Transfer cloud account ownership from a freelancer to your company

TL;DR — If a freelancer created your cloud accounts under their personal email, your company does not fully control its own systems. The fastest safe fix is: create company-owned root/owner accounts first, add company admins, transfer billing and domains, rotate secrets, then remove the freelancer's owner access only after you verify logins, DNS, email, and backups still work. Reading time: ~5 min

Goal

When you finish, your company email address owns your key cloud accounts, at least two company staff can log in as admins, billing goes to your company, recovery methods point to your company, and the freelancer no longer has sole control over hosting, DNS, domains, databases, storage, or email services.

Prerequisites

• A company email address to use for ownership, such as it@yourcompany.com or ops@yourcompany.com
• Access to that mailbox and its inbox
• Your password manager login (a secure vault for storing passwords and recovery codes)
• The current list of providers your app uses: hosting, DNS (domain name records), domain registrar (where the domain is registered), database, object storage (file storage), email sending, and backups
• Billing access: the company credit card or finance contact who can update payment methods
• The freelancer available during the transfer window, if they currently hold owner access
• Two company staff members who should be admins
• Optional CLI tools if your provider supports them: terraform >= 1.6 — check with terraform version

Steps

Step 1: Inventory every account your app depends on

Create a shared document or spreadsheet with these exact columns and fill one row per provider:

Provider | Purpose | Login URL | Current owner email | Company admin added? | Billing company-owned? | Recovery email/phone company-owned? | Notes

Check the app's invoices, old onboarding emails, and your DNS nameservers to find providers. In your DNS provider dashboard (e.g. Cloudflare: DNS → Records), note where your domain points.

What you should see when this succeeds: one complete list covering domain registrar, DNS, hosting, database, storage, email, backups, and monitoring.

Step 2: Create a company-owned owner account for each provider

In each provider's dashboard, use the sign-up or account settings flow with your company email, not the freelancer's email. If the provider supports organizations or teams, create one named exactly:

yourcompany-production

If the account already exists under the freelancer's login, in that provider's dashboard go to the account/team members area (for example: Settings → Team, Members, Users, or Organization) and add your company email as an admin or owner.

What you should see when this succeeds: your company email receives an invitation email and appears in the provider's member list with Admin or Owner status.

Step 3: Add a second company admin and enable MFA

For each provider, in the dashboard go to Security or Account Settings and turn on MFA (multi-factor authentication, a second login step) for the company owner account. Then add a second company staff member as admin.

Use these literal values where the UI asks for a role:

Primary company account role: Owner
Second company staff role: Admin
Freelancer role during transition: Admin

Store backup codes in your password manager under a shared vault entry named exactly:

<provider-name> - owner account

What you should see when this succeeds: both company users can log in, MFA is enabled, and backup codes are saved in the company vault.

⚠️ Do not remove the freelancer yet. If you remove them before billing, DNS, or recovery settings are transferred, you can lock yourself out or cause downtime.

Step 4: Transfer billing and recovery methods to the company

In each provider dashboard, go to Billing/Payment Methods and replace the freelancer's card with the company card. Then go to Account Settings → Security or Profile and replace recovery email and phone with company-controlled values.

Use these literal checks:

Billing contact email: finance@yourcompany.com
Recovery email: it@yourcompany.com

If the provider has invoices or tax details, update the company legal name and billing address in Billing → Invoices, Tax, or Company Details.

What you should see when this succeeds: the company card is the default payment method, invoices show your company details, and password reset emails go to a company mailbox.

Step 5: Transfer the domain registrar and DNS control

First identify both pieces:

• Domain registrar: where the domain is registered and renewed
• DNS provider: where the DNS records are edited

In the registrar dashboard, go to Domain Settings and confirm the registrant/admin email is a company email. In the DNS provider dashboard, go to the members/team area and add your company owner account.

If the freelancer controls the registrar account, ask them to start an account change or push transfer in the registrar dashboard to your company account. If the provider instead requires an auth code, use the registrar's Transfer/Move Domain flow and send the code to your company account.

What you should see when this succeeds: the domain contact email is company-owned, and your company account can edit DNS records.

Step 6: Rotate secrets the freelancer may know

Rotate all credentials that could still let the freelancer in: hosting deploy keys, API keys, database passwords, SMTP credentials, object storage keys, and webhook secrets.

In each provider dashboard, use the credentials or API keys page and create a new key, update the app with the new value, then delete the old key. Name new keys exactly like this:

production-2026-company-owned

If your app stores secrets in environment variables, update them in your hosting dashboard (for example: Settings → Environment Variables, Secrets, or Configuration).

What you should see when this succeeds: the app still works with the new secrets, and the old keys are deleted or disabled.

Step 7: Export infrastructure config if available

If your freelancer used infrastructure as code (configuration files that define cloud resources), ask for the repository and state files. If Terraform is used, ask for these exact items:

terraform version
terraform providers

And request copies of:

*.tf
terraform.tfstate
terraform.tfstate.backup

Store them in a company-owned Git repository and restrict access to company admins.

What you should see when this succeeds: your company has the code or documented settings needed to recreate infrastructure without the freelancer's account.

Step 8: Remove the freelancer's owner access

After verification, demote or remove the freelancer in each provider dashboard.

Use these exact role changes:

Before removal: Owner or Admin
After transfer complete: Removed

If you still need short-term support, set the freelancer to the lowest role that lets them do the agreed work, such as Developer, Billing, or Read only, depending on the provider.

What you should see when this succeeds: only company users remain as owners/admins, and the freelancer no longer appears in the member list or has only a limited non-owner role.

Verify it works

Check every provider in your inventory and confirm all four checks pass:

1. Company owner can log in with MFA
2. Second company admin can log in
3. Billing shows company card and company invoice details
4. Recovery email goes to a company mailbox

Then verify the live systems still work:

[Company Admin] ---- 1. login ----> [Cloud Provider]
[Cloud Provider] ---- 2. owner/admin ok ----> [Company Admin]
[Company Admin]
|
v
[DNS Provider] ---- 3. edit test TXT record ----> [Domain]
[Company Admin]
|
v
[Hosting] ---- 4. view env vars/deploy ----> [App]

Practical checks:

• In the DNS dashboard, add a temporary TXT record named ownership-test with value company-control, save it, then delete it after it appears.
• In the hosting dashboard, confirm you can view deployments and environment variables.
• In the registrar dashboard, confirm the renewal contact email is a company email.
• In the billing page, confirm the default card is the company card.

You should see: successful logins for two company users, editable DNS, visible app settings, and company-owned billing/recovery details.

Common pitfalls

Removing the freelancer too early

Mistake: deleting the freelancer's access before adding company admins and updating recovery details.

Symptom: you cannot approve changes, receive password resets, or access billing.

Fix: re-invite the freelancer temporarily, add company owner/admin accounts first, then repeat the transfer in order.

Confusing the registrar with the DNS provider

Mistake: updating DNS records but never transferring the domain registration account.

Symptom: the site works today, but renewals, transfers, or nameserver changes still depend on the freelancer.

Fix: check both the registrar dashboard and the DNS dashboard; transfer both if they are different services.

Leaving recovery email on the freelancer's mailbox

Mistake: changing the visible account email but not the recovery email or phone.

Symptom: password reset links still go to the freelancer.

Fix: in Account Settings → Security/Profile, replace every recovery method with company-controlled values.

Rotating a secret without updating the app

Mistake: creating a new API key or database password and deleting the old one before updating environment variables.

Symptom: deploys fail, the app returns errors, or email/file uploads stop working.

Fix: create new key, update the app settings, verify the app, then delete the old key last.

Only one company person has access

Mistake: transferring ownership to a single employee's mailbox.

Symptom: you are stuck again when that employee is on leave or leaves the company.

Fix: keep one company owner account plus at least one second company admin, both with MFA and backup codes in the company password manager.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.