Yes, it is safe to give a virtual assistant access to your email when you set it up properly instead of handing over your password. In Gmail, add your assistant as a delegate, share every other login through a password manager, and give access only to what the job needs, under a signed NDA.
You have spent years building your client relationships and the way your business runs. Of course you want to protect them. Even Baklid, founder of Skale Bak, tells owners who feel this: "It is very normal to feel nervous about giving your assistant access to your email, your CRM and your business. You are bringing in a new team member, and you would feel the same hiring locally."
Safety comes from the setup: access you can see and remove at any time.
Is it safe to give a virtual assistant access to my email?
It is safe when your assistant uses Gmail's delegate access, not your password. A delegate can read, send and delete email for you, but Gmail's own help page says a delegate cannot change your password or chat as you.
Here is what that means for you:
- Your password stays yours. Your assistant signs in to their own account and opens your inbox from there.
- You can see who sent what. When a delegate sends a message from your account, Gmail shows their email address.
- Sensitive settings stay locked. Google keeps sensitive account settings, and features beyond email, out of a delegate's reach.
Keep 2 Step Verification switched on for your own Google account (Google's guide). With delegate access, your assistant never needs your password or your sign in codes.
How do I give my assistant Gmail delegate access?
You add a delegate from Gmail on a computer. You cannot do it from the Gmail app, and Google asks you to confirm it is you first.
- Open Gmail on your computer.
- Click Settings, then See all settings.
- Open the Accounts and Import tab (Accounts on a work account).
- In "Grant access to your account", click Add another account.
- Enter your assistant's email address and send the invitation.
Your assistant has a week to accept the invitation, and it can take up to 24 hours before the access works. If you use Google Workspace, your admin controls whether delegation is allowed. You remove a delegate from the same section.
How do I give an assistant access to passwords?
Share passwords through a password manager, never by email, text or a shared document. Even always recommends the same thing: share logins through a safe password sharing tool.
A password manager lets you share a login without writing it down anywhere. Bitwarden shares logins through an organization collection, and 1Password can share an item through a link that expires. Either way, you decide which logins your assistant gets, and you can remove their access. If they ever saw a password, change it.
Start with the logins your assistant needs for their first jobs, and add the rest as the work grows.
How should a virtual assistant access my CRM and files?
Give your assistant their own user in the CRM and one shared folder for files. Even recommends adding them as their own seat, so they have access to what they need and nothing else.
- The CRM. A separate user lets you choose their role and see their activity. Choose the role their work needs, not the admin role.
- Files. Set up a shared Google Drive where your assistant lives and works. The rest of your company drive stays private.
- Email, split by who it needs. Even's approach: "For email, you keep the client emails that need you, and your assistant takes the rest: scheduling, follow ups, meeting notes."
You may worry that clients will feel the difference. The fix is the way your assistant learns the work. In Even's words: "For your CRM, your assistant follows exactly the way you already work: you walk through it together on a recorded call, and they turn it into SOPs." The full method is in our guide to writing an SOP for a virtual assistant.
How can a virtual assistant be a security risk?
Most risk comes from how access is set up, and each risk has a simple fix.
| The risk | The fix |
|---|---|
| Your email password shared in a message | Gmail delegate access, so your password is never shared |
| Logins sent in plain text | A password manager with only the logins the job needs |
| Admin rights in the CRM | A separate user with a limited role |
| The whole company drive open | One shared drive for your assistant's work |
| Bank details shared | Keep bank logins and payments with you |
| Access left open after someone leaves | The offboarding checklist below, done on their last day |
Trust starts before any access is granted, with who you hire. Our guide on how to vet a virtual assistant shows how Skale Bak screens and meets every candidate.
Do virtual assistants sign an NDA?
Yes. Every Skale Bak assistant works under a confidentiality agreement signed directly with you. Your assistant works from the Philippines, under Philippine law, including the Data Privacy Act of 2012, as our privacy policy sets out.
The NDA is part of the handover. As how it works explains, the access, the tools, the NDA and the way you work are all set up so your assistant is doing real work in their first week. You can remove any access at any time, for any reason.
What should I do when a virtual assistant leaves?
Remove every piece of access on their last day, in this order:
- Email. Delete them as a Gmail delegate (Settings, Accounts and Import, Grant access to your account).
- Passwords. Remove them from your password manager, then change the passwords they used.
- CRM. Remove their user or seat.
- Files. Remove them from the shared drive. Their work stays in the drive for whoever comes next.
- Everything else. Check any other tool they used, such as your project management tool, and remove them there too.
Keep this list in your SOPs so it happens the same way every time.
Does trust grow over time?
Yes, and that is what makes the careful start worth it. Start with the access the first jobs need, then add more as your assistant proves themselves.
Even puts it this way: "The longer you work with an assistant, the deeper the relationship gets. They understand your business better, they can handle more, and you trust them more. They become a true team member."
This is how Even thinks about every handover: systems first, then plug in the best talent. Safe access is one of those systems.
Where should you start this week?
Pick the first 3 jobs you want to hand over, and list the access each one needs. That list is your setup plan. The free Handover Playbook helps you choose those jobs and the order to hand them over in.
If your assistant will take your inbox and calendar, see what an executive assistant does for the full list. When you are ready, book 30 minutes to talk it through. If you go ahead, we set up the access, the tools and the NDA with you at the handover.
Questions people ask
Should my virtual assistant have access to my bank details?
No. Even Baklid: "I never recommend giving an assistant access to your bank details." Keep bank logins and payments with you, and give your assistant only the tools their work needs.
Will my clients know an assistant is replying from my inbox?
Yes, if they look. When a delegate sends a message from your account, Gmail shows the delegate's email address. Keep the client emails that need you, and let your assistant handle scheduling, follow ups and meeting notes.
Should I give AI access to my emails?
Only under the same rule: limited access you can remove, checked before you connect it. The safer setup is a person with delegate access who uses AI in their work. Even's view: "Think of an assistant who is enhanced by AI. That is the combination you want."