Who Owns and Controls Your Website?

Record the registrar account, registrant details where applicable, recovery email and phone, two-factor authentication, renewal date, payment owner, transfer lock, nameservers and DNS administrators. Use delegated access instead of sharing the master password when supported.

Record the provider, account owner, plan, billing, server or project identifier, support route, backup location, restore process, DNS and email dependencies, cancellation and export options. Keep an independent current backup when changing providers.

List the repository or file delivery, design files, copy, photographs, fonts, stock assets, themes, plugins and custom code. The agreement should state usage, modification and transfer rights, exclusions and any reusable provider material. Obtain qualified legal advice for a disputed interpretation.

Include business email, analytics, Search Console, tag manager, business profiles, payment, shipping, maps, messaging, advertising, CRM and social accounts. Use named individual users with appropriate permissions and preserve at least two business-controlled recovery paths for critical services.

Record where enquiries, customers, orders, backups and logs are stored; who can access them; retention and deletion responsibilities; processor agreements where applicable; and the safe export or transfer process. Remove former-provider access after verified handover.

For each item, record owner, administrator, billing contact, recovery method, URL, renewal, licence, export, responsible person and status. Change credentials safely, test forms and restore, preserve invoices, and confirm that the old provider's access is removed only after the new access works.