Creator resources

Creator account security checklist

Protect creator account access by keeping control of recovery details, using a unique password and enabling multifactor authentication wherever available. Before involving an agency, write down which tasks require access and how access will end. Keep identity documents and login codes out of introductory messages, and verify requests through a known channel.

By · Published · Updated

How do you protect creator account access?

Start with your own login and recovery settings before considering agency access. CISA recommends strong, unique passwords and a password manager, and multifactor authentication adds a further login check. Use the security options your platform provides and keep recovery details under your control.

  1. Review the email address, phone number and devices attached to the account.
  2. Set a unique password and turn on available multifactor authentication.
  3. Store recovery codes in a secure place you control.
  4. List the tasks an agency needs to perform and ask which supported permissions they require.
  5. Agree how account changes will be approved and recorded.
  6. Write an offboarding checklist before granting access.

What privacy limits should you set with an agency?

Agree what you are comfortable publishing, how private files are stored and who can view them. Keep home addresses, personal documents and unrelated accounts out of routine planning material. Review the background of a photo or recording before posting it, including labels, screens and reflections that you did not intend to show.

No privacy measure makes a public creator account anonymous in every situation. Ask what a specific tool does and what it cannot prevent. Avoid relying on a promise of “100% privacy” as the basis for deciding what to publish.

What should happen when management ends?

  • Review and remove permissions that are no longer needed.
  • Check recovery information and active sessions in the platform settings.
  • Change any password that was shared, and follow the platform’s current guidance.
  • Confirm delivery of agreed files and how remaining copies will be handled.
  • Keep a record of the handover and unresolved questions.

How should you handle an unexpected login request?

Pause before opening a link or sharing a code. Contact the person using an address or channel you already know. CISA’s phishing guidance explains how deceptive messages can seek information or access. If an account may be compromised, use the platform’s official recovery process.