Showjuniperfizz
Step 03 · Contracts

Passwords, NDAs and Scope

Trust is the product a virtual assistant really sells. Paperwork and access habits are how you prove it before you've touched a single email.

A signed paper contract and fountain pen on a dark desk, half in shadow, half in warm lamplight

The agreement comes before the inbox

Never start work, even a "quick trial week", without a signed agreement. It's not about distrust. It's the document you'll both look at when a question comes up in month four, and it shows the client you run a real business. Have a solicitor or lawyer in your country review your template once; it's one of the best early investments you can make.

Use the checklist below as a starting point when you draft or review your contract. It isn't legal advice, and the right wording depends on where you and your client are based.

  • Parties and status. Your business name, the client's, and a clause confirming you're an independent contractor, not an employee.
  • Written scope. The exact services included, response times and working hours. Anything else is quoted separately.
  • Fees and payment terms. Rate or package price, invoice dates, payment window, late-payment terms and what happens to unused hours.
  • Confidentiality. A clause or separate NDA covering client data, business information and how long the obligation lasts after the contract ends.
  • Data protection. Where personal data is involved, your role under rules such as the UK GDPR or EU GDPR, often set out in a data processing agreement.
  • Access and security. How you'll receive access, which tools store credentials, and how access is removed at the end.
  • Notice and termination. How either side ends the arrangement, and the notice period, commonly 30 days for retainers.
  • Liability. A sensible cap on liability and a note that the client approves anything sent or paid in their name.

Access without handing over passwords

Delegated access

Gmail and Google Calendar support delegation, and Microsoft 365 lets owners grant mailbox and calendar permissions. You work inside your own login; the client can revoke it in a click.

Shared vaults

Where delegation isn't possible, use a password manager such as 1Password or Bitwarden. The client shares a vault; you never see a password in an email or chat thread.

Two-factor plans

Agree how two-factor codes reach you before you need one at 9 pm. Many password managers can store authenticator codes inside a shared vault.

Keeping scope honest

Scope creep rarely arrives as a big request. It arrives as "while you're in there, could you just…". One small favour is good service. Ten small favours a month is unpaid work and an unclear contract. When something new comes up, reply warmly and specifically: "Happy to help with the newsletter. It's outside our current package, so I'll send a quick quote for it today." Clients respect this far more than they resent it.

Keep a simple change log in the client's shared folder. When a task is added permanently, update the scope in writing and adjust the package price.

Your own security habits

Use a separate browser profile for each client, lock your screen when you leave the desk, keep your operating system updated and turn on full-disk encryption. Don't work on client accounts over open café Wi-Fi without a trusted connection. If you ever suspect a breach, tell the client the same day; how you handle a mistake matters more than the mistake.

Offboarding cleanly

Every client relationship ends eventually. Keep an access log listing each account, the type of access and the date it was granted. At the end, hand over any documents and SOPs, ask the client to remove your delegation and vault access, confirm in writing that it's done, and delete local copies of their data. A tidy exit is often what earns the referral.

Next: Systems