Who owns the website and the login when you hire a studio?

The four things people mean by "the website"

When an owner asks who owns the website, they usually mean four different things at once. The domain is the name, held at a registrar. The content and data are the words, images, customer records, and form submissions. The code and design are what a developer wrote to make the site work. The hosting is the machine the site runs on, and the login that opens it.

Each of those has its own owner and its own paperwork. A contract that says "you own the website" without naming the four is leaving the important part to whoever reads it later. Ask about each one separately, and get each answer written down before the work starts.

Why the code belongs to whoever wrote it until you sign

Under the U.S. Copyright Act, copyright vests initially in the author of a work. A "work made for hire" is the exception, and the Copyright Office describes only two ways to get one: an employee creating the work as part of their regular duties, or a commissioned work in one of nine listed categories, with a written agreement signed by both parties. A website is usually not on that list.

So when an outside studio, agency, or freelancer builds your site, the code is theirs unless a signed document transfers it. Section 204 of the Act says a transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights. Ask for an assignment clause, or a license that says exactly what you may do with the code. This is general information, not legal advice, so have a lawyer read the contract.

The domain is the one you cannot afford to lose

The domain is the address every customer, email, and search result points at. ICANN, which coordinates domain names, tells registrants that they assume sole responsibility for the registration and use of their domain name, and that they must provide accurate contact information. That responsibility should sit with your company, not with a person at a vendor.

Register the domain in your company's legal name, with a company email address you control as the contact, and turn on multifactor authentication at the registrar. CISA recommends requiring MFA wherever possible, across systems like email and file storage. A studio can still manage your DNS records through delegated access. It does not need to hold the registration to do the work.

A host login is not ownership

Owners often keep a hosting password because someone told them ownership means the login. That is backwards. Ownership is the name, the content, the data, and the code, plus a contract that says how you get them back. A server password you are afraid to use is a second job, not a right.

With a managed website, the studio operates the servers. Updates, backups, certificates, and recovery are on the studio's side of the line, and nobody on your side logs into a server. What you hold instead is the exit: a copy of the content and data you can take with you, the code in a repository you can access, and the domain in your own name. If a provider will not put the exit in writing, that is the answer to the ownership question.

Managed website or marketing agency: what to ask either one

The labels overlap, and the contract decides more than the label. These are the questions that separate the two models, and the answer you want to hear.

How we handle it

We design, host, and operate the site on dedicated infrastructure. No shared hosting. You never log into a server, because running the servers is our job. You own your name, your content, your data, and the custom code we put in your private code repository, unless a LICENSE file in that repository says otherwise. You never own LTFI software, because LTFI is the system we operate, not something you install.

The domain stays registered to you. Credentials go in a vault, not a spreadsheet. Leave when you want, and take your data with you. We say that before we start, because the time to settle ownership is before the first invoice, not after the last one.