The Accounts Your Business Should Control Before Software Goes Live

A custom product depends on more than its staff login page. Domain registration, hosting, email delivery, payment services, and other accounts may be essential to keeping it available. Before launch, the business should understand who controls those relationships, who can recover access, and how authorized technical work is performed.

Identify the accounts behind the service

Ask the developer for an understandable account inventory. Include the purpose of each service, its account holder, the person responsible for billing, and its connection to the business workflow. Some accounts may be managed by the provider under an agreed arrangement; others may need direct business control.

Consider a hypothetical appointment company launching online bookings. Its domain directs customers to the product, its payment account collects money, and its email service sends confirmations. Losing access to any of these can affect operation even if the custom software itself is working.

The NCSC's guidance on important online accounts recommends reviewing accounts a business relies on, including website and domain services. Its practical relevance is that the inventory should extend beyond the application users immediately recognize.

Separate ownership of the relationship from daily administration

The owner does not need to perform every technical task personally. A developer can receive appropriate delegated access while the business retains the account relationship where that arrangement is suitable. Avoid making one person's private account the unexplained foundation of a business-critical service.

For the appointment company, the developer may administer settings while a designated business manager receives billing and renewal notices. The exact structure depends on the supplier's capabilities and the engagement. Ask what happens if the developer changes or the company's authorized manager leaves.

Where services operate through a provider-managed account, clarify continuity and transfer terms. Direct account control is not always the available model, and technical access does not by itself establish contractual rights. The company should understand the arrangement rather than assume every service can be moved immediately.

Protect recovery as carefully as ordinary access

An account is not under practical control if only an unavailable person can recover it. Identify recovery methods, authorized contacts, and alternative arrangements. Keep sensitive recovery material in a controlled location rather than in an ordinary project document.

The appointment company should review whether important recovery messages reach a business-controlled address and whether loss of one phone would prevent access. The technical provider can explain supplier-specific options. The owner should confirm who is authorized to use them and when.

The NCSC guidance also recommends stronger sign-in protections for important accounts. Use the protections supported by the relevant service and assess how recovery will work alongside them. Strong access controls and workable continuity should be considered together.

Verify access and responsibility before launch

Ask authorized people to confirm that they can reach the accounts they are expected to manage. Check billing contacts, renewal notices, and supplier support routes. Record what was verified and any unresolved limitations.

For the appointment company, a pre-launch review should establish who can change the domain relationship, who can inspect payment status, and who receives a notice about an unsuccessful subscription charge. These tasks deserve different permissions; broad shared credentials are not the only way to coordinate them.

Review the inventory when important services are added or people change. A launch document becomes less useful if later dependencies remain known only to the developer who introduced them. Keep responsibility information current without distributing unnecessary administrative access.

Apply Holism's model with explicit account arrangements

Holism combines AI, an experienced developer, and a Software Product Line of reusable capabilities and consistent rules. The developer can assess external dependencies and explain which service accounts support the custom product. AI assists delivery while human judgment directs access and operating choices.

The owner supplies business authority and chooses the continuing arrangements. Agree which accounts the company controls directly, which the provider manages, and what rights and support apply if the relationship changes. Holism's reusable foundation does not automatically define account ownership or transfer rights.

Practical control begins with knowing the essential services and having authorized, recoverable access to the agreed responsibilities. An accurate inventory and verified recovery arrangements give the business a stronger operating position than a collection of passwords held by one person.