Handover is where accounts go wrong. Credentials get half-transferred, old access lingers, and six months later nobody can say who owns the billing. A written checklist applied both ways – when you receive an account and when you hand one on – removes most of that.
Receiving an account
- Confirm what you are receiving before payment: which credentials, which identities.
- Sign in, change the password, and enable multi-factor authentication.
- Move recovery email and phone to addresses you control.
- Create your own administrative identity and stop using the handed-over one.
- Remove every identity, role and key belonging to the previous holder.
- Inventory running resources and storage; question anything unexplained.
- Check billing: balance, payment method, any credits and their expiry.
- Enable audit logging and a billing alert.
- Record the date and what was received, for your own audit trail.
Handing an account to a client
Agencies do this at the end of most engagements, and doing it cleanly is part of the professional service. The goal is that the client ends up in full control and you end up with no residual access.
- Document what exists: resources, architecture, scheduled jobs, DNS, dependencies.
- Transfer ownership of the account or invite the client as owner.
- Have the client set their own password, multi-factor authentication and recovery contacts.
- Remove your identities, roles and API keys once they confirm access.
- Move billing to the client’s payment method.
- Hand over documentation in writing, not verbally.
- Confirm in writing that your access has ended and on what date.
| Item | Before | After |
|---|---|---|
| Owner identity | Agency | Client |
| Administrative logins | Agency staff | Client staff |
| API keys | Agency automation | Client automation, newly issued |
| Billing method | Agency | Client |
| Recovery contacts | Agency | Client |
| Documentation | In the agency’s head | Written and delivered |
The documentation that actually matters
- What runs where, and what depends on what.
- Which scheduled jobs exist and what they do.
- Where DNS is managed and where certificates come from.
- How to deploy, and how to roll back.
- Where backups go and how to restore one.
- What the monthly cost is and what drives it.
That list fits on two pages and answers nearly every question a new owner will have in their first month.
Summary
Handover is a process, not a password. Run the same checklist in both directions, put the outcome in writing, and the account stops being a source of ambiguity for everyone involved.
