Why we hand over the keys on day one, not day eighty

The default most agencies use

The standard agency move is to hold the code on their own GitHub org, the deploys on their own Vercel account, and the env vars in a 1Password vault that only the project manager can see. The handover happens at the end — sometimes well, sometimes never.

It's framed as 'we'll take care of everything for you.' What it actually does is make the client a tenant on their own product. If the relationship sours, or the agency goes quiet, the founder is left negotiating for access to software they paid for.

What we do instead

On day one, before any code is written, we set up:

• A GitHub repo in the client's org, not ours
• Deployments wired to the client's Vercel or AWS account
• Env vars stored where the client's team can see them
• A single shared doc with every URL, login, and recovery contact

We push to that repo. We deploy to that account. The client's engineers — if they have any — can read every commit as it lands. If they don't yet, the audit trail is ready for the day they hire one.

Why it works

It removes the worst version of the trust problem. A client who knows they can fire us at any moment without losing their software treats us like a partner instead of a hostage situation. The relationship gets healthier, not weaker.

It forces good hygiene. When the client can read your commits in real time, you stop pushing `wip wip wip` and start writing messages a stranger could follow. The bar goes up on its own.

It eliminates the 'handover sprint.' The handover is just… the work. There's no two-week migration at the end where we re-export everything into the client's accounts and pray the env vars line up. The accounts were always theirs.

What people worry about

Some founders push back: 'won't a non-technical client be overwhelmed by the access?' They might be on day one. By week four, they're forwarding the staging URL to a friend without asking us. It turns out people figure their own software out quickly when you stop hiding it from them.

The other worry is on our side — that giving up the accounts gives up leverage. We don't want leverage. We want clients who keep working with us because the work is good, not because they can't leave.

The lesson

The keys aren't a deliverable. They're a starting condition. If you can't comfortably hand them over on day one, the relationship is built on something other than the quality of the work — and that's the thing to fix, not the access policy.