Protect your artist accounts: owners, recovery and team access

Map access without making a password list

Start with the accounts that let your team change the artist’s public presence: recovery email, distribution, artist-management tools, YouTube channel, social profiles and website. Record the service, public profile URL, responsible owner and the job each collaborator needs to do. Keep passwords, codes, recovery material and private identity documents out of this working sheet.

A photographer who supplies images does not necessarily need profile access. A person checking analytics may not need permission to publish. Establish the task before choosing a role, and review access when a project or working relationship ends. These are practical team recommendations; actual roles depend on each service.

Secure the account that controls recovery

For Google accounts, the official Security Checkup reviews recovery information and security recommendations. Google supports passkeys and 2-Step Verification; review the methods offered for your own account and maintain a usable recovery route. Keep recovery material private and use trusted, updated devices.

Spotify recommends a distinct password and not sharing it. Review third-party application access if unauthorised access is suspected, and sign out on devices you do not control. Do not assume every artist platform offers the same authentication settings. Open the service directly rather than following an unexpected message asking for codes or account access.

Before a tour or release, check that the account owner can still receive legitimate recovery messages. A team member’s old work address or lost device is a practical continuity problem even when the public profile looks correct. Keep the recovery check separate from the public press contact.

Delegate the job, not the owner’s login

YouTube channel permissions allow people to help without receiving the owner’s Google login. Roles differ, including what they can publish, manage or see; check the current role description before inviting someone. A distribution payment split is not a YouTube access role.

For Spotify, follow the existing account and team-access guide. Do not copy permissions from one platform into another or assume that a distributor can recover every external profile for you.

• Write the actual task and the minimum access needed for it.
• Confirm the collaborator’s identity through your established contact route.
• Review the permissions displayed by the real service before authorising access.
• Set a review date and retain a private record of who should still have access.
• When work ends, check both the team role and any separately connected application.

If you notice an unfamiliar change

First distinguish an account-access issue from delivered music appearing on the wrong profile. Unexpected metadata does not by itself prove that someone signed into your account. Use the profile-mapping guide for a misplaced release and the incident-record guide for a possible rights or impersonation issue.

If there are unfamiliar sign-ins or security changes, use the provider’s official account-security and recovery route. Preserve the time, affected public URL and a short description. Do not send DistroBolt passwords, one-time codes, recovery codes or payment details. DistroBolt can review the release-side issue; recovery of a third-party login remains subject to that provider’s process.

Run a release-team access review

• Each important public profile has a known responsible account owner.
• Recovery methods have been checked privately by that owner.
• Collaborators use appropriate individual roles where supported.
• Old team invitations and connected applications have been reviewed.
• The team knows where to report an access issue without sharing credentials.

Working checklist only. Ticks are not saved or sent to DistroBolt.

A fictional band’s designer leaves after creating its cover. The band retains the approved artwork and removes access that is no longer needed, while the designer keeps the files their contract permits. This is an access-management example, not a statement about ownership or an instruction to delete somebody else’s material.

Common questions