Who keeps ownership of the business account?
The account must remain the property of the business. The agency preparing or publishing content does not require transferring ownership of the account to it. The business owner clarifies who owns the brand assets and access, and grants permissions only as far as the job requires. The official authorization route supported by the platform and the integration in use is followed.
Key distinction: Granting account access is not unlimited permission to change product prices or share a customer's private information. Content decisions, account access and customer communication limits are separate permissions.
Seven-step secure handover checklist
| Stage | The business owner's question | Proof of acceptance |
|---|---|---|
| 1. True owner | Who manages Instagram and the related business assets? | Authorized business account |
| 2. Platform | Is the connection made through an official permission or access screen? | Connection record |
| 3. Scope of permission | What will the agency actually do? | Task list |
| 4. Publication approval | Who will approve pricing and campaigns? | Approval owner |
| 5. Security | Who holds login protection and recovery information? | Control of the business |
| 6. Traceability | Which content went out, when, and with what authority? | Publication record |
| 7. Exiting access | How will the agency's access be closed when the service ends? | Closure check |
This table does not claim that the same buttons exist in every version of Instagram, Facebook or third-party content planning tools. The connection route in use is checked against the current support and permission scope for the specific account.
What information does the agency really need to request?
A good starting point requires the business name, logo, current products and services, real photos, brand tone, working hours and verified links. The agency's requesting the account password, email recovery code, SMS OTP or the security code sent to your device is not part of a standard brand brief.
During authorization, the platform itself may ask you to sign in; never send these credentials to an agency employee via WhatsApp or in an email text. Check the domain name of any suspicious login link and review the business's real account access history.
How is content approval separated from connection authority?
For example, a restaurant hires NEFES to prepare and publish Instagram content. This does not automatically give authority to change menu prices, create discounts or promise a refund for a customer complaint.
Daily content: Prepared with approved photos and product information.
Price or campaign: Goes through the business's current registration and approval.
Complaints, health or personal data: Removed from the standard reply template and directed to the responsible person.
This distinction does not slow down a small business's fast work; it prevents content from being based on incorrect commercial information.
How should permissions be planned for a multi-branch business?
The central brand logo, general campaigns and product names may be authorized at head-office level. The branch manager verifies the real working hours, location and photos of that branch. Whether a single-account or multi-account model is used depends on the platform, but recording the input owner and the approver separately is useful in both cases.
Giving the agency the main recovery address for all branches should not be considered mandatory just to carry out content production.
What happens when the contract ends?
Prepare a short handover list for the end of the service: have agent and partner permissions been reviewed, have unused access been closed, has the fate of linked automations been decided, and are the rights to the raw photo archive and published creative clear? The basic expectation is that existing content remains in the business account and that control of the account stays with the business.
In the sample exit record, columns for account ownership, handover date, revoked access, access confirmation and file delivery may be included.
How NEFES works
NEFES plans content and creates Reels and posts using the business's real photos and brand memory, and manages the approval and publishing process within the authorized account workflow. The business remains the owner of its login information, and access granted is limited to actions within the service scope.
Final decision question: “Will I be able to access my own account, photos and brand assets without interruption on the day I stop working with the agency?” If the answer is unclear, clarify the authority and exit plan before work begins.
Adapt this guide to your business
Check together the business account selected on the connection screen and the permissions requested. Keep a list of access to be removed when the work ends, and do not make sending a personal password through a messaging app a working method.
