A familiar situation, reconstructed from cases many Moroccan business owners will recognise: a Casablanca SME has its ecommerce site built by a small agency. Three years on, fixes drag, the maintenance invoice keeps climbing, and the owner decides to move. He asks for the source code, the hosting credentials and the domain transfer. The answer: the code belongs to the agency, the server is shared with six other clients, and the domain was bought with the founder’s personal card.
This is not necessarily bad faith. It is what the contract signed three years earlier says, or rather what it fails to say: no assignment of rights, no exit plan, no inventory of accounts. The provider is simply applying the letter of a document nobody has reread since.
Which leads to a rule that surprises people: the exit is prepared before you sign elsewhere, not after. The three mistakes below are the ones that cost the most at handover time, and each of them is fixable with a few days of administrative work.
Why leaving an IT provider is riskier than it looks
Source code is rarely the real sticking point. The accounts are. A live web or mobile product sits on roughly fifteen administrative dependencies, and every one of them is registered to somebody:
- the domain name at the registrar, with its registrant contact and transfer code
- the DNS zone, often hosted somewhere other than the site itself
- the hosting account or cloud console, and above all the root account carrying the billing
- business email and the MX records
- the Git repository, the deployment pipeline and the environment variables
- the CMI merchant account and the payment gateway keys
- Search Console, Analytics, Tag Manager, Google Business Profile
- App Store and Google Play developer accounts, if there is an app
- theme licences, paid plugins, third-party APIs and the SMS service
Losing the code costs weeks of development. Losing the domain or the merchant account costs revenue the same day, which is why a provider change is run like a migration: an inventory, an order of operations, dates. Not like the end of a commercial relationship settled over the phone.
Mistake 1: a contract with no reversibility clause
The reversibility clause is the paragraph describing what happens at the end, whatever the reason for that end. It is missing from most two-page development quotes signed in Morocco, because nobody wants to discuss separation on the day a project starts.
A useful clause fits on half a page and answers six questions: what (code, data, documentation, credentials, configurations), in which format, within what deadline after the request, with how many support hours included to accompany the transfer, at what rate beyond that, and who owns the exploitation rights to the code written specifically for you. On that last point, assignment of software copyright has to be evidenced in writing: if your contract is silent, do not assume the code is yours, and have a lawyer review the wording before you negotiate it.
Two details matter disproportionately in practice. First, tie part of the final balance to acceptance of the handover, not to the go-live date. Second, ask for the account inventory and the documentation to be refreshed once a year during the life of the contract, instead of being produced on the last day of the notice period. A serious provider agrees without argument, if only because it spares them reconstructing history in a panic after the original developer left two years ago.
If you are drafting the next contract right now, reversibility belongs in the same document as the service commitments: the RFP is the right place to describe it, and the quote is where you check it did not quietly disappear.
Mistake 2: the provider holds the hosting and domain access alone
A ten-minute check, worth doing today. Run a whois on your domain and read the registrant name. Open your hosting console and see which address receives the invoices. Open Search Console and see who is listed as owner. If three answers out of four point at your provider, you are not buying a service, you are depending on a person.
Fixing this requires no confrontation. The structural accounts are created by the company, using a neutral address such as [email protected] monitored by two people internally, with a company card for billing. The provider is then invited as a delegated administrator. Their day-to-day work does not change at all, they simply can no longer walk off with the key.
In order of priority: registrar, DNS, cloud root account, Google Workspace or Microsoft 365, mobile developer accounts, CMI merchant account, backup tool. App Store Connect and Play Console deserve extra insistence: if they sit in the agency’s name, your listing, your reviews and your install history belong to them, and a refused transfer means republishing from scratch with a new URL and a download counter back at one.
Mistake 3: code and data delivered in unusable form
A successful source code handover does not look like a zip archive sent over WeTransfer the day before the notice period expires. It looks like a Git repository with its history, an install file that lets an outside developer run the project locally on day one, the list of environment variables (values travelling through a separate channel), the database migration scripts, exact dependency versions, and a clear line between what is custom and what came from a purchased theme or a licensed component.
On the data side, insist on standard formats, SQL dumps or CSV, not PDFs or screenshots. Then run the test that actually counts: restore the backup yourself on a neutral server before you settle the invoice. That is where you find out the export contains the orders table but none of the attachments, or that staging and production have not shared the same schema for eighteen months.
A provider who can only hand over a zip is also telling you something about how the project was built. Negotiation will not fix that, but your budget can absorb it if you see it coming.
What a badly prepared takeover costs
The cost lines are always the same, only the scale changes. A proper takeover audit covering code and infrastructure usually runs 8,000 to 20,000 MAD for a brochure site or a small application, and more like 25,000 to 60,000 MAD for a business application or an ecommerce platform with integrations (payment, ERP, logistics). On top of that: rebuilding undocumented environments, rewriting the modules nobody can read, and paying both contracts during one or two months of parallel running.
The timeline gap is the striking part. With an up-to-date inventory, decent documentation and a cooperative counterpart, the new provider is self-sufficient in two to three weeks. Without any of that, expect six to twelve weeks before the first real improvement ships, with the product frozen in the meantime. And a candidate who quotes a flat maintenance fee without an audit phase is not doing you a favour, they are guessing.
The handover checklist before you switch IT provider Morocco
Before you announce your departure, collect everything you already have legitimate access to: exports, backups, documentation, invoices, credentials in your possession. That is not a trick, it is the inventory you take before a move. Then work through this order:
- a written inventory of every account, with the registered holder and the recovery email for each
- a full backup copied to your side, then restored and tested on a neutral environment
- data exports in formats a third party can read, relations and attachments included
- a code repository with history, install documentation and the list of third-party licences
- a dated cutover plan, with an agreed downtime window and DNS TTL lowered 48 hours ahead
- a parallel running period covering at least one full business cycle (a month-end close, a payroll run, a sales month)
- a named contact at the outgoing provider and a quantified number of support hours
- the final balance conditioned on acceptance of the handover, not on the contract end date
- notice served in writing in the form the contract requires, so you hand over no grounds for refusal
- a reversibility clause negotiated in the new contract, before signature rather than as a later amendment
Picking the successor is a separate exercise, and the criteria worth applying (verifiable references, the team actually assigned, service commitments) are covered in our guide to choosing a Morocco IT services company. One suggestion: tell the candidate you are arriving from a difficult takeover. Their reaction, audit first or instant quote, will tell you plenty.
CNDP and continuity: what follows the client, never the provider
For personal data, Law 09-08 separates the data controller from the processor. In a typical SME and agency relationship the controller is your company, so the CNDP declaration must be in your name. Pull out the receipt and look. If the filing was made by the agency on its own behalf, you have a correction to make, and the exact formalities are worth verifying on the CNDP website rather than taking on trust.
The processing agreement should also cover return then deletion of data at the end of the relationship, a ban on using it for any other purpose, and where it is hosted. The forgotten copies are almost always the same ones: the customer file in the project manager’s mailbox, Excel exports on his laptop, a staging database that was never anonymised. Ask for a dated deletion certificate, and use the transition to redo the CNDP compliance checklist in the company’s name.
The right order of operations
Inventory, recovery of whatever you can already reach, a technical audit of what you genuinely hold, negotiation of the handover and the notice period, selection of the successor with a reversibility clause, then a dated cutover with parallel running. Done in that order, the move takes a few extra weeks up front and saves you the three months of reconstruction that otherwise follow.
This is exactly the kind of consulting work we do at Arrowlancer: auditing the code and infrastructure you take back, drafting the reversibility clause and the transition plan, running the cutover without service interruption. Our areas of work are listed here, and if your notice period has already started, tell us where you stand before you sign the next contract.