The first question is: who owns the profile?
The business should control the primary owner account. A provider can be added as a manager for the work it has agreed to perform. Google created owner and manager roles so people do not have to share sign-in credentials.
Do not send a provider your password, authenticator secret, backup codes, or one-time verification code. Shared credentials blur the record of who made a change and can make a routine offboarding needlessly difficult.
- The business remains the primary owner.
- Each person uses an individual account and the minimum role needed.
- Two-step verification is enabled where the account supports it.
- Access removal is part of the written offboarding plan.
Primary sources: Google third-party policies · Google guidance for working with third parties
Ask what the fee buys
A Google Business Profile is free. A provider may charge for its time, tools, advice, implementation, monitoring, or reporting. Those management fees should be clear, along with any advertising spend or third-party software cost.
Request a list of actual deliverables. “Monthly optimization” could mean a careful review of categories, services, photos, customer questions, website alignment, and performance. It could also mean one generic report. The written scope should remove that ambiguity.
- Which profile fields and supporting website pages will be reviewed?
- Which changes need the owner’s consent before they are made?
- Are citation, website, review, photo, or posting tasks included?
- Which tools or media costs are billed separately?
- What files, logs, and access will the business receive at the end?
A useful report tells you what happened
Ask to see the reporting format before signing. It should separate work performed from results observed. A profile edit, a map ranking sample, a direction request, a website form, and a qualified lead are different events.
The report should also include a change log. If visibility changes, the owner needs to know what was edited and when. Where attribution is limited, the provider should say so instead of presenting an estimate as a platform-confirmed fact.
Know the tactics that put the business at risk
Guaranteed top-three placement is a warning sign because no provider controls Google’s results. So are instructions to add keywords to the real-world business name, buy reviews, create a replacement profile to escape enforcement, or verify an office where the business does not genuinely operate.
A responsible provider will sometimes advise against a requested tactic. That is part of protecting the account. It should be able to show the applicable Google guidance and offer a compliant alternative when one exists.
Primary source: Google third-party policies
Plan the ending before the work starts
A clean engagement can end without an account dispute. The contract should explain notice, final reporting, exportable files, outstanding costs, and when the provider’s access will be removed.
Before removing access, confirm that the business has an active owner account, current recovery options, and copies of the agreed records. The provider should not hold the profile, website, domain, analytics, or advertising account hostage to keep a client.
Primary source: Google guidance for working with third parties
Key takeaways
- Keep the business as primary owner and grant individual manager access.
- Get deliverables, fees, consent rules, reporting, and offboarding in writing.
- Expect a change log and reporting that separates activity from outcomes.
- Reject ranking guarantees, shared passwords, fake locations, and policy-evasion tactics.
Primary sources
Verify the platform guidance
Platform rules in this guide come from the official sources below. The practical recommendations are Biancorp's interpretation of how to apply them carefully.