Use case

Encrypted Notes for Agencies and Freelancers

Agencies and freelancers have a structural problem: credentials arrive from clients who use different tools, on no shared infrastructure, and then accumulate. After five years of projects you are holding logins for dozens of organisations that stopped being clients long ago.

Last reviewed July 31, 2026Reviewed by Inkrypt Security Team

The accumulation problem

Every project starts the same way: the client emails hosting credentials, a CMS login, an analytics invitation and an ad-account password. Those emails go into a folder. The project ends. The folder stays.

Two things follow. First, you are holding live credentials for organisations you no longer work with — an unpleasant position if your own mailbox is ever compromised, because the breach is no longer only yours. Second, if a former client is breached through a credential that also sat in your inbox, you are part of the incident investigation whether or not you were the cause.

The liability is the stored copy

It is not the sharing that creates exposure — it is the permanent copy in your archive. Reducing what you retain reduces your liability more than any other single change.

Receiving credentials without keeping them

You usually cannot dictate how a client sends things. You can control what happens next.

Ask for access, not credentials. A named user account on the client's CMS, hosting panel or ad account is better for both sides: it is auditable, revocable, and it never puts a shared password in your possession. Make this your standard opening request.
When you must receive a password, move it immediately. Put it in your password manager and delete the email — including from Trash and any archive folder.
Give clients a way to send it safely. A link to an encrypted note is a concrete, one-click alternative to pasting a password into an email.
Purge on project close. Add credential cleanup to your offboarding checklist alongside the final invoice. Delete what you hold and confirm in writing that you have.
Prompt rotation at handover. A short note saying "we no longer hold access; we recommend rotating the credentials we used" is professional, takes a minute, and closes the loop.

Handing work back

Project handover is the other half, and it is usually worse — a document listing every credential, emailed as a single attachment, is a common deliverable and a genuinely bad idea. One compromised mailbox exposes the client's entire estate.

Better handover patterns, in rough order of preference.
Approach	Assessment
Transfer account ownership in each platform	Best — no credentials move at all
Client creates their own accounts; you delete yours	Excellent — clean separation of identity
Password manager shared vault, then revoke	Strong, when both sides use one
Individual expiring encrypted notes per credential	Good — works with no shared tooling
One document with every credential, by email	Avoid — single point of catastrophic failure

Better handover patterns, in rough order of preference.

What to tell clients

Clients often send passwords by email because nobody has offered them anything else. A short, non-preachy line in your onboarding document changes the default:

*"Please don't email passwords. Either add us as a user on your account — which is safest, and lets you revoke access instantly — or send credentials through an encrypted note and give us the password by phone."*

That framing works because it leads with the client's benefit: revocable access they control. Security framed as *your* requirement is friction; framed as *their* control, it is a selling point. Several agencies use exactly this as a differentiator in pitches.

A minimum standard worth adopting

No client credential is ever stored in email — password manager or nowhere.
Named user accounts are requested first, every time, as a matter of routine.
Credential cleanup is a line item on the project-close checklist.
Handover happens per-credential with expiry, never as one document.
Every closed project ends with a written rotation recommendation.

Frequently asked questions

How do I get clients to stop emailing passwords?

Offer a concrete alternative in your onboarding document and lead with their benefit: a named user account they can revoke instantly is better for them than a shared password. Most clients email passwords because nobody offered them anything else.

Should I keep client credentials after a project ends?

No. Delete them and tell the client you have, along with a recommendation to rotate anything you used. Retained credentials for former clients are pure liability with no upside.

What if a client insists on emailing a password?

Accept it, then immediately move it into your password manager and delete the email from every folder including Trash. Recommend rotation once the project starts, since that password has been sitting in at least two mailboxes.

Is one note with all credentials acceptable for handover?

It is better than an email, but still concentrates risk — one password compromise exposes everything. Prefer separate notes with separate expiries, or better, transfer account ownership so nothing needs to move.

Write your first encrypted note

No account, no email address, no download. Type a note, set a password, share the link.

Open the notepad