Digital Asset Inventory Checklist: 10 Checks You Can Do Yourself (Free)
Table of Contents
- Check it yourself first, then decide whether to bring someone in
- 1. Whose name the domain is in, and when it expires
- 2. SSL certificate expiry
- 3. Where the site is hosted and who has back-end access
- 4. Owner of the Google Business Profile
- 5. Facebook Page admins
- 6. Instagram binding and two-factor authentication
- 7. LINE Official Account admins
- 8. Marketplace accounts (Shopee and others)
- 9. Email and domain mailboxes
- 10. Who holds the passwords
- One-page summary
- After the checks
Check it yourself first, then decide whether to bring someone in
The previous piece, Whose name is your shop's digital assets in, explained why a digital asset inventory matters. This is the hands-on version: 10 checks, each with three parts. How to check, the red flags, and the one thing to do right now.
No technical background needed. Most items take a login and a glance, or a question to one person. No answer is also an answer: it means the asset is not in your hands today.
Take a sheet of paper or open a spreadsheet and record three columns for each item: whose name, who holds the keys, when it expires. When you are done you will have a basic digital asset inventory.
1. Whose name the domain is in, and when it expires
How to check: enter your domain into any WHOIS lookup tool and read the registrant and expiry date. For Taiwan's .tw domains, TWNIC runs a WHOIS lookup.
Red flags: the registrant is a former employee, a former agency or a name you do not recognise; expiry is within 90 days; privacy protection is on and nobody knows which email logs in at the registrar.
Do now: find the registrar login email and confirm you can get in. If you cannot, start contacting whoever registered the domain today.
2. SSL certificate expiry
How to check: open your website in a browser, click the padlock in the address bar, and read the certificate's validity period.
Red flags: the padlock is red or the browser says "not secure"; the certificate expires within 30 days; nobody knows who issued it or whether it renews automatically.
Do now: ask your host or whoever built the site whether the certificate auto-renews. If not, put the expiry date in your calendar with a reminder one month ahead.
3. Where the site is hosted and who has back-end access
How to check: ask whoever built the site which hosting company it is on, what the admin URL is, and which email logs in.
Red flags: only the agency has a back-end login; hosting is charged to someone else's credit card; you do not know where the site lives.
Do now: get a back-end account of your own, at the highest permission level. Move the hosting charge to the company account.
4. Owner of the Google Business Profile
How to check: sign in to the Business Profile with your Google account, open the people-and-access settings, and see who the primary owner is.
Red flags: the primary owner is an agency or former employee's account; you have manager access only; your account cannot get in at all, meaning the profile is unclaimed or claimed by someone else.
Do now: make yourself or the company Google account the primary owner and add a family member as an owner. According to Google's help page, a newly added user must wait 7 days before managing all features, so do not leave this until you need it urgently.
5. Facebook Page admins
How to check: open the Page settings and look at Page access, which lists everyone with full control.
Red flags: only one person has full control; that person is an agency or a former employee; you yourself have task access only and cannot add or remove people.
Do now: make sure at least two family members or company colleagues have full control. Remove accounts you no longer work with.
6. Instagram binding and two-factor authentication
How to check: open the Instagram accounts centre and see whose email and phone number are attached; open the security settings and check whether two-factor is on and which phone receives the codes.
Red flags: the attached phone is a staff member's personal number; two-factor is off; codes go to only one phone.
Do now: change the attached email to a company address, switch on two-factor, and store the backup codes in your password manager.
7. LINE Official Account admins
How to check: sign in to the LINE Official Account Manager, open the permissions page under settings, and see which members are listed and with which role.
Red flags: a single admin; that admin's LINE account lives on one personal phone; the paid plan is charged to a personal account.
Do now: add a second admin (the console issues an invitation link you send to them). Move the paid plan to the company account.
8. Marketplace accounts (Shopee and others)
How to check: sign in to each marketplace back end and check the registered email and phone, whose bank account receives payouts, and whether sub-accounts are available.
Red flags: the account was registered with a staff member's phone number; payouts go to a personal bank account; only one person knows how to log in.
Do now: change the registration details and payout account to the company's. If the platform supports sub-accounts, create one for a second person.
9. Email and domain mailboxes
How to check: list every mailbox the shop uses externally, including domain mailboxes (your shop name at your domain) and free webmail. For each, note who manages it and whose recovery email and phone are attached.
Red flags: every account logs in through the same free mailbox; the domain mailbox is administered by the agency; the recovery email is one that is no longer in use.
Do now: identify the mailbox that every other account logs in with, make sure its recovery email and phone are your own, and switch on two-factor. This is the key to all the other keys.
10. Who holds the passwords
How to check: ask yourself one question. If you were unreachable tomorrow, could your family get the logins for the nine items above within an hour?
Red flags: passwords on paper in a drawer; passwords pasted in the family group chat; every password on one phone; only you know them.
Do now: pick a password manager, put the nine logins above in it, and set up emergency access for one family member. Never store the master password anywhere digital.
One-page summary
| Item | How to check | Red flags | Do now |
|---|---|---|---|
| Domain | WHOIS registrant and expiry | Not in your name, expires within 90 days | Confirm you can log in at the registrar |
| SSL | Browser padlock, validity period | Expires within 30 days, nobody knows who renews | Confirm auto-renewal |
| Hosting | Ask for admin URL and login email | Only the agency has access | Get a top-level account of your own |
| Google Business | Back end, primary owner | Owner is the agency, you cannot get in | Make yourself primary owner, add family |
| Facebook Page | Settings, full-control list | One person, and it is the agency | Two family members with full control |
| Accounts centre binding, security settings | Staff's personal number, no two-factor | Company email, two-factor on | |
| LINE Official Account | Permissions page, members | Single admin | Add a second admin |
| Marketplaces | Registration details and payout account | Staff phone, personal bank account | Move to company name |
| List all mailboxes and recovery settings | Recovery email no longer in use | Own the recovery details, two-factor on | |
| Passwords | Could family get them within an hour | Paper, group chat, one phone | Password manager with emergency access |
After the checks
If all 10 have answers and every asset is in your name or the company's, congratulations: you are already safer than most shops. Keep that sheet with the policy originals and the company seal, and review it once a year.
If some items cannot be traced however hard you try, or you want a formal report verified again with tools that you can hand to family and your accountant, Ultra Lab's Digital Asset Inventory does exactly that: a 15-minute questionnaire (a son, daughter or advisor can fill it in), automated checks plus a 30-minute phone call, and an inventory report with a 90-day action list within five working days. One-time NT$4,800, assets stay in your name, we never hold passwords.
Ready for the next step? Digital legacy planning for shop owners covers how to arrange this list for the next generation.
FAQ
How long do the 10 checks take?
If you set up every account yourself, under an hour. If some were set up by staff, an agency or a family member, most of the time goes into asking people, which can take days. Not finding an answer is itself a result: it means that asset is not currently in your hands.
How do I find out whose name my domain is in?
Enter your domain into any WHOIS lookup tool and read the registrant and the expiry date. Many domains have privacy protection switched on, so no name shows; in that case, find whoever originally registered it or the email address used to log in at the registrar. If you cannot find that login email, you do not have the key to your domain.
How do I see who owns my Google Business Profile?
Sign in to the Business Profile with your Google account and open the users or people-and-access settings, which list the primary owner, owners and managers. If your account cannot get in at all, the profile was claimed by someone else or has never been claimed.
If I finish the checks, do I still need the inventory service?
Not necessarily. If all 10 have answers and every asset is in your name or your company's, you are already safer than most shops. The service is for two situations: some items cannot be traced however hard you try, or you want a formal report, verified again with tools, that you can hand to family and your accountant. One-time NT$4,800, and we never hold passwords.
Can I give this checklist to an employee or family member to run?
Yes, it was designed for that. Every item has a how-to and red flags and needs no technical background. Have the owner assign one person to complete it, then have the owner read the results personally, because the owner is the one who decides whose name each asset should end up in.