The number one mistake gym owners make when onboarding a Fitness VA is dumping every password into a shared Google Doc. By month six, that doc is forwarded around, sitting in someone's downloads folder, and you have lost track of who has access to what.
1Password fixes this in about 90 minutes if you set it up right. Here is exactly how to structure vaults, share access, and offboard cleanly.
If you do not have a VA yet, our hiring playbook covers the broader onboarding sequence and where password setup fits.
Why 1Password over a shared doc or LastPass
Three reasons, in priority order:
- Scoped sharing. You can grant your VA access to MindBody and Klaviyo without exposing your bank login or your Stripe admin.
- Audit trail. Every login, every share, every revoke is logged. If something goes wrong, you have evidence.
- Clean offboarding. Pulling vault access takes 60 seconds and immediately revokes everything everywhere.
LastPass had the breach issue, browser-saved passwords have no sharing model, and Google Docs is a security nightmare. 1Password Business is the default for fitness teams under 10 people. Bitwarden is a fine alternative if you prefer open source.
Vault structure that actually scales
Build five vaults from day one. Do not start with one giant shared vault.
- Founder Private. Personal logins, banking, anything legally yours alone. Never shared.
- Studio Admin. MindBody admin, Stripe, payroll, vendor accounts. Founder + senior ops only.
- VA Tools. Day-to-day VA logins: scheduling, email, social, content. This is the workhorse vault.
- Marketing Tools. Ad accounts, Klaviyo, Mailchimp, GoHighLevel. Shared with VA only if marketing is in scope.
- Archived. Closed accounts and deprecated tools. Keep for audit purposes.
Each vault gets a clear purpose. New tools get added to the right vault on day one, not retrofitted later.
Scoped sharing rules
Share by vault, not by individual item. Three rules keep this clean:
- VAs get the VA Tools vault by default. Add Marketing Tools only if it is in their scope.
- No one gets Studio Admin without a written scope expansion. Billing access is a different trust tier than scheduling access.
- Founder Private is never shared. Use a separate password reset flow if you ever need help with personal accounts.
When you onboard a new VA, the entire access grant takes 90 seconds: invite by email, assign to VA Tools vault, set role to "Member" not "Manager," done.
What to put in a credential entry
A bare password is not enough for a VA who has never used the tool. Each entry needs:
- Username and password (obviously).
- The exact login URL (not a Google search).
- A field for "VA notes" with quirks: "MFA goes to founder phone, ping Slack first."
- A field for "scope" listing which workflows use this login.
- A tag for the workflow ("lead reply," "newsletter," "billing").
Tags are the unlock. A VA can search "lead reply" and see every credential they need without scrolling through 80 entries.
MFA without the chaos
Multi-factor auth is the most common friction point. Three patterns work:
- Shared TOTP via 1Password. Most tools support TOTP and 1Password stores it natively. The VA gets the code without you forwarding screenshots.
- Shared phone for SMS-only services. Buy a $5/month Google Voice number used only for SMS MFA. Share the inbox.
- Founder-as-MFA-relay. For sensitive tools (Stripe, bank), the VA pings you and you read the code. Adds friction by design; that is the point.
Avoid forwarding MFA codes through email or screenshots. That defeats the purpose.
Offboarding in 60 seconds
The day a VA leaves, the steps are:
- Revoke their 1Password user account.
- Rotate the five most sensitive passwords in the vaults they accessed (the ones that touch money or member data).
- Pull their email forwarding rules from your shared inbox tools.
- Audit the activity log for anything unusual in the last 7 days.
Total time: 15 minutes. If you are dumping passwords in a Google Doc, this same process takes a full afternoon and you will miss something.
Costs and the trial decision
1Password Business costs about $8 per user per month. For a founder + one VA setup, that is $192 per year. Cheaper than the time cost of one credential breach.
If you are still on the fence, our Fitness VA tasks list shows the volume of tools a typical VA touches. Multiply that by your churn risk on a shared doc and 1Password pays for itself the first month.
Common setup mistakes to avoid
Three patterns guarantee a mess later:
- One vault for everything. You will end up sharing your bank login because you forgot to split it out. Always start with five vaults.
- Sharing individual items instead of vaults. Becomes impossible to audit and revoke. Vault-level sharing only.
- No tags. Without tags, your VA wastes 5 minutes per task hunting for the right credential. Tag everything by workflow on day one.
Set this up before the VA's first login. Trying to retrofit 1Password three months in is a half-day project.
Frequently asked questions
Does 1Password work if my VA is in another country?
Yes, no friction. 1Password is jurisdiction-agnostic and works on any device with a browser.
What about Bitwarden, Dashlane, or Keeper?
All fine. Bitwarden is the strongest free-tier alternative. Whatever you pick, the five-vault structure still applies.
Should the VA have their own personal vault?
No. Their personal logins should live in their personal 1Password account, not yours. Keep boundaries clean.
How often should I rotate shared passwords?
Quarterly for high-stakes credentials (payment processors, admin accounts). Annually for everything else. Always after offboarding.
Can I share a single credential temporarily?
Yes, 1Password has time-limited sharing links. Useful for one-off vendor access without granting full vault membership.