Account ownership and access when you work with an agency

The rule fits in one sentence: social media account ownership stays with the brand, and the agency only ever receives access, revocable and granted to named people. The brand owns its accounts, its professional management workspace and its ad account, and everything else follows from that.

This is what stops a change of agency, or one person leaving, from costing a brand its history, its content and its audiences. This article sets out the three permission levels to separate, how to treat content and data, and the exit checklist to agree on signature day rather than on the way out.

What social media account governance actually covers

Social media account and access governance is the set of rules that decide who owns a social asset, who can act on it, at what permission level and for how long. It is not an IT security topic, it is a brand asset topic.

The assets involved go well beyond the visible accounts: the professional management workspace, one or more ad accounts, the tracking identifier installed on the website, audiences built up across campaigns, and the source files behind the content.

Ownership of each one comes down to a single test: if the relationship ends tomorrow morning, who keeps control without needing the other side to agree? If the answer is not the brand, the asset sits in the wrong place.

The problem almost always surfaces at the same moment, the end of a relationship: moving from one social media agency to another is largely decided by choices made much earlier.

The default rule: the brand owns its accounts, the agency gets access

The right setup is always the same. Brand accounts, the professional management workspace, the ad account and the payment method sit under the brand's own legal entity, and the agency is added as a partner with the permissions its work requires and nothing more.

There is nothing adversarial about this. The agency simply has no reason to hold an asset that does not belong to it.

Accounts opened by the agency deserve particular attention. An account created by the provider because it was faster at kick-off stays attached to the provider's entity, and moving it later takes a deliberate action on their side.

Better to open these assets from the brand on day one, or schedule the transfer within the first few weeks. This belongs in the social media agency contract and in the social media agency brief you send to the agencies you shortlist.

Owner, admin, working access: three levels

A permission level describes what a person can do to an asset and, more importantly, what they can do to everyone else's access. That second dimension is the one that matters and the one nobody checks. Three levels are enough:

• Ownership: the asset's attachment to a legal entity. It is not shared, and it stays with the brand.
• Administration: the ability to add, change and remove access. At least two people on the brand side, never a provider by default.
• Working access: publishing, scheduling, replying to messages, running campaigns, reading the data. This is the right level for an agency in almost every case.

Two internal admins is not distrust, it is continuity: one unplanned absence should never lock a company out of its own accounts. And because interfaces keep changing, think in permission levels rather than menu names. The wording moves, the logic does not.

Named access to social media accounts, and authentication that holds up

Named access means access tied to an identified person with their own work login, not a shared generic account that several people take turns using. It is the only way to know who did what, and the only way to remove one person without disrupting everyone else.

The shared generic login is the most common weakness: it travels by message, it survives departures, and it makes two-factor authentication unworkable. Three rules cover most of it:

• Credentials that genuinely have to be shared live in a company password manager, never in a message thread.
• Two-factor authentication is on everywhere, with the second factor held brand side for owner and admin levels.
• Access is reviewed on a fixed date, quarterly for instance, and a review means removing, not noting.

Removal happens the day someone leaves, not the following week, internally and on the agency side alike.

Content, source files and creator usage rights

Content ownership is settled in the contract, not in the platform settings. Delivered content does not automatically belong to the brand: the rights assignment clauses decide what it can do with it and for how long.

For agency-produced content, the real question is handover of the source files: edit projects, rushes, open design files, fonts and their licences. Without them, the brand holds exports it can no longer change.

Creator content follows a different logic. The creator remains the author of their video, and the brand buys a usage licence limited in time and territory, with or without paid reuse.

Those expiry dates need to be known by the brand, not only by the agency that negotiated them. An inventory listing each piece, its creator, the term and the approved placements prevents a campaign from running content whose rights have lapsed. It is standard practice among the influencer marketing agencies working in France.

Performance data, history and the ad tracking identifier

Performance data is an asset in the same way accounts are: it is the only record of what worked. A brand that starts from scratch at every handover reruns the same tests.

Three things need securing. The ad tracking identifier installed on the website belongs to the brand, since it sits on its pages and is fed by its visitors, and it should never live inside a provider's workspace. Audiences built from those signals follow the same reasoning.

Finally, reporting exports belong in a space the brand owns, updated as you go rather than rebuilt in a rush during a handover: a social media dashboard kept on the brand side solves this with no extra effort.

Personal data collected through forms, prize draws or inboxes follows the same principle and makes the brand the data controller. Sharing it with a provider has to be framed, limited to what is needed and cut off when the engagement ends.

Reversibility is set up on signature day

Reversibility is a brand's ability to take back control of its assets without depending on its provider. It gets prepared while things are going well, because once a separation starts, priorities shift and time runs short.

The checklist to lock in at signature is short:

• The named list of granted access, kept current brand side.
• Written confirmation that every asset is held by the brand.
• The format and deadline for source file handover.
• Where data exports are stored.
• An inventory of creator contracts and their expiry dates.
• The wind-down period at the end of the engagement.

How an agency answers these questions during a pitch says a lot about how it works. At Sleeq, a creative social and influence agency, this frame is set at kick-off rather than improvised at the end.

There is a cost to this control: a little operational friction. Named access slows the first days, and keeping administration brand side means someone internally has to be available to grant access.

A brand that refuses all friction ends up handing over ownership of its asset to save a few days, which is a poor trade. The workable balance is to make the friction predictable, with a named contact, an announced turnaround for access requests and a review already in the calendar. To frame this before you run a pitch, you can contact our social media agency.

Frequently asked questions

Who owns social media accounts managed by an agency?

The accounts should belong to the brand, attached to its legal entity through a professional management workspace. The agency receives revocable working access granted to named individuals. If an account was opened by the provider at kick-off, arrange the transfer within the first few weeks and confirm it in writing rather than waiting until the relationship ends.

How do you get your accounts back after an agency leaves?

If the brand owns its management workspace, you simply end the partnership link and remove the access you granted, without asking anyone. If the assets sit with the agency, recovering them depends on its cooperation, because only it can initiate the transfer. Avoiding that dependency is exactly why ownership is framed at signature.

Should you give your agency the account passwords?

No. Sharing a password grants anonymous access that cannot be traced and is hard to remove cleanly. The right setup is to invite the agency's people from the professional management workspace, each with their own login and the permission level their work needs. A departure is then handled with a single removal.

What permission level should an agency get?

Working access covers almost every case: publishing, scheduling, replying to messages, running campaigns and reading the data. Administration rights, which allow adding and removing other people's access, stay brand side and in the hands of at least two people. Ownership of the workspace itself is never delegated to a provider, not even temporarily.

What happens to agency-produced content when the contract ends?

It depends on the rights assignment clauses in the contract. A broad assignment lets the brand keep running and editing the content after the engagement. Add an obligation to hand over source files in a workable format, otherwise the brand is left with exports it cannot adapt. Creator content follows separate, time-limited terms.

How often should social media access be reviewed?

A quarterly review covers most needs: list the access that exists, remove anything no longer tied to live work, and confirm the brand still has two active admins. Between reviews, removal should be immediate whenever someone leaves, internally or on the agency side. A review that ends without any removals has not achieved anything.

Key takeaways

• Social media account ownership stays with the brand: its accounts, its management workspace, its ad account and its tracking identifier. The agency gets access, never ownership.
• Three levels are enough: ownership stays with the brand, administration sits with two internal people, the agency holds working access.
• Access is named, protected by two-factor authentication, reviewed on a fixed date and removed the day someone leaves.
• Content ownership is settled in the contract, with source file handover, and creator licences carry expiry dates to track.
• The reversibility checklist is locked in at signature, and that control is paid for with a little accepted friction.