Who actually holds the keys to your business?
By Steven Coochin — 2026-03-02
This piece is inspired by recent real events. I won't name the businesses involved, but I will say this: what I'm about to describe is not rare. It's something we are seeing play out again and again across Clermont and the wider region.
A business owner calls in a panic. Emails have stopped working. The website can't be updated. The accounting software is inaccessible. Or a domain renewal notice has gone missing somewhere; no one can find it.
The systems are there. The business is trading. The staff are turning up. Yet the digital doors are locked.
When we start digging, the same pattern often appears. The person who originally set things up, whether a staff member, a contractor, a relative, or an agency, still holds the highest level of control. The business owner has access, but not ownership. And access is not the same thing.
Access is not ownership
Most business owners can log in to their systems. They can send emails, raise invoices in Xero, upload products to their online store, and post to social media, which feels like control. But control sits one layer above that.
Who is listed as the registered owner of your domain name? Who is the top-level administrator of your email system? Who owns the master account for your accounting software? If your website hosting needs to be transferred tomorrow, could you authorise it directly? In too many cases, the answer is unclear.
A domain might be registered under a personal Gmail account from years ago. An email system might have been created under a previous staff member's login. An accounting file might technically belong to an external bookkeeper. A social media advertising account might sit inside someone else's business manager. Nothing feels wrong until something goes wrong. Then it becomes urgent.
There's another layer to this that often gets overlooked. Your customer lists, invoices, financial history, website content, email archives, and supplier records are the intellectual property of your business. They form part of your asset base. If you do not clearly control the systems that house that data, you do not fully control your own business property.
This is bigger than passwords
We have spoken before about password managers, tools that securely store and organise your login details. They are useful, and every business should use one. They reduce chaos. They stop passwords from being written on sticky notes. They make handovers easier. But this article is about something different.
You can have every password neatly stored in a password manager and still not be the legal or administrative owner of the account. You can know the login details and still lack the authority to transfer, close, or recover the system if something changes.
There is also the issue of security codes. Many platforms now use multi-factor authentication. That is when, after entering a password, you receive a code on your phone or through an app to confirm it is really you. It is an extra layer of protection. While this can be annoying, it is actually a good thing. Unless that code only goes to someone else's phone.
We have seen situations where the security approval was tied to a former staff member's device. Or a contractor's phone. Or an email address no longer monitored. Suddenly, even with the password, the business owner cannot access their own system. This is not a technical flaw. It is a structural one.
The difference between using a password manager and having proper ownership is governance. Governance means the business entity is recognised as the owner. The director or authorised person has top-level control. Staff and agencies are granted access appropriate to their role. Recovery emails and security codes are linked to the business, not to individuals who may leave.
Your digital systems are business assets
If you own a building, the title is in your business name. If you have a bank account, authorised signatories are documented. If you sell the business, those assets transfer cleanly. Your digital systems deserve the same treatment.
Your domain name is digital real estate. Your email platform is communications infrastructure. Your accounting software holds your financial records. Your website and online store generate revenue. The data within them (customers, transactions and history) is part of your business value. If you cannot clearly demonstrate ownership and control, that becomes a risk. It shows up in a crisis, and again in growth, succession, or sale.
When we conduct what we call a Digital Control Audit, we map out who owns what, who has administrative authority, where recovery pathways point, and whether former staff have been fully removed. It is not glamorous work. There are no shiny dashboards. But it is some of the most important work we do. Almost every time, we find gaps. Not through negligence. Through growth and time.
How to take back the keys to your digital accounts
The goal is not to strip your team of access. It is to build a structure where the business sits at the top.
That means the business is the registered owner of its domain. The director or authorised person holds super admin rights to core systems. Staff have role-based access to what they need to do their jobs. Agencies are granted delegated access, not ownership. Security codes and recovery contacts are controlled by the business. There is documentation of how everything fits together. None of this is complicated. It just requires intention.
The situations that inspired this article were not dramatic cyberattacks. They were ordinary businesses discovering that the keys to their digital premises were not actually in their pocket. Untangling that after the fact is always harder than setting it up properly from the start.
Your business today is more than stock on shelves and money in the bank. It is systems, data, and digital infrastructure. That data belongs to you. Those systems should answer to you.
So here is the question worth asking. If you needed to unlock every digital door in your business tomorrow, would you be the one holding the master key?