Who Holds the Keys? The Owner-vs-Manager Map for Your Marketing Accounts
The holiday-hours surprise
Illustrative scenario, not a client story; results vary.
Picture a roofing contractor in early November. The crews are busy, storm season is coming, and two small jobs land on the owner's list: update the holiday hours on the Google listing, and change the Instagram bio to point people at a storm-season inspection offer. Ten minutes of work, tops.
The Google part goes sideways first. The owner signs in, opens the profile's people settings for the first time in years, and sees their own name listed as a manager. The primary owner is someone else: a freelancer who set the listing up a few years ago, got it verified and live in a week, and has since moved on to other work. Nobody did anything wrong. The freelancer was being helpful, used their own login to get things moving fast, and nobody ever came back to move ownership over.
Then Instagram. The owner goes to change the bio from Meta Business Suite and finds that the Facebook Page and the Instagram account sit inside a business portfolio the contractor can't open at all. It was created by whoever connected the ads years ago.
The holiday hours can probably still go up. A manager can edit most of a profile. But anything that needs the owner's role, like adding the new office manager or removing someone who no longer works with the business, now waits on a reply from someone who has no reason to be watching their inbox for it.
Most owners in the contractor's shoes believe something like this: it has our business name on it, so it's ours. Whoever helps with our marketing just needs the password.
That belief is the problem this post is about. The moment you need owner-level access is the worst possible moment to discover you don't have it: the holiday rush, the storm season, the week you're switching help. And it's almost always discoverable, and fixable, months earlier, on a quiet afternoon, with a list.
The one idea: owning vs. working
Here's the idea the rest of this post builds on. On your Google profile, your Meta accounts and your domain, the business name is a label. The role is what decides who controls it.
Google and Meta both separate two kinds of access, and your domain works on the same principle. One kind can add and remove people: invite a new helper, remove an old one, hand the top role to someone else. The other kind does the work: posts, replies, edits, ads, updates. The first kind is ownership in the practical sense. The second is management. A business can have its name, logo, photos and phone number on a profile and still sit in the second group on its own account.
This matters because the two groups feel identical day to day. A manager can post, reply to reviews and edit hours. You only feel the difference when you need to change who has access, which tends to happen exactly when you're changing help.
A quick note on where this fits. Our earlier post, Project or Retainer? First Ask: Does This Work Have a Finish Line?, was about how to scope marketing work. Who to hire is a separate question. This post is about the step underneath both: whoever you hire, who holds the keys? Get this right and changing help, adding help or taking work back yourself becomes a routine change instead of a scramble.
The next three sections walk the three keys most local businesses depend on, in the platforms' own words: your Google Business Profile, your Meta business portfolio, and your domain.
Google Business Profile: owners, managers, one primary owner
Google's help page on profile roles is unusually clear. About owners, it says: "As the owner, you have full control over the profile. You can add or remove users, manage profile info, and even delete the profile. A Business Profile can have multiple owners but only one primary owner." (Google Business Profile Help, Manage your Business Profile owners & managers)
About managers, the same page says they "have mostly the same access to the profile as owners. The only exception is they can’t add or remove users or remove the profile."
Read those two lines together and you can see why the roofing contractor could edit hours but couldn't add the office manager. Day to day, a manager looks like an owner. At the moment of change, they aren't.
Three more details from that page are worth knowing before you need them:
- New roles come with a wait. When someone becomes an owner or manager, Google says they "have to wait 7 days" before they can manage some features, including deleting the profile, removing other owners or managers, or transferring primary ownership. If you're planning a change of help, the week matters. Start before the busy season, not during it.
- History stays. When a user is removed, Google notes that "their replies to reviews, posts, comments, and other actions stay on the Business Profile." Removing an old helper doesn't wipe the work they did on your behalf.
- One login per person. Google's own tip: "To access and manage Business Profiles without the need to share your password, each user needs their own Google Account." That's the platform telling you passwords aren't how access is meant to work.
If the primary owner is someone outside the business, Google has a process for transferring primary ownership. Google's how-to for transferring primary ownership walks through it. For the roofing contractor, the fix is a friendly request to the freelancer to make the business the primary owner through that process, and then a note on the calendar for the 7-day wait.
The point: if you aren't the primary owner of your own profile, someone else decides who else gets in.
Meta: full control vs. partial access, and the partner trap
Meta organizes Facebook Pages, Instagram accounts and ad accounts inside a business portfolio in Meta Business Suite. Its help center describes access this way: "In Meta Business Suite, there are 2 levels of access: full control and partial access. These levels apply to both business portfolios and business assets in a portfolio, such as Facebook Pages, Instagram accounts and ad accounts." (Meta Business Help Center, About business portfolio and business asset permissions)
And on partial access: "Partial access: People’s permissions are limited to working only on the assets or tasks they’ve been assigned."
That's the owning-vs.-working split again, in Meta's words. Full control is the owner's seat. Partial access is the working seat, limited to whatever the person has been assigned.
The part most owners get wrong is less obvious. Meta's page on assigning assets says: "If a partner (e.g. an agency that you work with) shares a business asset with your organisation, then you're limited to the specific permissions that your partner assigned." The same note continues: "This may prevent you from giving someone full control of that particular business asset." (Meta Business Help Center, Assign business assets to people in your business portfolio)
In plain terms: if your own Page or Instagram account lives in someone else's portfolio and is shared with you, your access is capped at what they assigned. You can't hand out more than you were given.
Illustrative scenario, not a client story; results vary.
A martial arts studio hires a new social media helper for its spring enrollment push. The owner goes into Meta Business Suite to add the helper to the Facebook Page and Instagram account, and can't. The options simply aren't there.
Cause: years ago, a previous partner set up the studio's Page, Instagram and ad account inside the partner's own business portfolio and shared them with the studio. That was a reasonable way to get things running at the time. But it means the studio received partial access to its own assets instead of holding them in a portfolio it controls.
Consequence: every change of help needs the previous partner's cooperation. Even with a perfectly friendly former partner, that's a delay at the exact moment the studio wants to move fast, and it repeats with every new helper.
Fix: the studio holds the Page, the Instagram account and the ad account in its own business portfolio, with full control held by the owner. Each helper, the new social helper included, gets partial access to only the assets and tasks their job needs. Meta's guidance puts it in one line: "Assign only the level of access that people need to complete their work." Getting assets into the studio's own portfolio runs through Meta's own tools and usually needs the current portfolio holder's help, so it's worth asking for while the relationship is warm.
The point: receiving your own assets from a partner feels like having access. It's access with a ceiling someone else set.
The domain: the key under the doormat
Your domain name is the address your website and, often, your business email live on. It's also the account owners think about least, because it was usually bought once, during the original website build, and then renews quietly in the background.
The organization that coordinates the domain name system, ICANN, publishes a plain-language page for domain holders (registrants). It tells registrants they "will assume sole responsibility for the registration and use of your domain name." It asks them to "provide accurate information for publication in directories such as WHOIS, and promptly update this to reflect any changes," and to "respond to inquiries from your Registrar within fifteen (15) days, and keep your Registrar account data current." (ICANN, Registrants' Benefits and Responsibilities)
Notice what that page assumes: that the registrant is reading the registrar's messages and keeping the account details up to date. If the registrar account and contact email belong to someone who isn't watching, that assumption quietly breaks.
Illustrative scenario, not a client story; results vary.
A tutoring center decides to move its website to a new builder before the back-to-school rush. The new site is ready to go. Then the team opens the domain settings and finds the registrar account and the registrant contact are both tied to the email of the web designer who built the original site years ago.
Cause: the domain was bought as part of that first build, under the designer's account, so the site could go live quickly. It was a normal way to get started, and nobody reviewed it afterward.
Consequence: the website move stalls until the registrar account is sorted out. In the meantime, renewal and verification notices go to an inbox nobody at the center reads, which is exactly the situation ICANN's 15-day line warns against.
Fix: the business holds the registrar account and keeps the registrant contact current with an email address the business owns, ideally a role address like an office or admin inbox rather than one person's personal email. Any helper, a web designer included, works from the business's own account instead of holding it.
Marketing Munster is not a law firm; this is practice advice, not legal advice. We're describing what ICANN publishes for registrants and what tends to work in practice, not drawing conclusions about anyone's rights to a particular domain.
The point: whoever holds the registrar account and the registrant contact holds the address your website and email live on.
The rest of the keyring
Google, Meta and the domain are the big three, but a local business usually has more keys than that. Here's the full keyring as a map. Try filling in the "owner" column for your business as you read.
| Account | Who should be the owner | Who gets which role | Where to check |
|---|---|---|---|
| Google Business Profile | The business, as primary owner | Helpers as managers | The profile's people and access settings |
| Meta business portfolio (Page, Instagram, ad accounts) | The business, with full control | Helpers with partial access to only their assets | Business settings in Meta Business Suite |
| Domain registrar | The business's own registrar account | Helpers work from the business's account | Your registrar account and its contact details |
| Website builder | The business's own account | Helpers added as collaborators, not owners | The site's account or team settings |
| CRM (Syndra, our CRM, or whichever you use) | The business, as an admin user | Helpers as users, with only the access their job needs | The CRM's user settings |
| Email sending | The business's own account | Helpers added as users | The email tool's user settings |
| Ad billing / payment method | The business's own card and billing account | Helpers run ads without holding the billing | Billing settings on each ad account |
| Brand folder and design files | A folder the business owns | Helpers get edit access to the folder | The folder's sharing settings |
| Photo and video originals | Storage the business owns | Helpers upload and edit there | The storage's sharing settings |
If a row makes you think "I'd have to ask someone," that's the row to look at first. That's usually where the surprises live.
If that's true for three rows or more, book a free 30-minute Account Access Audit. We'll walk the access screens with you and show you what to fix first.
Onboarding and offboarding as a habit
The keyring doesn't stay tidy on its own. Access drifts a little every time help changes: a new freelancer gets added, a past agency's access lingers, a family member who helped one summer still has a login. None of that is anyone's fault. It's what happens when nobody owns the review.
And more hands are touching more accounts than they used to. LocaliQ reports that "only 34% of the SMBs we surveyed are currently working with at least one" marketing partner, and that of those working with a partner, "nearly 20% are working with four or more—up from 9% last year." (LocaliQ, Big Small Business Marketing Trends Report for 2026, a survey of over 300 small business owners; LocaliQ sells marketing services.) Read it as context, not a forecast: when more hands touch more accounts, the keyring needs a routine.
A routine that works looks like this:
Onboard at the least role. When someone new starts, add them to each account they need, at the lowest role the work requires. Meta's line is the right default everywhere: "Assign only the level of access that people need to complete their work." A social helper needs the social accounts. They probably don't need the domain or ad billing.
One login per person. Every helper uses their own account, never a shared one. Google's tip about each user needing their own Google Account applies in spirit to every platform on the map. Individual logins are also what makes clean offboarding possible: you can remove one person without changing anything for anyone else.
Offboard the same week. When help changes, remove the outgoing person's access that week, then confirm you're still primary owner on Google and still have full control in Meta. Plan around Google's 7-day wait for new owners and managers so an incoming helper isn't stuck during their first week.
Review quarterly, and before any change of help. Put a recurring reminder on the calendar. Open each people/access screen, compare it to the map, and remove anyone who no longer needs to be there. The best time to do it is before you change help, not after.
The point: access drifts every time help changes unless someone owns the review. That someone should be the business.
What to expect from anyone helping, including us
If you're bringing in marketing help, a freelancer, an agency or us, access is a fair thing to judge them on from the very first conversation.
Good help asks to be added, and only where the work is. If the job touches your Google profile, they'll ask you to invite their own login as a manager. If it touches Facebook or Instagram, they'll ask to be added to your Meta business portfolio with access to just those assets. Anywhere else, they'll ask for a user seat of their own. They won't ask for your passwords, and they'll leave you as the owner everywhere. If setting something up under their own login seems faster, good help will tell you so and explain how ownership comes back to you, so the shortcut doesn't become the arrangement.
That's also why partners who refer clients to us can count on the client keeping the keys.
A word of honesty about the hard cases. If an account truly can't be reached, because the original owner can't be found or a login is gone, the way back runs through each platform's own process. It can take time, and nobody, Marketing Munster included, can promise how it turns out. That's the strongest reason to map your keyring while everyone is still reachable and on good terms.
Here's the idea in one paragraph, worth keeping:
The name on the profile isn't ownership. The role is. Hold the owner role everywhere, hand out only the roles the work needs, and changing help never means losing your listing, your page or your domain.
Access hygiene isn't an afterthought to marketing work. It's the first deliverable of any engagement, whoever does it.
The checklist
- Find the people/access screen on every account and write down the owner by name: Google profile, Meta portfolio, domain registrar, website builder, CRM, email sending and ad billing. Why: you can't fix a row you haven't looked at.
- Be the primary owner on your Google Business Profile. Helpers can be managers. Why: managers can do almost everything except add or remove users or remove the profile.
- Hold full control of your Meta business portfolio, with the Page, Instagram and ad accounts inside it, and give helpers partial access to only what the job needs. Why: assets shared to you by a partner come with a ceiling someone else set.
- Own the domain registrar account and keep the registrant contact on an inbox the business controls. Why: renewal and verification notices need to reach someone who'll act on them.
- Never share passwords. Each helper gets their own login and role. Why: individual logins are what let you remove one person cleanly, and it's how the platforms are built to work.
- Onboard at the least role, offboard the same week. When help changes, remove access promptly and confirm you're still primary owner and full control everywhere. Why: lingering access is how keyrings drift, and Google's 7-day wait rewards planning ahead.
- Review access quarterly, and before any change of help, not after. Why: a review on a quiet afternoon beats a discovery in the middle of a busy season.
- Judge any help, us included, by whether they ask to be added instead of handed passwords, and whether you stay the owner. Why: fast setup under someone else's login is a cost you pay later.
Here's where Marketing Munster fits. Websites and social media are services we offer, along with design and video, consulting, and Syndra, our CRM, on one-off projects or ongoing retainers. The Account Access Audit is consulting: we map who owns and who manages each of your marketing accounts and what to fix first, before any other work starts.
A note on the examples: The roofing contractor, martial arts studio and tutoring center scenarios in this post are illustrative, not client stories, and results vary. Nothing here suggests any real vendor, freelancer or agency did something wrong. Quotes from Google, Meta and ICANN are from their public help pages, and the LocaliQ figures describe the businesses LocaliQ surveyed, not Marketing Munster or its clients. Marketing Munster is not a law firm; this is practice advice, not legal advice, and nothing in this post is a promise that any account can be transferred or restored.
Bring a list of your marketing accounts to a free 30-minute Account Access Audit. No passwords needed: you stay signed in, and we look at the access screens together. We'll map who owns and who manages each one (Google profile, Meta, domain, website, CRM) and what to fix first, so you leave holding the keys, whether or not we work together.