Delegate access vs. sharing a password

When we need to work inside your digital platforms (like your WordPress site, your web host, or Google Analytics), we will almost always ask you for delegate access rather than asking for your password.

Understanding the difference

Here is a simple breakdown of how the two methods compare.

✓

Delegate Access (Recommended)

You go into your account settings and click "Invite User" or "Add Collaborator." You enter our email address and choose our permission level.

Pros: Highly secure. You maintain total ownership. You can remove our access yourself, whenever you want. We use our own secure passwords and 2FA.
Cons: Takes a few minutes to find the "Invite" screen in your dashboard.

You give us the email and password you use to log in to the platform.

Pros: Can seem slightly faster in the moment.
Cons: Major security risk. Triggers 2FA codes that go to your phone, meaning we have to constantly bother you for codes to log in. If we leave, you have to remember to change your password.

Why delegate access protects your business

We operate as a strategic partner, and part of that responsibility is ensuring your business assets remain secure. Delegate access protects you in three key ways:

1. It solves the Two-Factor Authentication (2FA) problem

Most platforms now offer two-factor authentication, and any business account worth protecting has it switched on: a one-time code from an authenticator app, a text message, or an email. If we log in using your password, that code goes to you. We cannot get to work until you pass it on, which causes frustrating delays and interrupts your day. With delegate access, the codes go to our team's own secure devices.

Any two of the three count, and the second one is the whole point: someone who has stolen your password arrives at the same check you do, holding half of what it asks for.

Read this as text

Security people sort proof of identity into three kinds: something you know (your password), something you have (your phone, or a security key), and something you are (a fingerprint or face scan).

A password-only login asks for one of them. Two-factor authentication asks for two: usually your password plus a code from your phone. Supply both and the login check unlocks your account.

Now follow the attacker. Somebody who has stolen your password arrives at exactly the same check, and it asks the same two questions. They can answer the first one. They do not have your phone, so they cannot answer the second, and the check refuses them, which is why 2FA protects an account whose password is already public.

2. It restricts access appropriately

Delegate access allows you to assign "Roles." For example, you can make us a "Manager" or "Administrator" to do our work, while keeping yourself as the sole "Owner" who controls billing details and account deletion.

3. Clean and secure offboarding

When our engagement ends, you do not have to spend hours changing all of your passwords. You open the account's list of users and remove the Chykalophia user. The exact wording differs from platform to platform, but it is always a short job.

Some platforms do not support delegate access at all: older software, and a few registrars and security services that allow only one login per account. If we absolutely must use your login, we will guide you on how to share a password safely using an encrypted, self-destructing link.