A client asked us something recently that more business owners should ask, and most never do. If our IT company is managing our servers, who actually owns them? Where does our data really live? And if we ever walked away, could we take it all with us tomorrow, or would we be starting over?
Good question. Here is the honest answer, and the plain English version of how it should work.
Three Different Things, Often Treated as One
Managed IT gets talked about as one blob of “the tech stuff,” but it is really three separate layers, and mixing them up is where businesses get stuck.
- The infrastructure. The actual servers, storage, and network, sitting in a data center or cloud somewhere. Somebody’s name is on that account and that bill.
- The management layer. The tools an MSP uses to log in, configure, patch, and monitor that infrastructure. Think of this as the steering wheel, not the car.
- The data. Your files, your customer records, your email, your line of business databases. This should belong to you regardless of who is touching the keyboard.
A good MSP relationship keeps those three things cleanly separated and keeps your name on the parts that matter. A bad one quietly blurs them until the business cannot tell where its own infrastructure stops and the vendor’s begins.
The Question That Actually Matters: Whose Account Is It?
This is the one worth asking directly. When your servers live with a hosting or cloud provider, is that account in your company’s name, on your contract, with your own billing? Or is it inside the MSP’s own reseller account, with your business as one tenant among many?
Both models exist, and both can be run honestly. But only one of them means you can log into that hosting provider tomorrow, on your own, and see exactly what is there. If the account is not in your name, find out in writing what happens the day you decide to leave. A well run setup keeps the hosting account, the domain, and the licenses in the client’s name, with the MSP holding administrative access to manage it, similar to how a bookkeeper might have access to your accounting software without the account itself being theirs.
Root Access, Identity, and the Keys to the Building
Beyond the hosting account, ask who holds the actual admin credentials, and whether you could get them on request without a negotiation. Ask where authentication lives too. Many businesses now run their internal identity system, the thing that decides who can log into what, as its own piece, separate from any single vendor’s tools. That identity layer is arguably more important than any one server, since it is what grants or revokes access to everything else. Know who administers it, and confirm your own team has a real seat at that table, not just the MSP.
What Happens If You Leave
This is the question nobody wants to think about while the relationship is good, which is exactly why it belongs in the contract before it starts. FindLaw’s coverage of vendor data disputes points to a real case worth knowing. A public broadcaster lost access to 50 terabytes of archival footage when its cloud vendor’s business failed, despite believing it owned that data outright. Ownership on paper did not help, because the actual access, the credentials, and the export tools sat with the vendor.
A few things worth having in place before you ever need them:
- A documented export process you have actually tested, not just a clause that says exports are “available on request.”
- An independent backup that does not depend on the MSP’s own tools or account to restore, so a bad breakup does not mean starting from zero.
- A written offboarding process with a real notice period, so a transition happens on a timeline, not overnight.
The Bottom Line
Managed does not mean owned, and it should not. The infrastructure, the account it lives in, and the data on it should stay in your name, with your MSP holding the keys to manage it, not the deed to the building. Ask where the account lives, who holds root, and what the exit actually looks like on paper. If those answers are not clear today, that is worth a conversation now, while it is just a conversation and not an emergency.
Sources:
Comments are closed