Matt Turley, Continuum. Updated November 5, 2026.
The eight accounts that matter, how to give access safely, and how to check what you really hold.
Put every account the app depends on in your own name: the code repository, hosting, domain, database, sign-in provider, payment account, email service and AI provider. Give any builder access as a member, never your login. Owning the code means little if someone else holds the hosting or the database.
Invite them as a member with the lowest role that lets them work, using their own login. Never share your own password or a shared inbox login. When the job ends you remove one person and nothing else changes, and you can see who did what.
Keep an access list in a document only you control: each account, its owner, who has what role, and where the recovery email points. That one page is what saves a bad week when a developer disappears. The developer left checklist covers the first week if that has already happened.
Sign out of everything and try to recover each account using only your own email and phone. If any account recovers to someone else’s address, you do not own it yet. Do the same check for the domain, which is the one people most often discover belongs to a former contractor.
Then ask for the code in writing. If an agency or freelancer built it, settle in the contract that you own the work once paid, as in who owns the code when a freelancer builds your app.
Paste your live app URL and your email. A short automated check runs three public-security spot-checks and sends back one specific finding and what to do about it. It is free, and it is a preview, never a clean bill of health.
Run the free is-it-safe-to-ship check. Or book a call and talk it through.