You keep control of an outside vendor by holding three things yourself: the accounts, the evidence and the exit. Plenty of agencies and dev shops do good work under that arrangement. Trouble starts when a buyer learns, months in, that the domain or the code sits in someone else’s name and the only proof of progress is the vendor’s own report. The checklist below takes about an hour. Run it before you sign, or this week if you already have.
What should you hold before a vendor starts?
Ten things, each checkable from your own logins in a couple of minutes.
| # | What you hold | How to check it |
|---|---|---|
| 1 | The domain, registered to your company, in a registrar account you can log into | Log in yourself. If only the vendor can, you don’t control the domain. |
| 2 | Hosting and cloud accounts billed to your company | The invoice arrives in your inbox. |
| 3 | Source code in a repository your company owns, vendor as collaborator | A vendor-owned repo can be transferred to you with its issues and history; ask before the final payment. |
| 4 | Google Ads and Meta ad accounts created under your business | You hold Admin in Google Ads. Only Admin users can grant access and unlink manager accounts. |
| 5 | Google Analytics 4, you as Administrator | Only the Administrator role can add or change users. |
| 6 | Search Console, you as owner | Owners add and remove users; the vendor gets full-user access. |
| 7 | An IP clause assigning code, designs and content to you on payment | “A licence to use” or “buy the IP later” isn’t ownership. |
| 8 | An exit clause | Notice period, handover of files and credentials, data export, transition help. |
| 9 | Monthly written reports tied to leads or sales | Every figure should be one you can open in your own GA4, Search Console or ad account. |
| 10 | Named people on the work | Who actually works on your account or code, with written notice when that changes. |
Push hardest on items 1 to 6, since they cost the vendor nothing. A marketing manager on r/PPC asked for read-only access to the company’s own Google Ads account and the agency’s answer was that they “typically don’t share account access”. Already mid-contract? Start right here. Ask for Admin, Administrator and owner on those accounts; a reasonable shop says yes the same day. A delay, a “policy” or a fee tells you what leaving would cost while you can still negotiate.
Before you sign: what do you need to settle?
How the vendor gets paid, and whether its pitch and portfolio hold up.
Every pricing model pays the vendor for something. A percentage of ad spend grows with your budget whether or not results do; a fixed price holds only while the scope stays frozen. Pick the incentive you can live with and tie payments to deliverables you can check. See vendor pricing models compared, and our cost calculators for rough budgets.
The most confident answer in a pitch often isn’t the right one, and a non-specialist can’t easily tell them apart. Our pitch question list pairs each question with a good answer, a red flag that sounds good, and the follow-up.
Screenshots prove little. A live store listing under a named publisher proves more, and vetting an app developer’s portfolio takes about 20 minutes.
While the work runs: how do you know it’s working?
Check results in your own accounts once a month, against a timeline you agreed before the work began.
Search Console shows search clicks, GA4 shows conversions, and your CRM or call log shows real leads. For paid search, Google Ads change history lists account changes from the past two years, with the email of whoever made each one in the interface. A month with no entries from your agency is a fact you can bring to the next call. Click by click: how to check your SEO or PPC vendor is working.
Slow starts are harder to read, because SEO lags and new campaigns need time to gather data. What’s normal at week four, and what isn’t, is in Is this normal?
Leaving: what do you need to walk away with?
Everything on the checklist, still in your name, plus the files and data that only lived in the vendor’s tools.
Exit is where buyers learn what they never owned. One founder on r/startups wrote: “The dev refused to give me the source code, so I had to scrap the entire thing.” Quieter losses include call-tracking numbers the vendor registered and design source files. The asset-by-asset list is in who owns your code, domain and ad accounts.
This is not legal advice; contract law differs by country — have a lawyer review the final agreement.
Questions buyers ask
Is it normal for an agency to run my ads from its own account?
It happens, and some agencies prefer it. You pay later: the account’s history stays with them when you leave. Ask for an account created under your business and linked to their manager account; the link only works once your account accepts the invitation.
Do I need source-code escrow?
Usually not. Escrow suits enterprise software your operations depend on. For a marketing site or a small app, a company-owned repository with code delivered at each milestone is enough.
What if a vendor guarantees first-page rankings or a place in AI answers?
Treat it as a red flag. No vendor controls how Google ranks pages or what an AI assistant cites, so the guarantee is a sales line. Read what the refund actually covers.
Your next step: today, open your registrar, ad accounts, GA4 and Search Console, and write down whose name sits at the top of each. Anything that isn’t yours goes first on the agenda for your next vendor call. When you start a shortlist, compare vendors with this checklist beside you.