The Zero-Trust VA Onboarding SOP: How to Give 10 Overseas VAs Store Access Without Sharing a Single Password or 2FA Code
Disclosure: some links in this guide are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. How this site makes money.
🎯
Short answer
To onboard overseas Virtual Assistants without triggering Impossible Travel locks, authenticate your seller account inside an AdsPower or GoLogin profile bound to a dedicated US/UK Static ISP proxy. Give each VA a restricted RBAC seat with password-viewing disabled, and route support tickets through Gorgias so VAs never touch your admin.
"When we scaled to 6 stores and hired 8 VAs across the Philippines and Eastern Europe, our biggest risk wasn't ad spend—it was an employee logging in from home Wi-Fi or copying our master credentials. Implementing this Zero-Trust RBAC workflow let us delegate 90% of daily operations with zero security incidents."
The 4-Layer Zero-Trust VA Architecture
- Layer 1 — Customer Support Isolation (Gorgias): Customer service VAs never need direct access to Shopify, Amazon, or PayPal. Give them a restricted agent seat inside Gorgias where they can view tracking numbers and issue partial refunds without touching your store admin.
- Layer 2 — Pre-Authenticated Browser Profiles (AdsPower / GoLogin): For catalog managers who must access Seller Central or eBay, create the profile yourself, bind a Bright Data Static ISP IP, log in once with "Remember Me" checked, and share the cloud profile with DevTools and password export disabled.
- Layer 3 — Built-In TOTP 2FA Authenticator: Paste the store's 2FA secret key into AdsPower's built-in TOTP generator so the browser autofills 6-digit 2FA codes without you having to text codes on WhatsApp at 3 AM.
- Layer 4 — Instant Offboarding: If a VA leaves your team, revoke their sub-account seat in 1 click—instantly terminating their session without having to rotate proxies or re-verify bank accounts.
Pro tip
Enable "Block Chrome DevTools & Extension Installation" in AdsPower Team Global Settings so VAs cannot inspect session cookies or install third-party extensions inside your store profiles.
Tools mentioned in this guide · affiliate links
AdsPower Team RBAC
Gorgias AI Helpdesk
GoLogin Cloud
David Lewin
Founder of StealthScale.io and e-commerce infrastructure engineer writing field-tested playbooks on proxies, cloud VPS, anti-detect browsers and SEO.