Leaving an agency — for another agency, an in-house team, or a rebuild decision — is a project with its own failure modes, and I meet its casualties professionally: founders holding a codebase they cannot deploy, credentials they do not control, and a new team burning its first quarter on archaeology. Here is the playbook that prevents that, ordered by when leverage exists.
Phase 1: while they still want your money
Everything is easy to get while invoices are still being paid and references still matter. The complete access transfer:
- Repository ownership — transferred to your org with full history, their access downgraded to collaborator. History is not sentimental; it is the operating manual your next team reads.
- Every credential, transferred not shared — cloud, domains, DNS, database, email/SMS providers, payment dashboards, monitoring, app stores. "Shared" access dies with the relationship; owned access survives it.
- The tested setup guide — someone who did not write the system follows the README from clone to running app. Where they get stuck is your documentation backlog, discovered for free.
- A live deploy, driven by your side — watch a change go from commit to production with your hands on the keys. If deploys require a specific person's laptop, you have found the single point of failure before it found you.
- The independent review, while leverage exists. A fixed-scope review during the relationship produces the findings list you attach to the exit: items the agency addresses as part of professional conclusion, not items your new team inherits as surprises. The hiring-questions guide covers securing this right at contract time.
Phase 2: the handover itself
- Walkthrough sessions, recorded — how a signup becomes a paying customer, how money moves, where the bodies are buried. Two hours of recorded walkthrough saves two months of guesswork.
- The known-issues list, in writing — every system has one; ask directly and get it in the handover document. Agencies rarely volunteer it and rarely refuse it when asked.
- Dependency and vendor inventory — every third-party account, who pays for it, and which ones are on the agency's cards. Services quietly billed to the agency die without warning after the split.
- A defined support tail — thirty to ninety days of question-answering at an agreed rate beats both cliff-edge separation and open-ended dependence.
Phase 3: the first ninety days after
- Rotate every credential — not from distrust, from hygiene; you cannot audit who had what.
- Ship something small in week one: the fastest test of whether the handover actually worked end to end.
- Point the new team at the review findings as their prioritized map — inherited codebases without a map get rewritten out of fear rather than fixed out of knowledge, and unnecessary rebuilds cost more than any audit ever did.
Mid-transition and not sure what you are holding? That is the exact moment the independent review exists for: what exists, what works, what is fragile, what to fix first — in the format the sample report shows, delivered in five working days.
Frequently asked questions
What should an agency hand over when we part ways?
Everything that makes the system yours: full repository with history, all cloud/domain/database/monitoring credentials transferred (not shared), environment configuration documented, a working from-scratch setup guide someone actually tested, the deploy process demonstrated live, and a walkthrough session covering how the core flows work. If any of these is 'extra,' it was never your system — it was theirs, rented.
Should I get the codebase reviewed before ending an agency contract?
Before, yes — while you still have leverage. An independent review during the relationship costs a fraction of one sprint and converts the handover from 'take their word for it' into a findings list with severities you can require them to address as part of the exit. After they are gone, every gap becomes your new team's discovery project, at your new team's rates.
How long does an agency-to-in-house transition take?
With a clean handover and a reviewed codebase: weeks for a new team to ship confidently. With a hostile or sloppy handover: months, mostly spent reverse-engineering undocumented deployment, hunting credentials, and discovering what the tests never covered. The spread between those two outcomes is decided almost entirely by what you demand while the agency still wants something from you.
Written by Andrej Dragojevic, Stripe Certified Professional Billing Architect.