Who Owns Your Website and Accounts?

Ask a Monaco business owner who owns their domain name, and most will say "we do". Then ask whose name is on the registrar account, whose email receives the renewal notices and who can log in to Google Ads. The answers are often less clear: a former marketing manager, a freelancer who built the site in 2019, or an agency that set everything up under its own accounts.

That's fine until something changes. A staff member leaves, an agency relationship ends, a password expires, or the domain lapses because the reminder went to an inbox nobody reads. Then a business that thought it owned its online presence finds that it only had access to it.

This guide is a practical check you can run in an afternoon. It's for founders and managers, not developers.

Why this goes wrong so often

Few businesses set out to give away control. It happens one account at a time. A developer registers the domain to save you a step. An employee opens the Instagram account on their personal phone number. An agency creates your Google Ads account inside its own billing. Each decision is convenient at the time and no one writes it down.

In Monaco the risk is a little higher, because many companies are small, rely on outside suppliers and work with several agencies over the years. Staff often come and go on cross-border contracts. Every handover is a chance for an access to go missing.

The cost shows up at the worst moments: when you want to change agency, redesign the website, run a campaign before a big event, or prove to a payment provider or partner that you control your own domain.

The inventory: what you actually need to own

Start with a list. For each item, note who the account owner is, which email address it's tied to, who else has access and who pays for it.

• Domain name — the registrar account and the registrant name, whether it's a .mc, .com or another extension.
• DNS — often at the registrar, sometimes at a separate provider such as Cloudflare. Whoever controls DNS controls your website and email routing.
• Hosting and website — the hosting account, the CMS administrator login, and a copy of the code or theme if the site is custom-built.
• Email and office tools — the Google Workspace or Microsoft 365 super-admin account.
• Measurement — Google Analytics, Search Console, Tag Manager.
• Advertising — Google Ads, Meta Business Manager, LinkedIn Campaign Manager, and the billing behind them.
• Listings and social profiles — Google Business Profile, Instagram, Facebook, LinkedIn, TikTok, WhatsApp Business.
• Revenue tools — Shopify or another e-commerce platform, your payment provider, booking and CRM systems.
• Brand files — logo source files, brand guidelines, photography and their usage rights.

Most businesses discover at least one item where they can't name the owner. That's the one to fix first.

Owner versus user: the rule that solves most problems

The principle is simple. Your company should own every account; suppliers should be users. Agencies, freelancers and employees get access through their own named logins, with the level of rights they need. When they leave, you remove their access, and nothing else changes.

Most platforms support this. Google Ads and Meta let an agency manage your account through a partner or manager link while ownership stays with you. Analytics and Search Console allow several users with different roles. Shopify has staff and collaborator accounts. A good agency will set things up this way without being asked. If one insists on keeping your accounts inside its own structure, ask why, and get the answer in writing.

For the domain, make sure the registrant is your company and that renewal notices go to an address the company controls. If you're not sure how the registrant is recorded for your extension, your registrar can confirm it.

Use a company address, not a person

Many lockouts start with an account tied to someone's personal email or mobile number. Create a few role-based addresses on your own domain, such as admin@ or marketing@, and use them as the owner email for key accounts. Keep two-factor authentication on, but store the recovery codes and the second factor somewhere the business can reach, not only on one person's phone.

A shared password manager for the business helps here. It records who has access to what, makes offboarding a matter of minutes, and avoids passwords stored in spreadsheets or WhatsApp threads.

Access also has a data-protection side. Your CRM, booking tool and website forms hold personal data, and Law No. 1.565 expects you to protect it appropriately. Knowing who can open those systems, and removing people who no longer need to, is part of that. If you're unsure what your obligations are, our data protection compliance team or your DPO can help you check.

Put it in the contract

Access fixes today's problem. The contract prevents tomorrow's. When you hire an agency or freelancer, the agreement should say who owns the accounts they create, what happens to the code, design files and content they produce, and what they must hand over when the relationship ends, with a reasonable timeframe.

Intellectual property and contract terms are areas where wording matters, and the rules depend on the jurisdiction and the type of work. Have a lawyer review the relevant clauses rather than relying on a template. At BSS, our standard approach is that the client owns the domain, hosting, accounts and the website itself, and we work inside them.

Run the audit, then keep it current

A one-afternoon check looks like this:

1. List every account from the inventory above.
2. Log in to each one with a company login, not a supplier's. If you can't, that's a finding.
3. Check the owner and billing on each account, and transfer anything held by a person or supplier.
4. Remove former employees and past agencies.
5. Store credentials and recovery codes in the company password manager.
6. Write down renewal dates for domains, hosting, SSL and software licences.

Then repeat the check whenever someone leaves or you change supplier, and at least once a year. If you have a website maintenance contract, ask for this to be part of it. And before your next campaign, confirm that your Google Ads account and its billing are in your company's name.

Next step

If you're not sure who controls your domain, website or ad accounts, we can run the audit with you and move everything into your company's name without disrupting what's live. Get in touch and we'll start with a short call.