Who Owns Your Code, Domain and Ad Accounts?

You should own every account and every file you paid for, and your vendor should be a user you can remove in an afternoon. If any of that is the other way round, fix it now, while the relationship is friendly. It gets expensive once you’re leaving.

The bad version of this story is short. One founder on r/startups put it in a single line: “The dev refused to give me the source code, so I had to scrap the entire thing.” (thread) Nothing in that sentence is about bad code. It’s about who held the keys.

This page goes asset by asset: what you should own, what the vendor should get instead, and how to check it today. Then come the contract clauses to add before you sign, and an exit checklist for the day you leave.

What should be in your name, and how do you check it in two minutes?

Every asset below should be owned by your company, with the vendor added as a user or partner. Open each one yourself, logged in as you, not through a screen share the vendor runs.

If you can tick every row, you can stop reading here and bookmark the exit checklist. Most buyers can’t tick the last four, and those are the ones nobody asks about.

Why does an agency-owned ad account cost more than the ad spend?

Because the account’s history, its conversion data and its past campaigns stay with whoever owns it. Leave, and you start a fresh account with none of that.

The usual tell is a setup where you pay the agency and the agency pays Google or Meta. In one r/PPC thread a marketing manager asked for read-only access to her own company’s Google Ads account, and the agency answered that they “typically don’t share account access” (thread). Replies there, including from people on the agency side, said the same thing: the client should own the account, and an agency that won’t show you it is setting up a lock-in.

The platforms are built for the opposite arrangement:

• Google Ads. Agencies run client accounts through a manager account. Google’s own help page says users with administrative access to a linked account “can terminate the relationship with the manager account at any time by unlinking” it. The account itself has five access levels: Admin, Standard, Read-only, Billing and Email-only. Admin is the level that can give access, change access levels and cancel other users’ invitations. You want to be the Admin.
• Meta. Ad accounts sit in a business portfolio, and Meta lets the owner give a partner access to business assets instead of handing the account over. Meta’s developer documentation says it plainly: “Most marketing companies won’t need to claim ad accounts from their clients” (Meta for Developers).

Our view: if a PPC agency insists on running your spend inside an account it owns, don’t hire it. Some agencies do have a legitimate reason to pay the platform on your behalf, such as a credit line. That’s a billing arrangement. It can still run on an account you own, and the billing can move back to you when the contract ends. Put that in writing.

Where does the domain usually go missing?

At registration. A developer or assistant buys the domain to save you the hassle, in their own registrar account, sometimes under their own name.

Two separate things decide who controls a domain. The registrant is the legal holder of the registration; ICANN calls it the registered name holder. The registrar account is the login at the company that sold the domain. You need both. A domain registered to your company but sitting in the vendor’s registrar account still leaves them able to point it somewhere else.

That’s what happened to a small business owner in a r/SEO thread: a former website assistant redirected the company’s ten-year-old site to his own page and demanded payment to restore it. As far as the owner knew, nothing had ever been signed. Commenters kept asking the same first question, which is the right one: who owns the domain, and who has the registrar login?

What ICANN’s own pages say you’re entitled to:

• As registrant, you must keep your contact data accurate and your registrar account data current (Registrants’ Benefits and Responsibilities).
• Your registrar must give you the transfer authorization code within five calendar days of your request (ICANN transfer FAQ).
• Under the transfer policy in force today, after a change to the registrant name, organization or email you may not be able to move the domain to another registrar for 60 days. Some registrars let you opt out; they don’t have to (same FAQ). ICANN’s transfer policy review recommends dropping that lock, but until the new rules take effect, ask your registrar which lock applies.

A possible transfer lock is the reason to move the registrant to your company now, not during a dispute. Your email runs on the same domain, so a lost domain usually means lost email as well.

Do you own the code because you paid for it?

Not automatically. Who owns code written for you depends on your contract and on the law where it’s signed, and without a written assignment the default may not favour you.

This is not legal advice; contract law differs by country — have a lawyer review the final agreement.

What we’d want in practice:

1. An IP assignment clause that transfers rights in the work to you, triggered by payment. The vendor will keep its pre-existing tools and libraries, which is fair, but you should get a licence to use whatever of theirs ends up in your product.
2. Code in your repository from week one. A repo under your organization, with the vendor as a collaborator, means every paid milestone is already in your hands. If the vendor later moves a repo to you instead, GitHub’s transfer needs admin access on the repo, and issues, pull requests and commit history move with it.
3. Everything needed to run it. Code without the environment variables, deploy keys, build scripts and cloud account is a folder you can’t ship. Handover means another developer can build and deploy it from your accounts, using written instructions.

One offer to walk away from: a free or cheap prototype where you can buy the IP from the vendor afterwards. In an r/startups thread about exactly that deal, a commenter who said he was an IP advisor called it a terrible deal and said the client should always own the IP. We agree.

When is source-code escrow worth paying for?

Only when you license software you don’t own and your business would stop if the vendor disappeared. For a brochure site or an app whose repo you already own, it’s overkill.

Escrow means the vendor deposits its source code with an independent third-party agent, and the code is released to you only under conditions written into the agreement, such as the vendor’s bankruptcy or its refusal to keep maintaining the software (Wikipedia overview). It exists for licensees, not owners. If the repository is already yours, you don’t need a third party to hold a copy of it.

Where it does make sense (an enterprise SaaS your operations depend on, or a custom system the vendor keeps the rights to), ask about verification. A deposit is only useful if someone has checked it builds. Some escrow agents will build the deposited code and compare it with the version you run. In an r/startups thread, one vendor pushed back on a corporate client’s escrow request because their code changed daily, and other commenters said they’d just added the escrow deposit as a step in their release pipeline. That’s the setup to ask for: deposits that follow releases, not one zip file from signing day.

Which clauses should be in the contract before you sign?

These eight, checked one by one. We didn’t find this clause-level list on the vendor directories we reviewed, so treat it as a starting draft for your lawyer, not a finished template.

• [ ] IP assignment on payment. Rights in the deliverables move to you as each invoice is paid, with a licence to the vendor’s pre-existing components.
• [ ] Accounts in your name. Domain, hosting, repositories, ad accounts, analytics, call tracking and paid licences are opened under your company, or moved to it within a stated number of days.
• [ ] Admin access for you at all times. Not on request and not at the end of the project.
• [ ] Source-code delivery per milestone. Each accepted milestone is in your repository, with build instructions.
• [ ] Acceptance tests. What “done” means for each milestone, written before the work starts, so payment and IP transfer have a clear trigger.
• [ ] Data export. Reports, ad data, CRM records and analytics configurations exported in usable formats on request and at termination.
• [ ] Transition assistance. A stated number of hours or weeks of help handing over to you or a new vendor, at a stated rate.
• [ ] Escrow, only if justified. For licensed software you depend on, with verified deposits tied to releases.

Two of these do most of the work. If you get IP assignment on payment and code in your repo per milestone, a vendor who vanishes costs you time, not the product.

Pricing affects this too. Some fee structures make handing over control awkward for the vendor; how vendor pricing models compare covers which ones protect you.

Which answers should end the conversation?

Any refusal to put you in control of your own assets. These are the ones that disqualify a vendor for us:

• They won’t give you admin access to an ad or analytics account you’re paying for.
• They won’t sign an IP assignment, or they offer to sell you the IP later.
• They want to register the domain or open the hosting under their own account because it’s simpler.
• They’ll only hand over the code at the very end, in one go.

A good vendor answers these in one sentence and moves on, because it’s how they already work. If you want to test it before signing, ask during the pitch and see how fast the answer comes; questions for a vendor pitch has more of these.

How do you leave a vendor without losing anything?

Secure access first, export second, announce last. The order matters, because some vendors get less cooperative once they know you’re going.

One commenter in that r/PPC thread gave the same advice: line up the new setup and get access to everything before you tell the agency. Here’s the exit checklist, with who must hold each credential when you’re done.

Step 9 is the one people miss. Google’s Search Console permissions page says that if you don’t delete a removed owner’s verification tokens, that person can re-verify ownership later. For GA4, user management is covered on Google’s Analytics access page: only the Administrator role can add or delete users.

Call-tracking numbers are the asset buyers most often forget they don’t own. Your customers have been dialling those numbers, sometimes for years. Ask now, in writing, whose account they sit in and whether they can be moved to you if you leave.

FAQ

Can an agency keep my Google Ads account if we part ways? If the account is yours and the agency is linked through a manager account, no: you can unlink it at any time. If the agency created the account under its own setup and pays Google itself, you may not get it back, so export everything you can while you still have access.

Is it normal for a developer to hold the code until the final payment? Holding back the last milestone until it’s paid is normal. Holding back all the code until the end isn’t. Code for paid, accepted milestones should already be in your repository.

Do I need source-code escrow for my app? Usually not. If the repository is in your organization and the contract assigns the IP to you, you already have what escrow would give you.

The vendor registered my domain in their name. What now? Ask them to change the registrant to your company and move it to your registrar account, and get it in writing. If they refuse, talk to a lawyer before paying anything. The registrant field in public lookups is often hidden for privacy, so the reliable check is a registrar login of your own.

Does any of this matter if I trust my vendor? Yes, because people change jobs, agencies get sold and freelancers get sick. Owning the accounts protects the relationship as much as it protects you.

What to do this week

Open each account in the first table, logged in as yourself, and write down your role next to it. Anything where you’re not owner or admin goes on a list you send to your vendor this week, framed as housekeeping, not accusation. Then take the clause checklist to whoever reviews your next contract.

If the vendor drags its feet on handing over access, that tells you something about the rest of the engagement. How to check whether your SEO or PPC vendor is working is the next page to read, and the rest of the hiring-a-vendor guide covers the decisions before and during the contract.