How do I take over hosting, domains and payment accounts?
The short answer
Transfer in a fixed order: code and cloud accounts first, then third-party services, then DNS and the domain, then billing last. Payment processor accounts rarely move between owners, so plan a customer migration rather than a handover. Release escrow only once you control every asset yourself.
What is the right order to transfer things in?
Transfer in the order of what breaks least when it goes wrong: source control and cloud accounts first, then third-party services, then DNS and the domain, and billing last. Doing it the other way round is how buyers end up owning a domain that points at a server they cannot log into, or a payment processor collecting money for a product they do not yet control. The whole sequence is normally two to five working days, with the seller available throughout.
Write the order into the asset purchase agreement as a checklist. Escrow releases when you have confirmed every line yourself, not when the seller says it is done.
What moves how?
Each asset class has its own mechanism, and several of them have a delay or a lock you cannot shorten. The table is the one to build your timetable from.
| Asset | How it moves | The trap |
|---|---|---|
| Source control | Repository ownership transfer to your account or organisation | Forks, secrets in commit history, and CI variables that do not travel |
| Cloud account | Either the account itself changes hands or you migrate into a new one | Reserved capacity, billing alerts and IAM users tied to the seller |
| Managed hosting | Project or app ownership transfer inside the platform | Environment variables, custom domains and build hooks need re-checking |
| Domain | Registrar-to-registrar transfer with an auth code, or an instant push within the same registrar | 60-day locks after recent registration, transfer or registrant change |
| DNS | New zone built in your account, then nameservers repointed | TTLs. Lower them to 300 seconds a day before you move anything |
| Email sending | New account, domain authentication records, warmed sending reputation | Deliverability drops if SPF, DKIM and DMARC lag behind the cutover |
| Payment processor | Usually a new account of yours plus a customer and card data migration | Card data only moves by formal request from both parties |
| Analytics and Search Console | Property ownership transfer or new property with historical access | Losing historical data you will want for the first year |
| App stores and extensions | Platform-specific item transfer between developer accounts | Review delays and, for extensions, a publisher change users can see |
Why is the payment processor the hard part?
Payment processor accounts are usually tied to the legal entity and the individual who passed identity checks, so they rarely change hands in an asset transfer. The normal route is that you open your own account and the seller's processor performs a card data migration, which both parties must request in writing and which the processor handles directly rather than exposing card numbers to either of you. Subscriptions are then recreated against the migrated payment methods in your account.
Plan for three consequences. Some customers will need to re-authorise, particularly under European strong customer authentication rules and anywhere mandates are used, so expect a percentage of involuntary churn in the first cycle. Billing dates shift, so decide whether you are absorbing a part-month or charging one. And the migration takes days rather than hours, so do not schedule it for the day before a large renewal batch.
Where the deal transfers the company rather than the assets, the processor account can stay where it is. That is a different transaction with different implications, and it is worth deciding which one you are doing before you get to transfer week.
How do you move the domain without downtime?
Move the domain without downtime by separating DNS from the registrar and doing DNS first. Build the zone in your own DNS provider, copy every record exactly, and check it resolves before you change anything live. Then lower TTLs on the existing zone to 300 seconds, wait a day, repoint the nameservers, and watch traffic land.
Only then move the registrar. Inside the same registrar, a push between accounts is usually instant and avoids the 60-day transfer lock entirely, so ask the seller to open an account there rather than moving registrar at the same time. Between registrars you need the domain unlocked, privacy off and an auth code, and the transfer takes up to five days. A domain registered, transferred or re-contacted in the previous 60 days cannot move at all, which is worth checking during diligence rather than on the day.
What is the transfer-day sequence?
The order below is the one that leaves you in control at every step rather than halfway between two owners.
- Take a full backup of the database, storage and repository before anything changes.
- Accept the repository transfer and confirm you can build and deploy from your own account.
- Take ownership of the cloud or hosting account, or complete the migration into yours.
- Create your own accounts at every third-party service and swap credentials one service at a time.
- Rotate every secret, API key, webhook signing key and admin password. All of them, including ones the seller says are unused.
- Build and confirm the new DNS zone, then repoint nameservers.
- Complete the payment processor migration and run a live test charge and refund.
- Move analytics, Search Console and any advertising accounts.
- Move the domain registration once DNS is stable.
- Walk the asset checklist line by line, confirm each one yourself, then release escrow.
Step five is the one buyers skip. Until every credential is rotated, the previous owner and everyone they ever shared a key with still has access to your production systems.
What should the seller still be doing after close?
The seller should be on call for a defined handover period, with a response time written into the agreement. Fourteen to thirty days covers the first billing cycle, the first deploy you make alone and the first incident you have not seen before. Agree a channel, agree a response window, and agree how many hours are included.
Ask for one thing beyond availability: a written runbook covering deployment, restore-from-backup, the monthly billing routine and the three things that break most often. Most sellers can produce it in an afternoon if you ask during diligence. Almost nobody produces it after the money has moved.
Related: stack-transfer, how-to-hand-over-a-saas-business, what-if-a-seller-doesnt-complete-the-transfer
See what a business at this level is listed at.
Everything on sale between $50,000 and $150,000, on the same fields.