Biz in a Box

The five accounts every new business needs on day one, and why you must own them

Here is a story that plays out constantly, with the names changed because the names always change but the shape never does. A business owner hires someone — a web guy, a mate who's "good with computers", sometimes a partner who later isn't — to get the business online. That person registers the domain, sets up the email, builds the website, claims the Google listing. Under their email address. Years later they vanish: a falling-out, a closed agency, an unanswered phone. Now the domain is coming up for renewal in an account nobody can access, the website is hostage, and Google thinks someone else owns the business. Recovery is slow, sometimes expensive, occasionally impossible. This page lists the five accounts that matter, and the ownership rules that make the disaster impossible.

Last reviewed: 18 July 2026

The five accounts

  1. Domain registrar. The account where your domain name lives. Whoever controls this account controls whether your website and email exist at all. Lose it and everything built on the domain is at the mercy of a renewal date.
  2. Email — Microsoft 365 or Google Workspace. Not just your inbox. This account is the recovery address for nearly everything else the business signs up for, which makes it the master key. If someone else owns your email tenancy, they effectively own every account that sends its password resets there.
  3. Website hosting. Where the site's files and database live. Separate from the domain, even when bought from the same company. A locked hosting account means you can't fix, move or back up your own website.
  4. Google Business Profile. Your listing on Google Search and Maps — the thing customers actually find. Ownership sits with a Google account, and if that Google account belongs to a former contractor, your opening hours, photos and reviews are editable by someone who no longer answers your calls.
  5. The main social account. Whichever platform your customers actually use — for most Australian small businesses that's a Facebook page and Instagram account. Pages and business accounts hang off a personal login; if that personal login belongs to an ex-employee, so does your page.

Notice what these have in common: none of them is the website itself. The website is replaceable. The accounts are the business's identity, and identity is what you can't rebuild by paying someone to type faster.

The four ownership rules

Rule 1: every account registers to a business-owned email address. Not the web guy's Gmail. Not your personal Hotmail from 2009. An address on your own domain — which is why domain and email come first on day one. If you're not there yet, a fresh, dedicated address the owner controls beats anything belonging to another person. The test is brutal and simple: if this person disappeared tomorrow, could you still get into the account? If the answer depends on their goodwill, you don't own it.

Rule 2: the owner holds the recovery methods. Ownership isn't the username on the account — it's who receives the password reset. Check each account's recovery email and recovery phone number, and make sure both belong to you, the actual owner. Two-factor codes count too: if the authenticator app is on a contractor's phone, they hold a veto over your access. Recovery settings are where ownership quietly leaks away, because nobody looks at them until the day they matter.

Rule 3: contractors get delegated access, never ownership. Every platform on this list supports it: registrars have account sharing or authorised contacts, Microsoft 365 and Google Workspace have admin roles you can grant and revoke, hosting panels have additional users, Google Business Profile has manager roles beneath the owner, and Facebook's business tools let you assign page access without handing over a login. A good web professional will ask for delegated access, because they know this problem. Someone who insists on registering things under their own account is either cutting corners or building a moat — and you're on the wrong side of it either way. When the engagement ends, you revoke the role. Nothing to hand over, nothing to chase.

Rule 4: keep an offline record of where everything lives. One page, on paper or in a sealed document the owner controls: each of the five accounts, which provider it's with, which email address it registers to, where the recovery phone points, and when the domain renews. Not the passwords necessarily — the map. Most lockout disasters get worse because nobody can even name the registrar, let alone log into it. Update the page when anything changes, and store it where the business's other important documents live.

Already in the hole?

If you're reading this having recognised your own setup, triage in this order. First, the domain: confirm which registrar holds it, who the registrant contact is, and when it renews — a lapsed domain is the failure you may not come back from. Second, email: get admin control of your Microsoft 365 or Google Workspace tenancy into an owner-held account. Third, sweep the recovery settings on everything else and repoint them to addresses and phones you control. If the person who set things up is still reachable and cooperative, this is an hour of friendly admin. That window is the cheapest it will ever be — use it while it's open.

And if you're starting fresh: set up the domain and email yourself, under your own address, before you engage anyone. Our guide to setting up business email on your own domain walks through the email side, and the small business setup guide covers the rest of the stack. Then hand your web person delegated access and let them do everything else.

The short version

Five accounts are the business — domain registrar, email tenancy, hosting, Google Business Profile, and your main social account. Register every one to a business-owned email address, keep the recovery email and phone in the owner's hands, and give contractors delegated roles you can revoke instead of ownership you must beg back. Keep one offline page recording where each account lives. The test for all of it: if your web person vanished tomorrow, would anything be unrecoverable?

General guidance only — platform account structures and recovery processes change, so check each provider's current documentation for the specifics.

Want it set up so you own everything?

This ownership structure is how we set up every business we get online: the domain, the email, the hosting and the listings registered to you, with access delegated to whoever does the work — including us. Tell us your business name and we will set the accounts up properly from day one, or help you take back control of a setup someone else holds.