Google Business Profile for agencies: access, permissions, handover

An agency can win a local SEO account and lose it over a password. The work is rarely the problem. The problem is access: who holds it, what they can change, and what happens on the day the client leaves. Agencies that treat access as an operational detail spend the last week of a contract reconstructing what they delivered.

This guide covers the three ways to get access and the risk in each, the permission model that keeps client listings safe, and the handover file that ends a contract without a fight.

What is a Google Business Profile agency tool?

That last sentence is the whole model. The agency operates the listing; the client owns it. Every process below is designed to keep that true even when a relationship ends badly.

Three ways to get access, and what each costs

The manager invite is the default. It is enough for the daily work and it keeps ownership where it belongs. An owner role should be a temporary, documented exception — for a verification or a structural fix — not the standard model.

Shared logins are the one method to refuse. They make every action unattributable, they break two-step verification, and they turn a staff departure into a security review.

The permission model

Google's own roles are coarse: primary owner, owner and manager. The workspace adds a second layer, where a user sees only the locations assigned to them. Both matter.

The workspace layer in practice: a user sees the locations assigned to them, with store code, city and district, rating and status. Ownership stays with the client's Google account. Anonymized demo account.

Two rules prevent most incidents. First, an agency lead holds owner only while a specific task requires it, and the client is told in writing. Second, every person has their own login; a shared account is a permission that cannot be revoked precisely.

The Google alerts check adds a useful safety net: permission problems and account changes appear as alerts rather than as a surprise in month three. For a client with dozens of locations, that check is part of the service, not an extra.

Handover: what the client takes, what the agency keeps

A handover is not a goodbye email. It is a file and a sequence.

The client keeps:

• Ownership of every listing, in their Google account.
• The review archive and the performance history exported for the contract period.
• The documentation of what changed, when and why.

The agency removes:

• Its users from every listing and from the workspace.
• Any owner role granted for a specific task.
• Integration tokens and connected accounts it no longer needs.

The agency keeps:

• Its own templates and internal methods, unless the contract says otherwise.
• Its reporting format, not the client's data.

The sequence matters: export first, confirm the client can access the export, then remove users. Removing access before the export is how a routine offboarding becomes a dispute.

A handover file should include:

1. A location list with store codes, names and Google profile identifiers.
2. The date range and definitions used in the final report.
3. A change log for the contract period.
4. The current review archive export.
5. A named contact on each side for 30 days after the end.

A reporting standard that survives a change of agency

Clients compare agencies, and the comparison is only fair if the definitions match. Set them in the first month and keep them for the life of the account.

• One date range for every metric in the pack.
• One definition per metric, written in the report, not assumed.
• Per-location tables, not only a portfolio average.
• A work log next to the numbers: what was changed, when, at which locations.
• A note on data lag: Google finalizes performance data with a delay of about five days, so the last week is provisional.

The dashboard a client receives each month: portfolio rating, reviews received and response rate, with the same date range as the per-location tables. Anonymized demo account.

A report that shows a rating without the removal rate, or impressions without the date range, is not comparable to the next agency's report. That is convenient in the short term and expensive at renewal.

Three clauses worth having reviewed

This is not legal advice. Contract language should be checked by a lawyer in the relevant jurisdiction.

1. Ownership and access. The client owns the listings and the Google account; the agency is granted manager access for the term; any owner access is temporary and listed. The clause should say who removes access and when.
2. Data and export. The client owns the review archive, performance data and reports produced for them; the agency provides a full export within a stated period at the end of the contract. Name the format.
3. Offboarding. A defined handover window, a list of deliverables, and a statement that access is removed after the export is confirmed. A 30-day overlap is common; it should be agreed, not improvised.

Two more clauses are worth considering: who replies during a notice period, and what happens to work in progress.

What not to do as an agency

• Do not hold a listing hostage. Refusing to remove access is the fastest way to turn a lost client into a public warning.
• Do not become the owner by default. It solves a verification problem and creates a handover problem.
• Do not use one shared login for the team. It makes attribution impossible and breaks two-step verification.
• Do not change ownership without written confirmation. A "quick fix" to a client's account is a liability.
• Do not report a different date range than the previous agency. It makes the comparison meaningless, and the client will notice.
• Do not leave former staff with access. Remove users on the day they leave, not at the next review.

Checklist for onboarding and offboarding

Onboarding

• The client invites the agency as a manager, not an owner.
• Every agency user has their own login and two-step verification.
• Locations are assigned per user, not shared across the team.
• The reporting definitions and date range are agreed in writing.
• A baseline audit is run and stored before any edit.

Offboarding

• The final report and review archive are exported.
• The client confirms they can open the export.
• All agency users are removed from every listing and workspace.
• Temporary owner roles are returned.
• Integrations and tokens are revoked.
• A 30-day contact is named on both sides.

Access is the service

Clients rarely judge an agency by a single ranking. They judge it by whether the account is clean, the reporting is consistent and the exit is uneventful. Manager access, per-user permissions, one reporting standard and a real handover file are unglamorous, and they are what makes a local SEO engagement defensible.

The operational rhythm behind the reporting is the same one a brand runs internally; managing many locations without a spreadsheet covers the weekly queue. Multi-location management is where the location list, store codes and per-user access live together.

If your clients are clinic groups, where a public reply can disclose patient detail, read the clinic guide before writing the reply policy into the contract.

Start a 3-day free trial · See pricing