← Agency Answers

Security and Governance

Agencies hold the keys to their clients' public voices, which makes access, permissions, and accountability operational essentials rather than paranoia. These answers cover secure access without password sharing, offboarding, account ownership, wrong-account prevention, SSO, and the governance practices security-conscious clients ask about.

Does an agency need SSO for social media management?

Most agencies do not need SSO, but it becomes valuable past roughly fifteen to twenty staff or when enterprise clients require it in security reviews. Cloud Campaign includes SSO on the Agency plan, so it is available when a team's identity management or a client's procurement process starts demanding it.

How do agencies keep client data separated?

Through structural separation: each client gets its own workspace containing their accounts, content, calendar, analytics, and authorized users, with no shared surfaces between clients. Cloud Campaign is built on this workspace model, so one client's data is never visible from another client's workspace.

How does 2FA work with shared social media accounts?

Two-factor authentication and shared logins conflict by design, since the code goes to one person's device. The fix is to stop sharing logins: connect client accounts to a management platform through platform authorization and give each person their own login, so 2FA protects the client's account without blocking the team.

How do you prevent posting to the wrong client account?

Use structural separation rather than care: keep every client in its own workspace so the wrong account is not selectable from the right screen. Cloud Campaign's workspace model does exactly this, isolating each client's accounts, content, and calendar, which removes the dropdown-mistake risk entirely.

How do you see who posted what on a client's social media?

Attribution comes from working inside a platform where every person has a named login and content moves through recorded approval steps, rather than from shared credentials that make everyone anonymous. The approval trail is the practical record: who drafted, who approved, and when it published.

How should agencies share client social media logins securely?

Do not share logins at all. Connect client accounts to a management platform through the networks' own authorization, then give each team member their own login to that platform. Cloud Campaign works this way: accounts connect via platform authorization, and every plan includes unlimited users so nobody needs to share credentials.

What happens to social media accounts when an employee leaves?

Remove their platform access the day they leave, before or during the exit conversation. With authorized connections, deactivating one user ends their access to every client at once, with no password changes needed. Then audit what they held directly: page roles, ad account access, and any client-side credentials.

What is social media governance?

Social media governance is the documented set of rules for who may publish, what may be published, how content is approved, and how accounts are secured. It covers roles and access, brand and legal guardrails, approval workflows, crisis escalation, and record keeping. It is the operating system beneath social activity.

What roles and permissions do agencies need in social media tools?

Agencies need at least four access levels: full administrators, publishers who can schedule and post, contributors who draft but cannot publish, and reviewers or clients who approve without operational access. The critical requirement is scoping every role per client, so access to one workspace never implies access to another.

Who owns a client's social media accounts?

The client should, always. Accounts, pages, and business manager assets belong to the client; the agency holds managed access that ends when the relationship does. Put it in writing at onboarding, create assets under the client's ownership, and never let an agency profile be the sole owner of a client's page.