How do I hand over a SaaS product’s server logins and admin accounts safely?

Start with the inventory. Include hosting, the domain registrar, code storage, the database, payments, email sending, monitoring, customer support tools and any shared password store. Mark who is the legal account holder for each. Accounts held in a former employee’s name or the seller’s personal email are the ones that cause the longest delays.

Plan the handover in stages. Before closing, give the buyer read-only or limited access if they need to verify things. At closing, transfer ownership and add the buyer’s administrators. Use a password manager’s sharing feature or an in-person exchange instead of pasting secrets into a message. Turn on two-step sign-in for every account and keep recovery details with the new owner.

Then rotate everything. Replace passwords, server keys, API keys and tokens embedded in code, and check automated jobs that still use the old ones. Review the list of people with access and remove contractors who no longer need it. Your own login comes off last, after the buyer confirms every system works. Keep a dated log of who changed what, and give a copy to the buyer at the end.

Key takeaways

• Inventory every account and who actually holds it.
• Hand over in stages and rotate every secret afterward.
• Remove your own access last, after the buyer confirms it works.
• Keep a dated log of each change as evidence.