What to Check Before You Renew a Web Agency's Contract

Renewal shouldn't be automatic

Most agency contracts renew the same way they started — an invoice arrives, someone approves it, the relationship continues for another year. That's fine when everything genuinely is in order. It's a poor way to catch the cases where it isn't, because renewal rarely comes with a prompt to check anything. The point where a contract is up for renewal is the one moment you have real leverage to ask for evidence rather than reassurance, so it's worth using it deliberately.

None of what follows assumes the agency has done anything wrong. It's a list of things worth confirming either way, because the cost of asking is a few emails, and the cost of not asking — discovering a gap only when you try to leave — is much higher.

Ask for an access inventory, not a status update

Request a written list of every system the agency has access to on your behalf: domain registrar, DNS, hosting, source code repository, database, analytics and search console properties, advertising accounts, email service provider, payment gateway. For each one, ask who's listed as the account owner — your business, or the agency — and whether you personally have a working login with full administrator rights, not just a shared password you've never actually tested.

This is different from asking "do we have access to everything." That question invites a yes. Asking for the actual inventory, system by system, invites a list you can check against reality.

Verify domain and DNS control directly

Don't rely on the agency's word here — check it yourself. Look up your domain's registrant record (for a .my domain, via MYNIC's WHOIS, bearing in mind contact details are partly redacted for privacy) and confirm the registrant is your business, not the agency or an individual at the agency. Then confirm you can log into wherever your DNS records actually live and see them yourself. If either check turns up the agency as the owner of record rather than an authorised manager acting for you, that's worth raising before renewal, not after.

Confirm source code sits somewhere you control

If the agency has built custom functionality, ask where the code lives and get a link to the actual repository — not a description of it. If it's hosted under the agency's own account rather than yours, ask for it to be transferred — most repository hosts, including GitHub, support a proper ownership transfer that keeps the commit history and issue log intact — or for your business to be added as an owner, not just a collaborator.

Ask what was actually delivered against the contract

Compare the current contract or statement of work against what's actually live. If the agreement promises monthly reports, quarterly reviews, or a defined number of update hours, ask for evidence those happened — the reports themselves, dated change logs, or a summary of work completed against the agreed scope. This isn't about catching anyone out; it's about knowing what you're renewing before you renew it. An agency that's genuinely been doing the work should be able to produce this without much friction.

Check who's responsible for your customers' data

If the agency's systems touch customer or user data — a contact form, an e-commerce database, a mailing list — they're likely acting as a data processor on your behalf under Malaysia's Personal Data Protection Act 2010. This matters more than it used to: under the Personal Data Protection (Amendment) Act 2024, provisions extending direct Security Principle obligations to data processors themselves came into force from 1 April 2025, meaning the party actually holding that data now carries compliance duties for it, not just your business as the data controller. Before renewing, it's worth asking plainly where that data is stored, who can access it, and what security measures are in place — and getting the answer in writing.

Verify the agency itself

If you're about to commit to another year, it costs nothing to confirm the entity you're contracting with is what it claims to be. Malaysia's Companies Commission (SSM) is the authority for company records; its own services are at ssm.com.my. Several third-party sites use SSM-like domain names to resell company documents — they are private businesses, they charge per document, and at least one states in its own footer that it is "not affiliated with, sponsored by, or endorsed by any government entity". Check who you are actually buying from before you pay. This is a five-minute check, and it's a reasonable one to run on any vendor you're renewing a contract with, not a sign of distrust.

Red flags worth taking seriously

A few patterns are worth treating as genuine warning signs rather than minor inconvenience: the agency can't produce an access inventory at all; your domain, hosting, or repository is registered to the agency's own name with no clear path to change that; requests for admin-level access are met with delay rather than a straight answer; or the "reports" you're shown don't correspond to anything you can independently verify happened. None of these prove bad faith on their own, but together they're a reasonable basis to hold off on renewal until they're resolved.

Where an independent check fits

Going through this list takes time, and it's easier with someone outside the relationship doing the checking. JagaWeb's Essential System Review (RM1,500, or RM999 under the promotion running until 16 September 2026) covers access and ownership as part of its eight control points, with a decision-ready report at the end that's useful whether you renew, renegotiate, or move on. It's one option among several, not a verdict on your current agency — get in touch at sales@jagaweb.my or via jagaweb.my if it would help.