Is your IT provider's remote access safe?

Handing an IT provider the keys to your computers is an act of trust.

These questions tell you whether that trust is well-placed — useful whoever you work with, us included.

01 Does each person have their own login?

Named accounts matter. If a whole team shares one login, nobody can say who did what. Individual accounts mean every action traces to a person.

02 Do they connect with your knowledge?

Background monitoring is normal and quiet. But a person taking control of your screen should be something you've agreed to and can see — not a silent, unannounced session.

03 Is there a log you can review?

Ask whether sessions and changes are recorded, and whether you can see that record. "Trust us" is not an answer; a reviewable trail is.

04 Do they take only the access they need?

A provider shouldn't hold full admin rights to everything just because it's convenient. Least privilege limits the damage if their own accounts are ever compromised.

05 Is it written down?

A Data Processing Agreement should state what they access, why, and what happens to your data when you part ways. If it isn't in writing, that's a flag.