How to Secure Accounts When Operations Staff Leave: Store Account Handover, Cross-Border E-Commerce Permission Handover, and Store Permission Checklist in Practice

The risk in an offboarding handover isn't the password, but the three channels left open.

When operations hands back the main account password, the handover is not complete.

A common situation is: two weeks later, someone discovers that the sub-account can still log in to the backend, the ERP API key is still registered under the departed colleague's name, and the browser Profile and proxy IP he used before leaving are being used by a new colleague to log in to other stores.

The password is only one entrance to the main account. To truly shut down access, you must close off all three lines at the same time:Permission layer(platform official roles, sub-accounts, ad accounts, ERP and logistics authorizations, payment and collection binding),Environment layer(browser profile, proxy IP, login devices, cookies, and local storage),Audit trail layer(who reclaimed what and when, who reviewed it, and where screenshots are stored).

The handling order also comes from this framework: the closer the things a permission can change are to money and to the principal, the earlier they are handled.

The following is organized into three periods: before the handover, on the day of the handover, and after the handover.

48 hours before the handover: freezing sequence and records that must be exported

Freezing does not mean deletion. Freezing first turns 'can modify' into 'view only'; deletion is left until after all data has been exported.

1. Payments and collections: Freeze the permissions for withdrawals, rebinding receiving accounts, and modifying bank information. Once such actions occur, the cost of recovering afterward is the highest.
2. Main account: Change the password, and check whether any bound email address or phone number belongs to an individual.
3. Ad account: Suspend their ad operation permissions, but do not delete the account—campaign history, pixel, and audience data must be left for the successor.
4. ERP and logistics authorization: Flag the corresponding API key and authorization entries, and prepare for replacement.
5. Sub-accounts: List all sub-accounts, rather than handling only the most frequently used one.
6. Email and mobile phone number: Verify whether the platform notification email and the number for receiving verification codes point to an individual.

The export is carried out in parallel with the freeze.

Export as much as possible from what can be exported in the platform backend: order and settlement records, ad structure and spend, customer service conversations and open tickets, accessible login records, and lists of supplier and logistics contacts. The purpose of the export is not to keep records for HR, but to ensure the person taking over does not have to rely on the departing employee's memory to reconstruct business context.

Store permission checklist: one line per 'store + account + environment + responsible person'

For teams spanning three or more platforms, a handover based on memory is bound to miss things. The checklist granularity is one line corresponding to one 'store—account' combination; the main account and sub-accounts of the same store each take one line.

The most commonly overlooked column isEnvironment ID, which records which browser Profile this account normally uses and which proxy exit it logs in through.

Sharing an environment does not immediately cause problems by itself, but it makes subsequent anomaly alerts difficult to pinpoint—when you receive a review or restriction notice, you cannot determine which login of which account caused it.

When a platform investigates account relationships, it also usually does not rely on a single signal; instead, it looks at the degree of overlap across several layers of variables—network exit, device and browser fingerprint, identity and funding information, and operation traces. The specific reason is subject to the account notification and the platform's official explanation.

The method for writing permission groups can directly follow existing practices,Shopify multi-store management grouping, permissions, and isolation checklistThe three tables provided also apply to independent site teams.

The permission list has one 'store-account' combination per row, with main accounts and sub-accounts recorded separately.

Handover day: the order for revoking main accounts, sub-accounts, and third-party authorizations

The actions on handover day follow the same order as freezing; the difference is that freezing only changes status, while on this day identities must truly be removed.

1. Payments and Collections: Update the contact information for the collection account, or at least remove its operating permissions; confirm that the payee is the company rather than an individual.
2. Main account: After changing the password, immediately log in once with the new password to see whether old sessions are invalidated; switch the bound email to the company email and complete verification.
3. Ad account: In the ad platform's member management, remove their user identity; do not rely only on changing the password.
4. ERP and Logistics: Invalidate the old API key, generate a new key to hand over to the successor, and then confirm that order synchronization is still working properly.
5. Sub-accounts: Disable them one by one, refresh the member list, and take a screenshot. Amazon's user permission hierarchy, TikTok Shop's store roles, and Shopify's staff permission scopes must be checked item by item, rather than only checking whether the accounts are still in the list.
6. Content and Customer Service Platforms: Creator collaboration backends, social media accounts, and shared agent seats in customer service tools.

Multi-collaborator teams are most likely to make mistakes here: they only change the password and leave the member list untouched.Environment isolation, login permissions, and handover processes for TikTok Shop teams with multiple accountsIt provides the fields for assigning permissions by official role, so you can use them to check your own member list.

Special Items for Cross-Border Permission Handover

• KYC Entity and Contact Person: When the entity belongs to a company, the contact person and verification email must be switched to company resources; if it belongs to an individual, the change must be completed before the handover, rather than waiting until the day of departure.
• Payout accounts ：Confirm three things separately: the account name, the person it is bound to, and who can modify the account. Being able to log in to the backend does not mean being able to change payout settings.
• VAT and tax agents ：The agent's contact email and login access to the filing system are often tied to a particular operations person's personal email.
• Brand registry ：Ownership of the brand-registered account and authorization management — who can operate the brand tools.
• Ad BM and advertisers ：Ownership and operating rights for ad accounts are separate; before removing a member, first confirm that another admin is still in place.
• Creator collaborations and content licensing ：Sample shipment records, the list of creators currently collaborating, and store authorizations bound to personal social media accounts.
• Shopify Payments and ERP API key ：These kinds of authorizations are often never looked at again after they are generated; during handover, re-verify their validity period and who is using them.

These items share one common rule:Add the new administrator first, then remove the old member. Ownership transfer and member removal are not the same action; if you remove first, you may lose the only admin entry point along with it, and the account will briefly be left unmanaged.

7 days after handover: verify whether permissions are actually revoked

Completing the revocation action does not mean it takes effect. On some platforms, permission changes only refresh after re-login; some third-party authorizations retain access for a period after being removed in the backend, and some will continue to be called by automated tools. The verification order within seven days is as follows.

1. Login and operation records: Check whether there are still logins from that identity, that email, or that device, as well as actions such as price changes, inventory changes, and withdrawals.
2. Sub-account list: Reopen the member list and compare it line by line with the screenshot from the handover day; do not rely on impressions.
3. API and authorizations: In the authorization lists of the ERP, logistics, and advertising backends, confirm that the old key is no longer valid.
4. Browser profiles and proxies: Confirm whether the Profile used by the departing employee has been deactivated, rebuilt, or transferred to a new person. If it has been transferred to a new person, confirm that it is only responsible for the original store.
5. Device and local remnants: On the computer used by the departing employee, are there still saved login sessions, exported spreadsheets, and locally saved key files?

If any of the following situations occur, it means the deprovisioning is incomplete, and you need to go back to the previous step to complete the remaining work: there are still login or operation records after departure (first confirm that it is not an automated tool using the same account); you receive an environment anomaly or account review prompt; the payment method or receiving account is reused by another store; a sub-account shows as deleted but is still active.

Residual traces at the environment layer will not be exposed automatically and are often only uncovered when a problem occurs. You can refer toKey Points for E-commerce Multi-Account Environment IsolationCheck network egress, device fingerprints, behavioral cadence, and local storage layer by layer; when there are so many accounts that grouped management is needed,Account Grouping, Login Records, and Exception Handling Workflow for Multi-Store, Multi-Account Operationsprovides fields that can be directly reused; to determine whether a certain prompt is really related to historically shared variables, you need to go back tothe dimensions the platform examines when determining whether multiple accounts belong to the same entityfor comparison.

Completing the revocation action does not mean it has taken effect. Within seven days, verify it item by item using login records, member lists, and authorization lists.

Handover trail: a one-page confirmation form closes out responsibility

The purpose of the confirmation form is to turn “I thought it was revoked” into “someone has reviewed it.” It doesn’t need many fields, but each item must map to a piece of verifiable evidence.

• Time: freeze time, revocation time, and review time should be recorded separately.
• Store, account type, platform official role.
• Revocation items: payments and collections, main account, advertising, ERP and logistics, sub-accounts, content platforms; check each item off.
• Executor and reviewer: they cannot be the same person.
• Evidence: storage location of screenshots or exported files.
• Confirmation by both parties: the departing employee confirms that no personal bindings are left, and the responsible person confirms that permissions have been revoked.

Storage location must be written into the confirmation form itself; otherwise, no one will be able to find it after three months. It is recommended to limit viewing access to the team lead, HR, and the handover recipient; the confirmation form contains account and binding information and is not suitable for company-wide visibility.

Frequently Asked Questions

If it isn’t completed on the day of departure, can it still be completed afterward?

Permission-related actions can be added later; environment-related actions are more costly to add after the fact. If the departing person has already used a certain Profile to log in to multiple stores, the only thing you can do afterward is disable and rebuild, not roll back. Therefore, change passwords and freeze access on the day of departure if possible, and wrap up the rest within seven days.

If a small team has only two or three people, do they still need to fill in an environment ID?

Yes. When there are few people, accounts often get logged in back and forth across several people's devices, and the environment ID is the only record that shows "who operated which store in which environment." Even if you only fill in the Profile ID and the user as two columns, that is better than recording nothing.

Can a computer used by a departing employee be given directly to a new hire?

Yes, but it must be cleaned thoroughly first: delete the login states and passwords saved by the browser, clear the Cookies and local storage related to that account, and confirm that no key files or exported spreadsheets remain on the machine. If this machine was originally used to log in to multiple stores, it is safer to rebuild a separate environment rather than swap people in the old environment.

After a sub-account is deleted, will this store still be considered associated with the previous account?

Permission removal and the platform's internal determination records are not the same thing. Deleting a sub-account only removes access capability; it does not mean the historical data has been cleaned up synchronously. Determinations usually look at a combination of multiple layers of variables; for the specific criteria, refer to account notifications and the platform's official documentation.

Must the handover confirmation form be signed by both parties?

At least two signatures are required: the person executing the handover and the reviewer. The departing person's signature serves to confirm that no personal bindings are left behind, such as a personal phone number, personal email, or personal payment information; if this item is missing, it will be difficult to handle later when verification codes cannot be received or there is a dispute over fund ownership.