An agency can help. You should stay in control.

In the thread “Personal assistant suggestions? Agency is sketchy as hell”, the author describes concern about requests for documents and exclusive access to payment accounts. In a separate discussion, “Agency stole my account, need help”, another person reports losing account access and being unable to contact the agency. We cannot verify these allegations; they do, however, show which questions are worth asking before working together.

These accounts do not mean every agency operates in the same way. They show the need to assess procedures rather than image alone. A professional presentation, a large following and a conversation with a friendly account manager do not replace a clearly defined scope of permissions. Start with what the other party will actually do on your account.

If you need a publishing calendar, do not start by handing over the entire account. List the tasks: strategy, editing, publishing, analysis and messages. For each, add who is responsible, how approval works and what information is needed. This makes it clear which data are necessary and which someone is requesting purely for convenience.

Hypothetical example: the partnership covers content analysis. Initially, selected statistics and content are enough, without billing details or private conversations. Only an expanded service may require permissions to be agreed again. Do not assume every platform offers team roles; check its current rules and available options before granting access.

Ask for a description of a specific first week. Who will receive the content? Where will you put it? Who will approve the caption? This conversation quickly reveals the difference between an established process and improvisation.

Check who controls the email linked to the account, the phone number and recovery methods. This should not be left until the end of onboarding. Keep your own access and do not rely solely on an agency staff member's device to log in. Agree on who can change settings and how you will be notified.

Enable two-factor authentication where available, especially for your email. NCSC explains that an additional verification step makes access harder for someone who knows your password. It does not provide complete protection: who you grant permissions to and whether you can revoke them are just as important.

Use unique passwords and keep recovery codes in a safe place under your control. Do not send one-time codes to anyone whose identity and purpose you have not verified. The team's working methods should accommodate safeguards, rather than rely on turning them off.

Ask for a sample statement using fictional data before signing a contract. You should be able to follow the calculation from its starting basis to the agency's fee: what counts as revenue and how platform fees, refunds, currency conversions and additional costs are accounted for. Also agree on the billing period and when the report will be provided.

Do not assume that quoting a commission percentage alone explains the cost of working together. Two identical percentages can mean different amounts if they are calculated on different bases. Agree separately on the promotion budget and its approval process. You should know who can authorize an expense and how they will document it.

A demand for exclusive control over the payout account is a reason to pause granting access and clarify the situation. Ask for an arrangement in which you can independently check the source data and pay for the service under clearly described terms.

Write down what content you can create, what you do not accept and which posts require your consent every time. Include captions, editing, promotional content and replies sent as part of the service. Approval of one shoot should not be treated as blanket permission for any modification or publication on a new channel.

Ask where files are stored, who downloads them and whether subcontractors receive access. Agree on a procedure for deleting copies when the partnership ends and how completion will be confirmed. Full anonymity cannot be guaranteed for content published online; good organization reduces risk but does not eliminate it.

If you are asked for an identity document, require an explanation of the purpose, recipient, transfer method and retention period. Verification required by a platform and sending a scan through an arbitrary messaging app are different situations. Do not replace these explanations with trust in a company logo alone.

A good checklist for ending the partnership includes the last publication date, content handover, final report, settlement and revocation of permissions. Also check scheduling tools, storage drives, inboxes and active sessions. Ending the contract alone does not automatically log out every device.

If you lose access or see an unauthorized change, preserve the evidence you have and contact the platform's official support. Use its recovery procedures and describe the situation truthfully. Do not pay unverified people who promise to recover or block an account using a “special method”.

You can bring this list of questions to a conversation with an agency. Assess whether the proposed help solves your problem and whether you still understand what is happening on your account. Working together should simplify your work, rather than make you dependent on one person with access to everything.