The instinct is to change every password at midnight and send a short email in the morning. Sometimes that is exactly right. But a takeover has the same shape as terminating an employee who holds privileged access, and that has a playbook for a reason.

"This is very similar to an employee being terminated who has access to privileged information. We want to make sure we have everything that they have access to, make sure they don't destroy anything, change anything, and make sure that we have complete access and control over everything."

Michael Bowers, Heed AI Solutions

Three things go wrong when the order is wrong. First, anything hosted on the vendor's own accounts (their Render, their Cloudflare, their GitHub, their Google Sheet) disappears the moment they feel cut off, and you have no backup. Second, API keys that live inside their code keep working after you change the password, so the lockdown you think you did is not the lockdown you did. Third, an angry vendor holds the handoff hostage over the invoice, and now you are paying a lawyer to get a spreadsheet.

"As long as I get a backup of it, I can recreate it and then we can rebuild your platforms under your name and your control. That's really what I want to aim for: get the backup first."

Michael Bowers

So the sequence is: inventory, back up, lock down what is yours, then the call, then payment. Every step is done with you, on screen share, and written down.