Website Handover Checklist for Indian Businesses: 15 Assets Your Developer Must Transfer Before Final Payment

Quick answer: Before you release the final payment, make sure these are registered to your business, not your developer:

•       Core website: domain, hosting, source code with database backup, CMS admin, SSL, and business email

•       Marketing accounts: Google Analytics, Search Console, Google Business Profile, and Meta ad accounts

•       India-specific accounts: payment gateway, SMS DLT registration, and WhatsApp Business API number

•       Paperwork: GST invoices for hosting and domain, and a written assignment of copyright in the code

Each one should be in your company's name, billed to your company, with the developer added only as a user you can remove.

Most website disputes in India don't start with bad code. They start a year after launch.

You need a small change, or you want to move to a new agency, and you discover the domain is in the developer's personal account. The SMS sender ID belongs to their company. The payment gateway keys point to an account you never opened.

Global handover checklists cover the basics: domain, hosting and code. They miss the accounts that Indian businesses depend on and that are hardest to recover. This checklist covers both.

Why the Final Payment Is Your Only Real Leverage

Until the last milestone is paid, your developer has every reason to cooperate. After it, you are asking for a favour.

So treat handover as a deliverable in the contract, with its own acceptance step. Write "complete handover per checklist" next to the final milestone, and don't pay that milestone until every line below is ticked.

Part A: The Website Itself (Assets 1–6)

1. Domain name

The registrant (owner) must be your company. Your registrar account should be under a company email, not the developer's Gmail.

Check the registrant details in the registrar panel yourself; don't take a screenshot as proof. If the domain needs moving, ask for the transfer authorisation (EPP) code. Note that registrars commonly restrict transfers for 60 days after a new registration or a change of owner, so start early.

2. Hosting or cloud account

Your company should own the hosting, AWS, Azure or VPS account, with your card on file. The developer can be an added user with limited permissions.

If the site sits on the agency's shared reseller server, either migrate it or get a written commitment covering:

•       how long they will host it,

•       at what price, and

•       how quickly they will hand over a full backup if you ask.

3. Source code and database

Ask for the full, uncompiled source code, not just the live files. Get a recent database export and all uploaded media too.

For custom builds, the best form of handover is a Git repository (GitHub, GitLab or Bitbucket) owned by your organisation, with full commit history. History shows the next developer why the code looks the way it does.

4. CMS and admin panel access

You need the top-level admin account, not an "editor" login. In WordPress that means Administrator. In Shopify it means you are the store owner, not a staff account.

Also collect licence keys for paid themes and plugins. Licences bought on the agency's account stop receiving updates once the agency stops renewing them.

5. SSL certificate

Find out how SSL is issued:

•       Free auto-renewing certificate (such as Let's Encrypt): confirm auto-renewal works on your hosting.

•       Paid certificate: get the vendor account login and the renewal date.

An expired certificate shows visitors a security warning and can stop your forms and payments from working.

6. Business email and DNS records

If your email runs on Google Workspace or Zoho, your company must hold the super-admin login.

Also ask for a copy of all DNS records: MX, SPF, DKIM, DMARC and any verification records. Losing these during a hosting move is the most common cause of "our emails stopped arriving".

Part B: Marketing and Tracking Accounts (Assets 7–10)

These are often set up "quickly" by the developer and quietly stay in their account for years.

7. Google Analytics 4

Your company Google account must be an Administrator on the GA4 property. Viewer access is not enough. Without admin rights you can't add a new agency or recover historical data if the old one leaves.

8. Google Search Console

Your account should be a verified owner, not a "full user". Owners can add and remove everyone else.

9. Google Business Profile

The primary owner of your Business Profile must be your company account. This profile drives map listings and local calls, and recovering it from a former agency can take weeks. Our local SEO team sees this problem more often than any other.

10. Meta Business portfolio, Pixel and ad accounts

Your Facebook Page, Instagram account, ad account and Pixel (or dataset) should sit inside a Meta Business portfolio that your company owns. Agencies should be added as partners, not owners.

Part C: India-Specific Accounts Most Checklists Miss (Assets 11–13)

11. Payment gateway merchant account

Razorpay, PayU, Cashfree, CCAvenue and similar gateways run KYC on a legal entity. The live API keys on your website must come from a merchant account opened in your business name, with settlements going to your current account.

Check two things on handover day:

1.      Which account issued the live keys?

2.      Is webhook signature verification set up?

If the developer used their own account "for testing" and never switched it, your money is flowing somewhere you don't control. Our payment gateway integration checklist always includes this check.

12. SMS DLT registration, sender IDs and templates

If your website sends OTPs, order updates or promotional SMS, India's TRAI regulations require the sender to be registered on a telecom operator's DLT (Distributed Ledger Technology) platform. That registration covers the business as the Principal Entity, plus its sender IDs (headers) and message templates.

If your agency registered these under its own entity, those headers belong to them. Moving away means re-registering and getting templates approved again.

Ask for:

•       your own DLT Principal Entity ID

•       the list of approved headers and templates under your company name

•       the SMS provider account login

13. WhatsApp Business API number

Numbers used on the WhatsApp Business Platform sit inside a WhatsApp Business Account, under a Meta Business portfolio. If that portfolio belongs to the agency or their solution provider, moving the number later is a migration project, not a password change.

Make sure the verified business is yours and the phone number is registered to your company.

Part D: Paperwork That Protects You (Assets 14–15)

14. Invoices in your company name

Domain, hosting, SSL, theme and plugin purchases should be invoiced to your business with your GSTIN. This keeps proof of ownership clean and lets you claim input tax credit where eligible.

Invoices issued to the developer prove the developer paid, not that you own the asset.

15. Written assignment of copyright in the code and design

This is the point most Indian businesses never think about. Under the Copyright Act, 1957, an assignment of copyright is valid only if it is in writing and signed by the person assigning it (Section 19).

Paying an outside agency does not, by itself, make you the owner of the custom code and design they wrote. Your contract should include a clear assignment clause, effective on final payment. It should also cover any open-source components and third-party licences the developer used.

This is general information, not legal advice. Have your lawyer review the contract wording.

How to Run the Handover Day

Block two hours with your developer on a call and log in to every account yourself during it. A handover that exists only as a spreadsheet of passwords isn't a handover.

Use this order:

1.      Domain, email and DNS first. These lock you out of everything else if they go wrong.

2.      Hosting, code repository and CMS. Take a fresh full backup at the end.

3.      Analytics, Search Console, Business Profile and Meta. Add your company account as owner, then confirm the developer's role.

4.      Payment gateway, DLT and WhatsApp. Confirm the live keys, sender IDs and phone number are under your entity.

5.      Paperwork. Collect invoices, the signed IP assignment, and a one-page note on how to deploy and update the site.

Finish by changing every shared password. Keep the developer as a named user only where you still want their help.

If You've Already Lost Control of an Account

Domain: Contact the registrar with proof of business identity. If the developer is unresponsive, the registrar's dispute process applies. A domain held in a developer's personal name is the hardest asset to recover.

Google accounts: Google Business Profile and Search Console both have ownership-request flows. Expect delays.

The website itself: If the code is beyond recovery, a planned website redevelopment on accounts you own is often faster than a long dispute. Keep the old domain and redirect URLs properly so you don't lose rankings.

Security: Once you regain access, change all passwords, remove unknown admin users, and review server access logs. Our managed cybersecurity team can audit this for you.

Frequently Asked Questions

Who should own the domain name, the business or the web developer?

The business. The developer can be given access to manage DNS, but the registrant and the registrar account should both be in your company's name.

Can I ask for the source code if I only paid for a website?

You can ask, but whether you're entitled to it depends on your contract. Under Indian copyright law, ownership of commissioned custom code passes to you only through a written assignment. Add that clause before work starts.

What is DLT registration, and why does it matter for my website?

It is TRAI's mandatory registration for businesses that send commercial SMS in India, including OTPs and order alerts. If it's registered under your agency's entity, your sender IDs and templates belong to them.

How do I check who owns my Google Analytics or Business Profile?

Google Analytics: open Admin → Property access management and look for your company account with the Administrator role.

Business Profile: open the profile's People and access settings and confirm your company account is the primary owner.

Is it safe to let my developer keep access after handover?

Yes, as long as they are an added user with only the permissions they need, and you can remove them at any time. The problem is never access; it's ownership.

Building a new website, or taking back control of an old one? Prism Infoways sets up every project on accounts our clients own from day one, and hands over each item on this checklist before the final invoice. See our website development services or book a free handover review.