The Folder Nobody Wants to Build (Until They Need It): Your Digital Handover File

It's a Tuesday morning and you're not at your desk. Maybe it's the flu that's been doing the rounds, maybe it's a week in Cornwall you booked back in January, or maybe it's something more sudden. Either way, the phone still rings, a customer wants a refund, and the website has picked today to need a plugin update.

If the only person who can get into your domain registrar, your hosting control panel or your payment provider is you — and you're currently horizontal — your business has a problem that has nothing to do with cash flow.

Resilience, not red tape

Digital handover files tend to get filed mentally alongside insurance renewals and fire extinguisher checks: things you're told to do and quietly never get round to. But this one isn't box-ticking. It's the difference between a bad week and a bad quarter.

For a lot of UK small businesses — sole traders, two-person limited companies, three-person agencies — the operation effectively lives in one person's head and one person's browser. That's fine until it isn't. A handover file is simply the written version of everything you'd tell someone if you had ten minutes to brief them before disappearing.

What actually needs to be in it

Start with a plain list of every account that touches money, customers or the website itself. For most small businesses, that looks something like this:

• Domain names. Where they're registered (123-reg, GoDaddy, Cloudflare, names.co.uk and so on), the renewal date, and whether a transfer lock is switched on. For .co.uk domains, your registrar is usually a Nominet member — worth noting alongside the login.
• Hosting and DNS. Who runs the server, where the nameservers point, and how to raise a support ticket if the site goes down.
• Website admin. The CMS login (WordPress, Squarespace, Shopify), the dashboard URL, and any theme or plugin licences tied to your account rather than the site.
• Email. The mailbox provider, the admin console, and where the DNS records (SPF, DKIM, DMARC) live. If email breaks, most businesses feel it within the hour.
• Analytics and search. Google Analytics, Search Console, Google Business Profile, Bing Webmaster Tools.
• Payments. Stripe, GoCardless, Worldpay, PayPal, plus your bank's online banking portal.
• Finance and compliance. Accounting software (Xero, Sage, QuickBooks), HMRC gateway credentials, and your Companies House sign-in if you're a limited company.
• Suppliers worth naming. Royal Mail Click & Drop, your courier account, the card machine provider, the printer who holds your artwork.

That's the inventory. It should fit on one side of A4.

The bit people get wrong: access

The list is the easy part. The harder part is making sure the access is arranged so somebody else can actually use it, without you having to relay codes down the phone from a hospital bed.

A few ground rules worth adopting:

• Use a proper password manager. Bitwarden, 1Password, Dashlane — any of them will do. A spreadsheet called passwords.xlsx on the shared drive is not a password manager; it's a liability wearing a lanyard.
• Keep business accounts in the business name. If your Stripe account is tied to a personal Gmail address nobody else can reach, that's a future problem in a trench coat.
• Store two-factor recovery codes separately. The authenticator app is on your phone. If the phone is lost or broken, the recovery codes are what save the day — print them or keep them in the vault.
• Limit admin rights. Most day-to-day work doesn't need full administrator access. Give the minimum that gets the job done.
• Name a deputy. One person, briefed in advance, who knows the file exists and where to find it.

Where to keep it, and who gets to see it

Encrypted vault first, then a one-page note explaining where the vault is and how to get into it. That note is what you hand to a business partner, a trusted employee, or your accountant. Some businesses keep a sealed copy with their solicitor; for most small firms that's overkill, but a sealed envelope in the office safe is a reasonable middle ground.

If you hold customer data, it's worth a quick read of the ICO's guidance on security — a handover file that's protected properly is part of taking care of that data, not a workaround for it.

A 30-minute starting plan

You don't need a project. You need three short sittings.

Minutes 0–10: list. Open a blank document and write down every account you can think of that touches the business. Don't worry about order, just get them out of your head.

Minutes 10–20: consolidate. Move the five most critical logins — domain, hosting, email admin, payments, accounting — into a password manager and reset the passwords on the way in. That alone removes most of the risk.

Minutes 20–30: write the one-pager. Where the vault lives, who can access it, which suppliers to call first, and what to do if the website falls over. Two paragraphs is plenty.

Then don't let it rot

A handover file that hasn't been opened since you built it is only marginally better than no file at all. Diarise a quarterly review — the same way you'd check the smoke alarms — and update it whenever you change a supplier, a domain or a bank. It doubles as an onboarding document for new staff, which makes it far easier to justify the effort.

The point isn't to plan for disaster. It's to make sure that a normal, boring, inconvenient week doesn't turn into a crisis because the keys to the kingdom are in one person's pocket.