Digital Asset Handoff for a Home Services Acquisition

Transfer control, not just passwords

A password proves temporary access. Control requires the buyer's legal entity, buyer-controlled recovery email and phone, multiple administrators, documented billing ownership and the ability to remove the seller. Build the register early enough to discover accounts created under a former employee's personal address or a marketing agency's master account.

The digital asset register

Thirty days before closing

• Inventory systems from bank statements, browser bookmarks, app integrations, vendor bills and employee interviews.
• Record account ID, legal owner, super administrators, billing owner, renewal date, data exported, API dependencies and required provider process.
• Identify assets that may not be assignable. Obtain provider guidance instead of promising a transfer.
• Create buyer-controlled email identities and a secure password vault; do not exchange credentials in the purchase-agreement email thread.
• Export current DNS, call routing, user lists, conversion definitions, CRM fields and integrations.

Fifteen days before closing

Add buyer administrators where permitted without removing seller access. Prepare change tickets for accounts that require closing evidence. Freeze nonessential website, CRM and routing changes. Decide exactly when payment destinations, call forwarding and lead notifications change. Schedule personnel so the buyer can test each workflow while the seller is still available.

Closing-day runbook

1. Confirm the legal closing authorization before changing ownership or payment instructions.
2. Change recovery methods and billing under dual control; retain screenshots or provider confirmations.
3. Test calls, web forms, online booking, email, CRM dispatch, invoices and payment routing.
4. Rotate passwords, API keys and shared codes according to the planned sequence.
5. Remove seller access only after contracted transition access and evidence retention have been addressed.
6. Open a defect log with severity, owner, workaround and resolution deadline.

Google profile ownership is a workflow of its own

Google documents an ownership-request process when a verified profile belongs to someone else. Service-area businesses can require support involvement, and newly added owners or managers may face limits on certain actions for seven days. Do not schedule a same-day profile change without reviewing the current provider process. Inventory duplicate, suspended and practitioner profiles separately.

Security and privacy controls

Grant least-privilege access, require multifactor authentication, preserve legally required records and coordinate the treatment of call recordings, customer payment data, employee files and marketing consents with counsel. Do not copy an entire seller mailbox or shared drive merely because it is technically possible; define the business records being delivered and excluded personal or privileged material.

Seven-day acceptance test

For the first week, reconcile lead counts by source, abandoned/missed calls, web-form deliveries, booked jobs, merchant deposits and bounced email. Compare results to the pre-close baseline. A quiet failure in tracking or routing can look like a demand decline, so instrument the transition before changing campaigns.

Marketing agency and vendor diligence

Ask whether the company owns each ad account, landing page, phone number, creative file, analytics property and audience or merely receives reports from an agency account. Obtain the agreement, account IDs, administrators, billing history, conversion definitions, cancellation/transition terms and export rights. A vendor's willingness to “keep everything running” is not evidence of assignability or buyer control.

Define the delivered data boundary

Create a delivery schedule for customer/job records, call recordings, estimates, invoices, photos, technician notes, marketing consents, employee records and financial files. Identify retention, privacy, privilege and payment-card restrictions with counsel and providers. Hash or inventory material exports so both parties can establish what was delivered and when. Avoid copying personal seller content merely because it shares a mailbox or device.

Acceptance test matrix

Devices, vehicles and field applications

Inventory company phones, tablets, laptops, vehicle telematics, dash cameras, fuel cards and field-service apps. Record ownership, mobile-device management, SIM/carrier, passcode recovery, app enrollment and wipe/return process. Remove personal Apple, Google or Microsoft accounts without erasing company evidence. Test a technician's complete mobile workflow after reassignment.

Classify defects by business consequence

• Critical: lost phone number, payment misrouting, no domain control, dispatch outage or unauthorized seller access.
• High: lead forms, advertising, email or CRM integration fails.
• Medium: attribution, reporting, templates or secondary users are incomplete.
• Low: cosmetic branding or archived content needs cleanup.

Assign workaround, owner and deadline. Track critical/high defects daily during the transition and reconcile lead and deposit counts until stable.

Run a controlled parallel period

When systems permit, keep seller administrators available while buyer-controlled users complete real workflows under supervision. Compare inbound call counts, form leads, booked jobs, invoices and deposits between the last seller-controlled days and first buyer-controlled days. Investigate variance before removing the final seller recovery method. Record the exact cutover time because daily totals can otherwise hide missing events.

Keep an evidence packet with registrar and hosting receipts, account IDs, administrator screenshots, export inventories, support tickets and acceptance results. Passwords should move through an approved password manager, not the closing checklist. The packet should prove control without exposing reusable secrets in the transaction archive.

Accept a system by observing its result

Build an acceptance row for the phone, website, dispatch, payment and reporting path. Define the expected recipient, record identifier, timing and evidence before testing. A form's thank-you page or a calendar render shows only part of the journey. A controlled labeled test should be authorized and checked in the destination system before delivery is described as proven.

For an external scheduling service, distinguish the event configuration, available slots, submitted request, required confirmation and actual calendar entry. Preserve working settings during a transfer; account access and authorized provider changes are separate from a visual website refresh.

Review incident history and unresolved response work

Add a controlled incident-history review to the account-ownership file. Identify known security events, affected systems, investigation records, notifications, insurance matters, vendor actions and unresolved conditions. Use anonymous issue references in broadly shared schedules. A quiet support inbox or an owner’s statement that there was never a breach is not a substitute for the agreed evidence request and response.

Assign the legal, insurance, technical and company decision owners separately. A technical incident, a contractual notification duty and a legally defined breach can have different scopes. Preserve the actual analysis instead of having a general website decide who must be notified or invent a universal deadline.

Connect the delivery boundary to Illinois security review

Illinois’s Personal Information Protection Act defines its covered information and data collectors and addresses notice, disposal, reasonable security and disclosure-contract matters. Have counsel map the actual information and transaction to the applicable provisions, including sections 10, 40 and 45 where relevant. Do not label every job record the same or assume that a sale permits copying every customer, employee or personal file.

For each delivered dataset, identify source, cutoff, authorized recipient, business purpose, excluded records, access controls and retained seller/vendor access. Record the approved retention, disposal and disclosure-contract treatment. Keep card data, reusable credentials, personal seller material and privileged information out of an ordinary export. FTC guidance supports inventorying data, limiting unnecessary holdings and reviewing service-provider practices; it does not grant a blanket transfer right.

Prove recovery with an authorized isolated restore

NIST’s small-business CSF guide recommends regular backups and testing. Account recovery and data recovery answer different questions: buyer-controlled MFA can restore login access while the latest required work orders or invoice records remain unavailable. Inventory what is backed up, its cutoff, where it is retained, who controls it and the dependency on a departing person or vendor.

This is a qualified acceptance workflow, not instructions to alter production systems or restore sensitive records without authority. Define the permitted environment and recipients first. A hypothetical backup job marked successful does not establish that dispatch can retrieve the required latest records. Compare the restored population and cutoff with the planned operating need.

Assign continuing response and recovery ownership

Preserve the incident contacts, escalation chain, administrator backups and authorized vendor roles after closing. Set the scope and expiration of any seller transition access. Treat a credential rotation, terminated vendor account and retained legal evidence as separate actions so an access cleanup does not erase records still required by the transaction or applicable law.

Budget supported correction work once. A one-time restoration test, recurring backup service and unresolved historical incident are different economic items. Obtain actual quotes and technical scope; do not infer a liability reserve or standardized cybersecurity cost. Link the items to the insurance review and the dated cash plan when supported payment dates are known.

The new data-delivery and incident/recovery registers accompany the existing ownership and workflow tests. They should show the authorized decision, accepted evidence and unresolved exception. They are not a certification of security or a public repository for private incident details.

Sources and scope

Source links support the specific topics noted. Examples and analytical frameworks are illustrative; confirm current requirements and transaction facts with the responsible advisers.

1. Google Business Profile Help - Request Ownership
   Current ownership request process and service-area business guidance.
2. Google Business Profile Help - Owners and Managers
   Role management and restrictions for newly added owners/managers.
3. NIST CSF 2.0 Small Business Quick-Start Guide, SP 1300
   Voluntary cybersecurity framework, including backup testing, incident response and recovery; not a certification or statutory checklist.
4. Protecting Personal Information: A Guide for Business
   Data inventory, minimization, access, vendor practices, disposal and incident planning. No universal right to transfer every customer or employee record.
5. Personal Information Protection Act, 815 ILCS 530
   Definitions and sections 10, 40 and 45 inform notice, disposal, security and disclosure-contract review. Actual applicability and notice decisions require counsel; do not calculate a universal breach deadline.