Imagine this phone call. You've decided to part ways with your agency. No drama, just a decision. You ask for the login to your hosting panel. The account is in their name. You ask for the code repository. It's in their GitHub organisation, not yours. You ask for Google Analytics access. The property was created inside their workspace. You ask for the domain registration. That too.
Five minutes into the handover conversation, you realise: you don't own the thing you've been paying for. You're a tenant. Eviction is a decision they make, not one you can negotiate from a position of strength.
This isn't rare. It's the default. Most SME website builds leave the client in some mixture of this situation, and the client doesn't find out until they try to leave or the agency vanishes.
Here's the ten-point custody check. Run it against your current site. Count how many you pass.
01 · Who owns the domain registration?
Log into your registrar. If you don't know what your registrar is, that's already a failing grade. The domain should be in your company's name, on your billing, with your contact details. If it's in the agency's name, they own your address. Everything else you've built sits behind an address they control.
02 · Who pays the hosting bill?
The hosting account must be in your name, on your billing. "We manage the hosting for you" translates to "you can't leave without rebuilding". Get access today. Or start moving.
03 · Where is the source code?
A GitHub, GitLab or Bitbucket repository should exist, in your organisation, with your admin user at the top. Not "they send us a tarball when we ask". The repository is your asset. If it's on their machine, it isn't yours.
04 · Does the repository include the full history?
A squashed 'initial commit' two weeks before launch is a red flag. The real history shows who wrote what, when, and why. Without it, future fixes start by reverse-engineering what was already decided. Expensive, and unnecessary.
05 · Who has the CMS admin login?
You should have a super-admin account in your name. You should be able to create new editor accounts, remove old ones, and audit who has access. If every change to the site goes through the agency's login, you're paying for access to your own data.
06 · Whose Google Analytics / GA4 property is it?
The property should be in a Google Analytics account that your company controls. Years of behavioural data aren't portable the way you think they are. If the account dies, the history dies. That history is commercially valuable, don't lose it on the day you fire an agency.
07 · Who owns Search Console?
Same test. The verified property should be yours. Your SEO history, Google's messages to you about the health of your site, your sitemap submissions, all of that is Search Console data. Without ownership, you don't see what Google is telling you.
08 · Where do ad accounts and pixels live?
Meta Business Manager, Google Ads, LinkedIn Campaign Manager, these should be in Business Managers your company owns, with agency users given access. Not the other way round. If the agency's Business Manager contains your pixel history, their day-one action on your departure is to stop sharing. You lose the audiences. Years of optimisation, gone.
09 · Is the design handed over in editable files?
Figma workspaces, Sketch files, brand asset libraries, these should be shared to your workspace, not just to a PDF you were emailed. You might not touch them for five years. When you do, you'll want the originals.
10 · Is there a written handover document?
A handover doc that lists: where each asset lives, which accounts control it, what's in each repository, what's in each third-party service, who has admin, and how to restore from backup. One document, updated yearly, available to your team. Without it, institutional knowledge walks out the door every time anyone leaves.
How to score yourself
Ten passes: you're fine. Don't change anything.
Seven to nine: fixable in a week of administrative work. Do it before your next review cycle.
Three to six: you have a custody problem. You're unlikely to be able to leave without negotiation. Start moving critical assets today, ideally before the agency notices.
Zero to two: it is not an exaggeration to say that you do not own your website. Your agency does. Your leverage is low, your options are narrow, and you need an independent view of how to get out. An audit is a reasonable next step.
You pay the bill. You should own the asset. If you don't, that's the first thing to fix, before the site itself.