Who Actually Owns Your Social Accounts? An Access Checklist for Small Teams

Most small brands never decide who owns their social accounts. It just happens. Someone set up the Instagram login on a Tuesday in year one, the password went into a notes app, a contractor got it over Slack six months later, and now that account is the front door to the business.

That works right up until the moment it doesn't — and it never stops gradually. This is the least glamorous post we'll publish all year, and the one most likely to save you a very bad week.

The four ways access actually fails

Nobody plans for these, and all four are ordinary.

The phone. The account is logged in on one device, two-factor codes go to that number, and the recovery email is a personal address. If that phone is lost, wiped, or belongs to someone who has left, you are negotiating with a help center instead of posting.

The departure. A freelancer, intern, or agency had the password. They leave on good terms — nobody thinks to change anything, because changing it means re-doing two-factor and reconnecting tools. So the credentials stay out there indefinitely.

The compromise. Someone reuses a password, or clicks a convincing "copyright violation" message in the DMs. A shared password means you cannot tell who did what, and cannot revoke one person without locking out everyone.

The platform. Accounts get restricted or flagged, sometimes wrongly. Recovery depends on verified contact details and a business layer that is actually set up — things you cannot fix after the fact.

Know which layer you actually own

Most founders think of "the Instagram account" as one thing. It's usually three, and they fail separately.

1. The personal login. A human being's account. It is never the brand — it's a person who has been granted access to the brand.
2. The business layer. Meta's business portfolio, TikTok's Business Center, and similar structures sit above the public profile and hold the real ownership. People get added to this with roles.
3. The public profile or page itself — the thing your audience sees.

The common small-brand mistake is skipping the middle layer entirely: the profile is attached to a founder's personal login and nothing else. The account works fine, so the gap is invisible — until that personal login is the thing you have lost.

If you have a professional or business account, spend twenty minutes setting that middle layer up properly, with the company as owner and at least two humans holding the top role. Two, because one is a single point of failure and three starts to get loose.

Stop sharing the password

The rule is simple: people should have roles, not credentials.

Where a platform supports per-person access — Meta's business tools, LinkedIn company pages, TikTok's Business Center, YouTube channel permissions — use it. Each person signs in as themselves, gets the narrowest role that does their job, and can be removed in one click without changing anything for anyone else. You also get a trail of who published what.

Some platforms don't offer this. On X, a standard account has no native way to give a second person their own login, so teams share credentials by default. Where that's the case, contain the liability: keep the password in a password manager with per-person access rather than in chat, and rotate it whenever someone leaves.

Where roles don't exist, a workspace does

This is the practical workaround, and it's most of why scheduling tools exist in the first place.

Connect each social account once, at the workspace level, by someone who holds the proper role. Everyone else — your contractor, your first marketing hire, the co-founder who writes half the captions — works inside the workspace. They draft, they get approved, and the post goes out through that connection. They never see the password, and when they leave you remove a seat rather than resetting the account.

That's what makes handing off social media survivable, and an approval step meaningful: approval only means something if "publish" isn't something anyone can do from their phone at midnight.

If you run social for clients, this isn't optional — the one-workspace-per-client model exists precisely because collecting client passwords is a liability you don't want on your laptop.

Two-factor, at the layer that matters

Turn on two-factor authentication for every personal login with access to the brand — not just yours. Your own account being secure doesn't help if the freelancer with admin rights has a reused password and no 2FA.

Two details people skip:

• Use an authenticator app, not SMS, where the platform allows it. SMS codes are tied to a phone number, and phone numbers can be taken over or simply lost with the phone.
• Save the backup codes somewhere that isn't that phone. A password manager entry, or a sealed note in your company's document store. Backup codes stored only on the locked-out device are not backup codes.

Keep a connection inventory

Over a few years you'll authorize more third-party apps than you remember: schedulers you trialed, a link-in-bio tool, an analytics dashboard, a contest app. Each one is a live key to your account.

Once a quarter, open the connected-apps screen on each platform and revoke anything you don't currently use. Keep the survivors in a short list — tool, which account, who set it up — alongside the rest of your operational documentation.

The 30-minute access audit

Do this today, not on the calm day you're imagining:

1. List every account you own publicly — including the dormant one on the platform you abandoned. Dormant accounts get compromised too, and they still carry your name.
2. For each, write down who holds the top role. If the answer is "one person" or "I'm not sure," that's the first thing to fix.
3. Check the recovery email and phone on each. Move them to a company address that more than one person can reach, not a personal inbox.
4. Confirm 2FA is on for every human with access, and that backup codes are stored off-device.
5. Remove anyone who no longer needs access — and anyone you cannot identify.
6. Revoke unused app connections.
7. Name the second person who can get into everything if you're unavailable. Tell them. Make sure their access actually works by having them sign in once.

Seven lines. Most teams can finish it in an afternoon, and then it's a twenty-minute re-check twice a year.

The leaving checklist

When someone with access moves on, same day: remove their role on every platform, remove their workspace seat, rotate any shared password they held, and check the connected-apps list for anything they authorized. Do it even when the parting is friendly — this is hygiene, not suspicion, and saying so out loud keeps it from feeling personal.

Access is a publishing problem

It isn't really an IT topic. Every plan you make — the queue you bank before a holiday, the inbox someone covers while you're out, the pause control you reach for when a post goes wrong — assumes the right people can get in and the wrong people can't.

Get that layer right once, and everything you build on top of it stops being fragile.

---

Run your social from one workspace, not a shared password. Trendly connects each account once, then gives your team their own seats, draft-and-approve workflow, and a shared content calendar. Free forever · no credit card · cancel anytime.