A method for controlling access to client data by support providers includes initiating a session on a server computer in response to receipt of a request for assistance from a client, the session having client data associated therewith. A session key is generated for the session. The session key includes a session identifier and a support provider identifier corresponding to an assignee. The session key may further include a client identifier corresponding to the client. Requests to access the client data include an assignee key including a session identifier and a support provider identifier, and potentially a client identifier if needed. The assignee key is compared to the session key. If correspondence is found between the identifiers in the assignee key and the session key, access is granted. A corresponding apparatus and computer program product are also described.