Sotto

Home/Guides/Account safety

How to keep your account safe when someone else runs your DMs

Handing over your DMs shouldn't mean handing over your account. This is the setup we use, and what to ask any agency.

Updated 2026-10-082 min readBy the Sotto team
Access checklist
  • Your main password is never shared
  • Two-factor login everywhere
  • Platform payouts stay in your account
  • Chatters see approved vault folders only
  • Access removed within 1 hour when someone leaves
  • NDA signed before day one
Short answer

Never give anyone your main password. A safe setup gives each chatter their own login through a chat CRM with roles and two-factor login, keeps your payouts going to your own account, shows chatters only the vault folders you approve, and removes access within an hour when someone leaves. Payment outside the platform is never accepted or discussed.

The risks

When someone else runs your DMs, three things can go wrong: someone gets more access than they need, money goes somewhere it shouldn't, or a message breaks platform rules and puts your account at risk. A good setup closes all three before the first shift.

A safe setup, step by step

  1. No shared passwordChatters work through a chat CRM with their own login and a role that limits what they can do. Your main password stays with you.
  2. Two-factor login everywhereOn your platform account, the CRM and the team's email.
  3. Payouts untouchedPlatform payouts keep going to your own account. The agency invoices you separately; it never needs access to your payout settings.
  4. Vault by folderChatters see only the folders you approve for selling.
  5. NDA before day oneEvery team member signs one before they see anything.
  6. Fast offboardingWhen someone leaves, their access is removed within an hour and shared passwords are changed.

Rules for the team

No screenshots or downloads

Content and conversations stay on the platform and in the CRM.

No contact outside the platform

Chatters never move a fan to another app.

No off-platform payments

No PayPal, crypto, gift cards or "my Cash App". A chatter who asks is removed immediately.

Questions to ask any agency

  • Do you need my main password? The answer should be no.
  • Which CRM do you use, and what can each role see?
  • Who receives the platform payouts? You should.
  • What happens to access, fan notes and scripts if I leave?
  • What will a chatter never say in my name? See our rules.

If you leave

You get a final report and invoice, fan notes and open conversations are handed back to you, all access is removed within an hour of the last shift, and any copies of your content on team devices are deleted. You own your data and content, during and after.

Red flag: any agency that asks for your main password, wants payouts sent to them, or offers to take payments from fans outside the platform.

Keep reading

Want these numbers for your own page?

Send us your page link. Within 48 hours you get a free DM audit with five fixes you can use whether or not you work with us.

Get a free DM audit