Who owns what when someone builds your website.

A domain name is the address people type. You rent it from a registrar — Cloudflare, Namecheap, Google Domains, GoDaddy — for roughly $15–$60 CAD a year, and it is yours as long as you keep renewing it. DNS is the settings panel attached to it: a short list of records saying which server answers for the website, which service handles your email, and which records prove to Google or Microsoft that you control the domain.

Register it yourself, to your legal business name, on a company email address you will still have in five years. Turn on auto-renew and transfer lock. Then give your studio access to edit records — that is a five-second invitation and it is entirely reversible.

A lapsed domain is the one failure on this page with no clean recovery: an expired name can be bought by someone else within days, and it takes your email, your search rankings and every link anyone ever made to you with it.

A custom website is a folder of files. Those files live in a repository — almost always on GitHub — which keeps the full history of every change, who made it and when, and lets any change be undone. The repository is also what the hosting platform watches: push a change, the site rebuilds itself.

Two things matter to you. First, that a repository exists at all — if a supplier is editing files directly on a live server, there is no history and no undo. Second, what your contract says happens to it: assigned to you on final payment and transferred to your GitHub organisation is the cleanest arrangement, and it is what we do. A licence is a legitimate alternative, but it should be a sentence you read, not a fact you discover.

Platform builds are different by nature. Shopify, Framer and Webflow sites do not produce portable code, and no honest supplier can promise otherwise — what transfers there is the account, not the codebase.

Hosting is the machines that answer when someone visits your address. Modern platforms like Vercel do more than store files: they build the site from your repository, distribute it across a CDN — a network of servers worldwide, so a visitor in Melbourne is served from nearby — issue the SSL certificate that produces the padlock, and give you a private preview of every change before it goes live.

A small business site costs nothing to a few dollars a month at this tier. The account should be in your business name by default. Managed hosting under our account is the other honest model — one predictable invoice instead of four vendor logins — and if that is what you choose, the arrangement is written down and the site remains portable.

A CMS is the admin screen where somebody changes words and pictures without touching code. The categories worth knowing: all-in-one platforms (WordPress, Webflow, Framer) where the CMS and the site are the same product; headless CMSs (Sanity, Contentful) which store content and hand it to a custom-built site; commerce content (Shopify pages and blogs, which come with the store); and a custom admin built into the site itself — which is what runs this website, and which is often the right answer when a business needs to edit six things rather than everything.

You do not automatically need one. A CMS earns its keep when content changes often enough that waiting on a developer is a real cost. Below that threshold it is an update obligation and an extra way to break the site.

Whichever you use, the owner seat belongs to you, and so does the content inside it.

Say this part plainly: a normal marketing website does not need a custom database. Pages, services, a portfolio and a contact form need no database at all. If a supplier proposes one for a five-page brochure site, the right question is what it would store.

You need one when the site holds something specific to each visitor: user accounts, bookings, saved data, memberships, an internal dashboard, a portal your staff logs into. In that case, Supabase is a hosted bundle of a PostgreSQL database (the industry-standard place to keep structured data), authentication (sign-up, login, password resets, roles) and storage (files and images uploaded by users) — the pieces a small team would otherwise have to run themselves.

Where it exists, it holds your customers’ data, which makes it your legal responsibility under Québec’s Law 25 and Canada’s PIPEDA regardless of who built it. That is the strongest reason the organisation should be in your name.

An ecommerce platform is a database, a CMS, a payment flow and an operations tool sold as one subscription. Shopify holds your product catalogue, inventory counts, checkout, orders, shipping settings, discount codes and your customer list — which, over a few years, becomes one of the more valuable assets the business owns.

The store must be opened by you, under your business, with you as store owner. We work inside it with Staff or Collaborator access, which can be scoped to exactly the areas the work touches and revoked in a click. A supplier who insists on holding the owner seat is holding your customer list, and that should end the conversation.

If you are still deciding on a platform, our Shopify vs WooCommerce comparison covers the trade-off in detail.

Stripe is a payment processor: it takes card details on a page your site never sees, charges the card, and deposits the money in your bank account. Your site needs it only if you actually take money — a deposit, a subscription, a booking fee, a digital product, checkout on a custom store.

This is the one row on the matrix with no variation. A Stripe account is verified against a real legal identity, pays out to a real bank account, and carries the chargeback and tax obligations that come with taking money. It must be opened by your business, in your business’s name, on your banking details. We build the integration using restricted API keys you issue from your own dashboard, and you can revoke them without touching anything else.

Business email — you@yourcompany.com, through Google Workspace or Microsoft 365 — is yours without qualification. It is the recovery address for every other account on this page, which makes it the single worst thing to have sitting inside somebody else’s tenancy.

Transactional email is different: the automated mail your website sends. A contact-form notification, an order confirmation, a password reset. Those go through a delivery service such as Resend or Postmark, because mail sent straight from a web server lands in spam. Free tiers usually cover a small business’s form volume entirely.

Whoever holds that account, the SPF, DKIM and DMARC records go in your DNS — they are what let receiving servers confirm the mail is genuinely from your domain, and they are the difference between arriving and being filtered.

Google Analytics 4 measures what visitors do. Google Search Console shows what people searched before they arrived, and what Google thinks of your pages. Microsoft Clarity records sessions and heatmaps. Google Ads spends your money. Google Business Profile is your listing in Maps and the local pack.

All of them except Ads are free, and every one of them accumulates history that cannot be recreated later. They are also the accounts most often lost, because they are the easiest to create in a hurry under whichever Google login happened to be open. Create them under your business account, then invite your agency: Administrator in Analytics, a delegated Full user in Search Console, Manager access on Ads and on your Business Profile.

One technical detail worth insisting on: verify Search Console with a DNS record rather than an uploaded file or a tag in the page. File and tag verification break the moment the site is rebuilt. DNS verification survives it.