Who has the keys to your clients' Google Ads accounts?
A guided, read-only Access Audit for agencies. In the agreed screen-share sessions we go through your manager account and each client account in scope to look for former staff, unknown users, forgotten invitations, unknown linked managers and unexplained changes. You click, we watch: no passwords, no access to your accounts, no changes.
Explore the audit scope · founding price $290
See the page your clients get (PDF) · Sample agency report (PDF)
Prefer to talk first? Email us for a free 15-minute call. Founding price: $290 for up to 25 accounts, for the first 3 agencies. Details.
Why review access
- Agency manager accounts are being targeted. In April 2026 Search Engine Land published an agency's first-hand account: with 2-Step Verification and domain restrictions turned on, attackers still got in through one employee, removed legitimate users, added their own, created a new manager account in the agency's name and invited its clients. Read it.
- Don't assume two-admin approval is protecting you. Google's help says Multi-party approval applies to accounts with more than 3 administrators, and that read-only and API users are exempt. Google's page.
- Connected tools are easy to miss. We haven't found a list of connected apps inside Google Ads. Google says changes made through the API might appear in Change history as "Google Ads API" or a tool name, and that some account-level changes may not be listed. Google's page.
What we look for, account by account
| People who should be gone | Former employees and freelancers who still have access, and users nobody on the call recognises. |
|---|---|
| Weak sign-ins | Who signs in with a password only. Only administrators can see each user's sign-in method and last sign-in, so an admin joins the call. |
| Single points of failure | Accounts with one trusted administrator, and clients with no admin on their own account. |
| Open doors | 2-Step Verification not required, no allowed email domains, old invitations to outside addresses. |
| Unknown managers | Manager accounts linked to a client that nobody on the call recognises. |
| Unexplained changes | Changes in the last 90 days by people or tools that aren't on your team or tool list. |
How it works
- Agree scope before payment: account count, authorised administrator, dates and private meeting/delivery methods. Only after those are agreed do we request the prep list through the private channel. Do not email client inventories.
- A guided screen-share. We estimate 60–90 minutes for up to 25 accounts, pending an operational rehearsal. Scope and duration are confirmed before payment. Your administrator clicks; we guide, look and take notes.
- Within 3 business days after complete capture: the HumanLS Access Report (web + PDF) and a clean-up checklist ordered by severity, with the relevant Google Ads setting for your administrator to review.
- Around day 14: a second review with duration agreed before payment. Client pages require a fresh review of the client account and its manager account, with no critical or high findings remaining in either. Eligible accounts receive a page with your agency's brand.
If we see signs of a takeover in progress, we pause and refer your administrator to Google's official process. We do not provide incident response or recovery.
See a sample (fictitious agency, masked addresses)
- Agency report from the first session (PDF)
- Client page with the agency's brand, after clean-up (PDF)
Price
Up to 25 accounts
$490
One session · report · checklist · day-14 review · client pages.
Up to 75 accounts
$890
Two sessions · everything in the first plan.
Accounts include your manager account. More than 75 accounts: ask for a quote. Paid in advance; full refund if you cancel before the first session; free rescheduling with 24 hours' notice. Terms.
What the audit isn't
- It isn't a certification, and no review can promise an account is safe.
- It's a point-in-time look at what Google Ads shows. It doesn't detect stolen sessions, malware or phishing.
- We don't change anything, recover accounts or act for you. Google payments profile users (billing) are outside the review.
Your data
We note only what the report needs: addresses, access levels, settings and who made changes. Screenshots, if you allow them, are deleted when we deliver the report for that session. We never record sessions and never contact your clients. Happy to sign your NDA before the session; invoice on request. Privacy.
About me
I'm Nicolas, the person behind HumanLS. The service is a guided, read-only review: your administrator stays in control of the account. See the fictional sample above for the proposed deliverable.
One service, a point-in-time review
Continuous monitoring is not available and is not included. We are not taking monitoring reservations or deposits and have no launch date to promise.
Explore the audit scope · founding price $290
Prefer to talk first? Email us for a free 15-minute call.