Password managers, shared access and who holds the keys
Shared spreadsheets, passwords in chat, one login for everyone: how small businesses hold their keys, and the setup that fixes it in an afternoon.
The short answer
Digital keys get held in a shared spreadsheet, in chat messages, in one person’s browser, or with their web agency. One login for the hosting that everyone uses; a domain registered under a founder’s personal email; the analytics owned by a former marketing intern. The fix is not complicated: one company-owned password manager with shared vaults, an individual account for every person including your partner, roles instead of shared logins, and two-factor on everything that matters. It takes an afternoon and removes a whole category of risk.
The setup
| Element | What it is | Why |
|---|---|---|
| A company password manager | Business plan, owned by the company, not a personal account | The vault is an asset; it must survive any one person |
| Two recovery admins | Two people who can recover the vault if one is unavailable | One admin is a single point of failure |
| Vaults per area | Website and hosting; domains and DNS; marketing tools; finance | Access follows role, not friendship |
| Individual accounts | Every person and every partner has their own login to the manager and, where possible, to each service | You know who did what; leaving means one removal |
| Roles on services | Owner, admin, editor, viewer, set per person per service | Nobody has more than they need |
| Two-factor everywhere | Authenticator app or hardware keys on every account that supports it | Stops a stolen password from being enough |
| Quarterly access review | Who has what; remove the departed; check owners | Access lists only grow unless reviewed |
Doing it in an afternoon
- Open a business account on a password manager, in the company’s name, with two admins.
- Create vaults by area and decide who needs which.
- Collect every credential from spreadsheets, chats and browsers into the right vault. Delete the sources.
- Change every password you moved; assume the old ones are known. Make them long and random; the manager fills them.
- Turn on two-factor on each service as you go, with recovery codes stored in the vault.
- Convert shared logins to individual accounts where the service allows it, with the right role each.
- Give your partner named access inside the vault and inside the services, and remove any credentials they held on your behalf.
- Put the quarterly review in the calendar.
Where the partner fits
A partner works inside your vault and your service accounts, under their own names, at the roles the work requires. They never hold your credentials in their own systems. When the partnership ends, access ends with a few clicks and nothing needs to be re-secured. That arrangement is also how you know what exists: every service, every account, every owner is visible in one place that you control.
What this means for you
Holding your own keys is a precondition for everything else in a digital setup: ownership, continuity, security, clean hand-overs. One company password manager, individual accounts, roles, two-factor, two recovery admins, a quarterly review. An afternoon of work, and the question “who has access to what” has an answer you can read instead of a guess.
Frequently asked questions
Which password manager should we use?
Any of the established business-tier managers with shared vaults, per-user accounts, audit logs and two-factor. The choice matters less than the setup: company ownership, individual accounts, vault per area, two recovery admins. Pick one with a business plan and stop sharing passwords by any other means.
Our partner keeps our passwords for us. Is that a problem?
Yes. It means the business does not hold its own keys. The partner should have named access inside a vault the business owns. Then the partner can work, the business can see what exists, and access ends when the relationship ends, without asking anyone.
Do we need two-factor on everything?
On everything that supports it and matters: registrar, hosting, website admin, email, analytics, payment providers, the password manager itself. Use an authenticator app or hardware keys rather than text messages where possible. It is the single control that stops a stolen password from being enough.
Sources
- OWASP Cheat Sheet Series: Multifactor Authentication (accessed 2026-09-11)