How We Handle Access and Credentials — Safely

To get started, we need access to several of your systems: analytics, ad accounts, sometimes your website. This document explains exactly what access we ask for, why we need it, and what happens to it after the work ends.

What access we ask for

• Google Analytics 4 — view-only level, to analyze traffic and visitor behavior.
• Google Search Console — view or full access, depending on the task (checking indexing, submitting pages).
• Ad accounts (Google Ads, Meta Ads, etc.) — administrator or editor level, depending on how we work together.
• Website CMS or hosting — only if the task directly requires technical changes on the site.

How we ask for access

Through the service's official user-invitation mechanism (for example, "Add user" in Google Ads or GA4), never by sending passwords in text or by email. If a service doesn't support inviting users, we agree a secure way to transfer access separately.

Who exactly has access

Only the manager and the specialist assigned to your account. Not the whole Penguin Team, and not anyone "just in case" for the future.

How we store access

We don't store passwords in plain text. Access is granted through the platforms' official mechanisms, which you can see in your admin panel and revoke with one click at any moment, without needing to write to us.

What happens when the work ends

Access is revoked within a few working days after the work ends, or immediately at your request at any earlier moment. Just tell the manager.

Want to limit access to the minimum for a specific task? Just tell the manager. We can always work with the level of access that particular task needs, with nothing extra "just in case".