Free tool

Who holds the keys?

Your web person stops answering. Your bookkeeper quits. Can you still get in? Start with the four systems that would stop the business, check eight more if you like, and see the red flags to fix first.

Runs in your browser. Nothing you enter is sent to us, and there is nothing to sign up for. Privacy

This tool runs in your browser and needs JavaScript. Turn it on for lockhold.com and reload, or read the guide to work it out by hand.

How to read the result

The question is simple: if one person or company disappeared tomorrow, could the business still get in?

The control score runs from 0 to 100. Under 50 is At risk, 50 to 79 is Gaps to close, 80 and up is In control. These bands are our judgment, not an industry standard. With any critical flag still open, the most it can say is Gaps to close.
Critical means someone other than the business controls it and no one else could get in if that person lost their phone or left. That is the one that can stop the business in a day.
High means someone else controls it, or you’re not sure who does. Medium means there is no second way in, or it lives on paper or in someone’s head. Low means it’s spread across tools.
Fix these first puts the worst first, and the systems that would stop the business (bank, website, email, passwords) ahead of the rest. Tick one off when it’s fixed: the answers change to the business as owner with a backup, and the score goes up. Anything left, like a system that still lives on paper, stays on the list.
Not used leaves a system out of the score.

How it’s calculated

Each system scores out of 10: the owner is the business = 5 (one employee = 2, an outside company = 1, not sure = 0); a second person can get in = 3; it lives in one system = 2 (spread across tools = 1, paper or someone’s head = 0).
Bank and payments, website and domain, business email and passwords count double, because losing any of them stops the business.
Score = points ÷ points possible × 100, for the systems you’ve checked.

What it is, and isn’t

A checklist, not a security audit.

It checks who controls each system and whether there is a second way in. It doesn’t test passwords, devices or networks, and it isn’t legal or IT advice. Never type a password into this page, or into any document you print from it.

FAQ

Why does it matter who the owner is, if things work?

Because it works until someone leaves, gets sick or stops answering. Then the business can lose its website, email or bank access in a day. Owning the account, with others as users, costs nothing and prevents that.

My web designer owns the domain. Is that bad?

It’s common, and it’s a risk. The domain should be in an account the business owns, with your designer as a user. They can still do the work.

Why ask about losing a phone?

Because that is how most lockouts happen. The sign-in code goes to one person’s phone or inbox, and when that person is gone, so is the way in. A second admin, or recovery codes kept in the business’s password manager, fixes it.

What is the keys sheet?

A one-page list to keep with your records: each system, who owns it, whether someone else could get in, and a blank to write where the recovery codes are kept. Never the codes or passwords themselves.

Do buyers care about this?

Yes. A buyer will ask who controls the accounts and whether they transfer. The exit readiness score covers the rest of what they ask.

Want the full picture? Read How to document a business, or see all the free tools.

More free tools

Often used with this one

Exit readiness score – Fifteen questions on what a buyer looks at, with your weakest areas and what to fix first.
Owner dependence map – List what you do each week and see the hours only you can do, why, and what to hand off first.

Keep reading