A is for accounts you own

Why ownership matters more than access

Having a password is access; being the registered owner is control. A manager or editor role lets you post and change things, but the owner can remove you, change billing, or let the account lapse. When a relationship ends badly, only control counts.

A worked example makes the stakes concrete. Say a business earns $30,000 a month and half of new customers find it through its website or Google profile. If the domain lapses and the site and email go dark for two weeks, the business could lose something like $7,000 of new work, and customers trying to email it get bounce messages. The fix, done in advance, costs an afternoon.

Step 1: list every account

Start with a blank sheet and five sources of evidence. Memory alone misses about a third of accounts.

1. Your bank and card statements for the last twelve months: every recurring charge is an account.
2. Your email inbox: search for "welcome," "verify your email," "invoice" and "renewal."
3. Your website: footers and source code often reveal analytics, chat or booking tools and the hosting company.
4. Your phone: apps you use for the business.
5. Your staff: ask each person what they log in to for work.

Group what you find into these categories:

Step 2: check who owns each one

For each account, record four facts: registered owner, admins, recovery email, and billing.

• Registered owner: the person or company the platform treats as owner. On a domain, look up the registrant contact in your registrar account. On a Google profile, check the users list for "primary owner."
• Admins: everyone with full rights. Former staff and past vendors often remain here for years.
• Recovery email and phone: where password resets go. If it is a personal or ex-employee address, the account is only as safe as that inbox.
• Billing: whose card is on file. A cancelled personal card is a common cause of lapsed domains.

Mark each account green (business-owned, two admins, business recovery email, business card), amber (one item wrong) or red (owned or controlled by someone outside the business).

Step 3: fix the reds, in the right order

Fix identity first, then communication, then everything else. Your domain and email are the master keys; secure them before anything that resets through them.

1. Domain: if it is in someone else's registrar account, ask them to start a transfer to an account in your name. Domain registrars have formal transfer processes; follow them rather than asking for a password.
2. Email: make sure the business controls the email service admin console, not just a mailbox.
3. Google Business Profile: if you are not primary owner, ask the current owner to transfer it. If they will not respond, the platform has an ownership request process.
4. Ad accounts: add yourself as administrator, move billing to a business card, then reduce outside access.
5. Social pages: move page ownership to a business account rather than an individual's personal profile, where the platform allows it.

Do not delete and recreate an account to get around a stuck owner unless there is no alternative. You lose history and reviews, and duplicates confuse customers. If a transfer is genuinely disputed, our accounts and ownership recovery service works through each platform's own process with you, and we will say plainly when something needs a lawyer instead.

Step 4: write the key list

The key list is one page that lets a trusted person understand your accounts without seeing a single password. Keep it with the business's important papers and give a copy to the person named in letter X.

For each account, write:

• ☐ platform name and what it is for
• ☐ registered owner
• ☐ admins (names, not passwords)
• ☐ where the login is stored (for example, "password manager, business vault")
• ☐ renewal date and annual cost

Store passwords in a reputable password manager, not in the key list itself.

Step 5: keep it current

Update the list at three moments: when people change, when tools change, and once a year.

• Someone leaves: remove their access the same day and update the admin column.
• You add a tool: add a row before you start using it, and register it to the business email.
• Year-end: during letter Y, check every renewal date and confirm the card on file. The annual calendar puts this in December.

Common mistakes

Most ownership problems start with kindness and speed. Someone helpful sets up an account "for now," and "for now" lasts six years.

• Using a personal Gmail as the recovery address for business accounts.
• Giving a vendor owner rights when an editor or manager role would do.
• Letting a domain run on a one-year renewal with a personal card.
• Assuming an agency's "we'll hand it over" will happen without a written date.

Among results from our HVAC work, the businesses that compounded growth year after year did so on assets they controlled: CombiBoiler.ca built 500+ page-1 rankings for combi-boiler keywords, work that only keeps paying while the domain stays in the right hands. See more on our results page, or contact us if your audit turns up reds you cannot clear.