Three sites, five people and seven actions come to 105 yes or no decisions. One illustrative operator's access table, filled in line by line, with the fraud and card rules that set each answer.
Self storage staff permissions come down to one table: who works which sites, and which money actions they may take. Here is that table for an illustrative operator with three sites, five staff and seven actions, which makes 105 yes or no decisions (5 x 3 x 7). It is easy to make none of them on purpose: a shared counter login, or the manager role for everyone so the phone stops ringing. The Association of Certified Fraud Examiners studied 2,402 fraud cases for its 2026 report, and the typical case ran 12 months before anyone caught it.
Self storage staff permissions for three sites and five people
This operator is made up for the example. Elm Road, Mill Street and Route 9 are the sites. The owner holds all three. One manager runs Elm Road, weekend cover works Elm Road and Mill Street, an area manager covers Mill Street on weekdays and Route 9 all week and oversees Elm Road, and a part-time bookkeeper never touches the counter.
| Action | Owner | Area manager | Elm Road manager | Weekend cover | Bookkeeper |
|---|---|---|---|---|---|
| Sites | All 3 | All 3 | Elm Road | Elm Road, Mill Street | All 3, read only |
| Take a payment, rent a unit | Yes | Yes | Yes | Yes | No |
| Waive a late fee | Yes | Yes | Yes | No | No |
| Refund a card | Yes | Yes | No | No | No |
| Change rates | Yes | Yes | No | No | No |
| Move a tenant to lien or auction | Yes | Yes | No | No | No |
| Export the tenant list | Yes | No | No | No | No |
| Add or remove logins | Yes | No | No | No | No |
Your answers may differ. A two-person family business may say yes to far more. The point is that somebody decided.
Why the Sites row comes first
The Elm Road manager has no daily reason to open a Mill Street tenant record, so that access stays off. The FTC's guide to protecting personal information calls this the principle of least privilege: each employee gets only what their particular job needs. PCI DSS 7.2.1, the card security standard, ties access to job function in the same way.
Sites also change. The FTC tells businesses to have a procedure for workers who transfer as well as those who leave, so moving a manager from Elm Road to Route 9 should end one site's access on the day it starts the other.
Pull the money actions out of the counter role
Among ACFE cases at organizations with fewer than 100 employees, skimming appeared in 17%, against 6% at larger ones, and billing schemes in 28%, against 18%. The median loss at those smaller organizations was $126,000. Across organizations of every size, the median in real estate cases was $250,000.
Take an illustrative late fee of $20: a manager who takes the cash and then waives the fee six times a week, for the 12 months ACFE calls typical, has moved $6,240 (6 x $20 x 52), and each entry looks like ordinary kindness to a renter.
That is why the table splits the rows. NIST's control catalog gives the reason in its separation of duties guidance: it addresses the potential for abuse of authorized privileges. Elm Road can waive a fee, because renters ask at the counter, but only the area manager and owner can refund a card. Then someone other than the person who waived reads the waived-fee list.
Testing self storage staff permissions on a bad Saturday
A table survives until the first sick day. Same illustrative operator: on a Saturday the area manager calls in sick at 8am, and weekend cover has to open Route 9, a site their login cannot see.
The pressure at that moment is to read out someone else's password over the phone. PCI DSS 8.2.2 allows shared accounts only when needed for an exceptional circumstance, for the time needed, with management approval, and with every action attributable to one person. A password read out over the phone fails that last test: once a renter disputes a waived fee, nobody can say who waived it.
Time the proper route instead. How long does it take the owner, on a phone, to add Route 9 to one login? Then check that the access comes off on Monday. If adding a site takes a support ticket, people will go back to sharing passwords.
Leaving day and the logins outside your software
Staff do leave. The Bureau of Labor Statistics put average monthly separations at 2.6% in 2025 for real estate and rental and leasing, the sector that includes self-storage lessors. PCI DSS 8.2.5 says access for terminated users is immediately revoked, and 8.2.6 says inactive accounts are removed or disabled within 90 days.
The management system is the easy one. Keep a written list for the rest:
- Gate codes. Staff codes used on the keypad, including any kept for after hours.
- Google Business Profile. Google's help page says only owners can remove other owners and managers. A newly added owner or manager waits 7 days before they can remove anyone or transfer primary ownership, so add the replacement before the handover if you can.
- QuickBooks. Remove the user and check who holds admin.
- The card processor's portal. Stripe's published roles show how narrow this can go: a Refund Analyst can refund payments but cannot create them or view the balance. Stripe also warns that a user given several roles holds every permission of each one, so ask how your own processor handles it.
Give the bookkeeper reports, not the keys
A bookkeeper needs numbers from every site and has no business in a tenant record. QuickBooks Online shows the model with its View reports role: most reports, no underlying transactions, no audit log, and it does not count toward the plan's user limit.
Read the whole list every six months
PCI DSS 7.2.4 asks for a review of all user accounts and access at least once every six months, vendor accounts included, with management acknowledging the result. Which PCI items apply to you depends on how you validate with your bank, but six months is a sensible date to put in the calendar either way.
In ACFE's cases, lack of management review was the primary weakness in 18% of cases. Organizations using management review as a control saw 55% lower losses and 44% faster detection. Frauds caught in the first six months had a median loss of $40,000, and waiting one to six months longer pushed it to $100,000.
Print the table, cross off anyone gone, and ask why each remaining yes is still a yes.
What location-scoped logins cover, and what to ask about the rest
Staff are invited with their own logins, and what each person can see and touch is scoped per site. That covers the Sites row. An owner runs every location from a single login, with per-site settings and taxes and reports across the portfolio, which is the multi-location self storage management side of the platform.
For the seven action rows, bring the table to a 30-minute demo with any vendor, us included, and ask them to set up your weekend cover live. Start your own copy with the bottom row. It should hold very few yeses.
Questions about staff access at storage sites
Can storage staff share one login?
Avoid it. PCI DSS requirement 8.2.2 allows shared accounts only for an exceptional circumstance, for the time needed, with management approval and every action attributable to one person. A shared counter login cannot tell you who waived a fee.
How quickly should a departing manager lose access?
Straight away. PCI DSS 8.2.5 says access for terminated users is immediately revoked. Do the management software first, then the other logins and any gate code that person held.
How often should an owner review staff access?
At least every six months, the interval in PCI DSS 7.2.4. Also review after any transfer, since the FTC's guide covers workers who move to another part of the company as well as those who leave.
