Owning your domain, your site, and your data

This is not a hypothetical risk. Agencies and developers holding client assets is a known pattern in this industry, sometimes through malice and much more often through sloppiness. Either way the outcome for you is identical: you cannot leave.

It also does not usually surface until the worst moment. A relationship ends, a developer stops answering email, a company gets sold, and suddenly the business discovers its own web address belongs to someone else.

What exactly should I own?

Five assets, and the test for each is the same: can you get to it without asking anyone.

The domain. Registered to your business, at a registrar you can sign into, with your email as the contact. This is the one that matters most because everything else can be rebuilt and this cannot.

The site files and content. You should be able to export or download the whole thing. On a builder platform that means having the account. On a custom site it means having the code and the database.

Analytics and Search Console. Your traffic history. This is the only record of what your business did online before today, and it cannot be reconstructed after the fact.

Your Google Business Profile. Owner, not manager. Vendors frequently create the listing during onboarding and stay as owner, which means your reviews and your map presence sit inside their account.

Your ad accounts and lead data. Every inquiry anyone ever submitted through your site. That list is yours.

If you cannot log into all five today, you do not own your web presence. You rent it.

What is the profile actually worth if it is not in my name?

Why do agencies end up holding these?

Mostly convenience, not conspiracy, and that is why it is so widespread.

A developer registers the domain because it is faster than walking a client through a registrar. A vendor creates the analytics account under their own login because they are already signed in. A marketing company sets up the profile during onboarding and never transfers it. Nobody intends to trap anyone. The trap forms anyway.

Then there is the smaller group who do it deliberately, and their model depends on it. If a client can leave with everything, the work has to be good enough to keep them. If the client cannot leave, it does not.

You can tell the difference with one question, asked early and pleasantly: if we part ways, what do I keep and how do I get it? A straight answer takes ten seconds. A vague answer is the answer.

What about the dashboard my agency gives me?

Treat it as a report, not as an asset, and ask what is underneath it.

There is a specific claim to refuse here, and Google has written the refusal for you. In its own documentation on generative AI features, Google states: be wary of third-party tools that promise ranking success or claim to use internal Google metrics, because no third-party tool has access to Google's internal ranking or AI systems. That sentence retires an entire genre of proprietary score.

The same applies to what can be measured at all. When Google launched its generative AI performance reports in Search Console in 2026, the available dimensions were impressions, pages, countries, devices and dates. Clicks, click-through rate, position, and the user's prompt are explicitly not available, and AI Overviews are not separated from AI Mode. So if a dashboard shows you a click count or a rank position inside an AI answer, it is not reading a source that exists.

The practical test for any vendor dashboard is three questions. Where does each number come from originally. Can I see that source directly, in an account in my name. Can I export the history if the dashboard goes away. A dashboard built on your Google Analytics, your Search Console, your Google Business Profile insights and your call tracking passes all three, because you can reach every input yourself. A dashboard built on a proprietary visibility score passes none.

There is a smaller version of the same problem in the tools that sit on your site. Bolt-on products that collect conversations and leads inside somebody else's system create the same dependence in miniature, which is one of several reasons to be careful about whether live chat and chatbots actually help a small business before you install one.

How do I check, and what do I do if it is wrong?

Checking takes twenty minutes.

Look up your domain in a public registration lookup and read the registrant organization and the contact email. If it is not you, that is your first call.

Sign into your analytics and check the account permissions list for who has administrator access. Do the same in Search Console. Do the same in your business profile, where the setting is explicit about owner versus manager.

If something is wrong, ask for a transfer in writing, politely, with a specific deadline. Most of the time you get it, because most of the time it was never intentional.

If you do not get it, registrars have dispute processes and Google has a profile ownership request process with a waiting period. Both are slow. The point of checking early is to never need either.

While you are in there, note the profile itself as a separate asset from the website. For a lot of businesses it produces more customers than the site does, and that is especially true when there is no storefront to walk into, which is why how service area businesses rank without a storefront can matter more than anything on your web pages.

What should the arrangement look like instead?

Simple, and written down once.

You hold the domain. Your agency gets access, not ownership. You hold the analytics and profile as owner and add your agency as a manager, which is a setting that exists precisely for this and takes one click to reverse.

Your contract says the files and content are yours on termination, delivered in a usable format, within a stated number of days. Not "we will provide reasonable assistance."

Your maintenance arrangement is separate from your ownership. Paying someone to keep a site running is normal and healthy, and it should never be the mechanism that keeps you from leaving. What website maintenance covers and what it should cost is a service question, not a control question, and any vendor who blurs those two is telling you something.

And build the site so it works without them. That means standard tools, no proprietary content system only they can operate, and a site that stays usable for every visitor. The accessibility basics that also improve conversion belong here too, because a site built on plain, standard markup is one anybody can maintain later.

Where does this argument break down?

Two places, and one of them gets owners into unnecessary fights.

When holding the asset is not the same as withholding it. A developer who registered your domain in their account eight years ago, out of habit, and who will transfer it this afternoon if asked, is not holding you hostage. The remedy is a conversation, not an exit. Ask before you conclude.

When you cannot administer what you hold. Ownership without competence is its own risk. A registrar account with the login in a notes app and no renewal reminder is closer to a hostage situation than a well-run agency account is. If you take ownership, take the calendar entries and the recovery email with it.

The one asset with no workaround either way is history. You can rebuild a site, redraw a logo, and rewrite copy. You cannot go back and collect three years of analytics you never had. That is why the analytics and Search Console rows on this list are urgent even when the relationship is excellent.

What to do this week

Look up your own domain registration today. Write down the registrar, the registrant name, and the expiration date. Set a calendar reminder a month before it expires, in your calendar, not your developer's.

Then check administrator access on analytics, Search Console, and your business profile. Add yourself as owner anywhere you are not.

Then run the profile arithmetic above with your own call volume, so the conversation has a number in it.

Then export something, just to confirm you can.

Then, if you find a problem, send the transfer request this week rather than at the moment you decide to leave. Requests made during a good relationship get answered. Requests made during a bad one get slow.

Questions about what you actually own?

Email me at eric@seod.com with your domain name. I will look up the public registration record and tell you what it says about who holds it, plus the exact wording I would use to request a transfer if it is not you. Takes me two minutes and it has saved people a great deal of trouble.

More on protecting your assets in the web design and branding library.