Who really owns the site, domain and content? Points to clarify

You want to change providers, but you don't know where your site's access codes are. Who bought the domain name? Where is it registered? And the photos and text you paid for—can you actually reuse them?

Having a site created is good. Knowing who controls what is even better, especially the day you need to change providers or fix a problem. For a small business, losing access to an email inbox, a booking system, or backups can quickly ruin your day. So, we're going to look at what makes up your site, what you can check, and how to keep control without having to manage everything yourself.

A website is a collection of different resources

The word "site" refers to several elements that don't have the same legal status or transfer methods. A provider may have built the interface, a host may run the files, a photographer may own the rights to the images, and a third-party platform may manage bookings. These actors can be different, even when everything was purchased in a single package.

This is where things easily get confused. You might have the right to use a photo without controlling the account that hosts it. Conversely, having access to a file doesn't necessarily give you the right to reuse it everywhere. Before talking about ownership of the site as a whole, we start by looking at each individual element.

The domain name: check the registrant, not just the contact

The domain name is the address that allows people to find the business online. For a domain, registries distinguish the registrant (or owner), who is responsible for the registration and maintenance of the domain, from the administrative contact. The administrative contact may be a provider, but that doesn't make them the owner.

I advise you to check in whose name the domain is registered and which address receives the renewal notices. If everything goes through your former provider's personal inbox, you risk discovering a problem at the worst possible time. Link the account to the business, using a professional address you control, and keep the contact details up to date.

If a transfer becomes necessary, the registrant must be able to obtain the `AUTH_INFO` code (or EPP code) from the registrar. This code shouldn't be published or kept in a shared document: it is used to secure a one-off transfer or change of ownership.

Code, hosting, and backups: three separate topics

Having access to the site's admin panel doesn't necessarily mean you can rebuild it elsewhere. The source code, the files used online, the server configuration, and the backups are several different things. Depending on your contract, you may have a user licence, an export, maintenance, or a combination of these. Look at what is delivered and in what format before you actually need it.

For a custom site, ask at the very least where the files are located, how to retrieve a usable backup, and who can change the DNS settings. If the site is based on a CMS or a proprietary solution, also clarify what is transferable: content, media, database, theme, plugins, configuration, and documentation are not always portable in the same way.

Hosting is a separate service. Paying a subscription doesn't automatically mean the company owns the infrastructure; however, it should know who is billing, who can manage the account, where backups are stored, and how the service can be taken over or stopped without losing data.

Text, photos, and visuals have their own rights

Text, photographs, illustrations, videos, logos, and graphic designs should not be lumped together under the term "site content" without verification. A photo provided by a client might have been taken by a professional. An image bought from a stock bank may be subject to a licence. A logo might belong to another person or company. The fact that a file is in the media library doesn't prove the business can reuse it everywhere and forever.

In law, the author generally benefits from rights to their work from the moment of creation, and a service contract is not enough to override this rule. When rights are assigned, the deed must specify the rights concerned as well as their scope, purpose, territory, and duration. For a business, this means a clear clause is better than a verbal promise or a vague line simply stating "site creation included".

You must also identify elements that remain under licence: fonts, plugins, themes, open-source components, stock photography, or library subscriptions. The right question isn't always "who owns it?", but sometimes "what use is authorised, by whom, and for how long?"

Accounts, data, and access are part of your digital assets

An email address, a hosting account, an analytics tool, a search console, a booking platform, or an email marketing service can be just as important as the code. If the account is in the provider's name, the business risks depending on them to change a schedule, retrieve a statistic, or respond to a customer request.

I prefer accounts to be created in your company's name, with a professional address that remains accessible even if you change providers. We then activate two-factor authentication and give the provider delegated access or an appropriate role. Avoid sending passwords in ordinary messages; when a contractor leaves, revoke their access and renew the relevant credentials.

Contact details, quote requests, or booking data also raise the issue of responsibility. The roles of the company and the supplier must be clarified based on the actual processing carried out. Data protection regulations state that a processor acts on behalf of a controller and that processing must be governed by a contract. An out-of-the-box booking solution doesn't remove the need to know what data is collected, where it goes, how long it's kept, and how to export it.

Who should control the essential elements?

You don't need to become a technician to stay in control. The idea is to be able to make decisions, retrieve your information, and change providers if necessary. The provider can continue to handle maintenance, updates, and security without being the only one controlling all the accounts.

A healthy foundation for a small business

Here is a generally healthy breakdown, to be adapted to the contract and tools used:

• the domain name is registered in the name of the company or the person actually running the business;
• the hosting billing account is identifiable and the company knows who can transfer it;
• essential accounts use a professional address controlled by the company;
• usage rights for text, photos, logos, and components are documented;
• backups and exports are planned, tested, and accessible in a usable format;
• provider access is delegated, reversible, and removable without interrupting the business.

This setup doesn't stop a provider from keeping their internal tools, methods, or generic components. Above all, it prevents visibility, contacts, and commercial data from being locked in an account that's impossible to take back.

The specific case of restaurateurs and online booking

For a restaurant, the site might showcase the menu, hours, and atmosphere, while an external service handles bookings. The booking account, calendar, availability rules, notifications, statistics, and customer data are not necessarily hosted in the same place as the site.

The booking service account should be linked to the restaurant's address, with a payment method and a recovery address that the establishment controls. The supplier's contract or terms should be kept along with login details, exit procedures, and any potential fees. You should also check if bookings can be exported and in what format.

An out-of-the-box solution can be the simplest choice to start: no need to develop a whole module if a suitable service meets the need. But even when integrated into your site, booking remains a separate service. If you change providers or if the tool increases its prices, do you know who receives the requests, who can change the hours, and how to retrieve the bookings? These are the points to clarify before you find yourself stuck with a service you can no longer manage.

The creation of the Le Coq Noir restaurant website illustrates this type of journey: the site and the booking system can be designed together, while remaining two separate blocks to be identified and managed independently.

What the contract should clarify before going live

A quote can remain readable and short while avoiding ambiguity. It should refer, if necessary, to detailed terms and a resource inventory. Before going live, check the following points in particular:

1. The scope of delivery: pages, features, code, content, media, documentation, exports, and backups.
2. The domain name: registrant, registrar, renewal, billing, access, and transfer procedure.
3. Rights to creations: assignment or licence, elements concerned, authorised uses, territory, duration, and limits.
4. Third-party elements: licences for photos, fonts, plugins, themes, open-source components, and external services.
5. Data: forms, quote requests, bookings, analytics, retention periods, roles, and processors.
6. Reversibility: export format, delivery timeframe, transfer assistance, potential costs, and service maintenance during transition.
7. Maintenance: what is included, what is not, who intervenes in an emergency, and how access is revoked at the end of the mission.

A contract may provide for a licence rather than a full assignment. This isn't necessarily a problem if the licence meets the company's actual needs and allows for planned developments. The problem arises when no one knows what authorisation was granted, for how long, or with what limits.

To distinguish between the scope of a site, its hosting, and its long-term follow-up, you can also consult our article on website maintenance. The topic is complementary: here, the issue is knowing who can use and take over the resources; maintenance then describes who intervenes on a daily basis.

How to take back control without taking the site down

Have you decided to change providers? Don't start by cancelling the hosting or closing accounts. First, gather access details and documents, then check that the new setup works. This way, you avoid discovering after the shutdown that a form or an email address depended on the old service.

1. Take inventory: domain, DNS, hosting, CMS, code, backups, emails, analytics, advertising tools, forms, and bookings.
2. Identify owners and administrators: note the accounts, recovery address, payment method, and people with active access.
3. Retrieve a verifiable export: ask for files, the database, media, useful configuration, and minimal documentation; test the restoration where possible.
4. Prepare the new account: create or transfer resources in the company's name, activate two-factor authentication, and limit rights according to roles.
5. Test before switching: check the site, forms, emails, hours, booking links, notifications, and backups.
6. Plan the switch: reduce DNS-related risks, keep the old service for as long as necessary, and have a rollback plan.
7. Properly revoke old access: remove users, renew passwords, and keep proof of the accounts taken over.

Choosing reliable web hosting for an SME then completes the inventory: the goal is not to choose an offer based on price alone, but to verify continuity, backups, and the ability to take over management.

Warning signs to watch out for

Certain situations deserve quick clarification:

• the domain is registered with a personal address or a name the company doesn't recognise;
• the provider refuses to say where backups are or cannot provide any export;
• rights to photos, text, or logos are not documented;
• a booking platform receives data but no one knows which account manages it;
• several essential services use an email inbox inaccessible to the company;
• the end of the service implies an immediate shutdown, with no transfer period or takeover procedure.

A warning sign alone doesn't prove a contract is irregular. It indicates that you should gather documents, re-read the terms, and get a written response. For a contentious situation or a significant financial issue, a legal professional remains the right contact: this article provides general guidance, not personalised legal advice.

Frequently Asked Questions

If I paid for the site's creation, does everything belong to me?

Not automatically. Payment establishes that a service was billed; it doesn't alone describe copyrights, third-party component licences, domain ownership, or file delivery terms. The contract and delivery documents provide the precise answer.

Can my webmaster keep the hosting?

They can offer to manage the hosting as a maintenance or managed service. However, the company must know who the domain registrant is, who bills for the hosting, how to retrieve its data, and what is planned if the provider changes. Technical management and administrative control can be separated.

Is a booking platform "mine" because it's integrated into my site?

Visual integration doesn't change the service provider. The account, terms of use, data, exports, and admin rights depend on the platform. The establishment must identify this block as a separate resource and check its exit terms.

What should be kept after delivery?

Keep the contract, invoices, proof of domain ownership, image licences or authorisations, list of accounts, documentation, backups, and exports. A dated inventory, even a simple one, avoids having to reconstruct the site's history years later.

Conclusion: staying in control without doing everything yourself

Staying in control of your site doesn't mean installing a server or becoming a developer. It means knowing where your resources are, who can access them, what you have the right to use, and how to retrieve what's needed if you change providers.

For a small business, four habits already make a big difference: registering the domain with your own details, documenting content rights, maintaining control of essential accounts, and planning an exit procedure for both hosting and online booking.

A site can be simple, quick to launch, and professionally supported while remaining manageable by the business. If you want to take inventory of your online presence or clarify a project's scope, contact Cadarsir to ask the right questions before a problem makes a takeover urgent.