Who Owns Your Business's Social Accounts? A Handover Checklist for Staff and Agency Changes

06 September 2026·5 min read

Quick answer: Your business should own every social account, email address, and password used to run it — not the staff member or agency who set it up. The moment someone starts managing your accounts, run a quick access audit; the moment they leave, run a full handover: reset passwords, move two-factor authentication to a device you control, export the content library, and remove them from every connected tool. Do this within 24 hours of any departure, not "when you get time." 📱

Here's the scenario that plays out more often than agencies like to admit: a business owner goes to post an Instagram Story on a Tuesday morning and discovers they can't log in. The password doesn't work. The email tied to the account isn't one they recognise. The person who set it all up — a freelancer, a part-time hire, a friend-of-a-friend who "was good with Instagram" — left three weeks ago, and nobody thought to ask who actually held the keys.

This isn't rare, and it isn't dramatic when it happens on good terms either. Most of the time nobody's being malicious. It's simply that account ownership was never set up properly in the first place, so there was nothing clean to hand back. We've seen it cost businesses their entire follower count, their content history, and weeks of momentum — all because ownership was an afterthought instead of a system. 💖

What most businesses get wrong

The mistake isn't waiting too long to ask for a handover — it's never establishing who owns what in the first place. Businesses hand a staff member or agency an email and password once, and from that point on, that account is administered from a personal phone, a personal email inbox, and a personal authenticator app. There's no separation between "the person doing the work" and "the business asset they're working on." When that person leaves — fired, resigned, contract ended — the account leaves with them in every practical sense, even if legally it's the business's property. Getting it back becomes a negotiation instead of a five-minute admin task.

The account handover checklist — run this whenever someone managing your accounts leaves, and log the results somewhere the business controls:

1. List every platform they touched: Instagram, Facebook, TikTok, LinkedIn, plus the business email and any scheduling tool.
2. Confirm who owns the admin role on each — not just who posts. On Meta, check the business (not the individual) owns the Business Manager.
3. Reset every password using a business-controlled password manager, not a shared note.
4. Move 2FA off their personal phone or authenticator app onto a business-owned device.
5. Change the recovery email on every account to one the business controls.
6. Export the content library — templates, caption docs, photo/video archives, unpublished scheduled posts.
7. Remove their access from connected apps: scheduling tools, Canva team accounts, ad accounts.
8. Document who now holds each password, with a named backup person.

Solo operator, freelancer let go: After a dispute over missed posting, a business owner discovered the freelancer's personal email was still the Instagram account's recovery address and only 2FA device. It took an 11-day Meta support ticket and a video verification to get the account back, during which the business posted nothing and lost roughly 6% of its followers.

Small team, "the Instagram person" resigns: One staff member unofficially "did the Instagram" alongside her main role. When she resigned, the owner assumed handover would happen naturally — it didn't. She'd used her personal Canva Pro account for every template, and those designs left with her subscription. The business rebuilt its visual templates from scratch.

How to set this up so it never becomes a crisis

The best time to run this checklist is before you ever hand access to anyone — not after they've gone. Set it up once, and every future handover becomes routine instead of a scramble.

Step 1: Create business-owned logins from day one, using a dedicated business email as the primary contact and recovery address for every platform, not a personal Gmail.

Step 2: Use a business password manager. Tools like 1Password or Bitwarden let you share access without revealing the actual password, and revoke it instantly when someone leaves.

Step 3: Put 2FA on a business-controlled device, not an individual's personal mobile number.

Step 4: Build a handover note into every offboarding process, staff or agency, so it's a standard step rather than a favour you hope someone remembers.

Step 5: Run a quarterly access audit even when nobody's leaving, to catch anyone who shouldn't still have admin rights.

💡 Ownership isn't the same as access. Being able to post to an account is not the same as owning it. If you can't answer "who is listed as the account owner, and what email and phone number recover it?" for every platform right now, that's the gap to close first — before you worry about anything else on this list.

Mistakes to avoid

Assuming a friendly departure means a clean handover. Even people leaving on great terms forget details or don't think to mention the Canva login — run the checklist regardless.
Leaving the recovery email unchanged. If their personal email can still trigger a password reset, they still effectively control the account no matter what the password is.
Storing the master password list in a shared note or spreadsheet. These get copied and forwarded. A proper password manager with access logs is worth the small monthly cost.
Waiting until someone's last day to start the process. Begin the moment notice is given, so there's time to fix gaps before they're gone for good.

Frequently asked questions

What if the person managing our accounts refuses to hand over access?

Start with the platform's official business verification process — Meta, TikTok and LinkedIn all have processes for a business to reclaim an account it can prove ownership of (ABN, business documents, prior admin history), though it can take days to weeks and isn't guaranteed to be fast. This is exactly why setting up business-owned logins from the start matters — it avoids this situation altogether rather than relying on goodwill or a support ticket after the fact.

Should we require agencies to work only within business-owned accounts?

Yes — any agency worth working with will expect this and should be able to work as an admin/collaborator on an account the business owns, rather than needing you to hand over full account credentials. If an agency insists on creating and "owning" your accounts themselves, treat that as a red flag in the contract stage, not something to sort out later.

How often should we actually do an access audit?

Quarterly is a reasonable minimum for a small business, and immediately whenever staff or contractor roles change. It only takes 15–20 minutes once your account list is documented, so there's little reason to skip it.