Site Ownership when webmaster splits

[handsonhosting]

Up for discussion;

• Person 1 owns a company
• Person 2 is an employee of Company (their webmaster)
• Person 1 owns company domain name & registered in their name
• Person 2 registers for web hosting in their name (with domain of company.com)
• Person 1 has paid all invoices over the previous year via Credit Card (can provide bank statements)
• Person 2 is terminated from company
• Person 1 now wants his files, servers and contact information changed
• Person 2 claims the site, files & work is his

So, here's the question - who do you give the access & files to?

This is a situation that is commonly faced, especially in the web design world when the owner of a company fails to pay for design created by the designer. Often times a designer will register web hosting for the client, configure the site, and when everything is paid for, they transfer the ownership information to their client. But what happens when the client says they own the site and the webmaster says that they own it?

The owner of the company wants everything transferred into their name (billing info, site access, server passwords etc). The webmaster claims the site is theirs, and all contact information is in their name. The webmaster did provide access to the company owner, however has since logged in and changed all access since they have left from the company.

We have been in this situation in the past, it's rare, but it's happened. Are you prepared on how to handle this? Have you outlined anything in your TOS or AUP regarding such situations?

How would you handle this situation if it was presented to you today?
This is a discussion scenario to help better equip new hosting company owners. For the purposes of this discussion I will act as both the owner & the webmaster. Feel free to ask any additional questions you feel might help you to determine an answer.

 

[SenseiSteve]

Very interesting scenario, Conor. Person 2 created the website as an employee of Person 1, so the rightful owner of the site and it's data belongs to Person 1.

And yes, we have guidelines to cover this.

First, the employee is not allowed to register for web hosting in their name. It has to be registered in the Company's name, and all user names and passwords must be on file with the company.

After an employee has been terminated, any attempt to access company owned sites places them at risk of criminal prosecution.

 

[easyhostmedia]

you never stated if person 1 or person 2 designed the website.

also a webhost only has to give web access to the account holder in this case person 2 as they regsitered the hosting in their name.

 

[handsonhosting]

Very interesting scenario, Conor. Person 2 created the website as an employee of Person 1, so the rightful owner of the site and it's data belongs to Person 1.

And if Person 2 claims the content is theirs and was done as a "partner" type scenario - does the position change?

you never stated if person 1 or person 2 designed the website.

For this purpose, lets assume you actually don't know the true answer on this. Person 2 says they designed it. Person 1 says that it was designed and they own it.

We're not talking about copyright of information, only the role of the web hosting company. If there's a legal claim on copyright, then that's a whole separate area - much like the breach of access would involve law enforcement etc.

In this case we're strictly looking at it from a web hosting companies point of view. All contact information in the billing system has Person 2's information. The only information that Person 1 has is a credit card that recurs billing.

Any changes on stance given the new information?

Status:
Hosting company should only deal with Person 1 = 1 vote
Hosting company should only deal with Person 2 = 1 vote

 

[easyhostmedia]

Most hosts will only deal with whoever the account with them is under which in this instance

Person 2 registers for web hosting in their name (with domain of company.com)
All contact information in the billing system has Person 2's information.

so it is person 2 who they will only deal with

 

[SenseiSteve]

Was there a partnership agreement in writing, or communications to that effect, such as emails between the two? In the absence of that, Person 1 still owns the site and data.

 

[easyhostmedia]

Was there a partnership agreement in writing, or communications to that effect, such as emails between the two? In the absence of that, Person 1 still owns the site and data.

maybe, but as it stands it is person2 who is the only details the host has so the host will only deal with person2

 

[SenseiSteve]

Well, fortunately we have legal counsel, so I don't have to make those decisions. I still believe if this went to court, as originally stated, Person 1 would win.

 

[handsonhosting]

In a court, likely Person 1 would be the outcome of the findings. So as a hosting company, you'd wait for a legal decision - which is fine.

What immediate rights do either of the individuals have with you (if any). Do you block access to both parties until a legal decision is made, or does Person 2 maintain access and ability to delete/post anything they want?

Lets twist it up a bit, or should I break to a new thread?
You sell hosting to a reseller. Reseller invoices are current, but doesn't respond to your phone call or email. THEIR client contacts you wanting the site files. They own the domain. Do you hand over the files since they're the domain owner, or is the reseller the only contact person your company deals with?

 

[easyhostmedia]

In a court, likely Person 1 would be the outcome of the findings. So as a hosting company, you'd wait for a legal decision - which is fine.

What immediate rights do either of the individuals have with you (if any). Do you block access to both parties until a legal decision is made, or does Person 2 maintain access and ability to delete/post anything they want?

Lets twist it up a bit, or should I break to a new thread?
You sell hosting to a reseller. Reseller invoices are current, but doesn't respond to your phone call or email. THEIR client contacts you wanting the site files. They own the domain. Do you hand over the files since they're the domain owner, or is the reseller the only contact person your company deals with?

In the UK it would be the reseller you would only deal with as they are the ones who ordered the hosting and therefore has the contract with you.
you have no legal contract with the resellers clients. if they need the files then they need to request these through the reseller.
as they might own the domain but the reseller may have designed the site and have the only rights to the site files/design.

 

[agentblack]

Up for discussion;

• Person 1 owns a company
• Person 2 is an employee of Company (their webmaster)
• Person 1 owns company domain name & registered in their name
• Person 2 registers for web hosting in their name (with domain of company.com)
• Person 1 has paid all invoices over the previous year via Credit Card (can provide bank statements)
• Person 2 is terminated from company
• Person 1 now wants his files, servers and contact information changed
• Person 2 claims the site, files & work is his

So, here's the question - who do you give the access & files to?

....

The owner of the company wants everything transferred into their name (billing info, site access, server passwords etc). The webmaster claims the site is theirs, and all contact information is in their name. The webmaster did provide access to the company owner, however has since logged in and changed all access since they have left from the company.

This seems to be a fairly open and shut case. If person 1 has been paying the invoices for the domains, that makes them the owner of the domain, however attempting to argue that fact with ICANN or the registrar might be futile, also some state laws dictate that who ever's name is on the WHOIS of a domain is the actual "owner" of that domain.

To prevent any issues in the future like this, person 1 should draft a document, SOP's, SOG's, formal company policy that dictates that no employee shall create domains for the company without the express written permission of whomever, and when domains are created they are to be created under the company's account at the domain registrar. Personally I would further outline discipline issues as well as legal issues that could occur for failure to follow the guidelines, attempting to "steal" company assets, etc.

Company's should also make sure they have a document that outlines all of the company's digital assets including website, domain names, online accounts to social networking, email accounts, CRM, etc.

Since we register domains on behalf of our clients we have a document that outlines who owns the domain, who controls the domain, who's authorized to transfer, make changes to, or delete domains on behalf of customers. This has helped prevent so many issues as there is no gray area as to who owns what.

Good luck.

Regards,
AB

 

[handsonhosting]

Hello AgentBlack - all very good information (from the point of view of the company who hires a person). The question however revolves around a hosting company and their interaction with the hosting account and which client.

Which Client the hosting company should be talking to is the question. For this scenario, lets assume that Person 1 has registered the domain name at GoDaddy.

*** Lets throw another item in the equation ***

• Person 2 has removed all credit card information.
• When the account comes up for renewal on the 1st of the month, if Person 2 does not pay, the account is suspended (only Person 2 has billing access information as they changed it previously)
• Person 1 wants all files prior to the suspension, so they can host the website elsewhere

 

[agentblack]

If the question revolves around two customers, or a customer and an outside third party, then the host should only be talking to the account holder of the account in question.

In other words, if person 1 is your client, and person 2 is the web developer who is not a client, then the staff should only speak to person 1 after having the person verify account information.

If both are clients of the host, then the host is in a sticky spot. Unless the host wants to attempt to play mediator, my advice would be for the host to remain neutral as it could bring up some legal issues for the host. In the eyes of the law the issues between person 1 and 2 are completely civil issues which would either need to be settled out of court, or in court.

The host could bring upon themselves liability if they attempt to intervene into the matter for either party. I would strongly encourage any host to remain neutral as possible.

If person 1 contacts the host attempting to gain information from person 2's account and vice versa, then that should send up an immediate red flag. The host should never release information about another users account unless they are ordered to do so with a valid court order issued by a judge of competent jurisdiction over the issue at hand.

The host's staff should just politely inform person 1 or 2 that they are not able to discuss other clients account information without the expressly written consent of the other party. Ask yourself: would you want Joe Q Public to access your bank account when they call the bank? Probably not, so don't release details of the client's accounts.

In your item above, Person 1 is going to be out of luck in this case unless they produce to you a valid court order demanding access to those files.

Hopefully this sorta answered the issue at hand.

Regards,
AB

 

[handsonhosting]

Thanks AgentBlack,

I think you covered all your bases with the response. Appreciate your participation.

Current Standings;
Hosting company should only deal with Person 1 = 1 vote
Hosting company should only deal with Person 2 = 2 votes

Added a poll to the thread to make things easier - dont' see a way to modify it to post previous results

 

[Posilan]

[*]Person 2 registers for web hosting in their name (with domain of [/LIST]

This is the key point - the legal contract is between the host and customer regardless of who actually pays the invoice.

Yes, "Person 2" may have done wrong by signing up for it in his personal name, but that it a matter between him and his ex-employer.

If the employer needs access to the files, he should ask the ex-employee to access/provide them.

Steve

 

[ldcdc]

If person 1 has been paying the invoices for the domains, that makes them the owner of the domain, however attempting to argue that fact with ICANN or the registrar might be futile, also some state laws dictate that who ever's name is on the WHOIS of a domain is the actual "owner" of that domain.

I don't think it's quite so clear that the payer is the owner. Contracts define the owner. I pay Namecheap, and Namecheap pays Enom for the actual domain registration. Namecheap puts my details in the whois. Is Namecheap still the domain's "owner" from Enom's POV? I don't think so; I can contact Enom and get control over the domain as long as whois info fits my personal/company data and email. Domain "ownership" is always under ICANN's rules, and the whois info is what really matters.

About the hosting situation, I think that the customer is the person/company who's billing details you have. That a third party was willing to pay the bills, is a different matter.

Person 1 can and should take/maintain control over the domain, either through the hosting company if it has an account with it, or through its upstream provider, or ICANN.

Person 2 is the hosting account's owner, and should be able to access it. The fact that Person 2 bought the hosting at the order of Person1, for the business purposes of Person 1, is a matter that the host cannot solve, was not aware of, or is a party to.

You sell hosting to a reseller. Reseller invoices are current, but doesn't respond to your phone call or email. THEIR client contacts you wanting the site files. They own the domain. Do you hand over the files since they're the domain owner, or is the reseller the only contact person your company deals with?

The Reseller is your customer. No one else should be given access to the account on the data in it.

A related situation is when the reseller doesn't pay his invoices and the account (and end-user accounts) are suspended. In this case, the host can, unilaterally, choose to restore any or all accounts for a period of time. End users can use their login credentials then to salvage their data. The host should still not give the end users the data directly, or provide them with login credentials.

 

[SenseiSteve]

Not enough choices in your poll, Conor.

You need to add with both or neither. Obviously you can only allow the admin on the hosting account to make any changes to that account, but once ownership has been disputed, you need to deal with both.

In the original scenario, Person 1 is disputing Person 2's ownership of the account, even though Person 2 is the admin of record on the account with the hosting company.

Person 1 can point his domain wherever he wants, but they also want the data for the site they directed their employee, Person 2, to design and put online.

I don't believe you can lock Person 2 out of the account without a court order, but I do still believe if this went to court, Person 1 would prevail and if Person 2 altered the data in any way after terminated, they could be held liable for damages.

 

[handsonhosting]

Not enough choices in your poll, Conor.

You need to add with both or neither. Obviously you can only allow the admin on the hosting account to make any changes to that account, but once ownership has been disputed, you need to deal with both.

What can you communicate with Person 1 given that the only billing/contact information you have in your billing/support system all pertains to person 2? Can you disclose anything to them other than tell them to go to court?

Person 1 can point his domain wherever he wants, but they also want the data for the site they directed their employee, Person 2, to design and put online.

Correct. Wouldn't this still mean that person 1 and 2 should be talking to each other and not using you (the hosting company) as the go-between? While Person 1 claims Person 2 was paid for the design work etc, that should be between them only as you personally wouldn't know which is true.

I do still believe if this went to court, Person 1 would prevail and if Person 2 altered the data in any way after terminated, they could be held liable for damages.

Agreed. Once the courts get in the mix they'll be able to investigate and resolve the issue and provide documentation on which way the hosting company should give access. Until that point though, do you believe that as a hosting company you would be dealing with Person 1 or Person 2? It sounds like you're saying that only #2 gets access until they go to court and #1 is awarded custody. In that case, as a hosting company, you'd only be dealing with Person #2 until a court ruled differently - is that right?

With regards to having a "both" option, it's not possible. Either person 1 gets the login information OR person 2 gets the login information, at which point only ONE person is able to access the hosting account and technical support.

 

[SenseiSteve]

By dealing with, I include talking to Person 1, but not discussing the hosting plan itself. This could be relaying to them what they need to do to claim ownership - and that could be to seek legal counsel.

 

[easyhostmedia]

Once the courts get in the mix they'll be able to investigate and resolve the issue and provide documentation on which way the hosting company should give access. Until that point though, do you believe that as a hosting company you would be dealing with Person 1 or Person 2? It sounds like you're saying that only #2 gets access until they go to court and #1 is awarded custody. In that case, as a hosting company, you'd only be dealing with Person #2 until a court ruled differently - is that right?

this is the only way the hosting company will be able to deal with person 1 as in the eyes of the hosting company the hosting was set up by person 2 so it is person 2 who has the contract with the host.