.avif)
.avif)
Handing a remote assistant your inbox, calendar and finance tools is the moment most founders hesitate. The worry is reasonable, but the fix is not to keep everything to yourself. It is to set up access the way security agencies recommend for any staff member or vendor, wherever they sit. This checklist covers what to do, in what order, and what to ask a provider.
The Short Answer
Security for an offshore hire is the same discipline as for anyone else with access to your systems, applied deliberately from the first day:
- Least privilege: grant only the access the role needs, and only for as long as it needs it.
- No shared passwords: use delegation in Gmail, Outlook and your calendar, and a named login of the assistant’s own in every other tool that offers one.
- Strong MFA on every account the assistant touches, phishing-resistant where possible.
- A contract that covers confidentiality and security, plus a vetting process you understand.
- Industry rules checked up front if you handle tax, financial or health data.
- An offboarding list kept current from day one.
The rest of this guide explains each step. If you are earlier in the process, start with how to vet a remote executive assistant.
Where the Risk Really Is
The data points to people and partners, not distance. Verizon’s 2026 Data Breach Investigations Report, which analyzed more than 22,000 confirmed breaches, found:
- A human element in 62% of breaches, up from 60% the year before.
- Third-party involvement in 48% of breaches, up 60% on the previous year.
- Social engineering accounted for roughly one in six breaches, and phishing was the way in for 16%.
- Exploited software flaws were the most common way in (31%), which is a reason to keep devices and software patched too.
IBM’s 2026 Cost of a Data Breach study put the global average cost of a breach at $4.99 million, a record high.
None of this is specific to offshore work. A contractor in Ohio with your password is as exposed as one in Colombo. What matters is how access is granted, protected and removed. The good news is that the tools to do this well are already built into the software most small companies use.
Share Access, Not Passwords
The single biggest improvement most founders can make is to stop sharing passwords. Each of the main tools has a built-in way to give an assistant access in their own name.
| Access | Safer way to share | Why |
|---|---|---|
| Gmail | Mail delegation | Assistant can’t change your password |
| Google Calendar | Share with “Make changes and see event details” | Easy to remove |
| Outlook / Microsoft 365 | Delegate access or Send on Behalf | Recipients see who sent it |
| Other logins | Own named login; a password manager shared vault only where a tool has one shared login | Access can be revoked per person; rotate shared logins when they leave |
| Finance tools | Own user with limited role | Most tools log activity per user |
Email and Calendar
Gmail’s mail delegation lets an assistant read, send and delete email for you; messages they send show their own address, and they cannot change your password or reach your Google Account settings. You can remove a delegate in Gmail’s settings at any time. Google Calendar sharing has separate levels, from “See only free/busy” up to “Make changes and manage sharing”. Choose “Make changes and see event details” so an assistant can manage your schedule without being able to share your calendar with anyone else.
Microsoft 365 offers the same idea: delegate access lets an assistant respond to email and meeting requests on your behalf, and Send on Behalf shows recipients that the assistant sent the message for you.
Everything Else
For tools without delegation, give the assistant their own named user wherever the tool allows one. For finance tools such as QuickBooks, Ramp or your bank, add them with the narrowest role that does the job, so most tools can log each action against a named person and you can remove that one user when the work ends.
Where a tool only has one shared login, keep it in a password manager’s shared vault rather than sending it by email or chat: a manager can grant or revoke vault access per person. Treat any shared credential as known to the assistant, and change it when the engagement ends.
Multi-Factor Authentication
Turn on MFA for every account the assistant uses. CISA ranks phishing-resistant methods (FIDO2/WebAuthn security keys and passkeys) as the strongest form of MFA and text-message codes as the weakest, and NIST’s current digital identity guidelines (SP 800-63B-4, 2025) name WebAuthn as phishing-resistant and treat text-message codes as a restricted method. Codes by text are worth replacing where possible. CISA’s advice for small businesses is to start with admin accounts and the people who handle sensitive data.
Contracts and Vetting
Access controls work best alongside two non-technical safeguards.
- A written agreement. The FTC’s guidance for small businesses is to put security provisions into vendor contracts and to limit access to a need-to-know basis, only for the time the vendor needs it. Whether you hire through a provider or directly, the agreement should cover confidentiality, acceptable use of your data, and what happens to it when the engagement ends.
- A vetting process you understand. Ask how candidates are screened, whether background checks are run, and who is responsible for the person day to day. Oceans, for example, runs verified background checks as part of its hiring process, described on how we hire.
Clear onboarding helps too: a short written policy on which devices and networks may be used for work, where files are stored, and how to report a suspicious email. Our remote onboarding playbook covers everything from pre-boarding to the 90-day review.
Compliance Rules to Check
For most companies, no industry rule stands in the way of giving an assistant access to email and calendars. Some industries do carry extra obligations, and they apply to the work, wherever the person is based.
- FTC Safeguards Rule (financial firms). It covers non-bank financial institutions such as tax preparation firms, mortgage brokers and finance companies. It requires a written information security program, MFA for anyone accessing customer information, and oversight of service providers.
- IRS Publication 4557 (tax professionals). The IRS guide to safeguarding taxpayer data reminds tax preparers that, under the Safeguards Rule, they need a written information security plan, and that MFA for anyone accessing customer information is required regardless of size.
- HIPAA (health data). If an assistant’s provider (or a contractor you engage directly) will create, receive, maintain or transmit protected health information on your behalf, HHS generally treats them as a business associate, which requires a business associate agreement. Members of your own workforce are not business associates.
- SOC 2 and ISO/IEC 27001 (provider assurance). SOC 2 is an AICPA attestation report on a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy. ISO/IEC 27001 sets the requirements for an information security management system, and organizations can be certified against it by an accredited auditor. Clients sometimes ask providers for one or the other.
Sri Lanka has its own data protection law, the Personal Data Protection Act, No. 9 of 2022. For the wider picture of employing people there, see outsourcing to Sri Lanka. If your industry is regulated, confirm your obligations with your own counsel before granting access.
Offboarding: Plan It on Day One
Access that outlives the job is an easy gap to miss. Keep a simple access register from the first day: every account, vault, shared drive and tool the person can reach, with the date it was granted. When the engagement ends:
- Remove mail and calendar delegation and calendar sharing.
- Suspend or remove the person from your password manager, and change any passwords and tokens that were shared with them. 1Password’s offboarding guidance recommends exactly this.
- Remove their user from finance tools, CRMs and project tools, and transfer ownership of any files they created.
- Revoke any devices, VPN profiles or API keys issued to them.
With a register, this can be done the same day. Without one, it means piecing it together from memory.
Questions to Ask a Provider
Before you sign with any offshore or remote staffing provider, ask:
- How are candidates vetted, and are background checks part of it?
- What confidentiality and security terms are in the contract, for the provider and for the individual?
- Which security measures do you run on your own systems, and can you show evidence of them in writing?
- Do you hold a SOC 2 report or ISO/IEC 27001 certification, and if not, what can you share instead?
- Who is responsible for the person’s equipment and working environment?
- How quickly can access be removed if the engagement ends, and who does it?
A provider that answers these clearly, in writing, is easier to trust with your inbox. For the wider decision, see how to manage offshore teams and what an offshore executive assistant does, or hire an executive assistant with Oceans.
Frequently Asked Questions
Is it safe to give an offshore assistant access to my email?
It can be, if access is set up properly. Use Gmail mail delegation or Microsoft 365 delegate access instead of sharing your password, turn on multi-factor authentication, and keep a list of everything the assistant can reach so it can be removed quickly.
How do I share passwords with a remote assistant securely?
Avoid sharing them where you can: give the assistant their own named login or delegated access. When a tool only has one shared login, keep it in a password manager’s shared vault rather than email or chat, treat it as known to the assistant, and change it when the engagement ends.
Which type of multi-factor authentication is safest?
CISA ranks FIDO2/WebAuthn methods, such as security keys and passkeys, as phishing-resistant and the strongest option, and codes sent by text message as the weakest. NIST treats text-message codes as a restricted method. Replace them where something stronger is available.
Do compliance rules apply if my assistant is based overseas?
Yes. Rules such as the FTC Safeguards Rule, HIPAA and the IRS data safeguarding requirements apply to the data and the work, wherever the person is based. Tax, financial and health businesses should confirm their obligations before granting access.
What should happen when a remote assistant leaves?
Remove email and calendar delegation, suspend them from the password manager, change any passwords and tokens they could see, remove their user from every tool, and revoke devices and keys. An access register kept from day one makes this quick.
Sources and Methodology
All sources read November 3, 2026. This article is general guidance, not legal advice.
- Verizon, 2026 Data Breach Investigations Report, executive summary: 22,000+ breaches, human element 62%, third-party involvement 48%, phishing 16%.
- IBM, Cost of a Data Breach Report 2026: global average $4.99 million.
- NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication, August 2025.
- CISA, Implementing Phishing-Resistant MFA, October 2022, and Require Multifactor Authentication for small businesses.
- NIST CSRC glossary, least privilege (from SP 800-53 Rev. 5).
- FTC, Cybersecurity for Small Business and FTC Safeguards Rule: What Your Business Needs to Know.
- IRS, Publication 4557, Safeguarding Taxpayer Data.
- HHS, Business Associates.
- AICPA, SOC 2 examination guide; ISO, ISO/IEC 27001.
- Google, Gmail delegation and Calendar sharing; Microsoft, delegate access in Outlook and Exchange Online recipient permissions (Send on Behalf); 1Password, shared vaults and offboarding.
- Oceans, how we hire.
