Paid social access: what practitioners need to review first

TL;DR: Access often survives employee departures, agency handoffs, and contractor exits inside ad accounts, business portfolios, and DSP seats, leaving brands exposed to campaign changes, budget shifts, and audience data access, according to Cerby. The control failure is not offboarding alone but platform-level revocation and ownership verification across each paid asset.

Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Why Paid Social Carries More Risk Than Organic (And How to Find the Gaps)”.

Key questions

Q: What breaks when paid social access is not removed after someone leaves?

A: The control that breaks is lifecycle enforcement inside the platform.

Q: Why do ad accounts and DSP seats create more risk than organic social profiles?

A: Paid media roles can do more than publish content.

Q: What are the signs that partner access has gone stale in marketing platforms?

A: Look for sole administrators, unknown external users, active spend on accounts no one can explain, partner grants that still exist after an agency change, and roles that can edit budgets or billing without current business ownership.

Practitioner guidance

• Inventory every paid media asset List each ad account, business portfolio, advertiser seat, and DSP instance, and record the owner, administrator, partner, and contractor access attached to each one.
• Revoke access in the platform of record Do not rely on HR offboarding or contract closure alone.
• Prioritise assets with spend authority Start with accounts that can change budgets, billing settings, audiences, inventory, or campaign delivery, because those roles create the highest operational and financial exposure.

Bottom line: Paid social and DSP permissions can survive employee exits, contractor completions, and agency handoffs even when corporate access has been disabled.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →