Account ownership: the quiet question that decides your emergencies

Ownership is decided the day an account is created, not the day you need it: register it to the company, or you may never prove it was yours.

There is a question that decides emergencies before they happen, and almost nobody asks it in week one: who owns each account. The domain registrar, the hosting, the mail system, the analytics, the social profiles, the payment accounts. In whose name was each one registered, and which personal mailbox receives its recovery messages today.

The failure pattern is so common it is almost a genre. The agency that built the site holds the keys because it was easier that way at the time. A departed employee's personal address is still the recovery point for systems the company pays for. Nobody thought about it, because nothing was wrong, right up to the day control mattered.

And control matters at the worst times: a migration to a new provider, a dispute with the one who holds the keys, or a hack that demands fast, provable access. Then the business discovers the uncomfortable truth that possession is not ownership. If the registration, the recovery path, and the payment method all point elsewhere, the account is legally and practically someone else's territory, whatever the logo on it says.

The discipline starts at creation, not at crisis. Every account is registered to the company, with the company's email domain on the recovery path, from the first minute. Where a third party must hold access, it holds delegated access, not the root: they work inside the account, they do not own the door.

Then one inventory, kept like any other asset register: what exists, where it lives, who holds each key, and when it was last checked. A single document, boring on purpose, that turns ownership from a memory exercise into a lookup. Handover then becomes a procedure with steps and a record, not a conversation that leaves with the person who had it.

We made the same point about DNS keys in our domain essay, and the principle generalizes to every account a business runs. Ownership is not restored after the fact; it is decided the day the account is created. Decide it deliberately and the emergencies shrink into incidents. Leave it to habit, and every routine change carries a small referendum on who really controls your business.