Nobody signs up to be held hostage. It accrues: the vendor registers the domain “to make it easy,” hosting lands on their reseller account, the code never gets a repository you can see, and five years later the relationship sours and you discover that leaving means starting over. If working with someone requires being unable to leave them, that’s not a vendor — that’s a hostage situation with invoicing.

The patterns, from inside

The bundled everything. One monthly fee covering domain-hosting- maintenance-“licensing,” none of it itemized, all of it in their name. Convenient right up until you ask what happens if you cancel.

The proprietary platform. A custom CMS only they can run, or a builder whose export produces nothing usable. Ask any prospective vendor: “If we part ways, what do I walk away with, and what does it run on?” The answer is the whole relationship in miniature.

The knowledge moat. No documentation, no repository, no second person who’s ever seen the admin. Sometimes it’s strategy; more often it’s just neglect that functions identically.

The prevention, in contract lines

Your agreement should state plainly: domain registered to you; hosting in your account (vendor as invited user); code in a repository you can access; a restorable backup deliverable on request; and a defined handoff on termination. A good vendor agrees without blinking — ours is published, and the red flags post covers the clauses that predict a bad year.

If you’re already in one

Don’t threaten; document. Inventory the four keys, request them in writing with a date, and get an independent read on what rebuilding your independence costs — that’s a rescue assessment, and it’s cheaper than the ransom.