# A social media account access audit, every quarter > A social media account access audit is two lists per client: who the platform says has access, and which of your profiles hold a login. Each gap is a finding. Source: https://mosaicbrowser.com/blog/quarterly-access-audit ## A quarterly check of who can reach each client account A social media account access audit is two lists per client: who the platform says has access, and which of your profiles hold a login. Each gap is a finding. ![Two lists per client, and every difference, beside a screenshot: mosaic projects: one library split into Client work, Etsy shops and Social team](https://mosaicbrowser.com/covers/quarterly-access-audit.webp) A social media account access audit comes down to two lists for every client, compared once a quarter. The first is the platform's: the people and partners Meta, Google or TikTok say can reach the client's accounts. The second is yours: the browser profiles and stored logins your agency keeps for that client. Every difference between the two is a finding, and the audit is finished when each one is fixed or written down. In Mosaic, your side of the list is the profiles in each client's project. The method works with any setup that keeps one client's sign-ins together. ## Why access drifts between audits Access is added in a hurry and removed by nobody. A freelancer gets added to an ad account for a launch. A partner agency is given a dataset for one campaign. Somebody signs in to a client's Instagram on a spare profile to fix a caption. None of it is wrong at the time, and none of it has an end date. Offboarding catches some of it, the contract ending and the handover ([what to do with a client's profile when the contract ends](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles) is that checklist). The quarterly pass is for everything that never got an offboarding: the person who moved to another client, the partner whose campaign finished, the login that outlived its reason. Mosaic is a desktop app Email yourself the link and open it on your computer. How it works: Logins and 2FA codes ## The platform's list, per client Read it from the platform, never from your own notes, because your notes are the thing being checked. On Meta, open the client's business portfolio settings. The people list shows every person with access and to what; the partners list shows other business portfolios, often agencies, that were given assets. Then open each asset, the Page, the ad account, the dataset, because an asset can carry access the portfolio overview does not make obvious. Meta renames these screens now and then, so look for people and partners rather than a menu path. Partner access is the model to want here, because it moves no password ([sharing a pixel with an agency](https://mosaicbrowser.com/blog/share-a-pixel-not-a-login) walks through it). On Google Ads, open the account's access and security page. It lists users and their access levels, and the manager accounts linked above the account. A manager account you do not recognise is the first thing to ask the client about. For each client, write one row per person or partner: who, what asset, what level of access, and whether your agency added them. ## Your list, per client In Mosaic that is one project per client. For each project, write down: 1. Every profile in it, by name, and who on the team uses it. 2. For each profile, the logins Mosaic holds for it. The profile editor shows the vault, with any two-factor codes, and beside it the logins Chromium itself saved, which can be more than anybody typed into the vault. 3. Every profile for this client that is in the trash. Trash keeps a profile for 30 days by default, cookies included, so a profile trashed last week still holds a signed-in session. 4. Every API key that can drive profiles, from the REST API page. A script with a key can open any profile, so a key belongs on the list as surely as a person does. A project is the client and a tag is the state, which keeps this list short to read ([projects for owners, tags for states](https://mosaicbrowser.com/blog/projects-owners-tags-state) has the scheme). ## Reading the two lists of a social media account access audit Most findings fall into four shapes: - A person or partner the platform shows and your records do not. Ask the client before removing anything; it may be their own staff. - A profile on your side with a login for a client you no longer serve. Hand over what only that profile holds, then trash it by name. - A two-factor method that belongs to somebody who has left. A setup key in a departed person's phone app is access that survives every password change. Enrol a new authenticator with its setup key in the profile's vault, then remove the old method on the platform. - A login on your side that the platform does not explain. The person whose credentials those are should be on the platform's list. If they are not, the login is a shared password, and it is the finding to fix first, because it is the one nothing on the platform can revoke ([the shared password spreadsheet](https://mosaicbrowser.com/blog/shared-password-spreadsheet) covers what replaces it). Write each finding down with the client's name and the date, even the ones you fix on the spot. The next quarter's audit starts from that page. ## What the audit does not cover Mosaic keeps each client's profiles apart on your computer. It does not change who a platform lets in; that list is the client's and the platform's, and only they can change it. The audit is a way to keep your list and theirs telling the same story. ## Questions ### How often should an agency audit access to client social media accounts? Once a quarter is a rhythm most agencies can keep, plus once whenever somebody leaves or a client ends. The quarterly pass catches the access nobody removed at the time. ### Where do I see who has access to a client's Meta assets? In the client's business portfolio settings, under people and under partners, and per asset on each Page, ad account and dataset. Meta renames these menus from time to time, so look for the people and partners lists rather than an exact label. ### Where do I see who has access to a Google Ads account? In the account's admin area, on the access and security page. It lists users with their access level and the manager accounts linked above the account. ### What counts as a finding in an access audit? Any difference between the two lists: a person or partner the platform shows that your records do not, a profile on your side holding a login for a client you no longer serve, or a two-factor method tied to someone who has left. ## Related [What to do with a client's browser profile when the contract ends](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles): Agency client offboarding goes wrong when access is revoked before the client can sign in. Confirm the handover, export, then trash the profile by id. [The shared password spreadsheet, and what replaces it](https://mosaicbrowser.com/blog/shared-password-spreadsheet): A spreadsheet of client logins breaks two-factor sign-in and leaves nothing to revoke. Partner access first, then one vault per login with its code. [Share the dataset, not the login: Meta's partner model](https://mosaicbrowser.com/blog/share-a-pixel-not-a-login): To share a Facebook pixel with an agency, the client adds the agency's business portfolio as a partner on the dataset. No password moves hands. [Projects say who owns it, tags say what state it's in](https://mosaicbrowser.com/blog/projects-owners-tags-state): How to organize client accounts with tags: the client goes in a project, the state in a tag. Owners rarely change; states change weekly. [How to manage multiple accounts without getting them linked](https://mosaicbrowser.com/guides/how-to-manage-multiple-accounts-without-getting-linked): Accounts get linked by shared cookies, IPs, fingerprints and habits. Give each its own profile, exit and history, then test it before you trust it.  [TikTok One for agencies: creator access without logins](https://mosaicbrowser.com/blog/tiktok-creator-marketplace-agencies): TikTok One, the old Creator Marketplace, lets an agency run a creator's post as a Spark Ad from its own ad account. The creator approves; no password. [How TikTok decides your Business Center ad account limit](https://mosaicbrowser.com/blog/tiktok-business-center-ad-account-limit): TikTok's Business Center ad account limit is a default set per Business Center type, raised through TikTok. Spend moves a different limit: ad groups. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.