A practical ownership guide for startups and SMBs about to hire, switch, or fire a web or marketing vendor. Which accounts your business must own outright, which roles to hand out instead of passwords, and what to check before you sign the next contract.

7 minutes · 5 October 2026 · Nabiulla Ahmed

Before you hire another web vendor, make sure your business owns its domain, hosting, website admin, analytics, and ad accounts — and the vendor only has access you can remove. Most ownership problems stay invisible until the day you try to leave: the domain is registered in a freelancer’s name, the hosting renews on their card, and the Google Business Profile or Meta page answers to their email. Fixing that takes an hour while the relationship is friendly. It can take weeks once it is not.

Why ownership problems only show up when you try to leave

When a website launches, speed wins. The vendor buys the domain “to save time,” creates the hosting account, sets up analytics under their own login, and sends you a password in a chat message. Nothing breaks, so nobody revisits it.

Then something changes — the freelancer gets busy, the agency raises its retainer, or you want a rebuild elsewhere — and the gaps surface at once:

• The domain is not legally yours — The registrant on record is the vendor or their company, so moving it needs their cooperation.
• Renewals sit on someone else’s card — A missed renewal can take your site and business email offline together.
• History is locked away — Years of analytics, Search Console data, and ad-account learning live under logins you never held.
• Nobody has a clean backup — The only full copy of the site is on hosting you cannot log in to.

None of this requires bad intent. It is usually convenience that was never undone.

“A vendor should be a guest in your accounts with a key you can take back — not the landlord of your website.”

The accounts your business must own, not just use

“Owning” means the account is registered to the business, billed to the business, and recoverable through an email address and phone number the business controls. Check each of these:

• Domain registrar — Registrant name and email are your business, with auto-renew on and a valid card on file.
• DNS — Wherever your DNS is managed (registrar, Cloudflare, or host), you hold the top-level login.
• Hosting and control panel — The hosting plan and cPanel or cloud console are in your name, not reseller space inside the vendor’s account.
• Website admin — At least one administrator account on WordPress, Shopify, or your CMS belongs to a person in your business.
• Business email — Google Workspace or Microsoft 365 super-admin sits with you, because email resets every other password.
• Analytics and search — Google Analytics and Search Console properties list you as owner or administrator.
• Listings and social — Google Business Profile, Facebook and Instagram pages, and your WhatsApp Business account sit inside a business portfolio you own.
• Ad accounts and payments — Google Ads, Meta ad accounts, and the payment gateway are billed to and controlled by the business.
• Code and backups — For custom builds, the repository and an off-server backup are accessible without asking anyone.

Owner versus user: the access roles that actually matter

Most platforms let you give a vendor real working access without giving away ownership. Use the role, not the password:

• Google Search Console — Keep yourself as a verified owner; add vendors as full or restricted users.
• Google Analytics — Your account holds Administrator; vendors usually need Editor or Marketer, not admin.
• Google Business Profile — You stay primary owner; the vendor is added as a manager.
• Meta business portfolio — Your business owns the pages, ad accounts, pixel, and WhatsApp assets; the agency gets partner access to the specific assets it needs.
• Google Ads — Your business owns the ad account; an agency links it to their manager account, and either side can unlink.
• Website and hosting — Each vendor person gets their own named login at the lowest role that does the job, so you can remove one person without resetting everything.

The test is simple: if the vendor disappeared tomorrow, could you remove their access and keep working the same afternoon? If the answer is “we would need their password,” ownership is in the wrong place.

Domains: the lock and renewal traps you don’t see coming

The domain is the one asset that takes your website and your email down together, so it deserves extra care.

• Check the registrant, not just the login — A WHOIS or registrar lookup may show privacy service details; ask the registrar or vendor to confirm the legal registrant is your business.
• Know the transfer locks — Under ICANN’s Transfer Policy for generic domains like .com, a change of registrant can trigger a 60-day lock on moving to another registrar unless you opt out beforehand where the registrar allows it. ICANN has been reviewing these lock periods, and country-code domains follow their own registry rules, so confirm current terms with your registrar before you change ownership details.
• Order the steps — If you plan to move registrars and change the registrant, sequence it deliberately so a lock does not strand you mid-migration.
• Keep the auth code path open — Transfers need an authorization (EPP) code sent to the registrant email. If that inbox belongs to the vendor, you depend on them.
• Turn on auto-renew with two contacts — Expiry notices should reach the business, not only an ex-vendor’s inbox.

“Fixing domain ownership takes an hour while the relationship is friendly. It can take weeks once it is not.”

How to give a vendor access without handing over the business

Good vendors prefer clean access too — it protects them when something goes wrong. Set it up like this:

• One person, one login — No shared “admin@” accounts passed between freelancers.
• Least privilege by default — Start with the lowest role that does the job; raise it for a task, then lower it again.
• Two-factor on owner accounts — Tie it to a business phone or authenticator, and store backup codes somewhere the business controls.
• A password manager, not chat threads — Share access through vault items or invites you can revoke.
• An offboarding checklist — When a vendor relationship ends, remove users, rotate any shared credentials, and confirm backups still run.

A 30-minute ownership audit before you sign the next contract

Run this with whoever manages your website today. Write the answers down in one place:

• Who is the legal registrant of our domain, and when does it renew?
• Whose name and card is the hosting billed to? Can we log in to the control panel ourselves?
• Which person in our business is an administrator on the website, email, analytics, Search Console, and Business Profile?
• Do our pages, ad accounts, and WhatsApp number sit in a business portfolio we own?
• Where is the latest full backup, and have we ever restored one?
• If we ended the contract today, what would we need to ask the vendor for?

Anything on that last list is a dependency. Close it before you add a new vendor on top of an old one.

What to write into the vendor contract

A short ownership clause prevents most disputes. Ask for:

• Accounts in the client’s name — Domain, hosting, and platform accounts are created under the business, or transferred to it at go-live.
• Clear ownership of deliverables — Content, design files, and custom code you paid for belong to you once paid, with any licensed themes or plugins named.
• Credential and documentation handover — A written list of accounts, roles, and integrations at launch.
• Exportable backups — Regular backups you can download, not only restore inside the vendor’s tools.
• An exit process — What the vendor hands over, and how fast, if either side ends the engagement.

Build on accounts you control

Before you hire, switch, or scale with another web vendor, make sure the foundations are yours: domain, DNS, hosting, website admin, business email, analytics, listings, and ad accounts. Give vendors named roles you can remove, keep backups you can reach, and put the handover in writing. Then every future decision — a redesign, a new agency, an in-house hire — becomes a choice rather than a negotiation.

TechyXen builds websites, CRM, booking, ecommerce, and automation systems on accounts owned by the client, with role-based access and a documented handover at go-live. If you are unsure who holds the keys today, we can walk through the audit with you.

Web development · Automation & AI · Contact · WhatsApp · Call

Related reading

• Website maintenance retainer or rebuild — choose the contract for the job you have
• Website, CRM, and bookings as one stack — stop losing leads between tools
• A process audit before another SaaS seat — map the work, then buy the tool