Creator ad account access, permissions and offboarding

Access to a creator programme's ad accounts is the part nobody closes out. On every roster we have inherited, the first review finds the same three things: an agency replaced two years ago still holding admin, a brand manager who left in the last reorganisation still on the business account, and a creator's management company with standing rights nobody on the current team granted. None of it is malice. Access is granted under deadline pressure by whoever is at the desk, and nothing in the platforms prompts anyone to take it back. Partner access rather than people: The structural fix is to stop adding humans. In Meta Business Manager, assets are shared to a partner business ID, so removing an agency is one revocation rather than a hunt through named logins. TikTok Business Center works the same way. In Google Ads the link is a manager account, not a list of individual Google accounts. The brand's business owns the ad account, the page, the dataset and the catalogue; partners are granted a task on those assets and nothing beyond it. Where an agency created the pixel, we move ownership first, because everything built on top of it - audiences, conversion history, the modelling that depends on both - sits inside an asset the brand does not control. What the second line of defence will ask for: For a bank, an insurer or a listed utility, the access list is an auditable control and it will be requested. We produce it in the form they accept: every human and every partner business against every asset, with grant date, task granted and a named accountable owner inside the brand. Two-factor enforced on every seat. The number of admins is a number somebody decided on rather than whatever accumulated. Creator audiences are personal data: A custom audience built from engagement with creator content is processing under KVKK, and the lawful basis belongs in the register before the audience is built. Cross-border transfer changed in Turkey in 2024: Law 7499 amended Article 9 and introduced a standard contract route, with the signed contract notified to the Authority within five business days. If creator audiences are moving to a platform or partner outside Turkey, that notification either happened or it did not, and it is a short conversation with your data protection officer either way. Offboarding, written down: Three events break access hygiene: a creator relationship ends, an agency is replaced, an employee leaves. Each gets an order of operations, because revoking in the wrong sequence strands assets. What is preserved is specified too: creative files, spend history, and the authorisation register, which has to outlive whoever was holding it. The review cycle: Quarterly, the whole list is walked against the owner sheet and anything without a current reason is revoked. Between reviews, changes route through one person on our side and one on yours. That is the entire discipline. It does not need to be more sophisticated, and programmes fail on it anyway. Not included: We do not administer your identity provider and we are not your security function. We do not run campaigns in accounts we are governing, and keeping those two apart is the point of the arrangement. We never touch creator personal accounts or ask for their credentials. Who this is not for: Programmes with three creators and one ad account. A spreadsheet and a recurring reminder will do, and we will say that on the call rather than sell you a review cycle.