Who should own your domain and business accounts?

Ownership is more than knowing a password.

Control means the business can access essential accounts, receive security and renewal notices, review authorized users, keep agreed assets, and continue operating when a person or provider leaves.

It does not require you to perform every update yourself. A consultant can manage approved work through an account role you can review or remove. The owner still understands where the accounts live and who is responsible for them.

Platform rules and contracts matter. A domain registration, a software subscription, and a licensed photograph are different things. Ask what the business owns, what it licenses, what can be exported, and what will stop working if a service ends. Do not assume a website can be moved unchanged to any platform.

Start with the domain and business email.

The domain is the address customers use to find you. It may also underpin business email. Confirm which registrar holds it, which business-controlled account manages it, who receives renewal notices, and who can recover access.

Check that renewal and payment details are current. Record the renewal date and responsibility instead of relying only on automatic renewal. An expired card or inaccessible inbox can still cause problems.

Treat business email as an important recovery route. Use separate staff identities where available, strong unique credentials, and multifactor authentication. Keep a secure, documented recovery method that does not depend entirely on one person’s phone or an inbox that could become unavailable with the domain.

Separate account access from file ownership.

Have the appropriate owner or administrator role for the website platform and visibility into billing. Invite the builder as a contributor or manager when that role meets the work. Avoid sharing a master password just because it is quicker.

Agree in writing on the handoff: approved copy, logo files, original business photographs, purchased assets and their licenses, and any custom work included in the project. Some platform components or licensed assets may not be transferable.

Ask what “backup” means in your setup. A folder of images is not necessarily a recoverable website. Confirm what can be restored or exported, where the copy is kept, and who can use it. Test a restore or recovery procedure in a safe setting when the platform allows it.

Use personal identities responsibly.

Business Pages can legitimately be managed through people’s individual accounts. The risk is making one employee or vendor the only person with control, or passing the same password among everyone.

Use business tools and role-based access where the platform supports them. Keep appropriate owner control, add trusted backup access when suitable, and give contributors only the permissions they need. Posting content does not automatically require control of billing or security.

For Google Business Profile, keep the business in the primary-owner role and add helpers as owners or managers as appropriate. Each person can use their own Google Account. Google documents limits on some actions during a new owner or manager’s first seven days, so allow time when planning a transfer.

Review access when a working relationship changes. Verify unfamiliar ownership or recovery requests through a known channel before approving them.

Build an account register—not a password list.

Keep passwords and backup codes in an appropriate secure password manager or protected recovery system, not in this ordinary register. Limit who can see the register too: even without passwords, it describes your business’s account structure.

CISA recommends strong passwords, multifactor authentication, software updates, and phishing awareness as practical security foundations. These steps reduce exposure; they are not a guarantee against compromise.

Make offboarding an ordinary business process.

1. Confirm the authorized owner. Agree on who is entitled to approve the change before moving access or files.
2. Check the remaining access first. Make sure a trusted business administrator can sign in and recover the account.
3. Complete the agreed handoff. Collect the included files, license information, billing details, and instructions.
4. Remove or reduce former access. Review connected apps and shared credentials as well as visible user roles. Rotate credentials that were shared.
5. Retest the essentials. Check the website, business email, domain renewal settings, inquiry route, and profile details.

If nobody can access an account, use the provider’s official recovery process. Preserve invoices, ownership records, and relevant agreements. Avoid deleting a profile or registering a replacement domain in a rush; those steps can create a second problem.

Where ownership is disputed, stop and resolve authority through the provider and appropriate professional advice. Veris’s role is to help you understand and organize the work—not to bypass another person’s access controls.

A sound relationship leaves the owner more capable. The goal is reliable help with a clear route to continuity, not dependence on one person.