The short verdict
- A website is six or seven accounts, not one. Each one has an owner.
- AI-built sites are often set up fast on someone’s personal email, and nobody moves them later.
- Spend an hour listing every account and making sure the company controls it.
01Why this comes up
The site was built on a Saturday by a founder, a freelancer or a friend, on whichever email they were logged in with. It worked, so nobody looked at the setup again. Months later, someone leaves, a card expires or a password is lost, and the company discovers it does not control its own website.
It is not a problem unique to AI builders, but the speed of building makes it more common.
02The parts of a website
The domain
The most important one. Whoever controls the domain registrar account controls where the site and the email point. It should be in a company account, with two people able to sign in, and set to auto-renew on a company card.
DNS
Sometimes at the registrar, sometimes at a service like Cloudflare. This is where the site and email records live. Same rule: company account, two admins.
The builder account
The Lovable, Bolt, v0 or Framer account that holds the project. If it is on a personal account, the project leaves when that person does. Most tools let you transfer projects or create a team workspace.
The code repository
If the code syncs to GitHub, which account owns the repository? Move it to a company organisation, not a personal profile.
Hosting
Where the site actually runs. For exported projects that might be Vercel or Netlify. For Webflow it is the site plan. The billing and the admin access should both be the company’s.
The database and backend
If the site uses Supabase or a similar service for forms or accounts, that project holds customer data. It needs to be in a company account for practical reasons and, depending on where you are, for data protection ones too.
Analytics, forms and email
Google Analytics, Search Console, the form tool, the email sending service. Each one is a separate login.
03An hour to fix it
- List every service. Domain, DNS, builder, repo, hosting, database, analytics, Search Console, forms, email.
- Note the owner and the card. Whose login, whose payment method.
- Move what is personal. Transfer to company accounts, or add a company admin and remove the personal one.
- Use a shared password manager. So access does not depend on one person.
- Turn on two-factor sign-in on every account that supports it, especially the domain.
“You do not own a website. You own a list of accounts. Make sure the list has your name on it.”
04When working with an agency or studio
Ask where the site will live before work starts. A good partner builds in your accounts, or transfers everything at the end. When we hand over a Webflow site, it sits in the client’s own workspace and is billed to them by Webflow directly. If anyone, including us, ever needs to be removed, nothing breaks.
05Questions people ask
Who owns the code an AI tool generated?
Usually you do, under the tool’s terms, but read them. The practical question is who controls the account it lives in.
What if the person who set it up has left?
Start with the domain. Registrars have recovery processes if you can prove the business owns it. Then work through the rest of the list.
Is it safe to share one login between the team?
Better than one person holding it, worse than separate logins in a team workspace. Use team features where they exist.
Can you help us untangle it?
Yes, as part of any move. Send us the link and we will start with a map of what is where.
