How to Part Ways With an AI Contractor Without Losing Your Domain, Your Data, or Your Weekend

I spent 25 years in IT and security before I built a single AI system. A large part of that time was walking into environments that someone else controlled and making them safe for the people who actually owned them. Terminated administrators. Departed contractors. Managed service providers who did not want to be replaced. The shape of the problem never changed, and it has not changed now that the contractor is building AI agents instead of managing servers.

That is what I told a client in August, and it is the whole playbook in one sentence. Here is the sentence expanded into steps, in the order they have to happen.

Step 1: Inventory from your sent folder

You do not remember everything you gave them. Nobody does. You remember the big ones, the website login and the CRM, and you forget the one-time passcode you read them over the phone for Facebook, the Google Drive folder you shared, the GoDaddy invitation you accepted without reading.

Search your sent mail and your texts for the contractor's name. Forward every message that contains a login, an invitation, a code, or a link to something. Put them in one list with three columns: the account, what kind of access, and whether it lives on your platform or theirs.

In the August case this exercise found a GoDaddy API key nobody had thought about. Changing the GoDaddy password would not have revoked it. The developer, to his credit, mentioned it on the call. A client alone would not have known to ask.

Step 2: Sort by ownership, and back up what is theirs

Every item is one of three things. Yours: they have a login to an account you own. Theirs: the thing runs on their Render, their Cloudflare, their GitHub, their Google Sheet. Unknown: you cannot tell.

Yours can be locked down whenever you decide. Theirs is the dangerous category, because a person who feels cut off can delete a project in thirty seconds, and then the argument is about something that no longer exists. Get a backup of anything on their platforms before anyone is told anything. If you cannot get a backup without them, that becomes the first item on the handoff list, and payment waits for it.

Step 3: Lock down in the right order

The order is not arbitrary. Whoever controls the domain controls the website, the email, and every subdomain. So:

1. Domain registrar (GoDaddy, Namecheap, Google Domains). Password, two-factor, and any API keys or delegate access.
2. DNS if it is separate (Cloudflare). Remove their membership from your account. If the zone is on their account, that is a backup-first item.
3. Hosting and cloud (your Render, your AWS, your Vercel). Remove users, rotate deploy keys.
4. Google Workspace or Microsoft 365 admin. Remove delegated access, shared drives, and any OAuth apps they connected.
5. Email marketing and CRM (Mailchimp, JobTread, HubSpot, GoHighLevel). Passwords and API keys, both.
6. Social. Remove them from Meta Business Manager, and remove any one-time passcode device or recovery method that is not yours.
7. Accounting and payments. If you gave QuickBooks or Stripe access, this is where you find out whether you should have.
8. AI accounts and keys. OpenAI, Anthropic, ElevenLabs. Rotate every key. A key in their code keeps working after you change the password.

Do this on a screen share with someone who has done it before. It takes about an hour and the mistakes are not recoverable.

Step 4: Draft the handoff, and structure the payment

The message should be short, calm, and specific. Credentials have been changed. Here is the list of what needs to be transferred. Michael, or whoever you have brought in, will confirm on a call. Payment goes out the moment it is confirmed.

Pay on handoff is the structure that gets the fastest, cleanest result. It is also the fairest. The contractor is not being asked to trust you, and you are not being asked to trust them. In the August case the client had the payment ready before the call started, and sent it within an hour of the repository arriving.

Step 5: Run the call with a professional on it

Do not make this call yourself. Emotion is already in the text thread, and you cannot verify what you are being handed. The person on the call needs to be able to open a repository and know what they are looking at, ask where each piece actually runs, and notice the API key that did not come up.

The tone matters as much as the checklist. I open by saying what was done well, because something always was, and by saying plainly that the person did nothing wrong if that is true. Then I ask for the repo, the cloud projects, the exports, and anything that still holds a key. Then I confirm subscriptions are cancelled. In August the developer and I ended the call by booking coffee. That does not happen when the client makes the call.

Step 6: Rebuild on accounts you own, with the keys visible

Whatever was worth keeping gets recreated under your name. Whatever was information in a new place gets replaced with something that acts. And every system I build now ships with a page inside it that lists every account, every key, every connection, and who holds it, so that the next handoff, if there ever is one, is a formality.

The full sequence, with the intake form that starts it, is on the takeover page. The one-day version of it is the $900 Handoff case study.