Google Business Profile and Website Access Checklist for Winnipeg Business Owners

Access should let the right people do approved work without giving away ownership, sharing personal passwords, or making a future handoff harder. Google controls its verification and edit-review processes, and no access setup guarantees a ranking, lead, or revenue outcome.

A new website or Google Business Profile project often starts with a simple question: who has access? For a Winnipeg business owner, answering it clearly protects the business while giving an agency enough access to complete an agreed scope. This checklist separates ownership from day-to-day management and documents what should be available before work begins.

If you are deciding which profile work to manage internally and which work to delegate, start with the practical trade-offs in our DIY Google Business Profile vs hiring an expert guide. Ownership and recovery should stay with the business either way.

Keep Google Business Profile Ownership With the Business

Confirm that an authorized owner of the business remains the primary owner of the Google Business Profile. Use a Google Account the business controls and can recover, rather than an agency account or an employee's personal account. Record the primary owner, any additional owners, and the recovery contact in the business's internal records.

Google allows multiple owners, but only one primary owner. Owners can add or remove people and manage the profile. Managers can handle much of the daily work, including business information, reviews, and posts, but cannot add or remove users or remove the profile. For most ongoing agency work, invite the agency's named Google Account as a manager instead of sharing a password. Give owner-level access only when the documented scope truly requires it, then review that access when the work changes.

In Google, the owner can check Business Profile settings and then People and access for current users and pending invitations. New owners and managers have limits on some administrative actions for their first seven days, so do not plan a critical transfer or removal for the same day as an invitation.

Define Website, Domain, and DNS Access Before Work Starts

Website access is not one login. List who controls the domain registrar, DNS, hosting, content management system, website analytics, Search Console, form notifications, and any paid services connected to the site. The business should retain administrative control of the domain, hosting account, and renewal notices. An agency can be granted the least access needed to do the approved work.

Put the existing website scope in plain language. For example, specify whether the work covers technical fixes, new pages, copy, forms, analytics setup, tracking review, SEO fields, Google integrations, or DNS changes. Identify the owner who approves changes and how approval is recorded. If the site needs a broader rebuild, review the scope for web design work before anyone changes a live site.

Use a Secure Access and Privacy Process

Do not email personal passwords, put them in a website form, or reuse one login across services. Use an appropriate credential manager for accounts that cannot use a role-based invitation. Keep multifactor authentication with the business owner or an authorized internal contact wherever possible, and document recovery methods without placing recovery codes in ordinary project notes.

Check what customer information the agency can see. Estimate forms, booking tools, call tracking, inboxes, and analytics may contain names, phone numbers, addresses, or message details. Limit access to the information needed for the agreed service, identify the approved contact path, and make sure privacy notices and notification recipients still match how the website works.

Plan Backups and Handoffs Before They Are Needed

Before a major change, save a current website backup and record where it is kept. Keep a copy of key domain and DNS settings, active subscriptions, approved brand files, and current website content. A simple handoff record should name each service, the business owner, the access level granted, the renewal contact, and the next review date. Remove former staff or vendors promptly when their access is no longer needed.

Ready-to-Use Handoff Checklist

1. Identify the account or service, its purpose, and the business-controlled account that owns it.
2. Record the designated business owner who approves access and account changes.
3. Record each delegated role, the named account receiving it, the approved scope, and the end or review date.
4. Name the business-controlled recovery contact and where recovery information is safely maintained. Do not place passwords or recovery codes in this record.
5. Record the current backup location for the website, domain or DNS settings, key files, and active subscriptions.
6. Set the next access review and the revocation step for former staff or vendors.

The same approach helps keep public business information aligned. If business details change, update the confirmed facts in the profile, website, and appropriate public listings. Citation and local business-information work can support that review, but it does not replace business approval or profile ownership.

Know What Google Controls

Google determines the available verification method for a Business Profile. After verification steps are completed, Google says review can take up to five business days and may take longer in rare cases. Google also reviews profile edits. An edit may be accepted, pending, or not approved, and timing can vary. Keep documentation ready and follow Google's current instructions rather than promising a specific verification or update date.

Accurate access, approved information, and a clear website can reduce avoidable ownership and customer-information problems. They cannot guarantee that Google will verify a profile by a certain date or rank a business in a particular position.

Start With a Documented Review

If you are unsure who controls your profile, website, or domain, start by documenting the current setup before making changes. HDS can review the public profile, website alignment, and visible customer contact path as part of a Google Business Profile support review. The business owner keeps control of decisions, accounts, and approvals.