The Agency or Web Designer Holds Your Keys

Why this matters

Most small shops got their website, their ad campaigns and sometimes their business email from a web designer, a marketing agency or a nephew who was good with computers. It was easiest for that person to set everything up in their own name, and nobody thought about it again. Then the agency raises its price, gets sold, goes quiet, or the relationship ends in an argument, and the shop learns that it does not own its own website, cannot see five years of ad data and cannot change the phone number on its own business profile. Getting admin access in your own name while the relationship is friendly takes an afternoon. Getting it after the relationship ends badly can take months, and sometimes it cannot be done.

The rule, and what "own" means

Every account that carries your business's name, money or customer data must have the shop as its owner, with the vendor as a user you added. Not the other way round.

"Owner" is a specific thing on most platforms, not a feeling. It is the role that can add and remove other users, change billing, transfer or delete the account. A vendor can do excellent work as an admin, manager or editor that you granted, and you can remove them in a minute. If the vendor is the owner and you are the guest, they can remove you.

The second half of the rule: the owner login uses an email address the shop controls, ideally on the shop's own domain, protected by multifactor authentication, with its password in the shop's password manager. An account "in the shop's name" whose login is the agency's email address is still the agency's account.

Do it in dependency order

The order below is not arbitrary. Each asset controls the password resets of the ones after it, so securing them out of order can leave you holding a website login whose reset email still goes to a domain the agency controls.

1. The domain name, at the registrar. The domain is the master key: it decides where your website and your email point, and whoever controls the registrar account can move both. Ask the vendor which registrar holds it and whose account it sits in. If it is in their account, ask them to transfer it into a registrar account you create, in the shop's name, with the shop as the registrant (the legal holder listed in the registration record). What breaks if you skip it: every other step can be undone from here, because a domain owner can repoint your website and email at will. The domain's own setup and renewal habits are their own article; see related: Your Domain Name Is the Master Key.

2. DNS and business email. DNS is the set of records that tells the internet where your website and email live. It may sit at the registrar, at the web host or at a third service. Find out where, and make sure the account that edits it is yours. If your email ([email protected]) runs through a business email service, the administrator account for that service must be yours too, not the agency's. What breaks if you skip it: a vendor who controls DNS can redirect your email, and email is how every remaining account sends its password resets.

3. Hosting. Hosting is the server space where the website files live. Ask whose account pays for it. Often the agency hosts dozens of clients on one plan and bills you a monthly fee for your share, which is fine as a service, as long as you can get a complete copy of your site files and database on request. Ask for that copy now, and store it. What breaks if you skip it: if the agency stops paying the host, closes, or deletes your site, there is nothing to restore from.

4. The website's admin login. Most small-business sites run on a content management system (the editing back end you log into). You want an administrator login of your own, on your own email address, with the highest role the system offers. Also ask what you are licensed to keep if you leave: a paid theme, a page builder or a plugin may be licensed to the agency, not to you, and can stop updating once you go. What breaks if you skip it: you cannot change your own hours, phone number or prices, and you are paying the agency for every edit.

5. Analytics and search-console accounts. These hold your visitor data and how search engines see the site, often years of it. Ask to be added as the owner, or for the property to be transferred to an account in your name. What breaks if you skip it: when the relationship ends, the history of what worked leaves with them, and the new vendor starts from zero.

6. Ad accounts. This is where most money is at stake. Agencies normally run your ads from their own manager account linked to your ad account. That structure is healthy if the ad account itself was created by you, in your name, with your card as the payment method. It is not healthy if the agency created the ad account inside their own manager structure and bills you for spend. Ask the direct question: "If we part ways, does the ad account and its history stay with us?" Get the answer in writing. What breaks if you skip it: the campaign history, audiences and conversion tracking, often years of tuning, belong to the agency, and you rebuild from nothing.

7. Business profile, review platforms and social pages. Make sure the shop's own people are the primary owners and the agency holds a lower role. These are the accounts customers see, and the ones where a removed owner hurts most quickly. What breaks if you skip it: a vendor who is the only owner can, through malice or neglect, leave your profile pointing at a dead phone number. See related: Recovering a Hacked Business Social Account, for how roles on these pages work.

The written side

Access is half of it. The other half is a short set of clauses in your agreement with any vendor who builds or runs these things. Ask for them at the start, or add them at the next renewal.

• Ownership of deliverables. The website design, written content, photos you supplied and any custom code are the shop's property on payment, and the vendor provides a complete copy on request.
• Ownership of accounts. Every account set up for the shop is registered to the shop, with the vendor as an authorized user.
• Exit handover. On termination for any reason, the vendor transfers ownership of any account still in their name and delivers site files within a stated number of days, such as 14, and is paid for work through the termination date.
• No hold-back. Access is not withheld over a billing dispute; disputes are settled separately.

A vendor who resists these clauses is telling you who will own the website. If a vendor contract you have already signed says the agency owns the site or the accounts, have an attorney read it before you try to move anything, because a transfer you start against the contract can become the dispute.

Worked example: a plumbing shop parts ways with its agency

A seven-truck plumbing shop has used a local agency for six years. The agency built the site, runs paid search ads and manages the business profile. The owner decides to switch agencies after a price increase. He has never logged into anything except the profile.

The inventory, before he says anything. He spends an afternoon finding out where everything sits, without telling the agency he is leaving. Of seven assets:

Two of seven are in the shop's hands. Five are not, and the domain sits at the top of all five.

The order he asks in. He asks the agency, while still a paying client, for three things in one email: the domain transferred to a registrar account he has just created, an administrator login on the website, and full ownership of the ad account. He frames it as housekeeping for his insurer's security questionnaire, which is true; his cyber insurance application asked who controls the domain.

What came back. The agency moves the domain within a week and gives him a website admin login. On the ad account, they answer that it was created inside their manager structure and "can't be transferred," but they can grant him admin. He accepts admin, then checks: as admin he can see the full history and export it, but he cannot remove the agency or take ownership.

Where it went wrong. He gives notice two weeks later. The agency, unhappy, removes his admin role from the ad account the same day. Six years of campaign data, keyword performance and conversion tracking are gone from his view. Because he had exported the account's history the week before, he keeps the spreadsheets, but the new agency still has to build a new ad account from scratch, which in its first two months performs at about half the old account's lead volume while it relearns.

Hosting. The agency gives 30 days' notice that the site will come down from their shared plan. Because he has the admin login, the new agency exports the site and moves it to hosting in the shop's name within the window. The domain is already his, so he repoints it himself.

What the order bought him. Domain first meant that, whatever else the agency did, they could not take the website address or the email with them. If he had asked for the website login first and left the domain for later, a hostile agency could have let the domain registration lapse, or repointed it, at the moment he gave notice.

What would have changed the answer. If the shop had opened its own ad account years ago and given the agency access to it, the ad history would simply have stayed when the agency was removed. That one difference cost him two months of reduced lead flow. And if his original contract had carried an exit-handover clause, removing his admin role on the day of notice would have been a breach he could point to, not just a bad day.

Checking where you stand

• For each of the seven assets above, you can log in yourself, today, and you see an owner or primary-admin role.
• Every owner login uses an email address the shop controls and has multifactor authentication on.
• You have a copy of the website files from the last year, stored somewhere the vendor cannot delete.
• You can remove every vendor from every account without asking them first. If there is one you cannot, that is the next thing to fix.
• Your agreement with each vendor says who owns the accounts and what happens at exit.

Record the result in the shop's account inventory so the next review finds it. See related: The Account Inventory Every Shop Should Keep.

References

• ICANN, information for domain name registrants on transfers and registrant rights (icann.org)
• See related: Your Domain Name Is the Master Key
• See related: The Account Inventory Every Shop Should Keep
• See related: Vetting a Software Vendor Before You Sign
• See related: Recovering a Hacked Business Social Account