AMS access and data ownership: what to ask any vendor
Your AMS holds your clients. Ask hard questions before you hand out a login.
Before giving a vendor AMS access, confirm in writing that your agency owns all client data and work records, that each person gets a named login with only the access they need, that multi-factor authentication is used, that the vendor won't contact or market to your clients, and that access is removed the day work ends.
The questions
| Ask | Good answer |
|---|---|
| Who owns the data? | Your agency, in writing |
| Where does the work happen? | In your AMS |
| What access do you need? | Named logins, least access for the tasks |
| Do you use MFA? | Yes, everywhere |
| Are your people background checked? | Yes |
| Will you contact my clients for other business? | No, and it's in the contract |
| What happens when we stop? | Access removed the same day; nothing kept |
Least access, in practice
- Someone doing certificates doesn't need accounting.
- Someone doing renewals doesn't need agency-wide reports.
- No one outside the agency needs admin rights.
Keep a simple access log
For each outside person: name, systems, permission level, date granted, date removed. Review it quarterly.
Where Humai fits
Humai's people work in your AMS with their own named Humai login and only the access the work needs. Your clients and data stay yours. Identity and background checks are done before anyone starts.
Questions agency owners ask
Who owns client data when a vendor works in my AMS?
Your agency should. Put it in the contract: all data and work records belong to the agency, and the vendor won't use or keep them.
Should a vendor get admin access to my AMS?
No. Give each person a named login with only the permissions their tasks need.
Could a vendor compete for my clients?
Ask directly, and get a written non-solicitation commitment.
How do I remove a vendor's access?
Keep a list of every system each person can access, and remove it all on their last day. Named logins make this easy.
What security basics should a vendor follow?
Named logins, multi-factor authentication, secure devices, background checks, and clear rules for handling client data.