In this guide 6 sections
Before the old vendor leaves, collect the repository with every branch, hosting and DNS logins, database dumps, API keys, app store and payment accounts, licences and documentation. Record who holds each item. Move ownership to your own company email, then test that you can deploy without the vendor.
Code: the repository, not a zip file
Demand the repository itself, with all branches, tags and commit history. A zip of the latest files hides which version is live and why a change was made.
Request the build and deployment steps too. A pipeline file such as a Dockerfile, a GitHub Actions workflow or a shell script shows how the code reaches the server. Without it, the first release after the handover becomes guesswork.
Transfer the repository to an organisation your company owns. Then remove the old vendor’s write access on the day the handover is signed.
- All branches and release tags
- Environment file template with variable names
- Build and deployment scripts
- README and setup notes
- Open issues and known faults
Hosting, domain and DNS
Servers are often rented on the vendor’s own cloud account. If that is the case, you need either a transfer of the account resources or a rebuild under your own. Raise it now. Notice periods end fast. Dates slip.
The domain name matters most and is lost most often. Check the registrar record. Is the registrant your company or the vendor? Confirm the renewal date and the DNS provider, whether Cloudflare, Route 53 or the registrar itself.
Collect the SSL certificate source, the SMTP mail settings and any CDN or firewall account in front of the site, so nothing sits unseen between visitors and the server.
Data: the database dump and the files
Get a full database dump taken on a named date, plus the uploaded files such as invoices, photos and documents. Restore both on a clean machine. Confirm they open.
Check that backups exist and run on a schedule, with the job log showing the last successful run. An untested backup job is not a backup. Record where the copies are stored and who can read them.
Personal data deserves care. Know which of your customers’ details sit in the dump, and make sure the vendor deletes their own copy once you confirm the restore works.
- Database dump with date and size
- Uploaded files bucket or folder
- Backup schedule and storage location
- Test restore result
Keys, accounts and licences
List every outside service the software uses. Payment gateway, SMS sender, email provider, map API, push notification service, Apple developer and Google Play accounts are the usual ones.
For each, note whose name the account is in. Where it is the vendor’s, ask them to transfer it or add you as the owner. Then rotate every key and password, so the old team’s copies stop working.
Some libraries carry paid licences. Check each licence key and its renewal date, because an expired licence can quietly stop updates to a payment plugin or a UI kit.
- Payment gateway merchant account
- SMS, email and WhatsApp providers
- Apple and Google developer accounts
- Map, analytics and error-tracking keys
- Paid plugin and theme licences
Decide who holds each item, then prove it
Give every item one named owner in your company and one backup. A shared login in a spreadsheet is not ownership. Use a password manager such as Bitwarden, with individual access.
Then run a dry test. Ask the new team, or one of your own staff, to clone the repository, deploy to a staging server and restore the database without calling the old vendor. Whatever blocks them is a missing item. Write it down.
Sign the handover only after that test passes. Keep the vendor reachable for a fixed period. Questions will come.
Vendor handover register
A one-page register with a row for each asset. Columns are asset, where it lives, current holder, new holder, date transferred, credentials rotated, and verified by. Rows are grouped into code, hosting and domain, data, keys and accounts, and licences, with a final signature block for both parties.
Open a blank worksheet to printQuestions owners ask
What if the vendor holds the hosting account in their own name?
Ask for the resources to be moved to an account you own, or for a full rebuild from the repository and database dump. Settle which before the notice period ends.
Should I change every password after the handover?
Yes. Rotate keys, passwords and tokens that the old team knew. Otherwise former staff or their laptops still hold working access.
How do I know the handover is complete?
When someone outside the old team can build, deploy and restore the system from what you hold. Until that test passes, treat the handover as unfinished.