In this guide 6 sections
List everything the vendor controls, then move each item to an account you own: repository, cloud account, domain, store listings, CI secrets and API keys. Mirror the code first. Switch pipelines second. Revoke vendor access last, only after one complete release, mobile signing step included, has shipped from the new setup and passed its smoke tests.
Audit what the vendor actually holds
Ask for a written list. Memory is not enough. Log in to each item, open the owner field and read who is administrator, because the name shown is often a developer’s personal email from three years ago.
The code is only half of it. The Apple developer account, payment gateway keys, DNS records and Play Console signing keystore often sit under one engineer’s login, and a repository audit never shows them. Check each by hand.
- Git repository and its branches
- Cloud account and billing owner
- Domain and DNS registrar login
- App Store and Play Console listings
- CI pipeline secrets and signing keys
- Third party API keys for SMS, maps and payments
Mirror the repository with history intact
Create an empty repository in an organisation you own, mirror-clone the vendor’s repository, then push every branch and tag so commit history, authors and dates come with it.
Build the copy on a clean machine, compare head commits on both sides and run the tests, so a missing submodule or ignored config file surfaces early. Keep the vendor’s repository live until then. No rush.
Move accounts in an order that avoids downtime
Start with the domain registrar and git hosting, which carry the least risk, then move cloud projects through the provider’s own transfer feature wherever one exists. Store transfers take days.
Rotate every secret after it moves. Every one. Database passwords, keystore passphrases and API tokens that a vendor engineer has seen should be treated as exposed, even when nobody suspects misuse.
- Domain and registrar first
- Git hosting second
- Cloud billing and projects third
- Store listings with the transfer review period
- Rotate keys last, one at a time
Keep delivery running during the switch
Point the CI pipeline at the new repository on a test branch before you flip production, then run one full release through it, including the mobile signing step. The old pipeline stays as fallback.
Share the dates with the vendor team. A calm handover keeps their engineers helpful. A surprise lockout loses you whoever knows why the deploy script carries that odd flag, plus the unwritten reasons behind the release steps.
Write ownership into the contract and close it out
Add a clause giving the client ownership of code, accounts and credentials from the first commit, plus a monthly check where someone confirms the owner on every account.
Then revoke admin rights. File the audit list with the date. Keep the vendor as a collaborator if work continues, and a month later test a restore from the new backups, since nobody checks backups until something fails.
Ownership transfer tracker
The tracker has one row per asset, covering repository, cloud account, domain, store listings, CI secrets and API keys, with columns for current owner, new owner and transfer method. Further columns record the date moved, whether the key was rotated, and who verified the transfer on the day, with a footer logging the final access revoke.
Open a blank worksheet to printQuestions owners ask
Can the vendor refuse to hand over the code?
Read the intellectual property clause first. If the vendor refuses after that, speak to a lawyer, because ownership of bespoke code turns on what the contract says and on the law where you operate.
Will I lose commit history if I move?
No. A mirror clone carries every branch, tag and commit with its author and date, so the history stays complete and searchable in the new home. Export issues and review comments separately.
How long does a full transfer take?
Code and domain move in a day. Store listings and billing transfers take longer because Apple, Google and the cloud provider review each request before approving it, so their review period sets the overall pace.