Commercial

Security and access, in plain terms

How does an agency handle my logins securely is a question almost nobody asks before handing over a password, which is exactly why it has a page of its own. The short version: we do not hold your passwords, and we could not lose them if we tried, because we never ask for them.

Delegated access, never a shared password

Every platform worth using supports adding a user or a partner by email, at a role that limits what they can do. That is the only way we take access. You add us from your own account, at the permission level the work actually requires, and you remove us the same way without asking us first.

A shared password is the worst available option. It cannot be scoped, it cannot be revoked without changing it for you too, it usually defeats two factor authentication, and it leaves no record of who did what. The convenience lasts one minute. The exposure lasts for years, and it is still sitting in a chat log long after the engagement ends.

Where a platform genuinely has no delegated access, we say so and lay out the options honestly rather than asking you to type a password into a message window.

What we ask for, platform by platform

• Google Analytics and Google Tag Manager: a user on your property, at the level needed to configure events and read reports.
• Google Search Console: a delegated owner or a full user on the property you verified.
• Google Business Profile: a manager on your listing. Never the owner. The listing stays owned by you, which is the single most commonly abused piece of access in this industry.
• Meta: a partner or asset level role in your business account, on your ad account, with your payment method. We never become the owner of an ad account.
• Domain and DNS: either you create the records we specify, or you add us as a user at the registrar. We do not need and will not ask for the registrar account itself.
• Hosting and code: we hold our own build environment, you hold the repository, and you are the account holder on both the domain and the deployment.

What we never ask for

• Your password, to anything, through any channel.
• A two factor code, a backup code or a recovery phrase.
• Your banking, payroll, point of sale or merchant account.
• Ownership of a Google Business Profile, an ad account or a domain name.
• A list of your customers, unless a specific piece of work requires it and you have a lawful basis to share it.

If anybody contacts you claiming to be us and asks for any of the above, it is not us. We will never request a code by phone or message, and the only address we write to you from is contact@ninetyfifthmktg.com.

How credentials are stored

The credentials that do exist are ours: our own accounts, and the API keys for the services your site runs on. They live in a password manager, with two factor authentication on every account that supports it. They are not in a document, a spreadsheet, an email thread or a chat log, which is where the overwhelming majority of agency credential leaks actually happen.

Secrets for your site live in the deployment platform as environment variables, never in the code. That is why the repository you own can change hands without leaking anything, and why a developer reading the source cannot read your keys.

Nobody outside the people doing your work has access to any of it. We do not resell your access into a third party dashboard, and we do not add your accounts to a tool that aggregates clients for its own reporting.

Subcontractors

When a specialist works on your account they get the narrowest access that lets them do the job, for the duration of the job, under their own named login. Never ours and never a shared one. You can ask at any time who currently has access to what, and the answer is a list with names on it rather than a reassurance.

Offboarding

When an engagement ends, you remove us. Not the other way round, because access you can revoke yourself is the only access you genuinely control.

We send a written list of every account we were added to, with the exact steps to remove us, and we delete our own copies of anything of yours we were holding. Nothing is retained as leverage and nothing needs to be negotiated.

$50 a month covers hosting, security, monitoring and small changes. Month to month, no initial term, and not billed at all while an SEO retainer runs. You own the code either way.

If something goes wrong

If we believe an account you own has been exposed, you hear from us the day we believe it. What we know, what we do not know yet, and what to change first. Before we have finished establishing whether it was our fault.

That order is deliberate. A vendor who investigates before it discloses is optimising for its own position, and the hours spent doing that are hours an attacker spends inside your account. We would rather make an awkward call early than a defensible one late.