Managing client accounts as an agency: one browser profile per client

An agency that manages clients' advertising, social and marketplace accounts should give every client account its own browser profile, file those profiles in a folder per client, and let staff open the profiles rather than hold the passwords. That one structure answers the questions clients ask agencies most often: who can get into our accounts, could our data mix with another client's, and what happens when we part ways.

This post walks through the whole client lifecycle: before you take on a client, onboarding, daily work, reporting and offboarding.

Why agencies keep clients apart

Agencies have three reasons to separate client accounts, and only one of them is about websites.

• Security. A compromised session or a mistaken click should touch one client, not all of them. A browser that holds every client's cookies at once makes every client as exposed as the weakest one.
• Access. Clients want to know who in your team can reach their accounts, and want that list to shrink when people leave. Shared passwords make both hard.
• Clarity. Posting from the wrong client's page, or changing the wrong ad account, is an ordinary human mistake. A browser that only ever holds one client's accounts makes it much harder.

And yes, platforms notice when many unrelated businesses' accounts are run from one browser and one office connection. Keeping each client in its own profile, in its own market, means each account looks like the business it belongs to.

Before you start: the platform's rules for agencies

Most large ad and social platforms have explicit arrangements for agencies: business managers, partner access, delegated roles. Where a platform offers its own way to grant an agency access, use it. It gives the client a record on the platform's side and lets them remove you there.

Where you do work inside a client's own login, have the client's written agreement, follow the platform's terms for that account type, and keep the setup below so you can show what you did. Our acceptable use policy applies to every profile.

Onboarding a client

1. Create the client's folder

One folder per client, with sub-folders by channel: Acme / Ads, Acme / Social, Acme / Marketplace. Everything the client owns lives there and nowhere else.

2. One profile per account

Each account the client gives you gets its own profile, named owner first: Acme – Ads – DE, Acme – Social – Main. Add notes the whole team needs: who at the client approves posts, who receives 2FA codes, which market the account serves.

3. An exit in the client's market

A client in Germany has its accounts used from Germany. Give the client's profiles a proxy in their region, ideally a static ISP or sticky residential exit so the address stays the same between visits. If the client has accounts in several markets, each market gets its own exit. Our guide to residential, datacenter, ISP and mobile proxies helps you choose, and the profile's timezone and languages should then follow that exit, as described in matching timezone and location to a proxy.

4. The client signs in, once

Ideally the client, or the person who owns the login, signs in to each account in its profile while you are on a call, and completes the 2FA step. The session is saved. Your team never needs the password. If the client changes it later, they sign in again in the profile once, and the team carries on.

Daily work: staff access without passwords

Staff open client profiles; they do not receive client logins. Share each client's folder with the people on that account, at the level their job needs:

• Account managers: edit access, so they can adjust a profile's settings.
• Specialists and freelancers: launch access, so they can work in the accounts and change nothing else.
• Clients themselves, if they are in your workspace: view access.

A shared profile opens on one computer at a time, so two people cannot be signed in to the same client account from two places. When someone else has it open, you see who and where. More detail on roles and levels is in share account access with a team.

Reporting and routine checks

Agencies repeat the same checks across many accounts: is the campaign live, did the post publish, what is the account's status. Two habits help:

• Run routine checks across a client's profiles in one go, rather than opening each by hand.
• Keep a log of who did what. When a client asks who changed a setting on Tuesday, you want an answer.

Offboarding

Agencies are judged by how they leave as much as by how they start.

When a staff member leaves: remove them from the workspace on their last day. They never held client passwords, so nothing needs changing at the client's end because of them. Profiles they created can be transferred to a colleague.

When a client leaves: remove the client's platform-side agency access, sign out of each account, and either hand the profiles over or delete them. A profile handed back to the client should be encrypted on the way.

How Browz supports an agency

Browz keeps each client's accounts in their own profiles, so one client's sessions, cookies and exit never touch another's (Browz for agencies).

• A folder per client. Nested folders, tags and notes keep hundreds of client profiles in order. Lock sensitive profiles behind their own password (browser profiles).
• An exit in each client's market. One proxy per profile from any provider, checked through a real tunnel, with timezone and WebRTC set from the measured exit. Assign proxies to many profiles at once by policy (balanced, one to one, round-robin or seeded random), preview the plan and roll it back before launch.
• Teams. Invite staff as admins, members or viewers; share a profile, a folder or a proxy at view, launch, edit or manage. Per-member rights decide who may create, delete or share profiles, export cookies or edit proxies (teams).
• One device at a time, and an activity log. Owners and admins see joins, shares, edits, launches and refused launches, with who did each.
• Transfers. Move a profile, with its browser state, to another member when someone leaves.
• Bulk work and saved flows. Start, stop, tag or move a client's profiles together, and run saved RPA flows across them.
• Encrypted hand-over. Export a profile as a .browzprofile file encrypted with a passphrase you choose (scrypt and AES-256-GCM), and give it to the client.
• End-to-end encrypted sync on every plan: the server stores ciphertext it cannot open (security).

Onboard a client from the command line

Two profiles of the same client can share one exit, as here: they belong to the same business. Different clients should not. Plans and seats are on the pricing page: the Free plan covers 5 profiles, and paid plans start from $4.99 a month with a 14-day refund on the first payment.

Agency checklist

• The client's written agreement, and the platform's agency rules, for every account.
• Platform-side agency access wherever the platform offers it.
• A folder per client, a profile per account, named owner first.
• An exit in the client's market; never one exit shared between clients.
• The client signs in once; staff never receive passwords.
• Access by folder, at the lowest level that does the job.
• An activity log you can show the client.
• Offboarding steps written down for staff and for clients.

Frequently asked questions