Ownership recap
Who owns what, once it is live.
The same boundary that governs onboarding governs the relationship afterwards. It is a
provisional operating model, and a commercial agreement will refine it.
Your agency
// Owns the client and the application
- Client relationship Owns the commercial and day-to-day client relationship.
- Application code Owns source, dependencies, build configuration, and application defects.
- Deployment Supplies a deployable build, a production branch, and release approval.
- Data and auth Owns schema, migrations, authorization logic, and data correctness.
- Domains and DNS Confirms domain authority and authorizes cutovers and client-facing timing.
- Backups and restores Identifies critical data and authorizes restore point, target, and timing.
CloudVault
// Owns the infrastructure layer, invisibly
- Client relationship Stays behind your agency. Does not market or upsell to your clients.
- Application code Does not change code without an approved support request and repository authorization.
- Deployment Provisions and maintains the supported pipeline once it is implemented.
- Data and auth Maintains the managed database and auth service within confirmed boundaries.
- Domains and DNS Prepares and validates infrastructure records within approved scope.
- Backups and restores Runs only the backup services included in the approved plan.
Escalation path: End client → Agency → CloudVault
Exceptions must be explicit, narrow, and documented. A client emergency contact does not become a general support channel, and never becomes a route for us to sell around you.