Change providers without losing control of your digital identity

Imagine a business changing agencies. It receives the website’s files and thinks it has the essentials. Yet the domain, email and analytics management accounts may require separate access. This illustrative situation shows why a file delivery alone does not describe a handover.

Start by making an inventory: domain name, DNS management, hosting, website content, email, social media accounts and analytics tools. Add forms, sending services and subscriptions needed for the business to operate.

For each entry, record the account used, the person responsible, the billing arrangements and the person who can authorise a change. This overview helps identify dependencies before deciding what needs to move.

Changing who manages a domain, moving a website and changing email providers serve different purposes. These operations may be connected, but they should not be confused.

A domain name can direct users to several services. DNS Luxembourg explains the role of name servers in accessing connected services. Changes to their configuration therefore need to take account of every use of the domain, beyond the website alone. [1]

One provider may retain some services while the new provider takes over others. What matters is an explicit allocation, with a timetable and a contact for each operation.

The following list is a preparation framework proposed by Wize. Adapt it to the tools actually used, your contracts and your business’s responsibilities.

1. Identify what needs to be handed over. Files, exports, content, data, configurations and documentation: ask what will be delivered and in which format.
2. Clarify usage rights. Some themes, fonts, images or plugins may be subject to licences. Check which can continue to be used and which require a separate step.
3. Prepare access for the incoming provider. Prefer invitations or delegated access where available. Avoid sharing a password in a group conversation.
4. Describe the handover. Record the steps, the people who approve them and what to do if a check fails.
5. Plan how earlier materials will be retained. Define useful backups, who may access them and how long to retain them, according to your obligations and needs.

Keep a written record of what has been handed over and what remains to be done. A short list checked by both providers makes taking over easier than a set of files with no explanation.

Going live is a visible milestone, but incoming email, forms and administrative access also need to be checked. Plan appropriate tests: view essential pages, submit a test form, check it arrives and test incoming and outgoing email with the people involved.

Next, check that the business has the agreed permissions and that recovery contact details are up to date. ANSSI’s guidance highlights the value of protecting access, including a second factor where possible. [2]

Once the new arrangements have been confirmed, remove permissions that are no longer needed according to the agreed timetable. If old access remains necessary during a follow-up period, specify its purpose and when it will be reviewed.