Skip to main content

Partner Sub-Account Access and NDA SOP

Purpose​

Step-by-step procedure for allocating a GHL sub-account to an external partner or contractor, including NDA execution and record-keeping. This ensures partners can access the platform while protecting SC's client data and platform configurations.

When to Use​

  • Onboarding a new development partner who needs to explore or work within GHL
  • Granting a contractor access to a test/demo sub-account
  • Providing a partner a sandbox environment for technical validation before project kickoff

Prerequisites​

  • Partner/contractor relationship approved by SC leadership
  • Appropriate snapshot identified (see KB-009: Snapshot Selection Guide)
  • Partner's business email address (no @symphonycore.com accounts for contractors)

Procedure​

Step 1: Execute NDA​

Before any platform access is granted, obtain a signed NDA.

  1. Prepare NDA document

    • Use SC's standard contractor/partner NDA template
    • Include: confidentiality obligations, data handling, IP assignment, term, and jurisdiction
    • Customize partner name, entity details, effective date

  2. Send NDA for signature

    • Email NDA to partner's business email
    • Use DocuSign, HelloSign, or PDF signature (partner's preference)
    • Track status in the partner's engagement record

  3. Confirm execution

    • Receive signed copy from partner
    • Store signed NDA in Google Drive: symphony-core-documents-storage/10-people-operations/partners-team-folders/partner-[companyname]/
    • Record NDA status and date in the contractor engagement record

Do NOT proceed to Step 2 until NDA is signed.

Step 2: Determine Sub-Account Type​

ScenarioSub-Account TypeNaming Convention
Partner needs to explore/evaluate the platformDemo sub-account from appropriate snapshotz. [Partner] Partner Demo
Partner will work on an existing client projectUse existing client sub-account (grant user access only)No new sub-account needed
Partner needs a development sandboxDevelopment sub-accountz. [Partner] Dev Sandbox

Snapshot Selection Guide:

Client IndustrySnapshot
E-commerce / retailz.sc.Ecommerce.Base-2025-10-27-v1
Real estatez.sc.Real-Estate-Base-2025-10-06-v1
Professional servicesz.sc.Prof-Services-Base-2025-10-16-v1
Small business (US)z.sc.Small-Biz-Base-2025-10-15-v1
Small business (non-US)z.sc.non-US-Small-Biz-Base-2025-10-10-v1
E-learningz.sc.E-Learning-Base-2025-11-01-v1

Reference: KB-009: Snapshot Selection Guide

Step 3: Create or Allocate Sub-Account​

Option A: Create New Demo/Sandbox Sub-Account​

  1. Navigate to Agency View > Sub-Accounts
  2. Click "Create New Sub-Account"
  3. Load snapshot: Select the appropriate deployment-ready snapshot (green)
  4. Name the sub-account: z. [Partner Name] Partner Demo
    • The z. prefix sorts it to the bottom and marks it as internal/non-client
  5. Configure sub-account settings:
    • Business name: "SC Partner Demo - [Partner Name]"
    • Timezone: Partner's local timezone
    • Email: Use SC operations email (not partner's)
  6. Enable WordPress (if partner needs WordPress access):
    • Agency View > Sub-Accounts > select sub-account > toggle "Offer WordPress"
    • Purchase WordPress Standard plan ($10/mo) if needed
    • Follow WordPress Setup SOP for site creation

Option B: Grant Access to Existing Client Sub-Account​

  1. Navigate to the client's sub-account
  2. Go to Settings > My Staff (or Team Management)
  3. Add new user with partner's email (see Step 4)
  4. Set appropriate role — typically "User" with limited permissions
  5. Restrict access to only the sections they need (do not grant full admin)

Step 4: Create User Access for Partner​

  1. Navigate to the target sub-account > Settings > My Staff

  2. Click "Add Employee" or "Invite User"

  3. Enter partner details:

    • Name: Partner's full name
    • Email: Partner's business email (NOT @symphonycore.com)
    • Role: Select appropriate permission level

  4. Set permissions (principle of least privilege):

    Permission AreaDemo/SandboxClient Project
    Contacts/CRMFull accessRead-only or limited
    Workflows/AutomationsView + editView only
    WordPressFull accessFull access (for developers)
    SettingsLimitedNo access
    BillingNo accessNo access
    Phone/SMSNo access (unless testing)No access

  5. Send invitation — partner receives email to set up their account

  6. Provide WordPress credentials separately if WordPress access is needed:

    • wp-admin URL
    • Username and temporary password
    • Require password change on first login

Step 5: Update Records​

  1. Create or update contractor engagement record

    • Use Contractor Engagement Record Template
    • Document: NDA date, access granted, sub-account name, permissions, expiration date
    • Store at: 10-people-operations/employment/[name]-engagement-record.md

  2. Update Contractor Registry

    • Add partner to contractor-registry.md
    • Include: entity name, location, tax residency, payment method, services, engagement date

  3. Create partner contact profile (if not already existing)

    • Use Partner Contact Template
    • Store at: Google Drive symphony-core-documents-storage/10-people-operations/partners-team-folders/partner-[companyname]/[company]-contact.md

  4. Log access in platform access tracker

    • Record: who has access, what level, when granted, expiration date
    • Include in engagement record under "Platform Access Granted" section

Step 6: Set Review and Expiration​

  1. Set access expiration date:

    • Demo/evaluation accounts: 2 weeks from creation
    • Active project accounts: project end date + 30 days
    • Ongoing retainers: quarterly review

  2. Create calendar reminders:

    • 1 week before expiration: review and decide to extend or revoke
    • On expiration date: execute access revocation if not renewed

  3. Document expiration in engagement record

Step 7: Offboarding / Access Revocation​

When the engagement ends or access expires:

  1. Revoke GHL sub-account access

    • Navigate to sub-account > Settings > My Staff
    • Remove partner's user account
    • Change any shared passwords

  2. Revoke WordPress access

    • Remove wp-admin user account
    • Change admin password if shared

  3. Deactivate demo sub-account (if applicable)

    • Archive or delete the z. [Partner] Partner Demo sub-account
    • Cancel associated WordPress hosting plan ($10/mo savings)

  4. Revoke Google Drive access

    • Remove sharing on partner shared folder
    • Verify no residual access

  5. Update records

    • Update engagement record with end date and access revocation date
    • Update contractor registry status to "Inactive" or "Completed"
    • Note any outstanding invoices or deliverables

  6. Retrieve deliverables

    • Confirm all source files, design files, and documentation have been transferred to SC
    • Verify SC has access to all work product

Record-Keeping Checklist​

For each partner engagement, maintain the following records:

DocumentLocationStatus
Signed NDAGoogle Drive: partners-team-folders/partner-[company]/Required
Contract/SOWGoogle Drive: partners-team-folders/partner-[company]/Required
Engagement RecordRepo: 10-people-operations/employment/Required
Contractor Registry EntryRepo: 10-people-operations/contractor-registry.mdRequired
Partner Contact ProfileGoogle Drive: partners-team-folders/partner-[company]/Recommended
W-9 (US only)Google Drive: partners-team-folders/partner-[company]/If applicable
InvoicesGoogle Drive: partners-team-folders/partner-[company]/invoices/As received

Document Maintenance​

Review Schedule: After each new partner onboarding, or quarterly Update Triggers: GHL permission model changes, new access requirements, NDA template updates

Access Level: internal-team