of what to protect. It does not belong in the group chat.

A ten-minute quarterly review, simply checking whether the “who has access” column is still correct, prevents next December’s afternoon from starting from scratch.

What to do now

Fill in the table today, even with gaps. Remove former staff this week. Start correcting domain and Instagram ownership before the holiday break because those processes take time. If you prefer someone to look at the whole picture and identify what is exposed, we can assess it in a conversation: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471.

Frequently asked questions

Can a former employee be held responsible for using their access?

Yes, but removing access is your responsibility, and the damage happens before any legal proceedings. Removing it on the day of departure costs less than any dispute.

The agency refuses to transfer the domain or Instagram. What should I do?

For a .com.br domain, Registro.br has an ownership transfer procedure requiring the current owner’s agreement; if they refuse and the name is your registered trademark, administrative and judicial avenues exist. For Instagram, Meta has a channel for reporting trademark misuse, but results are not guaranteed. In both cases, begin with a dated, formal written request.

Do I need a system to manage access?

No. The table in this guide in a protected document and a password manager with folders are enough for a small business. An access management system is for when the list exceeds a few dozen people.