Why Cloud Account Ownership Matters More Than You Think

Ownership sounds like paperwork. It is actually the thing that decides, at
the worst possible moment, whether you can get your infrastructure back. Every
consequence below follows from one fact: the provider’s relationship is with the
registered account holder, and with nobody else.

What ownership determines

Who support will deal with. Providers verify identity before
making account changes. If you are not the registered holder and cannot satisfy
those checks, support cannot help you, regardless of how clearly you can
demonstrate that you are the one actually running the infrastructure.

Who can recover access. Recovery routes to the registered
email address and the registered payment method. Whoever controls those controls
the account, whatever any private arrangement says.

Who controls billing. The holder can change the payment
method, download invoices and close the account.

Who is accountable. If the infrastructure is used for
something that violates the terms, the registered holder answers for it. This
cuts both ways and is worth considering before putting your name on an account
someone else operates.

The three situations where this bites

An employee registered it

Extremely common. Someone created the account quickly to get a project
moving, using their work email and sometimes their personal card. Then they
leave.

If the email address is a company one that still exists, this is usually
recoverable. If they used a personal address, or if multi-factor authentication
is tied to their phone, the company may have production infrastructure it cannot
administer. Transfer ownership to a role-based address and a company payment
method before this becomes urgent, not after.

An agency registered it on a client’s behalf

The agency holds the account, the client believes they own their
infrastructure, and nobody has written down which is true. When the relationship
ends the ambiguity becomes a dispute at exactly the moment goodwill is lowest.

Settle it in the contract at the start. The cleanest arrangement is usually
that the client registers and grants the agency access, which is covered in
which cloud provider for an agency.

The account was bought from someone else

This is the version with no remedy. An account purchased from a third party
is registered to a stranger’s identity and payment method. You hold credentials;
they hold ownership.

Every consequence above now works against you. Support will not deal with
you, because you cannot pass the identity checks. You cannot recover the account
if you lose access, because recovery goes to their email. The original holder
can reclaim or close it at any time. And the provider’s own systems are watching
for exactly this pattern, because usage that does not match the registration
profile is what their fraud detection is built to find. The mechanics are in
why purchased accounts get
suspended.

A point that gets overlooked

Using an account registered to someone else also means your data, and your
clients’ data, sits on infrastructure controlled by an identity you cannot
verify. If that person’s own accounts are compromised, or if they decide to
reclaim what is legally theirs, your systems are exposed through a route you
have no visibility of.

The verification process that providers run exists partly to ensure that the
person using the service is the person who registered it. Buying an account
removes that protection entirely, for you rather than for them.

Getting it right

• Register in the name of the organisation that will own the infrastructure,
  not an individual.
• Use a role-based email address on a domain the organisation controls, with
  more than one person able to read it.
• Use a company payment method rather than a personal card.
• Store the credentials and multi-factor recovery codes in a shared vault with
  documented access.
• Add a secondary contact where the provider supports it.
• Write down who owns which account, and review it when people join or
  leave.

Transferring ownership properly

Most providers support a formal transfer between accounts, and that is the
route to use. It moves the relationship rather than just the password, which
means support, billing and recovery all follow.

Handing over credentials is not a transfer. It leaves the original holder as
the person the provider recognises, which preserves exactly the ambiguity you
were trying to remove.