Ten People, Forty Ad Accounts, Zero Shared Passwords: How Dolphin Handles Team Access

Every team that runs more than a handful of ad accounts arrives at the same afternoon. There is a spreadsheet. Column A is the account, column B is the email, column C is the password, and column D is a note that says ask Marco for the code. Marco is on a plane. Team access without sharing passwords is the problem that column C keeps failing to solve.

The problems that spreadsheet creates are not hypothetical and they are not evenly distributed. The 2FA is bound to one person's phone. The buyer who left in March still has a browser somewhere with a live session in it. Nobody can say who changed the budget on the account that spent triple on Sunday, because six people were in it and the platform saw one login. And the first time a client asks for an access log, you discover you are reconstructing history from a chat thread.

Dolphin solves a real part of this, and it solves it well. It is worth understanding exactly which part, because the other part does not go away, and the two are usually bought from different places.

What Dolphin actually does about the spreadsheet

The relevant machinery is listed on the pricing page itself, in the plan-comparison table — read on 29 August 2026 at dolphin-anty.com/tarifs/. Under "Team collaboration" the page lists:

• user creation and a per-user profile creation limit
• roles: Admin, Team Lead and User
• profile sharing with permissions
• folder sharing, proxy sharing, scenario, bookmark, extension and start-page sharing
• internal profile transfer and cross-account profile transfer
• profile transfer verification with black and white lists
• filtering by users, tags, notes, statuses, sites and folders

Alongside those, on the general profile-management rows: profile passwords, an audit log, tags, statuses, notes, folders and a trash bin. The "switch between Anty accounts" row is explicit about scale — no access on Free and Starter, then 2, 3 and 10 accounts as you go up the tiers.

Read that list as an operations person and the design intent is obvious. The unit of delegation is the profile, not the credential. A team lead creates a profile, logs into the ad account inside it once, and then hands the profile to whoever is working that account this week. The junior buyer never sees the password, never touches the 2FA, and when they leave you revoke the profile instead of rotating credentials across forty accounts. The transfer verification lists exist because handing a profile to the wrong person is the failure mode this design creates, and they built a guard for it.

That is a genuinely good answer to the spreadsheet, and it is better than what most teams do instead, which is nothing.

What it costs, per person

This is the part that decides whether the answer is available to you, because on both Dolphin products the seat is a paid add-on that does not exist on the entry tiers.

On Dolphin{anty}, read the same day: every plan ships with one user. Free and Starter both print additional users cannot be purchased. From Base up, an extra user is $10/month; on Team it is $20; on Enterprise, $25. So the cheapest configuration that supports three people is Base at $89 plus two users at $10 — $109/month, not the $10 on the Starter card.

On Dolphin{cloud}, read on 29 August 2026 at cloud.dolphin.tech: the 3-day trial carries 3 users and cannot be extended, Light ($9.99) and Start ($29) are single-user with no add-on, Base ($49) sells an extra user at $20/month, and Pro ($99) at $30. A four-person team on Pro is $189/month.

We put the full arithmetic, including the proxy line that neither price list prints, in a separate breakdown of Dolphin pricing across both products. The short version for this article: team access is where the bill starts growing, on both products, and it grows per head.

The question the profile layer cannot answer

Here is the sentence that matters, and it is not a criticism of anyone's product — it is a property of where the layer sits.

A shared profile is a shared session. Two people holding the same profile have the same power inside the ad account, because the ad platform sees one login.

Which means the profile layer can decide who gets in. It cannot decide:

• who may raise a budget and who may only pause
• who may launch to a live audience and who may only prepare drafts
• who may connect a new payment method
• what actually changed on Tuesday at 14:40, attributed to a person rather than to a session

Some of that can be pushed down into the ad platform itself — Meta Business Manager roles, partner access, per-asset permissions — and for a team with a handful of accounts that is often the right answer, done natively, for free. We wrote about when a native permission model beats a dedicated layer, and the honest conclusion there is that under about ten accounts you probably do not need anything else.

Past that, the native model stops scaling for a specific reason: it is per-platform, per-account and per-asset, so a ten-person agency with forty accounts across several platforms ends up maintaining the same permission decision in six different admin interfaces, by hand, and discovering the drift during an offboarding.

The layer above, and what it decides

This is where we sit, and the division is clean enough that we do not pretend otherwise: Dolphin solves access and identity; we solve campaign operations. Different layers of the same stack, which is why plenty of teams keep both. Their profile gets you into the account. What happens after that — launching, budgeting, rules, margin, reporting — is a different job with different questions.

On permissions specifically, the structure is four levels: organization → team → workspace → access group. Workspaces carry the data isolation, so a buyer assigned to one client's workspace does not see another client's numbers, and access groups let you attach a set of people to a set of assets without inventing a new team for every combination.

Two things sit on top of that and matter more in practice than the org chart does:

The audit log is queryable in plain language. Every mutation is recorded, and the assistant carries a query_audit_log tool, so "who changed the budget on this campaign last Tuesday" is a question you ask rather than a reconstruction you attempt. For anyone who has had to produce an access history for a client under time pressure, that is the feature, not the org chart.

Autonomous actions have money guardrails, on by default. EUR 50 for a single autonomous budget move and EUR 200 a day per team, both set in the shipped defaults rather than in a sales deck. There is also an asymmetric brake worth knowing about, and the reasoning behind it is written in the code rather than in marketing copy: when you stop autonomy, activations, budget increases and relaunches halt — but pause and budget decrease keep running, because those are the stop-losses protecting the same money. A symmetric switch would disarm someone's overspend protection at the exact moment they reached for the emergency handle.

A concrete handover, in both layers

A new buyer joins on Tuesday and leaves in October. Here is what actually happens in each layer, in order, because this is the only test of a permission model that means anything.

Day one, access layer. Create the user under Dolphin. Assign the role — User, not Team Lead. Share the specific profiles for the two accounts they will work, with permissions, not the folder that contains everything. Do not share the proxies they do not need. Note that they can now open those sessions from their own machine without ever seeing a password.

Day one, campaign layer. Add the seat. Put them in one workspace, not the organization. Give them the role that allows pause and prepare, not the one that allows budget increase. Leave autonomy guardrails at the default; they apply per team, not per person, so a new starter cannot outspend the day cap by accident.

Week six, the useful test. Something spent wrong overnight. In the access layer you can see which profile was opened. In the campaign layer you ask who changed what and get an answer with a timestamp and a name attached. The two answers together are a story; either one alone is half of it.

October, offboarding. Access layer: revoke the profiles, transfer them to whoever picks up the accounts, use the transfer verification list so they do not land with the wrong person. No credential rotation, which is the entire point of the design. Campaign layer: remove the seat, reassign their workspace, and the audit history stays — the person leaves, the record does not.

The order matters. Revoke access before you revoke authority and you get a clean cut. Do it the other way round and there is a window where someone has a live session and no accountability trail.

Where our model is worse, and by how much

Concession, stated plainly, because a page that only flatters one side is not worth your time.

Our seats come in fixed steps and cannot be bought one at a time. One, two, five, ten, thirty, bundled into the plan. There is no per-seat add-on. If you are eleven people you change plan, and that step is steep. Dolphin sells you a sixth user for $30/month and that is genuinely a better fit for a team that grows one person at a time. If your headcount moves in ones rather than in fives, their model will cost you less and annoy you less.

We have nothing at the identity layer, and we are not building it. No browser profiles, no fingerprints, no proxy management. If your constraint is how do I open forty accounts from one machine without them looking like one machine, we are not the answer to that question and no amount of our features changes it. That is their trade.

One clarification while we are being precise about our own numbers, because it is the kind of thing that gets misread: there are flat structural ceilings in the platform — 100 workspaces, 50 teams, 200 memberships — but those are abuse ceilings, not your entitlement. The commercial seat cap is the one on your plan, enforced separately. Anyone quoting "100 workspaces" as a selling point has read the wrong constant, and we would rather say so than let it sit in a comparison table.

The short version

Passwords in a spreadsheet is a solved problem, and Dolphin solves it at the layer where it belongs: the session, shared with permissions, revocable without a credential rotation. Budget it per head, because both Dolphin products charge per user and neither entry tier lets you buy one.

Then answer the second question separately, because the profile layer structurally cannot: who is allowed to move money, and how you prove afterwards who did. That lives one layer up, in whatever runs your campaigns — natively inside the ad platforms if your account count is small, in a permission model with an audit log if it is not.

If you want the campaign-layer version of that in detail, we keep a guide on setting up agency team roles across ad accounts, and a longer piece on running many accounts without a shared login. The features page for team management has the current permission model.