Why the sentence alone is not enough
If an agency's site says you own the code, that line sits on a sales page, and a sales page is not your agreement. What counts is what the signed paper says.
Under US copyright law, copyright in a work starts with the person who made it, its author. So unless something else is signed, the business that paid for the code is not its author, and does not start out owning the copyright.
The law names two ways to change that. The first is a work made for hire. When a work is a work made for hire, the person it was made for is treated as its author. A commissioned work counts as one only if it falls in a short list of kinds the law names, such as a contribution to a collective work or a translation, and both sides sign a writing that says so.
The second way is a transfer. A transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights being transferred.
So the words work for hire in a contract may not carry the weight people expect. The agreement should also carry a signed written transfer of the copyright to your business. If your site is a big part of how you make money, ask a lawyer to read that clause before you sign.
The code sits in an account you control
Owning the copyright is half of it. The other half is being able to reach the code and move it when you want to.
Take GitHub as an example of where code can sit. On GitHub, only someone with administrator access to a repository can transfer it to a new owner. GitHub's page on transferring a repository spells this out.
That tells you what to ask for. Either the repository lives in an account your business owns, or you hold administrator access to it from the start. If only the agency holds that access, moving the code depends on them, whatever the sales page says.
When a transfer does happen, the new owner can manage the contents, issues, releases and settings right away, and the commit history comes along. That history is the record of past changes to the code.
The domain is registered in your name
ICANN calls the person or business that holds the rights to a domain name the registrant. ICANN advises against listing a website designer, a hosting provider or any other third party as the registrant of your domain.
ICANN also tells registrants they carry sole responsibility for the registration and use of their domain name. That cuts both ways.
The hosting account is yours too
Hosting is where the site runs, and the same idea applies. The account should be in your business's name, with the agency added as a member.
Vercel is one hosting service, and its docs show why this matters. On Vercel, moving a project to another team requires being an owner of the team the project sits in now. If the agency owns that team, the move waits on them.
Vercel's docs also say some things do not move with a transferred project: connected integrations have to be added again afterward, and log data stays behind. A move after the fact is real work, even when everyone is helpful. Starting in your own account skips it.
When you and the agency part ways
Write the exit into the agreement before you need it. A good clause says what you get and by when.
The copyright part should already be settled, because a transfer only counts once it is in writing and signed. Then come the accounts. If the code sits in an agency account, the clause should say it moves to yours, with its history. If the hosting moves, the clause should say who adds the integrations back.
The domain has its own route. ICANN says moving your domain to another registrar is your right, and your registrar must give you the transfer code, called the AuthInfo code, within five calendar days of your request. ICANN's FAQs for registrants on transferring a domain cover this.
That right helps most when you are already the registrant. Nothing in this section should depend on goodwill at the end.
What to do
- Find the ownership clause in your web agreement. Look for a signed written transfer of the copyright to your business, not only the words work for hire.
- Log in to your domain registrar and check who is listed as the registrant. If it is your designer or your host, ask them to change it to your business.
- Ask who has administrator access to the code. If it is not you, ask for that access, or for the code to move to an account you own.
- Check that the hosting account is in your business's name, with the agency as a member.
- Save the steps for asking your registrar for the AuthInfo code next to your agreement.
- If the site carries a big share of your business, have a lawyer read the ownership clause before you sign.
On the websites we build, you own the code and the accounts from the first day, and the guide to what you own the code means sets out the details.