Never share your portal password with a vendor

At some point almost every trade owner has done it: a permit runner, an office helper, or a software vendor asks for access to the county portal, and instead of figuring out the sub-user settings, you just text them your login. Job done, problem solved, back to the truck.

The convenience is real. The risk is also real, and it tends to stay invisible right up until something goes wrong — an application filed incorrectly, an inspection scheduled for the wrong address, a fee paid from the wrong account. When that happens, the portal log shows your credentials, your name, and your license number. The person who actually clicked the button is nowhere in the record.

What the portal log actually records

Most county and city contractor portals keep a timestamped log of every action: permit applications submitted, documents uploaded, inspection requests made, fees paid, status changes acknowledged. That log records the username that was authenticated at the time, not the human being sitting at the keyboard.

When you share your password, every action your vendor takes is logged under your credentials. From the licensing board's point of view, you did those things. If an application goes in with wrong information, or an inspection gets cancelled without your knowledge, or a document gets uploaded to the wrong permit, the record says you made that call.

Where licensing boards draw the line

Contractor licensing is a personal credential. Most state boards are explicit that the license holder is responsible for all work and all representations made under that license. Submitting permit applications counts as a representation — you are telling the jurisdiction that the work meets code, that insurance is current, that the contractor of record is who the form says it is.

Some boards go further and treat portal credentials as an extension of the license itself, meaning that sharing them with an unlicensed party could be treated the same way as allowing an unlicensed person to pull a permit in your name. That is a disciplinary matter in most states, not just a paperwork problem.

You do not need to be doing anything wrong for this to become an issue. A vendor who makes an honest mistake — wrong job address, wrong permit type, fee paid against the wrong project — can trigger a compliance review. The board will look at who submitted the application. That is you.

The insurance angle most owners overlook

General liability and contractor's professional liability policies are written around the named insured's own operations. If a loss traces back to a permit application or inspection record that was filed incorrectly, your carrier will look at who had authority to act in the portal.

If the answer is a third party operating under your credentials without a documented authorization, the carrier has grounds to argue the loss falls outside the policy's scope. That conversation is much harder to have after a claim than before it.

What a named sub-user account actually does

Most state and county contractor portals, including the DORA systems used in several states, the eLicensing portals common in the Southeast, and the majority of municipal permitting platforms built on Accela or Tyler Energov, have a sub-user or delegate function. It is usually in account settings, labeled something like 'manage users,' 'add delegate,' or 'authorized representatives.'

A sub-user gets their own login credentials tied to your license account. They can be given specific permissions, submit applications, request inspections, upload documents, without access to billing, license renewal, or account settings. Every action they take is logged under their name, not yours, while still being associated with your license account.

When the relationship ends, you deactivate their login. Your password never changes. No other vendor or helper who ever had access needs to be notified or locked out, because they never had your credentials to begin with.

Setting one up: what to expect

The process varies by jurisdiction, but it is almost always shorter than it looks. Log into your contractor portal, find account or profile settings, and look for a user management or delegate section. You will typically enter the sub-user's name and email address, assign a permission level, and save. They receive an email to set their own password.

If your portal does not have a sub-user function, some older county systems do not, the right move is to create a shared business email address that you control, such as permits at your company domain, and use that as the portal login. The vendor gets access to that email account only, not your personal credentials, and you can revoke email access independently of the portal.

Either way, document it. A short note in your files, who has access, what permissions, when it was granted, takes two minutes and gives you a clean record if a board or carrier ever asks.

The same logic applies to other business accounts

Contractor portals are the highest-stakes example, but the principle runs across every business account a vendor might ask to access: your Google Business Profile, your scheduling software, your phone system, your payment processor. Each of those platforms has its own user management system, and each one has a reason it exists.

A scheduling or phone platform vendor who needs to configure something on your behalf should be added as an admin user with their own login, not given your owner credentials. If something goes wrong with the configuration, you want the log to show their account made the change, not yours. And when the project is done, you remove their access in thirty seconds without touching your own login.

This is where a tool like cheaply is worth mentioning: it connects to your existing phone number and calendar through its own integration layer, so there is no point at which the setup requires you to hand over a master password to anything. The access it needs is scoped to what it actually does, answering calls, sending texts, booking jobs, and it operates under its own authenticated connection, not your personal credentials.

When to audit who has access

Most trade owners have never looked at the user list on their contractor portal. If you have worked with a permit runner, an office manager, or a licensing service in the last few years, there is a reasonable chance someone has access you forgot about.

Pick a slow afternoon, before a busy season, after a slow one, and pull up account settings on every platform that touches your license or your money. Remove anyone who no longer works with you. Confirm that current helpers are on named sub-user logins, not your personal credentials. It takes less time than a single permit application and it closes a category of risk that most owners do not think about until they need to.