The question sounds trivial until the day you want to change vendors and cannot. The domain sits under a former intern personal account, the code lives on a server you cannot reach, and Google Analytics belongs to an email address nobody remembers the password for.
None of this is rare. It is the natural result of a project where nobody asked who keeps what. This article shows how to verify ownership and how to fix it.
The domain must be registered to your company
The domain is the most important asset of the set. Losing the code costs you the work of rebuilding. Losing the domain costs you the address printed on cards, running in ads, sitting in email signatures and pointed at by every inbound link.
Under ICANN rules, every domain has a registrant, and that registrant is the legal holder regardless of who paid the invoice. The registrar is the company where the domain is managed, and the registrant is the entity named in the record.
How to check in two minutes:
- Run a WHOIS or RDAP lookup for your domain without www.
- Read the registrant organisation and the administrative contact email. Many registrars mask these behind a privacy service, so the definitive check is logging into the registrar control panel with your own account.
- Note the expiry date and the nameservers listed.
- Check whether the transfer lock (clientTransferProhibited) is on. It should be, as a theft defence, and you unlock it deliberately when you move.
Country domains have their own registry rules. Brazilian .com.br names, for example, are managed by Registro.br and require a national tax ID on the registrant record, so ownership there is tied to a company registration rather than a free-form organisation field.
If the domain is not in your name: request a change of registrant, or a transfer to a registrar account you control. A transfer needs the domain unlocked and the authorisation code, usually called the EPP or auth code, which only the current account holder can retrieve. Do this while the relationship with the vendor is healthy, never mid-conflict.
Then turn on auto renewal. An expired domain goes dark, enters a redemption period with a recovery fee, and can eventually be registered by someone else.
Source code: what the contract must say
Under copyright logic, whoever writes the code holds rights to it. Paying for development does not automatically transfer those rights; the transfer has to be written down.
A sufficient clause covers four points:
- Assignment. The vendor assigns to the client the economic rights over the custom code and design, effective on final payment.
- Delivery. The vendor hands over full source code, database and installation instructions within a defined window at the end of the project or contract.
- Third-party components. Open source libraries, themes, plugins and fonts keep their own licences. The contract should distinguish licensed parts from custom parts so you know what you may modify and redistribute.
- Content. Copy, photos and video you supplied remain yours. Copy written by the agency should be assigned along with the code.
There is a common and acceptable middle ground: the agency keeps ownership of its internal reusable components but grants you a perpetual, irrevocable licence to use and modify them within that site. That is fair. What is not fair is needing permission to touch your own website.
If the proposal in front of you says nothing about this, how to evaluate a web design proposal shows how to push back.
Hosting and the right to portability
Hosting arranged by the agency is common and convenient. It only becomes a problem when there is no exit path.
You need three guarantees, ideally in the contract:
- Access. An administrative user in your name on the hosting panel, or at minimum the right to request access at any time.
- Export. The right to receive files and a database dump within a defined window, in an open format.
- Continuity on termination. A minimum period during which the site stays online after notice, so you have time to migrate.
If you are choosing an environment now, the comparison in shared hosting, VPS and cloud helps. And wherever the site lives, keep a copy under your own control, which is the subject of backups and continuity.
Third-party accounts in your name
This is the most forgotten part. The site can be entirely yours while every piece of historical data belongs to somebody else.
| Account | What you lose if it is not yours | How to fix it |
|---|---|---|
| Google Analytics | All visit and conversion history | Create the property under a company email and add the agency as an administrator |
| Google Search Console | Search data, indexing status, penalty alerts | Verify ownership via DNS, which only you control |
| Google Business Profile | Reviews, photos, the card shown in local search | Claim primary ownership with a company account |
| Meta Business | Page, pixel, ad history and saved audiences | Create your own Business Manager and grant the agency partner access |
| Domain registrar | The address of the site itself | Account in the company name, corporate email on file |
| Email marketing tool | The contact list, which is your asset | Your own account, with periodic list exports |
The rule is simple: the company is always the owner, the vendor is always a guest. The reverse works fine right up until it stops working. If you have yet to set up measurement, start with the metrics that matter in GA4.
One practical detail: use an address on your own domain for these accounts, something like digital@yourcompany.com, with shared internal access. A staff member personal email recreates the same problem in different clothes.
What happens when you change vendors
With the three fronts above settled, switching is an administrative process of a few days:
- Give notice within the agreed period and request files, database and documentation in writing.
- Add the new vendor as an administrator on the accounts you already own.
- The new vendor stands the site up in another environment and tests it while the domain still points at the old one.
- You change DNS from your own registrar panel. Propagation takes minutes to a few hours.
- Once everything is confirmed working, you close the previous contract.
Without those fronts settled, the same switch can turn into rebuilding from scratch. And when a site is rebuilt, URL mapping and redirects become critical: follow the redesign without losing SEO playbook.
A ten-point ownership checklist
- The domain registrant is your company, confirmed by WHOIS or the registrar panel.
- Auto renewal is on and billed to a company card.
- The domain contact email is a company address someone actually reads.
- You can log into the registrar panel yourself.
- A written clause assigns rights over custom code and design to you.
- You hold a copy of the source code and database outside the vendor server.
- The contract sets a delivery deadline for files on termination.
- Analytics, Search Console and Business Profile sit in company accounts.
- The Meta pixel and page belong to your Business Manager.
- Critical passwords live in a manager more than one person can reach.
Ten items, one afternoon of work. It is the difference between owning a website and renting one.
At ALB Seven, domain, code, content and accounts sit in the client name from day one, with documented handover. See our work in the portfolio and get in touch if you want an ownership review of your current site.