You should not solve remote-work security by deciding whether a Virtual Assistant is “trustworthy enough” to receive every password and card number.
Build the role so the person receives only the access needed for the work, with controls you can review and revoke.
Start with least privilege
Create a list of systems the Virtual Assistant needs, then assign the lowest permission level that lets them complete the workflow.
- Use a named user account instead of a shared owner login where possible.
- Keep billing, user administration and security settings with the appropriate internal owner.
- Use separate roles for viewing, editing, publishing and approving when the product supports them.
- Review access again when the role changes.
Use a business password manager instead of chat
Do not send raw passwords in email, Slack, WhatsApp or a spreadsheet.
Use a business password manager or identity system that supports per-user access, MFA and revocation. Some products can restrict whether a shared credential is revealed; others cannot. Check the actual product controls instead of assuming the password is always hidden.
Where SSO or individual invitations are available, prefer those over sharing a master credential.
Protect the account with MFA
Enable multi-factor authentication on sensitive services. Decide how the second factor will work before you delegate the account.
Do not build a workflow where the Virtual Assistant has to ask for the owner’s personal one-time password every day. Use supported team-access methods, delegated accounts or company-managed authentication where available.
Delegate purchases with controlled spending
If a Virtual Assistant needs to book travel, buy software or place routine orders, avoid sharing the main company card when your finance provider offers a safer alternative.
- dedicated virtual card;
- per-transaction or monthly limits;
- merchant restrictions where available;
- approval for purchases over a threshold;
- receipts attached to the transaction;
- automatic notifications to the finance owner.
Availability varies by bank, card issuer and country, so use the controls your existing provider supports.
Give the Virtual Assistant a company identity
Use a company-managed email account for business communication and software invitations when practical. That makes account ownership, offboarding and audit trails easier.
Do not let critical business accounts depend on a personal email address that the company cannot recover.
Set data rules, not just login rules
A person can have the correct password permissions and still handle data badly. Define where files may be stored, which information may be downloaded, whether local copies are allowed and which data can be entered into third-party tools.
For healthcare, legal, finance or other sensitive workflows, involve the appropriate privacy, security or compliance owner. Contract terms and an NDA can support the relationship, but they do not replace technical controls.
Device security should match the risk
A bring-your-own-device setup may be reasonable for lower-risk work if the company sets clear requirements. Higher-risk access may justify a company-managed device, disk encryption, endpoint protection, screen-lock policies and remote-management controls.
Do not require a VPN simply as a security checkbox. Use it when it solves a defined network-access problem and fits the company’s security architecture.
Create an offboarding checklist before day one
Offboarding should not depend on remembering every account manually.
- suspend the company email account;
- remove identity-provider and password-manager access;
- revoke active sessions where supported;
- disable dedicated cards or spending permissions;
- transfer ownership of files and documents;
- remove access to shared drives, CRM, help desk and project tools;
- rotate credentials that were genuinely shared;
- review logs for unexpected access after the role ends.
Security starts before the hire, but continues after it
Screening can reduce people risk, but no vetting process should be used as an excuse for excessive access. Build the workflow so one compromised account cannot expose everything.
See how VirtualAssistant.com.ph vetting works, then compare vetted talent for the role you need.