Who holds the keys? Board control of association logins and records

Most boards can name their management company. Fewer can say, with certainty, who controls the association’s email domain, the website, the bank portal, the accounting software, and the cloud folder where the official records live.

That isn’t a technology question. It’s a control question, and it belongs to the board.

Where control quietly drifts

Accounts usually get set up by whoever is handling the task that week. A manager opens the accounting subscription under the firm’s own master account. A website vendor registers the domain in its name to “make renewals easier.” A former treasurer built the shared drive on a personal email address. A past president is still the only administrator on the bank’s online portal.

None of that is sinister. Each one is a single point of failure the board never chose.

Why it matters at the worst moment

The risk shows up at transitions: a manager change, a vendor dispute, board turnover, or one person who is suddenly unreachable. That is exactly when the board needs records and access most.

Florida law already expects records to come back. A community association manager or management firm must return all official records in its possession within 20 business days after the management contract ends or after a written request, whichever comes first (s. 468.4334(4), F.S.). In an HOA, a recalled director must turn over association records and property within 5 full business days (s. 720.303(10)(b)2.). In a condominium, if official records are lost or destroyed, the association has a good-faith obligation to obtain and recover them as reasonably possible (s. 718.111(12)(b)).

Those rules cover records. They don’t automatically hand the board administrator rights to a domain, portal, or subscription registered in someone else’s name. Setting that up in advance is the board’s job.

For associations that must keep a records website (condominiums with 25 or more units, HOAs with 100 or more parcels), the condo statute is specific: the site must be wholly owned and operated by the association, or run by a third-party provider from whom the association owns, leases, rents, or otherwise obtains the right to operate the pages (s. 718.111(12)(g)1.a.). A board should know which of those it actually has.

Take a risk-based approach

Not every account carries the same risk. Start with the ones that move money, hold official records, or speak for the association: bank and payment portals, accounting software, the email domain and domain registrar, the website or owner portal, cloud records storage, and the video-meeting account. Vendor portals, social media, and utility logins come next.

The board checklist

• Build an account inventory. For each account: the service, what it’s used for, the legal owner of record, administrators by name, whether multi-factor authentication (MFA) is on, renewal date and payment method, and where the recovery email and phone point. Keep the inventory in the association’s records, not only in the manager’s files. Never put passwords in it.
• Make the association the owner of record. Accounts should be in the association’s legal name, billed to the association, with recovery contacts on an association-controlled address, not a personal or vendor address. Start with the domain registrar; whoever controls the domain controls the email and the website.
• Keep at least two board-level administrators. Two officers (for example, president and treasurer) hold administrator rights alongside the manager’s working access. The manager works in the account. The association owns it. Where the bank offers dual approval for payments, ask whether it fits your controls.
• Turn on MFA everywhere it’s offered. Email, banking, accounting, and the registrar come first. An authenticator app or security key is generally stronger than a text-message code. Make sure the second factor isn’t tied to the phone of someone who has left.
• Offboard deliberately. When a director leaves or the manager changes, act that week: remove access, change any shared credentials, update recovery contacts, and confirm in writing. Onboard the same way: new directors get association-issued access, not a borrowed login. Ask counsel how director email about association business should be handled and retained.
• Write it into the management contract. Ask counsel to include: the association owns all accounts and data created on its behalf; the manager provides a current administrator list on request and at least annually; manager staff with access use MFA; the association is told promptly when staff with access leave; and on termination, the manager returns records within the statutory 20 business days, transfers administrator rights, and provides data exports in usable formats. Apply the same thinking to the website vendor: domain in the association’s name, content exportable.
• Verify once a year. A board officer logs in and looks at the administrator list directly. A report that says “all set” is not the same as seeing it.

Trust but verify

Most managers and vendors want clean lines of control as much as the board does. The point isn’t suspicion. It’s that fiduciary oversight is deliberate, not hopeful. The board shouldn’t learn who holds the keys during a transition.

TBC Advisory is an independent partner to HOA and COA boards, not a management company. We help boards build the inventory, review contract language alongside counsel, and check that what’s contracted is what’s happening.

If your manager or website vendor changed tomorrow, could your board log in to every association account on day one?

This article is general information for board members, not legal advice. Statutes and rules change; confirm how they apply to your association with association counsel.

If your board wants a calm, independent check on who holds the keys to its accounts and records: tbcadvisory.com/contact