Keep It Yours

Evergreen reference

The Founder Infrastructure Ownership Checklist

Can your company still operate if your developer, CTO, agency, or IT provider disappears tomorrow?

Most founders assume the answer is yes. This checklist is how you find out for certain. Work through all eleven categories and apply the same test to each: could you log in and take control yourself, today, without asking anyone?

The eleven categories

01

Domains & DNS

The address your brand, website, and email all depend on — and one of the most commonly misregistered assets.

What you should control

  • The domain is registered to the company as the legal registrant, not to an individual, developer, or agency.
  • The registrar account (GoDaddy, Namecheap, Cloudflare, Squarespace, etc.) is owned by the company and a founder can log in independently.
  • DNS management can be delegated to a developer, but the registrar account that can transfer or release the domain stays with the company.

What to verify

  • Log in to the registrar yourself, without asking anyone for a password.
  • Check that the registrant organization and contact email are a company identity you control.
  • Confirm auto-renew is on and billed to a company payment method.
  • Confirm two-factor authentication is enabled and recovery goes to a company inbox.

Warning signs

  • You don't know which registrar the domain lives at.
  • The only way to change DNS is to ask your developer or agency.
  • The domain contact is a personal Gmail or a former contractor's email.
  • You've ever received a renewal notice addressed to someone outside the company.

Why it matters

If you lose the domain, you lose your website and often your email in one stroke — along with the ability to prove the brand is yours. Recovering a domain held by a departed party is slow, stressful, and sometimes impossible.

02

Cloud Infrastructure

The servers, databases, and services your product actually runs on.

What you should control

  • The root or owner account for each cloud provider (AWS, Google Cloud, Azure, Vercel, etc.) is registered to the company.
  • Billing is tied to a company payment method, not a personal card.
  • Founders hold the credentials to the owner account, with team members given their own scoped access beneath it.

What to verify

  • Confirm who holds the root/owner login for every cloud account in use.
  • Check that billing contacts and payment methods are the company's.
  • Ensure individual engineers have named accounts rather than sharing one root login.
  • Verify recovery and multi-factor settings point to company-controlled methods.

Warning signs

  • The cloud account was created with a developer's personal email.
  • Everyone logs in with the same shared credentials.
  • You can't see the billing dashboard or don't know what you're paying for.
  • Only one person can create or delete infrastructure and nobody else has owner rights.

Why it matters

Your cloud account holds the live product and its data. If control rests with one person or an outside party, an offboarding, dispute, or lockout can take your product offline with no clear path back in.

03

Source Code & Repositories

The code that is, in many companies, the core of the business.

What you should control

  • Code lives in an organization account (GitHub, GitLab, Bitbucket) owned by the company.
  • At least two founders or trusted principals are owners of that organization.
  • Contributors work as members of the org, so removing any one person never removes your access to the code.

What to verify

  • Confirm the repositories sit in a company organization, not a developer's personal namespace.
  • Check that the company controls org ownership and billing.
  • Ensure you have a recent copy or backup of critical repositories.
  • Review who has admin rights and remove anyone who no longer needs them.

Warning signs

  • The repo URL contains a person's username rather than the company's name.
  • Only the developer can grant access to the codebase.
  • There's no backup and no one but the original developer has ever cloned it.
  • You couldn't hand the code to a new team without the current developer's cooperation.

Why it matters

If your code sits in someone's personal account, your most valuable asset depends on their goodwill. Company-owned repositories mean the business — not any single contributor — controls its own product.

04

Email & Identity

Business email and the identity platform that resets passwords for everything else.

What you should control

  • The company is the administrator of its email/identity platform (Google Workspace, Microsoft 365), not merely a user.
  • A founder can create, suspend, and reset accounts for everyone on the team.
  • The admin account uses a company identity with strong multi-factor authentication.

What to verify

  • Confirm you have super-admin access to the email platform, not just a mailbox.
  • Check that account recovery for the admin goes to a company-controlled method.
  • Ensure departing employees' accounts can be suspended and their mail retained.
  • Review which apps and integrations have been granted access to company identity.

Warning signs

  • Your email runs on someone's personal account or a domain you don't control.
  • Only an outside IT provider can add or remove mailboxes.
  • There's no way to recover a former employee's email after they leave.
  • The admin credentials are held solely by a contractor.

Why it matters

Email is the master key: password resets for nearly every other system flow through it. Whoever controls your identity platform effectively controls access to everything downstream.

05

Payments & Billing

How money comes in, where it lands, and who can change that.

What you should control

  • Your payment processor (Stripe, PayPal, etc.) is registered to the company with founders as administrators.
  • Payout bank accounts, tax settings, and business details are controlled by the company.
  • Team members are added with scoped roles rather than sharing the owner login.

What to verify

  • Confirm founders hold administrator access to every payment and billing tool.
  • Check that payouts route to a company bank account, not an individual's.
  • Review who can issue refunds, change payout accounts, or export customer data.
  • Ensure multi-factor authentication protects the processor's owner account.

Warning signs

  • The Stripe or PayPal account is in a founder's or contractor's personal name.
  • Payouts land in an account not owned by the company.
  • You can't see the full transaction history or manage team access yourself.
  • One person controls both the processor and the destination bank account.

Why it matters

Payment accounts touch revenue, customer data, and tax exposure. Misplaced ownership here risks not just lockout but financial and compliance problems that are painful to unwind.

06

Analytics & Data

The measurement and customer data that inform every decision you make.

What you should control

  • Analytics, product data, and customer databases are owned under company accounts.
  • You can export your data and know where it physically lives.
  • Data-processing tools are configured under company identities, not personal ones.

What to verify

  • Confirm analytics properties (e.g. Google Analytics) are owned by a company account.
  • Check that you can export customer and product data without third-party help.
  • Review who has access to raw customer data and why.
  • Ensure backups exist for any database that would be catastrophic to lose.

Warning signs

  • Your analytics were set up under an agency's or employee's personal account.
  • Nobody at the company can export the customer list.
  • Historical data would disappear if one vendor relationship ended.
  • There is no record of where customer data is stored.

Why it matters

Your data is both a strategic asset and a compliance responsibility. Losing access to it — or being unable to move it — weakens decision-making and can create legal exposure.

07

App Stores

The developer accounts that publish and control your mobile apps.

What you should control

  • Apple Developer and Google Play accounts are enrolled as the company (organization), not an individual.
  • The company holds the account holder / owner role, with developers added as members.
  • Signing keys and credentials are backed up and controlled by the company.

What to verify

  • Confirm the store accounts are organization accounts under the company's legal name.
  • Check that a founder holds the account-holder role, not a contractor.
  • Ensure app signing keys are securely stored and recoverable by the company.
  • Review who can publish, unpublish, or transfer the apps.

Warning signs

  • Your app is published under a developer's personal store account.
  • Only one outside person can push updates to the store.
  • Signing keys exist only on a contractor's machine.
  • You couldn't transfer the app to a new developer without the old one.

Why it matters

App store accounts control distribution of your product. If they sit with an individual, you can lose the ability to ship updates — or even the listing itself — during a transition.

08

Third-Party SaaS

The CRM, marketing, support, and operational tools the business runs on daily.

What you should control

  • Critical SaaS accounts (CRM, email marketing, support desk, project tools) are registered under company emails.
  • Ownership of each account is held by the company, with staff added as members.
  • No essential tool depends on a single employee's personal login.

What to verify

  • List the SaaS tools the business genuinely depends on and confirm who owns each.
  • Check that account owners use company identities, not personal ones.
  • Ensure billing for each tool is on a company payment method.
  • Review seat and admin access, removing anyone who has left.

Warning signs

  • A key tool is registered to 'john@gmail.com' rather than a company address.
  • Losing one employee would lock you out of the CRM or mailing list.
  • Subscriptions are billed to personal cards and expensed.
  • No one has a complete list of the SaaS tools in use.

Why it matters

SaaS tools accumulate quietly, and ownership scatters across personal accounts over time. When a key person leaves, orphaned accounts can freeze operations or expose sensitive data.

09

Administrative Access

Who holds the keys across all systems — and whether that's centralized and intentional.

What you should control

  • The company maintains a clear record of which accounts exist and who administers each.
  • Admin and owner roles are assigned deliberately, with at least two trusted people able to recover critical systems.
  • A password manager or secrets vault owned by the company holds shared credentials.

What to verify

  • Maintain an up-to-date inventory of systems, owners, and administrators.
  • Confirm no single person is the sole admin of a business-critical system.
  • Check that credentials are stored in a company-owned manager, not personal notes.
  • Run an offboarding checklist whenever someone with access leaves.

Warning signs

  • Only one person knows how to get into everything.
  • Passwords are shared over chat, email, or spreadsheets.
  • There's no list of who has admin rights to what.
  • Former team members may still have access and no one is sure.

Why it matters

Access sprawl is invisible until it isn't. Centralized, documented administrative control is what lets a company survive departures, respond to incidents, and pass due diligence.

10

Backups & Recovery

Whether you could actually restore the business after a failure, mistake, or attack.

What you should control

  • Critical data and systems are backed up on a schedule to storage the company controls.
  • Backups are tested — you've confirmed they can actually be restored.
  • Recovery procedures are written down and not dependent on a single person's memory.

What to verify

  • Confirm what is backed up, how often, and where the backups live.
  • Perform or review a test restore of a critical system.
  • Check that backups are protected and not solely on one person's device.
  • Document who is responsible for recovery and how it's done.

Warning signs

  • You're not sure whether backups exist or when one was last taken.
  • Backups have never been tested with a real restore.
  • The only backup lives on the same account that could be lost.
  • Recovery depends entirely on one contractor being reachable.

Why it matters

Backups are worthless until proven restorable. Tested recovery is the difference between a bad day and an existential event when hardware fails, an account is compromised, or someone makes a costly mistake.

11

Vendors & Agencies

The outside partners who build and run things for you — and the ownership terms behind that work.

What you should control

  • Contracts specify that work product, accounts, and credentials belong to the company.
  • Vendors and agencies operate inside company-owned accounts rather than their own.
  • There is an agreed, documented handover process for when an engagement ends.

What to verify

  • Review agreements to confirm the company owns the deliverables and IP.
  • Check that agencies build in your accounts, not accounts they retain.
  • Ensure you hold administrative access to anything a vendor set up.
  • Confirm an offboarding and handover plan exists before you need it.

Warning signs

  • An agency 'hosts everything for you' inside their own accounts.
  • You can't access your own systems without going through a vendor.
  • Contracts are silent on who owns the work and the accounts.
  • Ending the relationship would mean losing access to critical systems.

Why it matters

Agencies and vendors are valuable partners, but convenience can quietly become dependency. Clear ownership terms ensure a smooth handover instead of a hostage situation when the relationship changes.

The question behind the whole list

“If the person who set it up vanished tomorrow, could you still get in?”

Anywhere the answer is “no” or “I'm not sure” is a gap worth closing this week.

Frequently asked questions

What is a founder infrastructure ownership checklist?
It's a practical, non-technical list of the digital systems a company depends on — domains, cloud, code, email, payments, data, app stores, SaaS tools, administrative access, backups, and vendors — with a way to confirm the company (not an individual or outside party) truly owns and controls each one.
Why does infrastructure ownership matter for founders?
If control of critical systems rests with a developer, agency, or former employee, the business can be locked out during a transition, dispute, or security event. Clear ownership protects continuity, satisfies investor due diligence, and keeps founders in control of what their company runs on.
How often should founders review this checklist?
Review it whenever someone with access joins or leaves, before a fundraise or acquisition, and at least once or twice a year as a standing hygiene check. Ownership tends to drift over time as tools and people change.
What's the single most important question to ask?
For every system: if the person who set it up disappeared tomorrow, could you still log in and take control? Anywhere the answer is 'no' or 'I'm not sure' is a gap worth closing right away.

This checklist is a condensed, practical companion to Keep It Yours, the book on the digital systems every founder must own and control. If you want the full reasoning, stories, and step-by-step fixes behind each category, that's where it lives.

Read more about the bookSee the quick-start guide version