External VA's, client data, and IP: What would you do in this situation?
Looking for some perspective from other operators who use (or have transitioned away from) third-party VA agencies. When working with an external VA agency, their staff inevitably touches customer phone numbers, addresses, payment notes, door/lockbox codes, internal pricing sheets, and custom messaging workflows. If you found yourself in a situation where you parted ways with an agency—or suspect client lists, proprietary operational workflows, or internal training templates are being reused, retained, or shared outside your agreement, how did you handle it?
Specifically:
- Did you rely on legal/contractual enforcement (NDAs, non-competes), or is pursuing that across borders essentially impossible?
- What immediate technical steps did you take to lock down data access, revoke shared credentials, and audit what was exported?
- How transparent were you with your clients if you couldn't verify whether contact lists were downloaded?
Curious how others have contained the fallout or structured their tech stack to prevent this from happening in the first place.