The business should be the primary owner of every account that can interrupt operations, identity, revenue, or customer access. A provider can be an administrator or manager without becoming the only owner.
“Personally control” does not mean the owner must perform every task. It means the company can see the account, manage access, receive renewal and security notices, and replace a provider without losing the asset.
The critical account list
Prioritize:
- Domain registrar and DNS
- Business email and identity administrator
- Website hosting, CMS, repository, and backups
- Google Business Profile
- Search Console and analytics
- Advertising and payment profiles
- Social media pages and channels
- CRM, forms, scheduling, call tracking, and automation
- File storage and design assets
- Ecommerce, payment, donation, or booking systems
- Password manager and MFA recovery
Banking and regulated systems require their own controls, policies, and professional guidance.
Use company identity, not a provider’s personal login
Register assets to an organization-controlled email that will survive an employee or vendor departure. Avoid shared passwords. Add each person with an individual account and the least privilege needed.
Google Business Profile, for example, supports owners and managers so users do not need to share one password. Keep a trusted internal primary owner and grant the provider an appropriate role.
Protect recovery paths
An account is not controlled if password reset goes to a former employee’s phone. Record recovery email, recovery phone, security keys, backup codes, billing contact, and renewal method. Use multifactor authentication; CISA recommends starting with administrative and sensitive accounts and prefers phishing-resistant methods where available.
Do not store the only recovery codes inside the account they recover.
Review access on a schedule
Quarterly and after every staffing or provider change:
- 1.Export the user and role list.
- 2.Remove departed users.
- 3.Confirm at least two trusted recovery paths for critical services.
- 4.Verify billing and renewal contacts.
- 5.Test backups and exports.
- 6.Record the account in the asset inventory.
Be careful with “owner” roles that allow deletion or transfer. Redundancy should be trusted and documented, not indiscriminate.
Ask providers for a clean structure
A good provider should explain where the asset lives, which account owns it, what access the company has, how backups work, and what happens at termination. These terms belong in writing before the build begins.
Ownership is business continuity. If one unavailable person can make the company disappear from email, web, Maps, or customer records, access needs attention now.
Owner, administrator, or day-to-day manager?
- Role: Business owner or internal executive; Appropriate responsibility: Primary ownership, billing visibility, recovery authority, provider replacement
- Role: Trusted internal administrator; Appropriate responsibility: User access, security settings, continuity tests, documentation
- Role: Outside provider; Appropriate responsibility: Technical or marketing management through its own delegated account
- Role: Employee or contractor; Appropriate responsibility: Only the access needed for assigned work
Platform names vary, so read what each role can actually do. “Admin” may include billing, deletion, transfer, or user-management power.
What if the company has one owner?
A solo owner still needs redundancy. Use an organization-controlled email, password manager, MFA, and a documented emergency-access plan for a trusted person or succession representative. This does not mean handing daily passwords to a family member. It means defining how authorized access can be recovered during illness, loss of a device, or incapacity.
Business-continuity and estate questions should be reviewed with legal and financial professionals. Technology settings alone do not grant lawful authority.
A takeover-readiness test
Choose one critical account and ask:
- 1.Can the owner sign in without the provider?
- 2.Does MFA go to a company-controlled device or key?
- 3.Can the company add and remove users?
- 4.Can it see billing and renewals?
- 5.Can it export data or move providers?
- 6.Is there a current backup?
- 7.Is the recovery process documented and tested?
Repeat for the domain, email administrator, website, Business Profile, analytics, CRM, and social pages.
Mistakes to avoid while reclaiming control
Do not remove a working provider before confirming what its account operates. Do not change DNS casually; it can break the website and email. Do not copy shared passwords into an ordinary spreadsheet. Do not create a second Business Profile because the first login is unknown.
Make changes in a planned window, preserve exports and logs, add the internal owner first, and test recovery. A provider can help inventory and transfer accounts, but the owner should approve role changes and retain the final record.
Make access review part of onboarding and offboarding
Before a new provider or employee starts, define the exact accounts and roles needed, require an individual login, enable MFA, and record who approved access. When the relationship ends, remove access promptly, rotate shared secrets that could not be avoided, transfer files and ownership, and verify automations or scheduled posts the person created.
Do not delete an account before preserving business records and transferring its assets. A former employee’s mailbox may own calendars, files, advertising audiences, or platform recovery paths.
At least once a year, have someone other than the usual administrator follow the recovery document in a supervised test. A plan that works only because one person remembers undocumented details is not yet a plan.
Related reading
hire a web designer without losing control
What Happens to Your Website If Your Web Designer Disappears?
Why Every Small Business Should Have a Digital Asset Inventory
The Online Business Information Audit: What to Check Before 2027
Sources
https://support.google.com/business/answer/3403100
Start with a read-only ownership review. TechDad Technology can help identify gaps without asking you to share passwords or change account access before dependencies are understood. Contact TechDad Technology.
