Which Accounts a Founder Must Own Before the MVP Build Starts

Before any developer writes a line of code, the founder should personally open seven accounts: the domain, the hosting account, the code repository, the payment processor, the app store developer accounts, the business email, and analytics. Each one should be registered to an email address on a domain you control, protected by two-factor authentication on your own phone, and stored in a password manager you own. The agency gets invited in as a member with a limited role, never as the owner. This takes about two hours and under $200 in 2026, and it is the difference between owning your product and renting it from the people who built it. Below is the list, who opens each account, what it costs, and exactly how an agency-owned account turns into a hostage situation when the relationship goes wrong.

Set up the founder identity first (30 minutes)

Every other account will send its password resets, security alerts and billing receipts to one mailbox. Whoever controls that mailbox controls everything downstream, so it comes first.

1. Buy the domain yourself (10 minutes, $10-20 a year for a .com). Use any mainstream registrar, pay with your own card, and turn on auto-renew. A domain bought on the agency's registrar account is legally theirs: the registrant of record is whoever the registrar's account belongs to.
2. Create a business mailbox on that domain (15 minutes, about $7 a month). Google Workspace Business Starter is $7 per user per month on an annual plan; Microsoft 365 Business Basic is $6. Use something like founder@yourcompany.com, not a personal Gmail, and not a shared address the agency can read.
3. Open a password manager (5 minutes, $0-8 a month). Bitwarden has a free tier; 1Password Business is about $8 per user per month. Every account below goes into it, and you share individual items with the build team instead of pasting passwords into chat.
4. Turn on two-factor authentication with your phone number or an authenticator app you own. Never let the agency's phone be the second factor on your accounts. If a service offers backup codes, store them in the password manager.

The seven accounts, who opens them, and what they cost in 2026

The table is the whole article in one glance. The "who opens" column is the same on every row for a reason.

Add it up: a .com, the Apple fee, the Google fee and the first month of a mailbox come to roughly $150-170 before the build starts. Everything else is free until real users show up. The free MVP cost calculator estimates the build itself; the accounts above are the part of the budget no quote includes, because they are yours, not the vendor's.

Domain and hosting: the two accounts that lock in everything else

Domain and DNS

Your domain is the one asset no one else can rebuild for you. Customers, search rankings, email reputation and every link you ever share point at it. Three facts matter when a vendor offers to "handle" it:

• ICANN rules block a transfer to another registrar for 60 days after the domain is registered or last transferred. If the agency registered it in week one and you fall out in week six, you wait.
• The registrant of record is the registrar account holder, and registrars will not move a domain on your say-so if the account is not yours. Some will after a formal dispute, which takes weeks and paperwork.
• DNS is where the website, the email, and the verification records for Google, Apple and Stripe all live. If DNS sits in the agency's Cloudflare account, every one of those depends on their goodwill.

The clean setup: you own the registrar account and a free Cloudflare account, DNS is pointed at Cloudflare, and the developers are invited as members of your Cloudflare account to add the records they need. You can see every record they add and remove them in one click.

Hosting and the cloud account

Hosting is where the application and, more importantly, the database live. In 2026 most MVPs run on a platform like Vercel or Render for the app ($0-25 a month to start) plus a managed database such as Supabase or Neon ($0-25 a month), or on AWS for anything heavier ($20-150 a month at MVP scale). Our guide to choosing a hosting provider compares them; whatever you pick, the billing account is opened by you, with your card.

The reason is the database. If the agency's AWS account is suspended for an unpaid bill or closed after a dispute, your app goes dark and the customer data goes with it. You can rebuild code from a repository. You cannot rebuild six months of user records that lived in someone else's account.

Payments and app stores: the accounts you legally cannot delegate

Stripe (or any payment processor)

A Stripe account is tied to a legal entity, its tax ID and a bank account. Stripe does not transfer accounts between entities. If the agency opens it, the money from your customers lands in the agency's bank, your subscriptions are contracts between your customers and the agency's account, and the saved cards are stored under their account. Getting out means opening your own account and asking Stripe to migrate the card data, which requires a written request from both sides and typically takes two to four weeks, during which active subscriptions have to be recreated.

Open it yourself before the kickoff. You need your company details, an EIN or equivalent tax number, and a bank account; most founders finish in 20 minutes. Then invite the developers with the Developer role, which gives them API keys and webhooks but no access to payouts or bank details. Stripe charges nothing monthly, so there is no reason to wait. The practical setup is covered in how to add payments to your MVP.

Apple Developer Program and Google Play Console

If the MVP is a mobile app, the store accounts decide who the app belongs to in the eyes of the platform, and they are the slowest accounts to open, so start them first.

• Apple costs $99 a year. Enrolling as an organization requires a D-U-N-S number, which is free but can take 5-30 days to issue and verify. The person enrolling must have legal authority to bind the company. Enrolling as an individual is faster but puts your personal name on the App Store listing and makes a later transfer to the company harder.
• Google Play is a one-time $25. Organization accounts also need a D-U-N-S number. New personal accounts must run a closed test with at least 12 testers for 14 days before they can publish to production, which is another reason to open the account weeks before launch day.

An app published under the agency's developer account carries their name on the store page, and its reviews, ratings, install history and subscribers are attached to that account. Apple does allow an app transfer between accounts, but only when the current owner initiates it, and apps using certain services cannot be transferred at all. Google allows a transfer by form, again only with the original owner's cooperation. Open your own accounts, then add the developers with the App Manager role on App Store Connect and the equivalent release permission on Play Console.

Email, analytics and the small services that quietly matter

These are cheap and easy to overlook, and each one is a small hostage waiting to happen.

• Transactional email (password resets, receipts). Resend, Postmark or SendGrid cost $0-20 a month at MVP volume. The DNS records that authorize sending live on your domain, and the sender reputation belongs to the account that sent the mail, so that account must be yours.
• Google Analytics 4 and Search Console. Both free. Create the property under your Workspace account and give the agency the Editor role. Agencies routinely create GA4 properties under their own account, and when you part ways your traffic history stays with them.
• Error tracking and uptime. Sentry has a free developer tier and a Team plan at about $26 a month; uptime monitors are $0-10 a month. These are the alarms that say the product is down, and they should reach your inbox.
• Third-party API keys: AI model providers, maps, SMS. Pay-as-you-go, billed to your card. A key on the agency's account stops working the day they stop paying, and the usage history you need to forecast costs is invisible to you.
• Social handles that match the domain. Free, five minutes, and impossible to recover from a stranger later.

How agency-owned accounts become hostage situations

Nobody plans a hostage situation. It happens because opening accounts is a chore, the agency offers to do it, and nothing goes wrong until something else goes wrong. Three patterns cover most of the cases we have seen or been told about.

The disputed final invoice

The build runs long, scope is argued over, and the founder withholds the last payment. The agency, holding the domain, the hosting and the repository, replies that access will be restored when the invoice is settled. Both sides may even be right on the merits; the founder still has no product until they pay. With the accounts in your name, a billing dispute stays a billing dispute, and switching developers mid-project is a matter of revoking access and inviting the next team.

The agency that disappears

Small studios close, freelancers change careers, your point of contact leaves and nobody else has the login. The domain lapses because the renewal notice went to a mailbox no one reads; the hosting account is suspended for a declined card. There is no villain, just an app that stops working with no one to call. Auto-renew on your own card prevents the whole category.

The slow, polite ransom

The most common version has no drama at all. The agency owns the accounts, so every change needs them. A DNS record for your new email tool, a Stripe webhook, a build upload to the App Store: each is a ticket, a wait, and often a small invoice. You keep paying a retainer not because the work needs them but because the access does, and you only notice when a second vendor quotes for a change and cannot get in.

The fix for all three is the same and it is cheap: you open the accounts, you own them, you invite the team in. Put it in the contract too. What to put in a development contract covers the clause: every account is registered to the client, the vendor gets member access, and no vendor-owned account is used in production.

Giving the build team access without giving up ownership

Developers need real access to do the job. Every platform in the table has a role that gives them the work surface without the keys, and each takes a minute to set up.

• Registrar and Cloudflare: member with DNS edit rights. The registrar login stays with you.
• Vercel, Render, Supabase: invite them to your team. You stay owner; they get Member or Developer.
• AWS: an IAM user or role scoped to the project. Root credentials never leave your password manager.
• GitHub: you create the organization and the repository, then add the developers as collaborators with write access. If they started in their own repository, have it transferred to your organization on day one, not at handover.
• Stripe: Developer role. Products, keys and webhooks, but no bank details or payouts.
• App Store Connect and Play Console: App Manager (Apple) and release permissions (Google). They can upload and submit; they cannot remove you or transfer the app.
• GA4, Search Console, Sentry: Editor or Member. Never Owner.

Keep a one-page access register (account, role, person, date). On handover day, remove every entry and rotate any API key the team generated. Our MVP handover checklist lists what to collect before you revoke anything.

If the agency already owns something: the transfer order

If you are reading this mid-project, do the transfers in this order, and do them before the final payment while both sides are still motivated.

1. Email first. If the agency created your Workspace or the mailbox the other accounts are registered to, get super-admin on it transferred to you today. Every other recovery flow depends on it.
2. Domain. Ask for an account-to-account push if you both use the same registrar (minutes) or the authorization code and an unlock for a transfer (5-7 days, and only after the 60-day window). Move DNS to your Cloudflare account at the same time.
3. Code repository. GitHub has a built-in transfer that moves the repository, its history and issues to your organization in one step.
4. Hosting. Vercel and Render can transfer a project between teams. On AWS there is no transfer; the practical route is to export the database, deploy from your repository into your own account, and switch DNS.
5. Stripe. Open your account, then have both sides request a card data migration from Stripe support. Plan two to four weeks and recreate subscriptions.
6. App stores. Apple App Transfer and Google Play app transfer, both initiated by the current owner. Check Apple's transfer restrictions before you assume it is possible.
7. Everything else. Add yourself as Owner on GA4, Search Console, Sentry and the email sending service, then downgrade or remove the agency.

Close it with one written message listing every account now in your name and asking the agency to confirm nothing remains in theirs. Keep that reply. At SquadPrime we ask for exactly this setup before a build begins: the founder opens the accounts, the senior professionals on our team work inside them, and on delivery 100% of the code is yours and nothing of yours lives in an account we control. The kickoff call checklist includes the account list so the two hours are done before day one.

FAQ

Which email should I use to open the accounts for my MVP?

Use a mailbox on your own domain that only you control, such as founder@yourcompany.com in Google Workspace or Microsoft 365. Never use an address the agency created, and never share a personal Gmail with the build team. Set the recovery phone to your own number, and keep your personal address only as the recovery email for the Workspace account itself.

Can my agency open the accounts and transfer them to me later?

For most accounts yes, but every transfer costs time and some are painful. A domain cannot be transferred to another registrar for 60 days after registration, a Stripe account cannot change its legal owner at all, and an Apple app transfer needs the current owner to initiate it. Opening the accounts yourself takes about two hours and avoids every one of those problems.

What does it cost to own all the accounts myself?

Under 200 dollars up front in 2026. A .com domain is 10 to 20 dollars a year, the Apple Developer Program is 99 dollars a year, Google Play is a one-time 25 dollars, and a business mailbox is about 7 dollars a month. Hosting, Stripe, GitHub and analytics all start at zero and only charge as real usage grows.

How do I give developers access without handing over ownership?

Invite them as a member with a limited role instead of sharing your password. Vercel and Render have team members, AWS has IAM users, Stripe has a Developer role, App Store Connect has an App Manager role, and GitHub has collaborators. You remain the owner or administrator on every account, and on handover day you remove their access in about five minutes.

What if the agency already registered my domain or opened Stripe in their name?

Ask for the transfer in writing before you make the final payment, while you still have leverage. For the domain, request an account-to-account push at the same registrar or the authorization code for a transfer. For Stripe, open your own account now and ask them to request a card data migration into it. Then close the handover with a written confirmation that no account remains in their name.

All third-party names and trademarks belong to their respective owners and are used for identification only. Any market figures reflect our experience building MVPs and typical ranges as of October 12, 2026, and may change at any time. Spotted something outdated or inaccurate? Email talk@squadprime.com and we'll correct it promptly.

Related: The MVP Handover Checklist · Who Owns the Code When You Hire a Dev Agency?