Own your stuff: the domains, email and accounts your business must control

Here's the full set of keys you should hold. Write down, for each one, the login and who currently controls it.

Domain registrar login: the account at VentraIP, Crazy Domains, GoDaddy AU or similar where your domain lives.

DNS control: the settings that point your domain at your website and email. Usually at the registrar.

Website hosting and login: where the site files live and the admin login to edit the site.

Email admin: the master account for Google Workspace or Microsoft 365, not just your own inbox.

Google Business Profile: ownership of the listing, with you as the primary owner.

Social accounts: Facebook and Instagram logins in your name.

If you control these six, you control your business online.

It rarely goes wrong on purpose. It goes wrong because life happens.

The web guy gets busy and stops answering. He moves overseas. He retires. He has a falling out with you over an invoice. His business closes.

Suddenly the domain renewal email goes to his inbox, not yours — and if it lapses, your website and email go dark and someone else can grab the name.

Or you want to switch providers, and the new one can't do anything because the old one holds every login and won't hand them over.

None of this requires bad intent. It just requires you not holding your own keys.

On most of these platforms there's an owner and there are users. You want to be the owner.

On a Google Business Profile, for instance, you can add your web person as a manager — but you should be the primary owner. Managers can help; only owners can't be removed by someone else.

Same with email and hosting: have one master admin account that's yours, then give helpers their own user access. That way you can grant and revoke help without ever losing control.

If someone else currently holds your assets, you don't need a fight. Most of the time a clear, friendly request does it.

Try something like: "Hi mate, I'm getting our business records in order. Could you make sure the domain is in our name and send me the logins for the domain, hosting, email and Google listing? Happy to jump on a call if that's easier."

Ask for the registrant on the domain to be your business, with your email as the contact. Ask to be made primary owner of the Google profile.

If you hit resistance, stay calm and put it in writing. You're entitled to control your own business assets. With domains, the registrar can help you recover a name you can prove is yours, and auDA sets the rules for .com.au if there's a genuine dispute.

Once you've got the keys, keep them somewhere safe and findable — not on a sticky note or in your head.

A password manager is the best option. Free and paid ones exist; they store logins securely and you only remember one master password.

At a minimum, keep a written record in a safe place: the account, the username, and a hint to the password. Make sure your business partner or a trusted person can find it if you're off the tools.

Turn on two-factor authentication where you can, especially on email and the domain registrar. Those two are the master keys to everything else.

Once a year, log into each of the six accounts above and confirm you can still get in.

Check the domain renewal date and that the contact email is yours. Check who the owners and admins are, and remove anyone who shouldn't be there.

Ten minutes a year keeps you firmly in control of your own business.