I provide occasional web development and general technical services for clients. I usually build their sites and configure services from scratch, while they stay out of the day-to-day administration. I'm looking for a reliable way to store and maintain their business credentials so they can regain control if I'm unexpectedly unavailable, leave the relationship, or need to hand everything over.
I don't want to mix my personal credentials with client credentials, and I also don't want clients making changes whenever they feel like it—some might hand access to a cheap contractor for an urgent edit without understanding the risks. Ideally, they would have a controlled emergency handover process rather than normal administrative access.
Password-manager organizations and emergency-access features seem relevant, but I work alone and don't have a lawyer or technical trustee available to manage the process. What setup would be practical for a solo service provider?
A related concern is ownership: domains, hosting, DNS, billing accounts, and other services should probably be registered under the client's identity and payment details, with me added as a delegated or secondary administrator wherever possible.
4 Answers
Start with ownership rather than just passwords. The client should own the domain registration, hosting account, DNS, billing profile, and primary email addresses. Use the client’s payment method and contact information, then add yourself as a separate administrator or delegate. That way, they can recover the accounts even if your password vault is unavailable, and you can remove your access cleanly if the relationship ends.
For clients who genuinely need you to manage everything, create separate client accounts and keep your own account separate. Don’t make your personal login the only way into their services.
You don’t necessarily need a lawyer, but you do need someone you trust to follow written instructions and protect the recovery materials. A family member or friend could hold an encrypted backup and the recovery instructions without being given ordinary access today.
Document what each account is for, who owns it, where billing is handled, how 2FA works, and what should happen during a handover. Keep the instructions separate from the encrypted credentials, and test the recovery process occasionally.
A password manager with emergency access is probably the cleanest fit. You can designate a trusted person, set a waiting period, and require them to request access. If you’re still available, you can cancel the request during that period, which prevents routine or impulsive access.
Be careful with vault scope, though. If one vault contains every client’s credentials, emergency access could expose all of them. Use a separate vault or account per client, or otherwise confirm exactly what the emergency contact will be able to see.
Another option is a monitored dead-man-switch service: you periodically confirm that you’re still available, and if you miss the check-ins for a defined period, it releases instructions or recovery information. I’d treat this as a backup rather than the only safeguard, since automated systems can misfire and credentials still need to be kept current.
Also consider the normal offboarding case. A client should be able to end the relationship and receive their account information, backups, and documentation without waiting for an emergency.
A physical backup can work too: keep an encrypted KeePass database on a USB drive in a safe and put the master-password instructions in a sealed envelope. The drawback is maintenance—every password change means replacing the backup, so it can become stale quickly.