Transfer control, not just passwords
A password proves temporary access. Control requires the buyer's legal entity, buyer-controlled recovery email and phone, multiple administrators, documented billing ownership and the ability to remove the seller. Build the register early enough to discover accounts created under a former employee's personal address or a marketing agency's master account.
The digital asset register
| System | Control evidence | Continuity risk | Closing test |
|---|---|---|---|
| Domain and DNS | Registrar owner, administrative contact, transfer lock, renewal method, DNS host | Seller or vendor retains registrant control; transfer disrupts email | Buyer admins added, recovery changed, renewal verified, DNS exported |
| Phone and call tracking | Carrier account, number inventory, routing tree, recordings and consent settings | Main or campaign numbers do not transfer; tracking numbers disappear | Inbound and outbound calls tested from external phones |
| Google Business Profile | Owner and manager roles for every location or service area | Profile remains with seller; ownership request or reverification delays changes | Buyer-controlled account has the correct role and locations are inventoried |
| Advertising | Google Ads, Local Services Ads and social account IDs, billing, conversion actions | Campaign history or reviews sit in an agency-owned account | Buyer can view billing, pause spend and receive leads |
| CRM and dispatch | Tenant owner, users, roles, API keys, integrations, exports and retention settings | Technicians cannot dispatch or historical records are omitted | Sample lead-to-invoice workflow completed in buyer-controlled access |
| Email and collaboration | Super admin, domains, shared mailboxes, retention, MFA and forwarding | Seller continues to receive customer or financial mail | Recovery and forwarding reviewed; seller access scheduled for removal |
| Website and analytics | Hosting, repository, CMS, Search Console, analytics, tag manager and forms | Lead forms route to seller; buyer cannot deploy or measure | Test lead reaches buyer; deployment rollback and analytics event verified |
| Payments and finance | Merchant account, bank destination, processor, accounting and payroll admins | Cash routes to wrong account or stored customer data is mishandled | Provider-approved ownership process and penny/test transaction where appropriate |
Thirty days before closing
- Inventory systems from bank statements, browser bookmarks, app integrations, vendor bills and employee interviews.
- Record account ID, legal owner, super administrators, billing owner, renewal date, data exported, API dependencies and required provider process.
- Identify assets that may not be assignable. Obtain provider guidance instead of promising a transfer.
- Create buyer-controlled email identities and a secure password vault; do not exchange credentials in the purchase-agreement email thread.
- Export current DNS, call routing, user lists, conversion definitions, CRM fields and integrations.
Fifteen days before closing
Add buyer administrators where permitted without removing seller access. Prepare change tickets for accounts that require closing evidence. Freeze nonessential website, CRM and routing changes. Decide exactly when payment destinations, call forwarding and lead notifications change. Schedule personnel so the buyer can test each workflow while the seller is still available.
Closing-day runbook
- Confirm the legal closing authorization before changing ownership or payment instructions.
- Change recovery methods and billing under dual control; retain screenshots or provider confirmations.
- Test calls, web forms, online booking, email, CRM dispatch, invoices and payment routing.
- Rotate passwords, API keys and shared codes according to the planned sequence.
- Remove seller access only after contracted transition access and evidence retention have been addressed.
- Open a defect log with severity, owner, workaround and resolution deadline.
Google profile ownership is a workflow of its own
Google documents an ownership-request process when a verified profile belongs to someone else. Service-area businesses can require support involvement, and newly added owners or managers may face limits on certain actions for seven days. Do not schedule a same-day profile change without reviewing the current provider process. Inventory duplicate, suspended and practitioner profiles separately.
Security and privacy controls
Grant least-privilege access, require multifactor authentication, preserve legally required records and coordinate the treatment of call recordings, customer payment data, employee files and marketing consents with counsel. Do not copy an entire seller mailbox or shared drive merely because it is technically possible; define the business records being delivered and excluded personal or privileged material.
Seven-day acceptance test
For the first week, reconcile lead counts by source, abandoned/missed calls, web-form deliveries, booked jobs, merchant deposits and bounced email. Compare results to the pre-close baseline. A quiet failure in tracking or routing can look like a demand decline, so instrument the transition before changing campaigns.
Marketing agency and vendor diligence
Ask whether the company owns each ad account, landing page, phone number, creative file, analytics property and audience or merely receives reports from an agency account. Obtain the agreement, account IDs, administrators, billing history, conversion definitions, cancellation/transition terms and export rights. A vendor's willingness to “keep everything running” is not evidence of assignability or buyer control.
Define the delivered data boundary
Create a delivery schedule for customer/job records, call recordings, estimates, invoices, photos, technician notes, marketing consents, employee records and financial files. Identify retention, privacy, privilege and payment-card restrictions with counsel and providers. Hash or inventory material exports so both parties can establish what was delivered and when. Avoid copying personal seller content merely because it shares a mailbox or device.
Acceptance test matrix
| Workflow | Test transaction | Pass evidence |
|---|---|---|
| Lead intake | Submit web form and call every published number | Buyer notification, CRM source and response clock |
| Booking/dispatch | Create, assign and reschedule a sample job | Technician receives correct customer and route data |
| Estimate/invoice | Generate branded estimate and zero-dollar test invoice | Correct legal entity, terms, tax and sender |
| Payment | Provider-approved test or verification | Correct merchant and bank destination |
| Reporting | Trace the sample lead through analytics and CRM | Events, attribution and dashboard update |
| Recovery | Validate super-admin and recovery methods | Buyer-controlled MFA with backup administrator |
Devices, vehicles and field applications
Inventory company phones, tablets, laptops, vehicle telematics, dash cameras, fuel cards and field-service apps. Record ownership, mobile-device management, SIM/carrier, passcode recovery, app enrollment and wipe/return process. Remove personal Apple, Google or Microsoft accounts without erasing company evidence. Test a technician's complete mobile workflow after reassignment.
Classify defects by business consequence
- Critical: lost phone number, payment misrouting, no domain control, dispatch outage or unauthorized seller access.
- High: lead forms, advertising, email or CRM integration fails.
- Medium: attribution, reporting, templates or secondary users are incomplete.
- Low: cosmetic branding or archived content needs cleanup.
Assign workaround, owner and deadline. Track critical/high defects daily during the transition and reconcile lead and deposit counts until stable.
Run a controlled parallel period
When systems permit, keep seller administrators available while buyer-controlled users complete real workflows under supervision. Compare inbound call counts, form leads, booked jobs, invoices and deposits between the last seller-controlled days and first buyer-controlled days. Investigate variance before removing the final seller recovery method. Record the exact cutover time because daily totals can otherwise hide missing events.
Keep an evidence packet with registrar and hosting receipts, account IDs, administrator screenshots, export inventories, support tickets and acceptance results. Passwords should move through an approved password manager, not the closing checklist. The packet should prove control without exposing reusable secrets in the transaction archive.
Primary sources and review notes
- Google Business Profile Help - Request Ownership — Current ownership request process and service-area business guidance.
- Google Business Profile Help - Owners and Managers — Role management and restrictions for newly added owners/managers.