If you fired every vendor tomorrow, what would you actually still have?

Here is an uncomfortable question to ask on a quiet afternoon. If you parted ways with every vendor you use tomorrow, on bad terms, what would you still be able to log into?

Most owners assume the answer is everything, because they paid for all of it. Ownership and access turn out to be different things, and the gap only becomes visible at the exact moment it is most expensive.

The rule, in one line

The business holds the account. Vendors get access to it.

That is the whole principle, and it costs nothing to apply at the start of a relationship. Applying it retroactively costs a fortnight of emails and occasionally a lawyer, which is why it is worth doing while everyone still likes each other.

It applies to us as much as anyone. An agency that needs to own your assets to work on them is describing its retention strategy, not a technical requirement.

The inventory

Eight things, each with its own way of going wrong.

The domain

The registrar account should be in the business name, on a business email rather than the personal address of whoever set it up in 2014. This is the one that ends companies. Lose the domain and the website and every email address go with it in the same afternoon, and the renewal notice that would have warned you went to an inbox nobody has opened since that person left. It is also the asset most likely to be sitting somewhere nobody has thought about for a decade, because domains renew quietly and never ask for attention until the year they do. Check this one first even if you check nothing else on the list.

DNS

Frequently held somewhere other than the registrar, almost always forgotten, and decisive: whoever controls DNS controls where your site and your mail actually point, whatever the domain paperwork says.

Hosting or the site platform

Know what you could take with you if you left, because the answer varies enormously and some platforms will not let you export the site at all. The exit cost differs more than the monthly price does.

The Google Business Profile

The most commonly misheld asset in local business, usually sitting under a former employee or a marketing company from two agencies ago. Recovery is a documented process in which the current holder gets three days to respond, and counterintuitively silence is a better outcome for you than a refusal.

The phone number

Google requires the number on your profile to be under the direct control of the business. A tracking number sitting in an agency account is not, and if the line can leave when the relationship does, that is worth deciding deliberately rather than discovering at handover.

Ad accounts

Yours, with the agency added as a user. When the account belongs to the agency, the spend history and the conversion data stay behind when you go, and the next agency starts from nothing while you pay for the learning twice.

The CRM and the automations

The customer list is the actual asset here, so confirm you can export it today, in a format somebody could use, without asking permission from anyone.

AI and analytics logins

Newer, and already a problem. Business tiers exist partly so accounts sit under central administration and a contract in the company name rather than in a personal login that walks out with somebody.

How to check without a project plan

Set aside two hours. For each item, do not ask whether you have access; ask who else does, and whose name the account is in.

The practical test is a password reset. Trigger one and see which inbox it lands in. If the recovery email is a vendor address or a former staff member, you have found an account you do not really control, whatever the invoice history suggests.

Write down the answers in one place while you are at it. A single document listing what exists, whose name it is in, and where the login lives is worth more than any individual fix, because it turns a recurring panic into a page you can hand to somebody.

When you find one that is wrong

Ask plainly and early. Most vendors transfer things without drama, because most of them are not holding your accounts as strategy, they simply set it up on their own login years ago and never thought about it again.

Where a transfer is genuinely refused, treat that as information about the relationship rather than as a technical obstacle. Then work through the documented recovery routes, which exist for exactly this situation and are slower and duller than simply being asked.

And while you are in the profile, check what the Book button points at, since third-party links can appear there without anybody adding them and take five days to remove once you ask.

If you would rather someone go through the list with you and tell you which accounts are genuinely yours, book a strategy call. It is not a glamorous engagement and it is the one that stops a bad month from becoming a bad year.