By Justine Vendil, Founder of VA Workers PH · Published June 18, 2026 · Updated September 25, 2026
VAs often get access to sensitive client information: email accounts, customer data, financial details, passwords. Handling that responsibly isn't just good practice; it's often what determines whether a client trusts you with bigger responsibilities. This guide covers the everyday habits that keep client data safe, how to spot the scams aimed at VAs, and what to do if something goes wrong.
Tools like Bitwarden (which has a free tier) or 1Password let you store and share client credentials securely without emailing passwords in plain text or writing them in a shared doc anyone could stumble on. Password managers also let a client share a login with you securely, and some business plans can fill in a password without displaying it, though that protection isn't foolproof. Plans and features change, so check the current details on each provider's own site before you choose.
Protect the vault itself. Your password manager is only as strong as its master password. Use a long passphrase made of several unrelated words that you don't use anywhere else, and turn on two-factor authentication for the password manager account.
Keep separate vaults or folders per client. If a client's shared folder is clearly labelled, you won't paste the wrong login into the wrong site, and it's easy to remove everything for one client when a contract ends.
Use unique passwords for your own accounts too. Your personal email, your payment platform and your job board accounts are the keys to your income. If one reused password leaks from an unrelated site, attackers will try it everywhere else.
If a client shares login credentials, keep them only in the password manager they've approved: not in your notes app, not in a personal spreadsheet, not in your email. If you switch clients or projects, revoke or remove access rather than leaving old credentials sitting around.
Ask for your own login where possible. Many tools let the account owner add you as a separate user with limited permissions. That is safer for the client than sharing their main login, and it protects you, because the activity log will show exactly what you did and didn't do.
Handle customer data with the same care. Customer names, addresses, phone numbers, order histories and payment details belong to your client's customers. Don't download exports to your personal devices unless the task requires it, delete local copies when the task is finished, and never paste customer data into personal chat apps, unapproved AI tools or public forums when asking for help. If you need to show a problem to someone, blur or remove personal details from the screenshot first.
Offboard yourself cleanly. When a contract ends, send the client a short list of the tools you had access to and confirm that you've deleted any files and saved logins on your side. A message such as "I've removed all saved credentials for your accounts from my devices and password manager; you may also want to change the passwords I used and remove my user from these tools" shows professionalism and makes it more likely they'll recommend you.
Enable two-factor authentication (2FA) wherever a client's tools support it, and understand how to use authenticator apps, not just SMS, which is less secure because text messages can be intercepted or a SIM can be hijacked. Clients notice when a VA proactively suggests better security practices rather than seeing it as extra friction.
Sort out 2FA codes with the client early. A common problem for VAs is that a client's account sends the verification code to the client's own phone, which means waiting hours for them to wake up. Ask the client whether they can add you as a separate user with your own 2FA, or use a shared authenticator feature inside the approved password manager, so you aren't locked out during your shift.
Be careful with public Wi-Fi. If you work from cafes or co-working spaces, use a VPN when accessing client accounts on public networks. Sensitive data such as client CRM logins and financial dashboards shouldn't be accessed over unsecured Wi-Fi without that extra layer. Watch for fake networks with names similar to the cafe's; ask staff for the exact network name.
Lock your screen every time you step away. In a cafe or a shared home, an unlocked laptop is an open door. Set your device to lock automatically after a few minutes and protect it with a strong password or PIN.
Keep your devices updated. Install operating system and browser updates promptly, keep your built-in antivirus or security tools turned on, and avoid downloading cracked or pirated software, which is a common way malware gets onto a work laptop.
Separate work from family use if you can. If siblings or children share your computer, create a separate user account for work so client tabs, saved logins and files aren't one click away from someone else.
VAs are attractive targets because they have access to several businesses at once. Common tricks include emails that appear to come from your client asking you to urgently buy gift cards or change a supplier's bank details, fake login pages for tools you use every day, fake job offers that ask for your ID and bank details before any interview, and messages claiming your payment platform account has been suspended.
Slow down on anything urgent involving money or logins. If a request to pay, transfer, change bank details or share a code arrives by email or chat, confirm it through a different channel you already trust, such as a known phone number or your usual project tool. A genuine client will understand.
Type the address yourself. Instead of clicking a login link in an email, go to the site directly or use your password manager's saved link. Password managers usually won't autofill on a lookalike site, which is a useful warning sign.
Never share one-time codes. No legitimate client, platform or bank support team needs the verification code sent to your phone.
If you clicked a suspicious link, entered a password on a fake page, lost a device, or notice logins you don't recognise, act quickly and be honest.
Contain it. Change the affected passwords immediately from a device you trust, log out of all active sessions where the tool allows it, and disconnect a compromised device from the internet.
Tell your client right away. Explain what happened, when, which accounts may be affected and what you have already done. It's uncomfortable, but a client who hears it from you early can protect their business; a client who discovers it later may lose trust in you completely.
Write down the details. Note the time, the email or link involved, and every step you took. Your client may need this for their own records or obligations.
Occasionally a client might ask for something that crosses a line: sharing their own client's personal data insecurely, bypassing a security step "just this once," or using your personal accounts to send on their behalf in a way that mixes identities. It's reasonable to flag these gently rather than just complying. A client who values good practice will respect it, and it protects you too. You might say, "I'm happy to send this list, but it includes customers' home addresses; could we share it through the password-protected folder instead of email?"
The Philippines has the Data Privacy Act of 2012 (Republic Act No. 10173), and clients abroad may have their own privacy requirements under the laws where they or their customers are located. This article is not legal advice. If a client asks you to sign a confidentiality or data processing agreement, read it carefully, ask questions about anything unclear, and consult a qualified professional if you need advice on your specific obligations.
Good security habits are a selling point, so mention them in your applications. See top tools every Filipino VA should know for more on the apps clients expect, and when you're ready to apply, browse the job board for your next role.
About the author
Justine Vendil is the founder of VA Workers PH and its Facebook community of 280,000+ members. Justine has worked remotely since 2021, earning in dollars as a freelancer in marketing, writing, and community management.
Ready to find your next VA job?
Browse verified remote VA jobs from real employers — free to browse, free to apply.
Browse jobs now →More articles: