Once a new website goes live, it is easy to assume the company now owns it in much the same way that it owns a computer or office furniture. In practice, a website is a collection of separate assets, services, accounts and legal rights. They may not all belong to, or be controlled by, the same party.
This is not necessarily a problem. An agency may manage hosting, software updates or technical accounts because that is precisely what it has been hired to do. The difficulty begins when nobody can clearly explain who controls what, what the company is entitled to receive and what would happen if the working relationship changed.
Paying for work does not automatically transfer copyright
A website may include custom code, written content, photography, illustrations, design work and material licensed from third parties. These elements can have different owners and different usage conditions.
According to the UK Intellectual Property Office’s guidance on copyright ownership, the creator of a commissioned work is normally its first legal owner unless ownership is agreed otherwise in writing. The person commissioning and paying for the work may receive permission to use it without receiving the copyright itself.
The distinction between ownership and permission matters. A contract might transfer copyright in bespoke work to the company, provide a broad licence to use and modify it, or reserve certain rights for the supplier. None of these arrangements is automatically wrong, but the wording should be clear enough that the company understands what it can do later.
Third-party and open-source software brings another layer. An agency cannot transfer ownership of software it does not own, although the website may use that software under its relevant licence. The practical question is whether the company has the rights and access needed to operate, maintain and develop its website as intended.
The domain is small, but rather important
A domain name can be overlooked because its annual cost is usually modest. Yet it controls how customers reach the website and may also support the company’s email addresses. Losing control of it can disrupt far more than the homepage.
The company should know:
- which registrar manages the domain;
- who is recorded as the registrant;
- which email address receives renewal and security notices;
- who can change its Domain Name System, or DNS, settings;
- how the domain is renewed and paid for; and
- how access would be recovered if the usual administrator were unavailable.
The National Cyber Security Centre’s domain guidance recommends that a company’s domain is managed by the company rather than its web-hosting provider. It also advises using an organisational email account, giving more than one trusted person secure access, enabling two-step verification and maintaining automatic renewal.
An agency can still manage the technical settings. The important distinction is between allowing a supplier to administer the domain and making that supplier the only party capable of controlling or recovering it. For .uk domains, changing the registered holder involves a formal registrant transfer process, so it is better to establish the correct arrangement at the start.
Control also lives in accounts, data and infrastructure
The visible website is only part of the picture. A company website may rely on hosting, a content management system, source-code storage, analytics, search tools, payment services, email platforms, stock libraries and numerous other subscriptions.
It is not necessary for every employee to have unrestricted access to every technical service. That can create its own security problems. There should, however, be an accurate record of the services in use, who owns each account and how access can be recovered.
Customer and enquiry data needs particular attention. Where an agency processes personal data on a company’s behalf, the roles and responsibilities should be documented appropriately. The Information Commissioner’s Office guidance explains that relevant contracts should cover security, sub-processors and what happens to personal data when the agreement ends.
A usable exit arrangement should also consider content and operational data. Having the right to receive a database is less helpful if it arrives in an undocumented format that another supplier cannot understand. The expected format, timescale, cost and scope of a handover are worth agreeing before they are needed.
Agency-managed does not have to mean locked in
There are sensible reasons for an agency to manage hosting, deployments, licences and specialist accounts. Giving a company direct day-to-day control of unfamiliar infrastructure does not automatically make the setup safer or more resilient.
A healthy arrangement combines professional management with transparency. The company knows what it owns, what it licenses, which services it depends on and how continuity would be maintained. The agency knows which responsibilities it has accepted and where its authority ends.
Warning signs include accounts tied to an individual’s personal email address, missing contracts, undocumented subscriptions, no accessible backups and uncertainty over who can renew the domain. None proves deliberate lock-in, but each is worth resolving while the relationship is working well.
A practical website ownership check
A company reviewing an existing website can start with a short set of questions:
- Domain: Is the company correctly recorded and able to recover access?
- Contracts: Do the terms explain ownership and licensing of custom work?
- Accounts: Is there a record of the hosting, CMS, analytics and third-party services?
- Access: Are important accounts protected, recoverable and linked to appropriate company addresses?
- Data: Can content, files and operational data be exported in a usable form?
- Backups: Is it clear what is backed up, where copies are stored and how restoration would work?
- Handover: Does the agreement explain what will be supplied if the company changes provider?
The goal is not to remove every supplier from every account. It is to remove uncertainty. A company should be able to rely on an agency without discovering that its domain, data or ability to maintain the website depends entirely on one person remaining available forever.
