If your outbound stack asks an agency teammate to paste a LinkedIn password into a form and then stores that password "for reconnects," stop and rethink the threat model.
LinkedIn accounts are high-value identity. They carry personal network graph, messaging history, and often Sales Navigator access. A password sitting in an outbound vendor database is a gift to whoever eventually breaches that database. Agencies feel this more than single-seat teams because one platform may hold credentials across many client-facing identities.
What LinkedIn itself signals about risk
LinkedIn's Sales Navigator help is explicit that third-party software which scrapes, modifies, or automates activity on LinkedIn's website is prohibited, and that members using those tools risk account restriction. Separately, Sales Navigator has moved toward stronger account security expectations, including requiring two-factor authentication for users.
Official CRM integrations lean on OAuth-style connected apps and admin-controlled authentication, not on "leave us your password." That pattern is the industry default for a reason: scoped, revocable tokens beat durable shared secrets.
None of that means every connection method looks identical. It does mean "we keep your LinkedIn password forever" should fail a basic buyer review.
The agency failure mode
Agencies connect many LinkedIn identities: client founders, client SDRs, agency operators acting for a client brand. Without hard rules you get:
- Passwords reused across tools and written in onboarding docs
- Former contractors who still know a client login
- A single vendor breach that exposes many clients at once
- Confused ownership when an account gets restricted and nobody knows which tool was holding the session
Client-isolated workspaces help only if credentials are not copied into a shared vault by habit.
What "never persisted" should mean
GTM's stated posture is direct: LinkedIn passwords are forwarded to the connection vendor and never persisted. That is the right shape for agency buyers to demand.
Translate it into diligence questions:
- Do you store LinkedIn passwords at rest in your own database?
- If a connection vendor is involved, what do they store, for how long, and under what controls?
- Can a user revoke access without emailing support to "delete the password row"?
- Are LinkedIn connections scoped to one client workspace identity?
- What happens on staff offboarding for that workspace?
If a vendor cannot answer in plain language, assume the password is their problem until proven otherwise.
Practical controls while you evaluate tools
- Prefer OAuth or vendor-mediated connection flows over password paste when available
- Require MFA on every LinkedIn account used for outbound
- Keep one identity per workspace purpose; do not share logins across clients
- Document who owns reconnects when a session dies
- Review connected apps and active sessions on a schedule
- Never put LinkedIn passwords in Notion, Slack, or the CRM note field
Also respect platform rules. Automation that scrapes or drives LinkedIn outside permitted paths is not a clever growth hack. It is how accounts get restricted while you are mid-campaign for a paying client.
How this fits the rest of the motion
Credentials are one slice of trust. Agencies still need compliance gates before send, stop-on-reply, suppression that survives purge, and US residency clarity when buyers ask. Password handling is simply the slice that fails loudly and personally when it goes wrong.
GTM runs email and LinkedIn inside isolated client workspaces as part of find → qualify → write → send/reply/book. The LinkedIn connection path is designed so passwords are not kept as a platform souvenir.
CTA
If you want agency outbound where LinkedIn connections are handled without parking passwords in the product database, join the GTM waitlist at https://trygtm.com/waitlist.
Sources
- LinkedIn: Prohibited software and extensions
- LinkedIn: Two-factor authentication in Sales Navigator FAQs
- LinkedIn: Install the Sales Navigator OAuth app
- GTM product knowledge (
/workspace/trygtm/knowledge/product.md)