Lock down your accounts before you connect AI

Connecting AI to your business means connecting it to your accounts: email, calendar, files, social media, sometimes payments. Each of those connections is only as safe as the login behind it. I got serious about this after locking myself out of my own payment account, which paused every payment link I had out with clients until I got back in.

This guide is the order I'd do it in if I were starting again. It's practical advice from running a small studio, not professional security advice. If you handle sensitive data for clients, check your setup with someone qualified.

Two jobs that get confused

Two different tools do two different jobs, and most of the confusion comes from mixing them up:

• A password manager remembers what your passwords are. You keep one strong master password and it stores the rest.
• Two-step login (often called 2FA, two-factor authentication) proves it's you when you sign in, separately from the password. Usually a code on your phone, a fingerprint, or a small physical key.

Some password managers can also hold your two-step codes. That's convenient, but it means one vault holds both halves of every login. It's a trade worth knowing you're making.

Step 1: Get a password manager

Pick one and move every business login into it. I looked at 1Password and Bitwarden. Both have been independently audited and both are sound on security. I chose 1Password because it was easier to use day to day, and a tool you actually use beats a slightly better one you avoid.

While you do this, make a list of every account your business uses. That turned out to be the real problem for me, more than weak passwords. I had business things under at least five different logins and couldn't list them all from memory. One social page for a client turned out to belong to an account with no email address on it at all, only a phone number. Every search I ran by email came back empty, so as far as I could tell it didn't exist.

For each account, store three things together: the login, the recovery email or phone, and the recovery codes. A login nobody can recover isn't much use when something goes wrong.

Step 2: Turn on two-step login everywhere that matters

Start with the accounts that would hurt most if someone else got in: email first (it can reset everything else), then payments and banking, then your domain and website, then social media.

Where you're offered a passkey, take it. A passkey lets your phone's fingerprint or face unlock act as the second step, with no code to type.

Two things that caught me out:

• A password reset doesn't set up two-step login. My payment provider requires it on every account. When I reset my password, the reset worked, and I still couldn't get in because the second step was the problem. Have a backup second step set up before you need it.
• Some sites block screenshots of the setup code. You can't photograph the code with the same phone you need to scan it with. Show the code on your computer and scan it with your phone instead.

Step 3: Buy a hardware key for the important accounts

A hardware key is a small device you plug in or tap to prove it's you. There's no code for anyone to trick you into reading out or typing into a fake page. I use a YubiKey, made by a company called Yubico.

Buy it directly from the maker's own website, not from a big online marketplace. With security hardware, where it came from matters.

Set it up on your email and your payment accounts first. Register a second key as a backup and keep it somewhere safe, so losing one doesn't lock you out.

Step 4: Keep business tools out of logins you might lose

Here's a rule I now follow strictly: anything you use across your whole business shouldn't live in a login someone else controls. If you have a work email from a job, a client, or a partner company, don't sign up for your own business tools with it. When that relationship ends, the account can go with it.

I found one of my own client-facing tools sitting under a login tied to someone else's company. It was one offboarding away from disappearing, and I had to move it.

The same goes for client assets. A client's business page that hangs off one person's personal phone number is at risk if that number changes. The fix is an email address on the account and a second admin, not a better password.

Step 5: Give AI and tools only the access they need

When you connect a scheduling tool or an AI assistant to an account, it usually asks what it may reach. Read that screen. Some default to "everything". When I connected a social account to a scheduler, it offered every page I manage, including clients' pages, which makes it possible for a post to end up in the wrong account later. Tick only what that tool needs.

Then check the connections list in each account every few months and remove anything you no longer use.

What to do next

Do this before you connect your first AI tool to anything. One evening covers the password manager and your top five accounts. Do the rest over a week.

Next in this track:

• Subscription vs API key: don't get billed by surprise, before anything starts spending money on your behalf.
• Keep secrets out of your files and chats, for the passwords and keys your tools need.

If you'd like someone to look over which accounts your business depends on and which ones are exposed, ask me for the free audit. I'll point out the logins I'd fix first.