Loading…
Loading…
Your domain, hosting, code and logins should be in your business's name. How to check who holds them, what to get at handover and how to recover them.
Your business should hold every part of its website in its own name: the domain, hosting, source code, admin logins, Google accounts, any app store and payment gateway accounts, and email. Paying a developer does not make you the holder. If the developer registered the domain with their own details, the registrar treats them as the holder. And under India's Copyright Act, the person who writes the code is its first owner unless they assign it to you in writing.
The stories business owners post on Reddit show how this goes wrong. One owner had paid for the domain and hosting but never had the cPanel login, and says the developer pulled the site down after they refused a ₹5,000 demand for SSL and maintenance. Another describes a founder who spent about ₹4.27 lakh over eight months with an app agency and got poor work and no proper documentation. A third describes agencies that take 50% up front and bill every change as a "change request".
Money disputes happen. They become a crisis when the developer holds the keys. This guide covers what to hold, how to check, what to put in the agreement and how to get things back.
Strictly, nobody owns a domain outright. ICANN, which oversees the domain system, compares registering a domain to leasing it: you hold the right to use the name for a period and keep it by renewing. The person or company listed as the registrant holds that right.
ICANN's own FAQ warns that a developer may have registered your domain with their own contact details, even if you paid them to do it. They are then the registrant of record, and you may need proof of payment to show the registrar the domain should be yours. ICANN advises against listing web designers or hosting providers as the registrant at all.
For .in domains, the rules are stricter:
The registry also says it has no duty to warn you before a domain expires. Renewing on time is the registrant's job.
A public lookup tells you where a domain is registered and when it expires. It usually will not tell you who holds it.
| A public lookup shows | Only the registrar account shows |
|---|---|
| Which registrar holds the domain | The registrant's full name and email |
| Creation and expiry dates | Whether auto-renew is on |
| Status codes, such as transfer locks | Who can log in and make changes |
| Name servers, which show where DNS is managed | The auth code needed to move registrars |
The domain is only the first item.
Buy hosting in your business's name, with your business email on the account, paid from your account. That gives you the control panel (often cPanel) or cloud console login, and with it the site's files and database. If the developer keeps your site inside their own hosting account, you will not have a login of your own. Then at least get scheduled full backups, and write into the agreement that a copy is handed over when you leave.
DNS decides which server shows your website and which service receives your email. Whoever controls DNS can move your site and can prove ownership to Google: Search Console accepts a DNS record as proof, and Google Workspace's admin recovery can ask for one. DNS may be managed at the registrar, the host or a separate service. Make sure that login is yours.
Custom code should live in a repository, for example on GitHub, under an account your business owns, with the developer added as a member. If it sits in the developer's account, moving it needs someone with admin access to that repository. GitHub keeps the history with a transferred repository and adds the original owner as a collaborator, so remove them afterwards if needed. Holding the repository is not the same as owning the copyright, which is covered below.
If the site runs on WordPress or another content management system, hold an administrator account yourself. In WordPress, that role has access to every administration feature on the site. The developer can have a separate login that you remove later.
Publish apps from a developer account in your business's name. Google Play organisation accounts and Apple organisation enrolment both need a D-U-N-S number. Apple shows the organisation's legal name as the seller, and asks for a work email and website on your organisation's domain.
If the developer publishes your app under their account, moving it later needs their cooperation. On Google Play the transfer request comes from the account that holds the app. On Apple, that account's Account Holder starts the transfer. Our mobile app development page covers how we publish apps.
Under the Reserve Bank of India's 2025 directions, payment aggregators carry out due diligence on the merchants they sign up and must make sure money due to a merchant goes only to that merchant's bank account. If a developer opens the gateway account under their business, your customers' payments settle to them. The developer needs access to connect your site, not the account itself.
Your business should be the top administrator of email on your domain. In Google Workspace, an administrator with no recovery phone or email is asked to prove control of the domain by adding a DNS record. Whoever controls the domain can usually recover the email too.
Use this at the end of a project, when you change developers, or now, for the site you already have.
| Item | In whose name | What you should hold |
|---|---|---|
| Domain | Your business, with an email you control | Registrar login with two-step sign-in, auto-renew and transfer lock on |
| DNS | Your business | Login wherever DNS is managed |
| Hosting or server | Your business, billed to you | Control panel or cloud console login |
| Source code | Your business's repository | Admin access, plus a downloaded copy |
| Database and files | Your business | A recent full backup you can download |
| CMS | Your email | An administrator account |
| Search Console | Your Google account | Verified owner |
| Google Analytics | Your Google account | Administrator role |
| Business Profile | Your Google account | Primary owner |
| App store accounts | Your business | Owner or Account Holder role |
| Payment gateway | Your business, KYC in your name | Dashboard login, settlement to your bank |
| Your business | Top administrator account | |
| Other services | Your business | Logins for SMS, maps, email sending or WhatsApp |
| Documentation | Not applicable | A list of all of the above and how to deploy the site |
Log in to each one yourself. A login you have never used is a login you may not have.
This section summarises what the Copyright Act, 1957 says. It is not legal advice. Have a lawyer look at your own agreement.
The Act treats computer programmes as literary works (section 2(o)). Section 17 makes the author of a work the first owner of its copyright, with some exceptions. The one people rely on is section 17(c): for work made by an employee under a "contract of service", the employer is the first owner unless they agree otherwise. An outside agency or freelancer is not normally your employee under a contract of service, so do not assume this covers code you paid them to write. Without a written assignment, the developer may own it.
Sections 18 and 19 set out how copyright passes to you:
Those last points catch people out: a clause that leaves out the period or territory may give you far less than you think. The Act also allows a licence in writing instead of an assignment (section 30), which a developer may offer for parts they reuse across clients. Know which one you are getting.
Open-source frameworks and libraries stay under their own licences, so your developer cannot assign those to you. And owning the copyright helps little if you do not have the code.
Many people search for a "website development agreement format India" and download a template. Treat it as a starting point, have a lawyer adapt it, and check that it covers:
The same questions apply to bigger systems. Our guide to custom software vs off-the-shelf covers scoping, and our ERPNext implementation guide lists questions to ask any partner, including who owns what they build.
When the developer is willing to help, there are two separate steps.
This step makes the domain yours. The current registrant asks the registrar to change the registrant to your business, with your email.
You get an authorisation code (auth code) from the current registrar and give it to the new one.
Change the registrant first, because that gives you control, and move registrars later if you want to. ICANN's Board adopted changes to the transfer rules in June 2026, but they apply only once implemented, so check ICANN's current policy before you start.
Then turn on two-step sign-in and auto-renew, and ask the registrar to lock the domain against transfers and updates. A .in domain can be registered for up to 10 years at a time, and the registry advises changing the auth code after a transfer.
Work in this order, because the domain unlocks most of the rest.
A small manufacturer's site runs on a .in domain. The developer has stopped answering, and the domain expires in two months.
The hard part is the evidence. Keep every invoice and payment record for your website.
Tanush Digital builds websites, custom software and mobile apps for businesses across India. You own the source code of the custom software we build for you. Our terms say that on full payment you receive ownership of the custom code written for your project, while open-source frameworks and libraries stay under their own licences. We can host your site on a server we look after, or on AWS, DigitalOcean or a platform you prefer, and we publish apps to Google Play and the App Store. Before you hire anyone, us included, take the checklist above to the first meeting and ask for each item in writing. Read about our website development work, or talk to us if you are stuck with a site you cannot get into.
Run a lookup at ICANN Lookup or, for a .in domain, the .IN Registry's WHOIS. It shows the registrar and expiry date, but usually hides the registrant's name and email. Then log in to the registrar account and check that the registrant is your business, with an email you control.
If the developer is the registrant on record, the registrar treats them as the holder until the registrant is changed. ICANN advises contacting the registrar with proof that you paid the developer. If the holder refuses, dispute processes such as the INDRP for .in domains exist. Take legal advice first.
Under the Copyright Act, 1957, the author is the first owner of copyright, and computer programmes count as literary works. An outside developer may own the code they wrote unless they assign it to you in writing. The assignment should state the rights, period, territory and consideration. Have a lawyer draft or check it.
Domain, DNS and hosting logins in your name, the source code and a database backup, a CMS administrator account, owner access to Search Console, Analytics and Business Profile, any app store and payment accounts, and a document listing them all. Log in to each one yourself before you sign off.
Possibly, if you act fast. When a registrar deletes a .in domain, it enters a 30-day Redemption Grace Period. Only the registrar that held it can restore it, and the website and email stop working. A 5-day hold follows, then anyone can register the name. Contact your registrar immediately.
Talk to us about your website, and bring the handover checklist with you.
In a free 30-minute call we map your process and tell you plainly what would change, whether that is Tanush LIMS, ERPNext or something built for you. We reply within 24 hours.