This doesn't always happen out of bad faith, but out of badly structured processes. Still, the reality is that your business needs its own keys. Here's the digital ownership audit: if you fall short on any of these eight points, you're taking on an unnecessary risk.
Identity and hosting: the foundation
- Key 1 · The domain. Your brand's name on the internet. Under ICANN rules (the world's top authority on domains), the registered holder (Registrant) is the only legal owner. If your company's domain is in the agency's name, legally the brand online is theirs. You can check whose name it's in with a Whois lookup.
- Key 2 · Hosting. The house where your website lives. You should have access to the account or, at the very least, insist on automated, off-site backups that you can access directly.
The master keys: control
- Key 3 · Administrator access to the CMS. An «editor» profile is fine for publishing a post, but not for running your business. You need the administrator role to have real freedom: switch providers, install what you need and leave whenever you want.
- Key 4 · Professional email. Whoever controls the admin email controls the «reset password» button for your entire business. Billing for Google Workspace or Microsoft 365 should always go to your company.
- Key 5 · Premium software licences. Visual builders, paid plugins and themes: you need to know which licence they run under to make sure they keep updating if you change teams.
Your company's history: the data
- Key 6 · Google Analytics and Search Console. Under European law (GDPR), you are the data controller and the agency is only the processor. The analytics belong to you: they're the digital equivalent of your customer database.
- Key 7 · Google Business Profile. Google's guidelines are clear: the owner of the physical business must be the primary owner. Agencies operate as invited managers, never as owners.
- Key 8 · Meta Business Suite. Meta forbids agencies from keeping assets in their own Business Managers. Your pixel (the part that learns who buys from you) and your ad account must live in your own dashboard. If you leave, you take that intelligence with you.
Your quick audit: how many keys do you hold?
Count only what you can confirm right now, without asking anyone:
- The domain is registered in my company's name (I've checked it on Whois).
- I have access to the hosting or my own off-site backups.
- I have an administrator account on my website or CMS.
- The professional email is billed to my company and I control the admin account.
- I know which premium licences my website uses and which account they run under.
- I own Google Analytics and Search Console.
- I'm the primary owner of my Google profile (Maps).
- My Meta pixel and ad account live in my own Business Manager.
If you ticked all eight, congratulations: you're in full control. If several are missing, you now know where to start the conversation with your provider.