Handover is not a document. It is the difference between owning a system and renting one from whoever built it, and the difference is decided in the last two weeks of a project rather than the first.
None of what follows is unreasonable to ask, and a good supplier will have most of it ready. Asking early also tells you something useful: a vendor who hesitates at any of the five is telling you how the relationship ends.
The five to confirm
Not a sub-account of the vendor's organisation, not a project inside their tenancy. Billing in your name, an owner-level login you hold, and the vendor's access granted by you rather than inherited.
Log in and read the code today, while someone is still around to fix it if you cannot. A repository you have never opened is a repository you do not know you have lost.
Not “backups are configured”. An actual restore into a scratch environment, watched, timed and dated. Untested backups fail at exactly the moment you need them.
A screen recording of someone running the system, including the awkward parts: what to do when a job fails, where the logs are, which alerts matter. Written docs go stale; a recording of the real screen rarely misleads.
A date, with an owner, to check who still has access and remove whoever should not. This is the item everyone skips, and it is the one that quietly decays for a year.
Why accounts come first
Everything else can be recovered if the accounts are yours. Code can be re-read, documentation can be rewritten, a new supplier can be shown around. But if the production database lives inside someone else's cloud organisation, none of that helps, and your negotiating position is whatever they decide it is.
Account ownership is trivial to arrange at the start of a project and awkward to unpick at the end. Make it part of the kickoff, alongside who has admin and how access is granted.
What to do after the handover
Put the runbook somewhere your team will actually find it — the same place they keep everything else, not a folder named after the vendor. Then run the access review you scheduled. If nothing has changed, it takes ten minutes. If something has, you have just found it a year early.
