How should I handle client security and working solo with five high-quality individuals?
Get those five high‑quality individuals together and focus on the top lane (gank top lane) all the time—just kidding, that's a game reference. Regarding security when working solo, I don't think about it much, so it's hard for me to give advice. If you mean working solo with a team of five people, secure yourself reasonably but don't make security the sole focus, or you'll never get anything done. For client security, I use an 80/20 approach: I collect their credentials (emails, passwords) for the accounts I'll manage and store them in a single password manager (not plain‑text). Because I also have access to their API keys, I'm a bit more secure than most of my clients. I basically centralize all that information.
We actually tried separate Chrome profiles per client — it works until you hit about 10 profiles, since Google doesn't easily allow more than that. You could also use something like a Multilogin instance to store credentials with longer-lasting cookies and residential/Bright Data proxies, giving you a fixed IP so you get logged out less (especially useful for accounts with 2FA). But honestly, I don't do any of that — I just use my own browser profile and manage everything with 1Password, which solves both the multiple-logins problem and general credential coordination. On handoff: since everything is built directly in the client's own accounts, there's no major handoff needed — I just send an email with a 20-minute SOP video plus a written Google Doc walking through the whole system, including how to maintain and upgrade it themselves, so they're covered even if we stop working together down the line.
The reason I do this is twofold. First, it makes handoffs really easy. If you're no longer working with someone on this thing, you can say, 'Hey, you have everything you need. Here's the documentation on projects I've already delivered. Good to go. Goodbye. I love you. See you never.' Second, when you get people to sign up to these platforms, you can use your own affiliate link, which adds 3 to 5% to your margins almost immediately. That's how I do it—I don't have them deal with API keys or anything; I handle it all myself.
I recommend doing a kickoff call right after receiving payment or closing the deal. On that call, your sole goal is to gain access to every account you’ll need for the service. It’s straightforward: just say, ‘Hey Pete, let’s get everything running for you.’ In my experience, the main hurdle with automation integration is two‑factor authentication and access requests. If you’ve worked with someone like this before, you know people constantly ask you to unlock accounts or set them up—which I dislike. Instead, I handle everything ahead of time on a brief 30‑minute call: we walk through signing up on each platform together, I get the necessary access, and after that we don’t need to talk again except for my daily updates you receive each morning. By the end of the call I’ll have all required platforms—say, platform one, two, and three. If occasional two‑factor authentication is needed later, it’s easy because I already have most access. From there, you’ll have full access to their accounts and never need to build anything on your device and transfer it over; I’ve already done everything directly in their accounts, so there’sno handoff. That’s my recommendation.
I'll do what's called a kickoff call where I get them together with me for a 30 to 45 minute period. I'll guide them through signing up for all the software platforms I want them to use. Typically I have three or four software platforms they need to sign up for. Most of the time, if we're doing something email-related, I'll have them sign up for a new Google Workspace profile. If they've never used a no-code platform, I'll make them sign up using my affiliate code—often something like PandaDoc. So I pretty much define sign‑up procedures for this: I send them all the links in the chat, they click the buttons, create the account, and then I have them do it with email and password so I can get it immediately and verify sign‑in right there. The issue with two‑factor authentication for most services is that people sign up using Google, which forces them through Google’s TFA system—a pain. If you get username‑password credentials, just add them to a password manager like 1Password, LastPass, or Dashlane; that eliminates a large portion of that issue. For the Google stuff, I typically log in using a software platform called Multi‑Login (multilogin). It’s great because you basically have to store the exact same credentials. Essentially this lets you set up dedicated browser profiles using residential and data‑center proxies so you can consistently log in with a static IP—the same IP address every time—minimizing the number of re‑authentications you need. Yeah, I use this for Google stuff from time to time; I don’t always use it, but that’s how I solve that problem. Hope that makes sense. If you guys have any more questions, feel free to drop them in the daily updates channel. Obviously this incentivizes my channel to grow because I get more engagement, and I can answer questions I get on this channel for the foreseeable future until it becomes unreasonable to do so.