Who Really Owns Your Domain, Cloud and App Accounts? A Three-Rights Matrix for Outsourced Projects

Last month a 30-person bakery chain called us. Their previous agency had gone silent for six weeks. The company domain was due to expire in 12 days, and the renewal notices were going to a developer's personal inbox. The app was published under the agency's developer account, and the cloud server was billed to the agency owner's credit card. The owner had paid NT$680,000 for the system and only now realised the company held none of the keys.

1. Four myths about who owns the accounts

"The contract gives us the copyright, so the accounts are ours too." Copyright covers the code. Domains, cloud accounts and developer accounts are separate service agreements with each platform, and whoever is registered there is the holder.
"Letting the agency hold them is simpler." It saves about two hours of sign-up work. The cost comes later: for gTLDs, a change of registrant triggers a 60-day lock on moving to another registrar under the ICANN Transfer Policy.
"If we have the admin password, we own it." Passwords get changed. Control sits with the recovery email and phone. AWS recommends a company-managed group email for the root user and never letting one person hold both recovery channels.
"We can move the app over later." You can, with conditions. An Apple app transfer requires TestFlight to be switched off, and apps with subscriptions or Sign in with Apple need extra preparation.

2. The framework: a three-rights matrix

Split every digital asset into three rights and write down who holds each one:

Ownership (Owner): registered under the company's legal name and a group mailbox, with a company phone number for recovery.
Administration (Admin): granted to the vendor as a sub-account or role that can be revoked at any time.
Billing: charged directly to a company card. If the vendor pays on your behalf, every invoice comes with the original bill attached.

Cover at least eight asset types: domain and DNS, cloud hosting and databases, code repositories, app developer accounts, payment merchant IDs, email delivery services, analytics and ad accounts, and third-party API keys.

Formula: Ownership health = assets where the client holds Owner ÷ total assets. The target is 100%. Anything under 70% is red and gets fixed this month.

3. Three companies, three conclusions

Profile	Typical gap	First move
5-person startup, website only	Domain registered to the agency	Move domain and DNS back within a week
30-person retailer, website + app	App under the agency's developer account	Open a company developer account, then schedule the transfer
150-person manufacturer, several systems	Cloud costs buried in the agency's bill	Set up a company cloud organisation and move billing account by account

4. The hidden costs

From projects we have taken over:

Expired domain snapped up: buying it back commonly runs NT$30,000–300,000, and the website and email are down the whole time.
App forced to relaunch: reviews and download history reset to zero, and resubmission takes around 40–60 hours.
Rebuilding the cloud environment: 24–80 hours, or NT$36,000–120,000 at NT$1,500 an hour.
Opaque billing: pass-through costs often carry a 15%–30% markup with no breakdown.
Accounting: invoices are issued to the vendor, so the company struggles to book them as its own expense.

5. KPI scorecard: account governance (10 dimensions)

Score each item 0–2. Below 14 out of 20, ask for fixes before you sign:

Delivers an asset inventory in week one
Asks the client to register Owner accounts themselves
Accepts access only as sub-accounts or roles
Turns on MFA everywhere
Stores credentials in a shared password manager
Attaches original bills to pass-through costs
Puts an account handover list in the contract
Revokes access within 3 working days of staff changes
Updates the inventory every quarter
Can explain each platform's transfer limits

6. How ScriptWalker handles it, and when we are not a fit

Project: the matrix is delivered in week one. The client registers every Owner account and we take admin access only.
Retainer: quarterly inventory and cost report, with cloud charges billed straight to the client's card.
Advisory: for companies that already have a vendor, a one-off audit of about 8–16 hours.
Full outsourcing: we run operations and on-call, while the accounts stay with the client.

We will decline when:

The client wants the vendor to hold every account in its own name long-term.
There is no internal contact person, and no willingness to use a group mailbox.
We are asked to take over accounts without authorisation or proof from the current holder.

7. The 90-day ownership recovery playbook

Weeks 1–2: fill in the matrix, calculate the health score, and set up a group mailbox and password manager.
Weeks 3–4: deal with domains and certificates expiring within 30 days first. Open company developer accounts (an Apple organisation account needs a D-U-N-S Number and costs US$99 a year; Google Play is a one-time US$25).
Months 2–3: move cloud, payments and apps one at a time, checking login, charges and callback URLs after each move.
Day 90: health score at 100%. Remove access for former vendors and staff who have left.

8. Self-check list

☐ The domain registrant is the company
☐ Renewal notices go to a group mailbox
☐ The company holds the cloud root account
☐ MFA is on for every account
☐ Recovery email and phone are not held by one person
☐ Apps sit in the company's developer accounts
☐ The payment merchant ID is under the company's tax ID
☐ Cloud invoices are addressed to the company
☐ The vendor has revocable admin access only
☐ The contract includes an account handover list
☐ The inventory was updated in the last 3 months
☐ You can revoke any vendor's access within an hour

9. FAQ

Is it cheaper to use the vendor's accounts?

Usually not. Cloud list prices do not change with the holder. The better deal is giving the vendor admin access inside your own account.

Our old vendor has disappeared. Can we still recover the domain?

If the company is the registrant, apply to the registrar with supporting documents. If it is registered to the vendor, you need their consent or a dispute process, which takes months, so act well before expiry.

Do users have to reinstall after an app transfer?

No. Official Apple and Google transfers keep users and reviews, but subscriptions and sign-in need preparation. Allow 2–4 weeks.

10. Next step

Not sure which accounts you actually hold? Book a free 30-minute consultation and we will fill in your first three-rights matrix with you and flag the most urgent red items.