Who Owns the App Account on a Connected Device

Why this matters

Every connected thermostat, water shutoff, generator, opener and pool controller is tied to an account in a manufacturer's cloud. Whoever holds that account receives the alerts, controls the device, can see its history, and decides who else gets access. When a shop creates that account in its own name to save ten minutes at install, it quietly becomes the custodian of the customer's home data, the recipient of their 3am leak alarm, and the gatekeeper they must call to sell their house. The rule this card defends is short: the account belongs to the customer, the shop gets access by the customer's consent, and the two are never swapped for convenience.

The three roles an account system usually has

Manufacturers name these differently, but the shape is nearly universal:

• Account owner. The person whose email and password create the account, who accepts the terms of service, and who can add or remove everyone else. One per device or per home in most systems.
• Shared users. Household members the owner invites. They usually get control and alerts but cannot remove the owner.
• Dealer or professional access. A separate pathway for installers and service companies, typically through a professional portal or app. The owner grants it, can see that it exists, and can revoke it. It is often scoped: view only, view plus diagnostics, or full control. Some systems also log what the dealer did.

The roles exist precisely so nobody has to share a password. When a shop logs into the owner's account with the owner's password, or creates the owner account itself, it has collapsed the three roles into one and lost every protection the system was built to give both parties.

Why the shop never registers a device in its own name

Each reason below is a separate failure, and each one has happened to somebody:

• The alerts go to the wrong place. A leak, freeze, high-temperature or power-loss alert goes to the account owner. If that is the shop's office email, it lands in an inbox nobody reads at 3am, or at the phone of the technician who set it up. When that technician leaves, the alerts go with them. See related: The Alert Went to an Employee Who Left.
• The shop holds the customer's home data. Thermostat schedules reveal when a house is empty; camera and door-lock histories reveal more. Data the shop holds is data the shop must protect and, if it leaks, may have to report. Every US state now has some form of data breach notification law, with different triggers and definitions, so what a given leak obliges depends on the state; that obligation is better never acquired.
• The shop accepted the terms of service on the customer's behalf. The account owner is the party who agreed to the manufacturer's terms, including what the manufacturer may do with the data. The customer never saw them.
• The house sells and the device is stranded. A new owner cannot take over an account whose owner is a contractor they have never heard of. The shop either becomes an unpaid help desk or the device gets factory-reset and its history lost.
• The warranty may be registered to the wrong party. Some manufacturers tie warranty registration to the account. A warranty registered to a contractor can complicate or delay a claim by the homeowner. Check the specific manufacturer's terms.
• The customer cannot leave. A customer who wants to switch service companies has to ask the old one to hand back their own house. That is a relationship ending badly with the shop holding the keys.

None of this changes if the shop offers a monitoring service. A shop that sells remote monitoring still sets up the account in the customer's name and holds dealer access, with the scope and the response obligations written into the service agreement. See related: Remote Monitoring as a Service.

What dealer access should look like

Ask for the narrowest access that does the job, and make it visible to the customer:

• Scope. View and diagnostics is enough for most service relationships. Full control is justified where the shop actively manages the device, for example adjusting a schedule under a service plan.
• Consent the customer can see. The customer approves the request in their own app, or adds the shop's professional account themselves. Do not approve it from their phone on their behalf. If they approve it, they know it exists and know how to remove it.
• A record. Note on the job and the customer record: the account email (not the password), the access level granted, the date, and who requested it. The shop should never store the customer's account password anywhere.
• An end. Access persists until revoked. When the service relationship ends or the house sells, the shop removes its own access; the handoff SOP owns the steps.

When the person paying is not the person who lives there

The account goes to whoever has the right to control the property and decide who sees its data, which is not always the person in front of you:

• Rentals. The property owner or their manager usually owns the account for equipment that belongs to the property (the furnace, the water shutoff); the tenant gets shared-user access if the owner allows it. A tenant should not be the account owner of building equipment, because they leave.
• An older customer with an adult child helping. The account belongs to the homeowner, with the child as a shared user if the homeowner wants that. Where the homeowner has no email or smartphone, the family member may hold the account with the homeowner's clear agreement, which you record. Do not create an email address for anyone.
• Second homes and vacant properties. The owner holds the account, and should add a local contact (a neighbor, a property manager) as a shared user for alerts. This is where the shop is most tempted to "just take the alerts", and where the 3am failure is most expensive.
• Commercial accounts. A business-owned account in the business's name, with an owner-side administrator who is not the shop.

A worked example: the water shutoff for a father, set up by his daughter

A plumber installs an automatic water shutoff valve with three leak sensors at a house owned by a man in his eighties. His daughter, who lives forty minutes away, booked and paid for the job. He has a landline, no smartphone and no email he checks; neither of them wants to deal with "another app". The office has suggested the plumber "just put it on the shop account so we can watch it".

The plumber does not. The conversation at handover goes like this:

TECH: The valve reports to an app. Somebody has to own
      that account. It should be you, since it's your
      house. Your daughter can get the alerts too.
OWNER: Can't you just keep it? I won't look at it.
TECH: If we keep it, the alert at 3am comes to our
      office, and nobody's there. If it's yours, it
      rings her phone and yours.
DAUGHTER: I'll set it up on my phone. Is that okay?
TECH: That works if your dad's happy with it. He's
      the owner, so I'll note that he agreed. Then
      you add him as a user, and you approve us
      for service access, view only.
OWNER: Fine. She does all this stuff anyway.

What gets done and recorded:

• Account owner: the daughter, using her own email and a password she types, with the father's agreement noted on the job. She adds her father's landline as an alert contact, which this valve's system supports, and herself on the app.
• Dealer access: requested by the shop's professional account, approved by the daughter in her app, scope view and diagnostics. Recorded with the date and the account email, no password.
• Alert test: with both of them told the water would go off for a few minutes and no taps or appliances running, a sensor wetted with a damp cloth, the valve closing, and the alert reaching the daughter's phone within about a minute and the landline call within about two. Commissioning in full is owned by its SOP.
• The office's request: declined, with the reason written on the job: alerts would route to an unmonitored inbox.

What would have changed it. Had the father used a smartphone or email, he should own the account, with the daughter as a shared user. Had nobody in the family been able to hold an account, the right answer is to install the valve in a standalone mode if the manufacturer supports one (it closes locally on a leak with no app), record that alerts are not configured, and tell the family plainly what that means. Taking the account into the shop's name is not one of the options. And if the shop wanted to sell the family a monitoring plan, that is a separate written agreement layered on top of a customer-owned account, not a reason to hold the account.

Where this stops being a field decision

Account ownership is a practice question until the shop starts holding customer data as part of a service it sells. At that point the questions (what data the shop may collect, how long it keeps it, what it must do after a breach, what the service agreement promises) are governed by contract and by state privacy and breach-notification law, which differ by state; California's privacy statute, for example, reaches further than most. This is not legal advice. Before launching a monitoring offer, take the draft service agreement and a description of what data the shop will see to a business attorney licensed in the state where you operate.

References

• Manufacturer documentation for the device's account, shared-user and professional or dealer access features
• State data breach notification statutes (all states have one; triggers and definitions vary by state)
• See related: The Connected-Device Commissioning SOP; The Connected-Device Handoff at Home Sale SOP
• See related: The Alert Went to an Employee Who Left; Remote Monitoring as a Service; Privacy of Cameras and Sensors You Install