The worst email an agency can send is a report that contains another client's numbers. It usually happens through convenience: one shared login, one big property list, one export template that pulls from everywhere.
1. One organisation per client
An organisation in QueryDeck owns its properties, members, annotations and exports. Nothing crosses the boundary unless someone with access to both moves it. Your agency team members belong to several organisations; client stakeholders belong to one.
- Name organisations after the client, not the domain.
- Connect only that client's Search Console and GA4 properties.
- Keep internal test sites in a separate agency organisation.
2. Assign roles by job, not seniority
| Role | Give it to | Can do |
|---|---|---|
| Admin | Account lead | Members, properties, billing |
| Editor | Analysts | Annotate, automate, export |
| Viewer | Client stakeholders | Read dashboards and reports |
3. Build exports inside each workspace
White-label exports pick up the organisation's name and logo. Because the template lives inside the workspace, it can only reach that workspace's data. Copy a template to a new client instead of pointing one template at many clients.
4. Offboarding takes one click
When a contract ends, export the history for the client and remove your agency members from the organisation. The client keeps their record; your team loses access the same minute.
See how members and roles work on the members page.
