The Bottleneck Online Security System.
B.O.S.S. stands for the Bottleneck Online Security System, the set of protocols every Distant Assistant works under. It covers background checks before placement, credential handling through a shared password vault, two-factor authentication, retained admin rights, documented onboarding and offboarding, and separation of duties.
Security is not an upgrade here. It ships with the department.
The question everyone asks and nobody answers well.
Handing an outsider the keys to your business is the moment delegation gets uncomfortable. Your inbox. Your books. Your customer records. Your social accounts.
Most assistant companies answer with one line about background checks and change the subject. That answer is not enough, and founders know it.
So here is the whole thing. Every protocol, in plain language, with what stays under your control and what happens the day someone leaves.
The eight B.O.S.S. protocols.
Background checks before placement
Background checks and verified references run before a Distant Assistant is placed with you. Not after you ask. Not on request. Before.
Credentials through a shared vault
Your passwords move through a shared password vault. Your assistant logs in without ever seeing the password itself. You revoke access in one click, without changing a single credential or locking yourself out of anything.
Two-factor authentication stays on
Two-factor authentication remains active across every financial platform. Convenience never overrides it.
Company Admin rights stay with you
You hold the admin seat on every account. Always. Your assistant works as a user inside permissions you set, and you change those permissions whenever you want without asking anyone.
Access levels you choose
How much your assistant handles is your decision, set during onboarding and adjustable at any point. Three levels, described in the next section.
Recorded onboarding handoffs
Handoffs are recorded, so the workflow lives in documentation instead of somebody's memory. A process nobody wrote down is a process that leaves when a person does.
Same-day documented offboarding
When a Distant Assistant leaves your engagement, offboarding is documented and access is pulled the same day. No lingering logins. No forgotten seat on a tool you stopped checking.
Separation of duties
The person entering your transactions is never the only person reviewing them. Separation of duties holds at every access level, so no single set of hands both performs and approves the same work.
You choose the access level.
Access is your decision, not ours. Set it during onboarding and change it whenever you want. These levels apply anywhere a Distant Assistant touches a sensitive system, and they matter most on your books.
| Level | What your assistant does | Authority |
|---|---|---|
| Record | Enters, categorizes, reconciles, and works inside a platform as a limited user. Data flows in through read-only feeds. | None. Your assistant never receives your bank portal login at this level. |
| Prepare | Queues bills, stages payroll, and readies actions for your review. | Nothing releases until you approve it. |
| Execute | Initiates actions inside a scope you write, with a dollar ceiling and an approved vendor list. | Yes, within your written limits, with your review afterward. |
Most clients move from Record to Prepare somewhere around month three. Some stay at Record forever. Both are right answers.
Our own bookkeeper here at Bottleneck works at the Execute level. She reconciles our books, manages vendor payments, and keeps our financials clean. We trust her with it because the structure earned the trust before the access followed.
What never changes hands.
Admin rights on every account.
Your passwords, which your assistant never sees.
Approval on every financial decision, unless you write a scope granting otherwise.
The ability to revoke all access in one click, at any hour, without explaining why.
Documentation is a security feature.
Most people think of documentation as an efficiency tool. It is also how access stays controlled.
When a process lives in one person's head, removing that person creates a hole. Somebody keeps a login active so the work keeps running. That is how forgotten access happens, and forgotten access is how businesses get hurt.
Every Distant Assistant maintains your Workflow Manual, the written record of how each recurring task gets done. The work survives an absence, so nobody has a reason to leave a door open.
This is Delegation Intelligence doing security work. You are not depending on one person. You are running a department.
Common questions
Frequently asked questions.
What does B.O.S.S. stand for?
B.O.S.S. stands for the Bottleneck Online Security System. It is the set of security protocols every Bottleneck Distant Assistant works under, covering background checks, credential handling, two-factor authentication, retained admin rights, access levels, documented onboarding and offboarding, and separation of duties.
Is it safe to give a remote assistant access to my accounts?
It is safe when the structure is built for it. The risks are a person nobody vetted, a password shared over email, an assistant holding admin rights, and access that never gets pulled when someone leaves. Bottleneck addresses each one with a specific protocol rather than a promise.
How do I share passwords with an assistant without giving them the password?
Through a shared password vault. Credentials are stored in the vault and your assistant logs in without the password ever being visible to them. Access is revoked in one click, with no credential changes needed on your side.
Does Bottleneck run background checks on Distant Assistants?
Yes. Background checks and verified references are completed before placement, not after a client asks for them.
Who holds admin rights on my accounts?
You do. Company Admin rights stay with the client on every account. Distant Assistants work as users inside permissions the client sets and adjusts.
Do Distant Assistants have access to my bank accounts?
Only at the level you choose. At the Record level, no. Bank data flows in through a platform's read-only feed and your assistant never receives your bank portal login. Higher levels exist and require your explicit decision, with written limits.
What happens to my access when a Distant Assistant leaves?
Offboarding is documented and access is pulled the same day. Every credential path runs through the vault, so removal is immediate and complete rather than a checklist someone works through later.
What is separation of duties?
Separation of duties means the person performing a task is never the only person reviewing it. Applied to bookkeeping, the assistant entering your transactions is not the sole reviewer of those entries. It removes the single point of failure that most small businesses live with.
Can I change my assistant's access level later?
Yes, at any point. Access is set during onboarding and adjusted whenever you decide. Most clients start at Record and widen the lane once the rhythm is proven.
Do these protocols apply to every role?
Yes. Every Distant Assistant works under B.O.S.S. protocols regardless of role. An Executive Assistant inside your inbox, a Social Media Coordinator inside your accounts, and a Bookkeeper inside your books all operate under the same system.
Find the fit
See which work you would hand over first.
Take The Bottleneck Finder. Seven minutes or less. It shows you which tasks are keeping you stuck and which Distant Assistant role is built to handle each one.
No credit card. No call. No spam. Only clarity.