How to vet a VA before giving them access to your email

Handing over your email to someone else is not the same as asking them to attend a meeting on your behalf. Email is the gateway to your business relationships, financial records, client secrets and personal conversations. When it goes wrong—a VA leaks sensitive client data, misses a critical deadline, or deletes years of correspondence—the fallout is fast and costly. Most people vet a VA's background and communication style but skip the step that matters most: testing their systems, reliability and actual access practices before the real work begins.

The mistake most business owners make is treating vetting as a one-off conversation. You ask for references, maybe check their LinkedIn, perhaps do a video call, and then hand them your password. That is backwards. What you need is a structured handoff process that reveals how they actually work under pressure, how they handle sensitive information, and whether their discipline matches the trust you are about to place in them.

Before you give them your password

Start by asking how they manage email access for multiple clients. Do they use a shared password vault with audit trails, or do they scribble it in a note? Do they change passwords regularly? Do they log out after every session, or do they stay logged in to save time? Their answer tells you whether they even think about security. It should not be a difficult question; any VA who has worked with email-critical clients will have a clear answer.

Next, ask for two specific examples of how they have handled confidential information in past roles. Not general statements—real scenarios. How did they deal with a private medical appointment in a client's calendar? How did they handle an email marked "confidential" that arrived while the client was travelling? If they are vague or defensive, that is a red flag. A trustworthy VA will have a story ready; they think about this.

Request a trial run with low-stakes access first. Give them view-only access to an archive folder or an old email account for a week. Ask them to sort, label and summarise a specific subset of messages. Tell them you will be checking the audit log to see what they accessed and when. This sounds formal, but it filters out people who get uncomfortable with transparency. The ones who stay and deliver clean work are the ones you hire.

Red flags during the trial

Watch for someone who accesses folders they were not asked to touch. If you give them your Inbox to organise and they start browsing your Sent folder or archive, ask why. Maybe they have a good reason; maybe they are curious. Either way, you now know their boundary-setting is loose. Someone who respects confidentiality only accesses what they need.

Also notice how they communicate about what they find. Do they summarise decisions to you in writing ("I moved 300 newsletters to a folder and deleted 15 promotional emails—all unread. Shall I keep archiving these weekly?"), or do they just do it and hope you do not notice? The first person is thinking about accountability. The second is not.

Ask them to use two-factor authentication on any login. If they push back—saying it slows them down or is inconvenient—that is your signal they are prioritising speed over security. You want the opposite.

The handover checklist

Before full access, have them sign a simple confidentiality agreement. This does not need to be a 10-page legal document; one page covering that they will not share, store elsewhere, or discuss any information they see, is enough. It creates a paper trail and makes expectations explicit.

Agree on a communication protocol: which emails they handle independently, which they flag to you first, and how urgent matters get escalated. Write this down. Many VA relationships break down not because someone is untrustworthy, but because they guessed wrong about what you wanted and now you are discovering overreach or missed opportunities.

Set a review cadence—a 15-minute weekly check-in for the first month. Ask to see their email log or a summary of what they handled. Did they miss anything? Did they act outside their remit? This is training time, not interrogation, but it means you catch problems early.

When you find someone who passes these steps cleanly—who is transparent about their systems, respects boundaries without resentment, and communicates clearly—that is someone worth booking. On Strove, verified VAs will have client reviews that speak to their reliability with sensitive tasks; filter by those five-star ratings and ask your shortlist for their specific email and diary management experience.