Record business control, delegated roles and recovery
Assign the business’s owner role, delegated responsibility and recovery route for domain, hosting, analytics and content data. Verify access through the responsible person without recording secret values. The matrix is complete only when it explains practical control and export or recovery responsibility, not merely who received a login.
Worked example — illustrative data.
| System | Business owner role | Delegated responsibility | Recovery check |
|---|---|---|---|
| Domain registrar | Business-controlled account | Technical DNS editor | Owner can access recovery route |
| Hosting and CMS | Business admin where supported | Editor or deploy role | Document restore/export owner |
| Analytics | Business administrator | Analyst or implementation role | Confirm another approved admin |
| Product and media data | Business content owner | Merchandising editor | Locate usable exports and rights |
Inventory services from actual billing and implementation records. Ask the responsible owner to verify access without exposing credential values. Distinguish legal ownership, account administration and day-to-day editing because those are different responsibilities. Record who approves access changes and what happens when a supplier leaves. Include a practical export and restoration discussion so control is useful beyond a login screen. Keep the matrix in an appropriate private location.
Verify an owner task without recording secret values
Ask the authorized business owner to confirm access, relevant administrator responsibility and the supported recovery route for each system. Record only the outcome and role, never passwords or recovery codes. Distinguish an editor who can change a page from the owner who can manage billing, domains and access. Keep old dependencies until an approved handoff proves the replacement.
Decision: Call the handoff complete only when the business can perform the agreed owner tasks and the recovery route is confirmed. This worksheet does not establish a particular agency’s ownership terms.
Provider transfer rules may leave dependencies behind: Some services cannot transfer every asset or identifier between accounts. Verify the provider’s current rules before promising a transfer or canceling the old service. Preserve dependencies until the replacement is proven.
Does an agency-created account automatically belong to the business?
Review the contract, provider account rules and actual administrator roles. The worksheet records practical control; it does not determine legal ownership or override transfer restrictions. Resolve the specific terms before changing or cancelling access.
Continue with Guides for stores, software teams and local businesses, Website design and development services and Test a website with the person who will edit it.